Edit tour

Windows Analysis Report
c2A6GRyAwn.dll

Overview

General Information

Sample name:	c2A6GRyAwn.dll renamed because original name is a hash value
Original sample name:	c25a973f8b0a24249c6e6894cef4d6b7.dll
Analysis ID:	1578032
MD5:	c25a973f8b0a24249c6e6894cef4d6b7
SHA1:	ca709195fdae41296ce26a31f710f3d9a7495a8f
SHA256:	e5024fae6c595676b50f0a9b8ab6a3ccd0a9b36a069c5a3746ad07d73ef6cfb8
Tags:	dlluser-abuse_ch
Infos:

Detection

Nitol

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Nitol

AI detected suspicious sample

Contains functionality to capture and log keystrokes

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to detect virtual machines (IN, VMware)

Creates an autostart registry key pointing to binary in C:\Windows

Found evasive API chain checking for user administrative privileges

PE file has a writeable .text section

Tries to delay execution (extensive OutputDebugStringW loop)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to detect virtual machines (SGDT)

Contains functionality to detect virtual machines (SIDT)

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 180 cmdline: loaddll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 6284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 612 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 2472 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

WMIC.exe (PID: 2300 cmdline: wmic cpu get processorid MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 1520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 1224 cmdline: rundll32.exe C:\Users\user\Desktop\c2A6GRyAwn.dll,cef_add_cross_origin_whitelist_entry MD5: 889B99C52A60DD49227C5E485A016679)

WMIC.exe (PID: 1020 cmdline: wmic cpu get processorid MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 1248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 7060 cmdline: rundll32.exe C:\Users\user\Desktop\c2A6GRyAwn.dll,cef_add_web_plugin_directory MD5: 889B99C52A60DD49227C5E485A016679)

WMIC.exe (PID: 4912 cmdline: wmic cpu get processorid MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 6104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 1784 cmdline: rundll32.exe C:\Users\user\Desktop\c2A6GRyAwn.dll,cef_add_web_plugin_path MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5688 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_add_cross_origin_whitelist_entry MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6672 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_add_web_plugin_directory MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 344 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_add_web_plugin_path MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1732 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",create_context_shared MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3620 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_zip_reader_create MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6008 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_zip_directory MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3924 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_write_json MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6448 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_window_create_top_level MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4720 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_visit_web_plugin_info MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4676 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_value_create MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2000 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_undefined MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7124 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_uint MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4308 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_string MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7156 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_object MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1272 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_null MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5948 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_int MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3780 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_function MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6020 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_double MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5336 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_date MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5808 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_bool MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7176 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_array_buffer MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7196 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_array MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7208 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8stack_trace_get_current MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7228 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8context_in_context MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7236 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8context_get_entered_context MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7244 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8context_get_current_context MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7252 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_urlrequest_create MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7264 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_uriencode MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7272 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_uridecode MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7280 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_unregister_internal_web_plugin MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7292 cmdline: rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_time_to_timet MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Nitol		No Attribution	https://asec.ahnlab.com/en/44504/ https://blogs.technet.microsoft.com/microsoft_blog/2012/09/13/microsoft-disrupts-the-emerging-nitol-botnet-being-spread-through-an-unsecure-supply-chain/ https://en.wikipedia.org/wiki/Nitol_botnet https://krebsonsecurity.com/tag/nitol/	https://malpedia.caad.fkie.fraunhofer.de/details/win.nitol

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000023.00000002.3043543087.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000012.00000002.2994205386.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000013.00000002.3010385963.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000025.00000002.3036735360.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000002C.00000002.3045359153.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000015.00000002.3048776239.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000018.00000002.3041645495.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000001A.00000002.3028669862.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000028.00000002.3039825345.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000001B.00000002.3018050041.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000001E.00000002.3014122900.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000001D.00000002.3046146995.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000014.00000002.2997697072.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000021.00000002.3049295552.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000014.00000002.2996930195.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000002B.00000002.3037447093.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000026.00000002.3043646710.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000022.00000002.3014901718.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000015.00000002.3045928626.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000002B.00000002.3037998868.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000000F.00000002.3008220827.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000011.00000002.3038214334.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000026.00000002.3045848548.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000000F.00000002.3007932543.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000016.00000002.3049878489.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000001B.00000002.3016390156.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000010.00000002.3016124444.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000025.00000002.3034740174.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000002C.00000002.3047979874.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000001C.00000002.3036458003.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000003.00000002.3052963500.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000020.00000002.3045577027.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000001F.00000002.3017796393.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000017.00000002.3047870662.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000001C.00000002.3036956799.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000001A.00000002.3028319982.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000023.00000002.3045748192.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000001F.00000002.3016249210.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000027.00000002.3043643127.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000021.00000002.3046734441.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000002A.00000002.3051527334.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000001D.00000002.3048956174.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000020.00000002.3043417699.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000000E.00000002.3013317433.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000012.00000002.2994516394.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000024.00000002.3045374022.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000029.00000002.3028907198.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000010.00000002.3017577594.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000004.00000002.3008266392.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000006.00000002.3054985603.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000029.00000002.3028489885.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000024.00000002.3047877855.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000016.00000002.3047426962.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000002A.00000002.3048737599.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000022.00000002.3014058075.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000028.00000002.3036392206.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000018.00000002.3039178109.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
0000001E.00000002.3015022254.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000027.00000002.3045790077.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000017.00000002.3050280645.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000019.00000002.3036054251.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000013.00000002.3010015146.0000000010037000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000011.00000002.3040921469.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000019.00000002.3036809299.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
Click to see the 63 entries

Unpacked PEs

Source	Rule	Description	Author
18.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
37.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
37.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
4.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
25.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
41.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
19.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
22.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
29.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
44.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
15.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
14.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
28.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
35.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
34.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
34.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
27.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
33.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
33.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
29.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
20.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
14.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
17.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
24.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
34.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
31.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
6.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
41.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
38.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
29.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
6.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
35.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
40.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
32.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
43.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
23.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
25.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
37.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
39.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
23.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
21.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
36.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
22.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
22.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
33.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
24.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
43.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
15.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
16.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
32.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
17.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
18.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
40.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
31.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
44.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
27.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
30.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
38.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
44.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
23.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
42.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
6.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
30.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
3.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
17.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
19.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
18.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
26.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
38.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
26.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
43.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
20.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
21.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
4.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
16.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
4.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
20.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
42.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
19.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
28.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
35.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
30.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
3.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
39.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
36.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
21.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
32.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
41.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
27.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
31.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
28.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
25.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
26.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
3.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
14.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
24.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
39.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
16.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
36.2.rundll32.exe.6c9c33e0.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
15.2.rundll32.exe.10000000.0.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
42.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
40.2.rundll32.exe.6c9c33e0.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
Click to see the 97 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\SysWOW64\rundll32.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\rundll32.exe, ProcessId: 1784, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: c2A6GRyAwn.dll

Virustotal: Detection: 12%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.9% probability

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000D890 CryptAcquireContextA,GetLastError,CryptCreateHash,GetLastError,CryptReleaseContext,CryptHashData,GetLastError,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptGetHashParam,lstrcpyA,wsprintfA,lstrcatA,CryptDestroyHash,CryptReleaseContext,	3_2_1000D890
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000D890 CryptAcquireContextA,GetLastError,CryptCreateHash,GetLastError,CryptReleaseContext,CryptHashData,GetLastError,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptGetHashParam,lstrcpyA,wsprintfA,lstrcatA,CryptDestroyHash,CryptReleaseContext,	4_2_1000D890
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000D890 CryptAcquireContextA,GetLastError,CryptCreateHash,GetLastError,CryptReleaseContext,CryptHashData,GetLastError,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptGetHashParam,lstrcpyA,wsprintfA,lstrcatA,CryptDestroyHash,CryptReleaseContext,	6_2_1000D890
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_1000D890 CryptAcquireContextA,GetLastError,CryptCreateHash,GetLastError,CryptReleaseContext,CryptHashData,GetLastError,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptGetHashParam,lstrcpyA,wsprintfA,lstrcatA,CryptDestroyHash,CryptReleaseContext,	14_2_1000D890
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_1000D890 CryptAcquireContextA,GetLastError,CryptCreateHash,GetLastError,CryptReleaseContext,CryptHashData,GetLastError,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptGetHashParam,lstrcpyA,wsprintfA,lstrcatA,CryptDestroyHash,CryptReleaseContext,	15_2_1000D890
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_1000D890 CryptAcquireContextA,GetLastError,CryptCreateHash,GetLastError,CryptReleaseContext,CryptHashData,GetLastError,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptGetHashParam,lstrcpyA,wsprintfA,lstrcatA,CryptDestroyHash,CryptReleaseContext,	16_2_1000D890

Source: c2A6GRyAwn.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: c2A6GRyAwn.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 122.226.191.212 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 104.21.42.47 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 206.238.77.142 2222	Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.5:49757 -> 206.238.77.142:1111

Source: Joe Sandbox View	ASN Name: CHINATELECOM-ZHEJIANG-JINHUA-IDCJINHUAZHEJIANGProvince CHINATELECOM-ZHEJIANG-JINHUA-IDCJINHUAZHEJIANGProvince
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: COGENT-174US COGENT-174US

Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.77.142

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_1001A470 WSARecv,WSAGetLastError,

3_2_1001A470

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: ifconfig.cc
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: ifconfig.cc
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: ifconfig.cc
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: ifconfig.cc
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: ifconfig.cc
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.83.1Host: 4.ipw.cn

Source: global traffic	DNS traffic detected: DNS query: 4.ipw.cn
Source: global traffic	DNS traffic detected: DNS query: ifconfig.cc

Source: rundll32.exe, 00000007.00000003.3130524926.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3165789414.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3165789414.00000000007EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://4.ipw.cn/
Source: rundll32.exe, 00000007.00000003.3130524926.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://4.ipw.cn/X

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: <BackSpace>	3_2_1000EF10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: <Enter>	3_2_1000EF10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: <BackSpace>	4_2_1000EF10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: <Enter>	4_2_1000EF10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: <BackSpace>	6_2_1000EF10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: <Enter>	6_2_1000EF10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: <BackSpace>	14_2_1000EF10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: <Enter>	14_2_1000EF10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: <BackSpace>	15_2_1000EF10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: <Enter>	15_2_1000EF10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: <BackSpace>	16_2_1000EF10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: <Enter>	16_2_1000EF10

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_1000F017 GetKeyState,GetAsyncKeyState,GetKeyState,

3_2_1000F017

System Summary

PE file has a writeable .text section

Source: c2A6GRyAwn.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_3_00F90A95 NtSetInformationProcess,VirtualAlloc,wsprintfA,MessageBoxA,ExitProcess,VirtualFree,	0_3_00F90A95
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_3_00F90A09 NtQueryInformationProcess,NtQueryInformationProcess,NtSetInformationProcess,VirtualAlloc,wsprintfA,MessageBoxA,ExitProcess,VirtualFree,	0_3_00F90A09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_02BF0A95 NtSetInformationProcess,VirtualAlloc,wsprintfA,MessageBoxA,ExitProcess,VirtualFree,	3_3_02BF0A95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_02BF0A09 NtQueryInformationProcess,NtQueryInformationProcess,NtSetInformationProcess,VirtualAlloc,wsprintfA,MessageBoxA,ExitProcess,VirtualFree,	3_3_02BF0A09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_00BA0A95 NtSetInformationProcess,VirtualAlloc,wsprintfA,MessageBoxA,ExitProcess,VirtualFree,	4_3_00BA0A95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_00BA0A09 NtQueryInformationProcess,NtQueryInformationProcess,NtSetInformationProcess,VirtualAlloc,wsprintfA,MessageBoxA,ExitProcess,VirtualFree,	4_3_00BA0A09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_3_033A0A95 NtSetInformationProcess,VirtualAlloc,wsprintfA,MessageBoxA,ExitProcess,VirtualFree,	6_3_033A0A95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_3_033A0A09 NtQueryInformationProcess,NtQueryInformationProcess,NtSetInformationProcess,VirtualAlloc,wsprintfA,MessageBoxA,ExitProcess,VirtualFree,	6_3_033A0A09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_3_00530A95 NtSetInformationProcess,VirtualAlloc,wsprintfA,MessageBoxA,ExitProcess,VirtualFree,	7_3_00530A95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_3_00530A09 NtQueryInformationProcess,NtQueryInformationProcess,NtSetInformationProcess,VirtualAlloc,wsprintfA,MessageBoxA,ExitProcess,VirtualFree,	7_3_00530A09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_3_00B10A95 NtSetInformationProcess,VirtualAlloc,wsprintfA,MessageBoxA,ExitProcess,VirtualFree,	14_3_00B10A95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_3_00B10A09 NtQueryInformationProcess,NtQueryInformationProcess,NtSetInformationProcess,VirtualAlloc,wsprintfA,MessageBoxA,ExitProcess,VirtualFree,	14_3_00B10A09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_3_030E0A09 NtQueryInformationProcess,NtQueryInformationProcess,NtSetInformationProcess,VirtualAlloc,wsprintfA,MessageBoxA,ExitProcess,VirtualFree,	15_3_030E0A09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_3_030E0A95 NtSetInformationProcess,VirtualAlloc,wsprintfA,MessageBoxA,ExitProcess,VirtualFree,	15_3_030E0A95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_3_03200A09 NtQueryInformationProcess,NtQueryInformationProcess,NtSetInformationProcess,VirtualAlloc,wsprintfA,MessageBoxA,ExitProcess,VirtualFree,	16_3_03200A09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_3_03200A95 NtSetInformationProcess,VirtualAlloc,wsprintfA,MessageBoxA,ExitProcess,VirtualFree,	16_3_03200A95

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_100123C0 LoadLibraryA,GetProcAddress,_memset,_memset,GetCurrentProcess,OpenProcessToken,DuplicateTokenEx,LoadLibraryA,GetProcAddress,SetTokenInformation,CreateProcessAsUserA,CloseHandle,CloseHandle,FreeLibrary,

3_2_100123C0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10010560 ExitWindowsEx,	3_2_10010560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10010560 ExitWindowsEx,	4_2_10010560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10010560 ExitWindowsEx,	6_2_10010560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_10010560 ExitWindowsEx,	14_2_10010560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_10010560 ExitWindowsEx,	15_2_10010560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_10010560 ExitWindowsEx,	16_2_10010560

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_3_00F9000D	0_3_00F9000D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_02BF000D	3_3_02BF000D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10030296	3_2_10030296
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000B300	3_2_1000B300
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000B30B	3_2_1000B30B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002136E	3_2_1002136E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002A416	3_2_1002A416
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10020580	3_2_10020580
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002062D	3_2_1002062D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100036A0	3_2_100036A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100217A3	3_2_100217A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002F7B6	3_2_1002F7B6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10030A12	3_2_10030A12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10020B21	3_2_10020B21
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10034B30	3_2_10034B30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10032BA9	3_2_10032BA9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002FD26	3_2_1002FD26
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002DE4D	3_2_1002DE4D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10020F39	3_2_10020F39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_00BA000D	4_3_00BA000D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10030296	4_2_10030296
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000B300	4_2_1000B300
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000B30B	4_2_1000B30B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002136E	4_2_1002136E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002A416	4_2_1002A416
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10020580	4_2_10020580
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002062D	4_2_1002062D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100036A0	4_2_100036A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100217A3	4_2_100217A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002F7B6	4_2_1002F7B6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10030A12	4_2_10030A12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10020B21	4_2_10020B21
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10034B30	4_2_10034B30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10032BA9	4_2_10032BA9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002FD26	4_2_1002FD26
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002DE4D	4_2_1002DE4D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10020F39	4_2_10020F39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_3_033A000D	6_3_033A000D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10030296	6_2_10030296
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000B300	6_2_1000B300
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000B30B	6_2_1000B30B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1002136E	6_2_1002136E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1002A416	6_2_1002A416
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10020580	6_2_10020580
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1002062D	6_2_1002062D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100036A0	6_2_100036A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100217A3	6_2_100217A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1002F7B6	6_2_1002F7B6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10030A12	6_2_10030A12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10020B21	6_2_10020B21
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10034B30	6_2_10034B30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10032BA9	6_2_10032BA9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1002FD26	6_2_1002FD26
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1002DE4D	6_2_1002DE4D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10020F39	6_2_10020F39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_3_0053000D	7_3_0053000D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_3_00B1000D	14_3_00B1000D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_10030296	14_2_10030296
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_1000B300	14_2_1000B300
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_1000B30B	14_2_1000B30B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_1002136E	14_2_1002136E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_1002A416	14_2_1002A416
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_10020580	14_2_10020580
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_1002062D	14_2_1002062D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_100036A0	14_2_100036A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_100217A3	14_2_100217A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_1002F7B6	14_2_1002F7B6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_10030A12	14_2_10030A12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_10020B21	14_2_10020B21
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_10034B30	14_2_10034B30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_10032BA9	14_2_10032BA9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_1002FD26	14_2_1002FD26
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_1002DE4D	14_2_1002DE4D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_10020F39	14_2_10020F39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_3_030E000D	15_3_030E000D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_10030296	15_2_10030296
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_1000B300	15_2_1000B300
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_1000B30B	15_2_1000B30B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_1002136E	15_2_1002136E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_1002A416	15_2_1002A416
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_10020580	15_2_10020580
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_1002062D	15_2_1002062D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_100036A0	15_2_100036A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_100217A3	15_2_100217A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_1002F7B6	15_2_1002F7B6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_10030A12	15_2_10030A12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_10020B21	15_2_10020B21
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_10034B30	15_2_10034B30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_10032BA9	15_2_10032BA9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_1002FD26	15_2_1002FD26
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_1002DE4D	15_2_1002DE4D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_10020F39	15_2_10020F39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_3_0320000D	16_3_0320000D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_10030296	16_2_10030296
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_1000B300	16_2_1000B300
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_1000B30B	16_2_1000B30B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_1002136E	16_2_1002136E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_1002A416	16_2_1002A416
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_10020580	16_2_10020580
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_1002062D	16_2_1002062D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_100036A0	16_2_100036A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_100217A3	16_2_100217A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_1002F7B6	16_2_1002F7B6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_10030A12	16_2_10030A12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_10020B21	16_2_10020B21
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_10034B30	16_2_10034B30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_10032BA9	16_2_10032BA9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_1002FD26	16_2_1002FD26
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_1002DE4D	16_2_1002DE4D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_10020F39	16_2_10020F39

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10024850 appears 222 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6C917890 appears 72 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 1000E140 appears 54 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10025CA4 appears 72 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10024223 appears 36 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10028155 appears 120 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 1002EE60 appears 36 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10025EF4 appears 36 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 1001ED99 appears 36 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 1000F3B0 appears 36 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 1001F13F appears 42 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6C924F40 appears 66 times

Source: c2A6GRyAwn.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: c2A6GRyAwn.dll

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: mal96.troj.spyw.evad.winDLL@177/0@3/3

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetModuleFileNameA,ExpandEnvironmentStringsA,_strlen,_strncmp,wsprintfA,_strlen,_strlen,CopyFileA,_memset,_strcat,OpenSCManagerA,CreateServiceA,LockServiceDatabase,ChangeServiceConfig2A,ChangeServiceConfig2A,UnlockServiceDatabase,GetLastError,OpenServiceA,StartServiceA,StartServiceA,_strcat,RegOpenKeyA,lstrlenA,RegSetValueExA,	3_2_10012550
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetModuleFileNameA,ExpandEnvironmentStringsA,_strlen,_strncmp,wsprintfA,_strlen,_strlen,CopyFileA,_memset,_strcat,OpenSCManagerA,CreateServiceA,LockServiceDatabase,ChangeServiceConfig2A,ChangeServiceConfig2A,UnlockServiceDatabase,GetLastError,OpenServiceA,StartServiceA,StartServiceA,_strcat,RegOpenKeyA,lstrlenA,RegSetValueExA,	4_2_10012550
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetModuleFileNameA,ExpandEnvironmentStringsA,_strlen,_strncmp,wsprintfA,_strlen,_strlen,CopyFileA,_memset,_strcat,OpenSCManagerA,CreateServiceA,LockServiceDatabase,ChangeServiceConfig2A,ChangeServiceConfig2A,UnlockServiceDatabase,GetLastError,OpenServiceA,StartServiceA,StartServiceA,_strcat,RegOpenKeyA,lstrlenA,RegSetValueExA,	6_2_10012550
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetModuleFileNameA,ExpandEnvironmentStringsA,_strlen,_strncmp,wsprintfA,_strlen,_strlen,CopyFileA,_memset,_strcat,OpenSCManagerA,CreateServiceA,LockServiceDatabase,ChangeServiceConfig2A,ChangeServiceConfig2A,UnlockServiceDatabase,GetLastError,OpenServiceA,StartServiceA,StartServiceA,_strcat,RegOpenKeyA,lstrlenA,RegSetValueExA,	14_2_10012550
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetModuleFileNameA,ExpandEnvironmentStringsA,_strlen,_strncmp,wsprintfA,_strlen,_strlen,CopyFileA,_memset,_strcat,OpenSCManagerA,CreateServiceA,LockServiceDatabase,ChangeServiceConfig2A,ChangeServiceConfig2A,UnlockServiceDatabase,GetLastError,OpenServiceA,StartServiceA,StartServiceA,_strcat,RegOpenKeyA,lstrlenA,RegSetValueExA,	15_2_10012550
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetModuleFileNameA,ExpandEnvironmentStringsA,_strlen,_strncmp,wsprintfA,_strlen,_strlen,CopyFileA,_memset,_strcat,OpenSCManagerA,CreateServiceA,LockServiceDatabase,ChangeServiceConfig2A,ChangeServiceConfig2A,UnlockServiceDatabase,GetLastError,OpenServiceA,StartServiceA,StartServiceA,_strcat,RegOpenKeyA,lstrlenA,RegSetValueExA,	16_2_10012550

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_100152A0 CreateToolhelp32Snapshot,Process32First,Process32Next,lstrcmpiA,

3_2_100152A0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10013A20 run,_memset,swprintf,CreateMutexA,GetLastError,IsUserAnAdmin,ReleaseMutex,_memset,GetModuleFileNameA,_sprintf,DeleteFileA,MoveFileA,_wprintf,StartServiceCtrlDispatcherA,_wprintf,WSAStartup,_wprintf,_strlen,

3_2_10013A20

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10013A20 run,_memset,swprintf,CreateMutexA,GetLastError,IsUserAnAdmin,ReleaseMutex,_memset,GetModuleFileNameA,_sprintf,DeleteFileA,MoveFileA,_wprintf,StartServiceCtrlDispatcherA,_wprintf,WSAStartup,_wprintf,_strlen,	3_2_10013A20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10013A20 run,_memset,swprintf,CreateMutexA,GetLastError,IsUserAnAdmin,ReleaseMutex,_memset,GetModuleFileNameA,_sprintf,DeleteFileA,MoveFileA,_wprintf,StartServiceCtrlDispatcherA,_wprintf,WSAStartup,_wprintf,_strlen,	4_2_10013A20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10013A20 run,_memset,swprintf,CreateMutexA,GetLastError,IsUserAnAdmin,ReleaseMutex,_memset,GetModuleFileNameA,_sprintf,DeleteFileA,MoveFileA,_wprintf,StartServiceCtrlDispatcherA,_wprintf,WSAStartup,_wprintf,_strlen,	6_2_10013A20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_10013A20 run,_memset,swprintf,CreateMutexA,GetLastError,IsUserAnAdmin,ReleaseMutex,_memset,GetModuleFileNameA,_sprintf,DeleteFileA,MoveFileA,_wprintf,StartServiceCtrlDispatcherA,_wprintf,WSAStartup,_wprintf,_strlen,	14_2_10013A20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_10013A20 run,_memset,swprintf,CreateMutexA,GetLastError,IsUserAnAdmin,ReleaseMutex,_memset,GetModuleFileNameA,_sprintf,DeleteFileA,MoveFileA,_wprintf,StartServiceCtrlDispatcherA,_wprintf,WSAStartup,_wprintf,_strlen,	15_2_10013A20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_10013A20 run,_memset,swprintf,CreateMutexA,GetLastError,IsUserAnAdmin,ReleaseMutex,_memset,GetModuleFileNameA,_sprintf,DeleteFileA,MoveFileA,_wprintf,StartServiceCtrlDispatcherA,_wprintf,WSAStartup,_wprintf,_strlen,	16_2_10013A20

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1520:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\206.238.77.142:1111
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1248:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6284:120:WilError_03

Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM WIN32_PROCESSOR
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM WIN32_PROCESSOR
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM WIN32_PROCESSOR

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\c2A6GRyAwn.dll,cef_add_cross_origin_whitelist_entry

Source: c2A6GRyAwn.dll

Virustotal: Detection: 12%

Source: loaddll32.exe	String found in binary or memory: If you use save/load state for MDI tabs, you should override this method in a derived class!
Source: loaddll32.exe	String found in binary or memory: lIf you use save/load state for MDI tabs, you must override this method in a derived class!
Source: rundll32.exe	String found in binary or memory: If you use save/load state for MDI tabs, you should override this method in a derived class!
Source: rundll32.exe	String found in binary or memory: lIf you use save/load state for MDI tabs, you must override this method in a derived class!
Source: rundll32.exe	String found in binary or memory: If you use save/load state for MDI tabs, you should override this method in a derived class!
Source: rundll32.exe	String found in binary or memory: lIf you use save/load state for MDI tabs, you must override this method in a derived class!
Source: rundll32.exe	String found in binary or memory: If you use save/load state for MDI tabs, you should override this method in a derived class!
Source: rundll32.exe	String found in binary or memory: lIf you use save/load state for MDI tabs, you must override this method in a derived class!
Source: rundll32.exe	String found in binary or memory: If you use save/load state for MDI tabs, you should override this method in a derived class!
Source: rundll32.exe	String found in binary or memory: lIf you use save/load state for MDI tabs, you must override this method in a derived class!
Source: rundll32.exe	String found in binary or memory: If you use save/load state for MDI tabs, you should override this method in a derived class!
Source: rundll32.exe	String found in binary or memory: lIf you use save/load state for MDI tabs, you must override this method in a derived class!
Source: rundll32.exe	String found in binary or memory: If you use save/load state for MDI tabs, you should override this method in a derived class!
Source: rundll32.exe	String found in binary or memory: lIf you use save/load state for MDI tabs, you must override this method in a derived class!

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\c2A6GRyAwn.dll,cef_add_cross_origin_whitelist_entry
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\c2A6GRyAwn.dll,cef_add_web_plugin_directory
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\c2A6GRyAwn.dll,cef_add_web_plugin_path
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get processorid
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get processorid
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get processorid
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_add_cross_origin_whitelist_entry
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_add_web_plugin_directory
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_add_web_plugin_path
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",create_context_shared
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_zip_reader_create
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_zip_directory
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_write_json
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_window_create_top_level
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_visit_web_plugin_info
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_value_create
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_undefined
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_uint
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_string
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_object
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_null
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_int
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_function
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_double
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_date
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_bool
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_array_buffer
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_array
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8stack_trace_get_current
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8context_in_context
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8context_get_entered_context
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8context_get_current_context
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_urlrequest_create
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_uriencode
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_uridecode
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_unregister_internal_web_plugin
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_time_to_timet
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\c2A6GRyAwn.dll,cef_add_cross_origin_whitelist_entry	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\c2A6GRyAwn.dll,cef_add_web_plugin_directory	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\c2A6GRyAwn.dll,cef_add_web_plugin_path	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_add_cross_origin_whitelist_entry	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_add_web_plugin_directory	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_add_web_plugin_path	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",create_context_shared	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_zip_reader_create	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_zip_directory	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_write_json	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_window_create_top_level	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_visit_web_plugin_info	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_value_create	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_undefined	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_uint	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_string	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_object	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_null	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_int	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_function	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_double	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_date	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_bool	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_array_buffer	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_array	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8stack_trace_get_current	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8context_in_context	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8context_get_entered_context	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8context_get_current_context	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_urlrequest_create	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_uriencode	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_uridecode	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_unregister_internal_web_plugin	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_time_to_timet	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get processorid	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get processorid	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get processorid	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62BE5D10-60EB-11d0-BD3B-00A0C911CE86}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: c2A6GRyAwn.dll

Static PE information: More than 159 > 100 exports found

Source: c2A6GRyAwn.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: c2A6GRyAwn.dll

Static file information: File size 2739712 > 1048576

Source: c2A6GRyAwn.dll

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x298400

Source: c2A6GRyAwn.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_3_00F90C05 LoadLibraryA,GetProcAddress,

0_3_00F90C05

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100241DC push ecx; ret	3_2_100241EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10024895 push ecx; ret	3_2_100248A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100241DC push ecx; ret	4_2_100241EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10024895 push ecx; ret	4_2_100248A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100241DC push ecx; ret	6_2_100241EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10024895 push ecx; ret	6_2_100248A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_100241DC push ecx; ret	14_2_100241EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_10024895 push ecx; ret	14_2_100248A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_100241DC push ecx; ret	15_2_100241EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_10024895 push ecx; ret	15_2_100248A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_100241DC push ecx; ret	16_2_100241EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_10024895 push ecx; ret	16_2_100248A8

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Windows\SysWOW64\rundll32.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Update

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

3_2_10013A20

Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Update			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Update			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _memset,_memset,GetModuleFileNameW,StrCpyW,PathRemoveFileSpecW,lstrlenW,_memset,GetEnvironmentVariableW,GetCurrentProcess,EnumProcessModules,_memset,GetModuleFileNameExW,StrStrW,_memset,GetCurrentProcess,SetPriorityClass,GetCurrentThread,SetThreadPriority,CreateProcessW,SetPriorityClass,SetThreadPriority,ResumeThread,GetCurrentProcess,SetPriorityClass,GetCurrentThread,SetThreadPriority,	3_2_1000E970
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _memset,_memset,GetModuleFileNameW,StrCpyW,PathRemoveFileSpecW,lstrlenW,_memset,GetEnvironmentVariableW,GetCurrentProcess,EnumProcessModules,_memset,GetModuleFileNameExW,StrStrW,_memset,GetCurrentProcess,SetPriorityClass,GetCurrentThread,SetThreadPriority,CreateProcessW,SetPriorityClass,SetThreadPriority,ResumeThread,GetCurrentProcess,SetPriorityClass,GetCurrentThread,SetThreadPriority,	4_2_1000E970
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _memset,_memset,GetModuleFileNameW,StrCpyW,PathRemoveFileSpecW,lstrlenW,_memset,GetEnvironmentVariableW,GetCurrentProcess,EnumProcessModules,_memset,GetModuleFileNameExW,StrStrW,_memset,GetCurrentProcess,SetPriorityClass,GetCurrentThread,SetThreadPriority,CreateProcessW,SetPriorityClass,SetThreadPriority,ResumeThread,GetCurrentProcess,SetPriorityClass,GetCurrentThread,SetThreadPriority,	6_2_1000E970
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _memset,_memset,GetModuleFileNameW,StrCpyW,PathRemoveFileSpecW,lstrlenW,_memset,GetEnvironmentVariableW,GetCurrentProcess,EnumProcessModules,_memset,GetModuleFileNameExW,StrStrW,_memset,GetCurrentProcess,SetPriorityClass,GetCurrentThread,SetThreadPriority,CreateProcessW,SetPriorityClass,SetThreadPriority,ResumeThread,GetCurrentProcess,SetPriorityClass,GetCurrentThread,SetThreadPriority,	14_2_1000E970
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _memset,_memset,GetModuleFileNameW,StrCpyW,PathRemoveFileSpecW,lstrlenW,_memset,GetEnvironmentVariableW,GetCurrentProcess,EnumProcessModules,_memset,GetModuleFileNameExW,StrStrW,_memset,GetCurrentProcess,SetPriorityClass,GetCurrentThread,SetThreadPriority,CreateProcessW,SetPriorityClass,SetThreadPriority,ResumeThread,GetCurrentProcess,SetPriorityClass,GetCurrentThread,SetThreadPriority,	15_2_1000E970
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _memset,_memset,GetModuleFileNameW,StrCpyW,PathRemoveFileSpecW,lstrlenW,_memset,GetEnvironmentVariableW,GetCurrentProcess,EnumProcessModules,_memset,GetModuleFileNameExW,StrStrW,_memset,GetCurrentProcess,SetPriorityClass,GetCurrentThread,SetThreadPriority,CreateProcessW,SetPriorityClass,SetThreadPriority,ResumeThread,GetCurrentProcess,SetPriorityClass,GetCurrentThread,SetThreadPriority,	16_2_1000E970

Contains functionality to detect virtual machines (IN, VMware)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10013080 in eax, dx

3_2_10013080

Found evasive API chain checking for user administrative privileges

Source: C:\Windows\SysWOW64\rundll32.exe

Check user administrative privileges: IsUserAndAdmin, DecisionNode

graph_3-24155

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Windows\SysWOW64\rundll32.exe

Section loaded: OutputDebugStringW count: 204

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_1000F2B0 GetCurrentProcessId,CreateToolhelp32Snapshot,Process32First,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle,

3_2_1000F2B0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10013000 sgdt fword ptr [esp-02h]

3_2_10013000

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10013000 sidt fword ptr [esp-02h]

3_2_10013000

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_3-24355

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_3-24540

Source: C:\Windows\System32\loaddll32.exe	API coverage: 0.0 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.3 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.8 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.3 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.3 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.3 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.4 %

Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM WIN32_PROCESSOR
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM WIN32_PROCESSOR
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM WIN32_PROCESSOR

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10005CA0 GetModuleHandleA,GetProcAddress,GetLastError,GetLastError,_free,_malloc,_free,GetSystemInfo,_perror,

3_2_10005CA0

Source: rundll32.exe, 00000003.00000003.3044035048.000000000300C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllt4@
Source: rundll32.exe, 00000006.00000003.3052110964.00000000033EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll.7
Source: rundll32.exe, 00000016.00000003.3039967374.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll)7
Source: rundll32.exe, 0000000F.00000002.3007386998.0000000003221000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.3005946313.000000000321E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll~7I%I
Source: rundll32.exe, 00000010.00000003.2995072880.000000000324D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000019.00000003.3034069524.00000000032BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.3026712557.000000000315D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001B.00000003.3004956795.000000000077D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001C.00000003.3034864840.000000000323D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.2998052313.0000000000ACD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.3038893460.000000000051D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.3040012987.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll'7
Source: rundll32.exe, 00000004.00000003.3006496639.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000003.3009331648.000000000069C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.3034066510.0000000002D9D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2992474707.00000000007AD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.3007675326.0000000000A2C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000014.00000003.2994978530.000000000338C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000003.3040523364.0000000002EEF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000017.00000003.3040728622.000000000093C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000018.00000003.3034292265.00000000009CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001D.00000003.3040619974.00000000031DD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.3011842238.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6C917EA0 IsDebuggerPresent,

0_2_6C917EA0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6C9297C0 RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,CreateThread,WaitForSingleObjectEx,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

3_2_6C9297C0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_1000F2B0 GetCurrentProcessId,CreateToolhelp32Snapshot,Process32First,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle,

3_2_1000F2B0

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_3_00F90C05 LoadLibraryA,GetProcAddress,

0_3_00F90C05

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_100143E0 FreeLibrary,_free,VirtualFree,GetProcessHeap,HeapFree,

3_2_100143E0

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6C925420 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C925420
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6C925420 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6C925420
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10028206 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_10028206
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6C925420 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6C925420
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10028206 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_10028206
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_6C925420 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_6C925420
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10028206 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_10028206
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_6C925420 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_6C925420
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_10028206 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_10028206
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6C925420 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_6C925420
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_10028206 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_10028206
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_6C925420 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_6C925420
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_10028206 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_10028206

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 122.226.191.212 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 104.21.42.47 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 206.238.77.142 2222	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get processorid	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get processorid	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get processorid	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown

Source: rundll32.exe

Binary or memory string: Shell_TrayWnd

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10025930 cpuid

3_2_10025930

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_1002A1A0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetTickCount64,QueryPerformanceCounter,

3_2_1002A1A0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_1002D09F __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

3_2_1002D09F

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10012A90 _memset,GetVersionExA,_memmove,InternetGetConnectedState,_strlen,_Func_class,

3_2_10012A90

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Nitol

Source: Yara match	File source: 18.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000002.3043543087.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2994205386.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3010385963.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.3036735360.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.3045359153.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3048776239.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3041645495.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3028669862.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.3039825345.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3018050041.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3014122900.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3046146995.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2997697072.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3049295552.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2996930195.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.3037447093.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.3043646710.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3014901718.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3045928626.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.3037998868.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3008220827.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3038214334.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.3045848548.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3007932543.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3049878489.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3016390156.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3016124444.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.3034740174.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.3047979874.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3036458003.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3052963500.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3045577027.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3017796393.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3047870662.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3036956799.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3028319982.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3045748192.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3016249210.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.3043643127.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3046734441.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.3051527334.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3048956174.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3043417699.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3013317433.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2994516394.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3045374022.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.3028907198.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3017577594.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3008266392.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3054985603.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.3028489885.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3047877855.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3047426962.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.3048737599.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3014058075.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.3036392206.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3039178109.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3015022254.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.3045790077.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3050280645.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3036054251.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3010015146.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3040921469.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3036809299.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Nitol

Source: Yara match	File source: 18.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.rundll32.exe.6c9c33e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.rundll32.exe.6c9c33e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000002.3043543087.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2994205386.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3010385963.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.3036735360.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.3045359153.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3048776239.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3041645495.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3028669862.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.3039825345.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3018050041.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3014122900.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3046146995.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2997697072.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3049295552.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2996930195.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.3037447093.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.3043646710.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3014901718.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3045928626.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.3037998868.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3008220827.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3038214334.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.3045848548.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3007932543.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3049878489.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3016390156.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3016124444.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.3034740174.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.3047979874.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3036458003.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3052963500.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3045577027.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3017796393.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3047870662.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3036956799.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3028319982.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3045748192.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3016249210.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.3043643127.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3046734441.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.3051527334.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3048956174.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3043417699.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3013317433.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2994516394.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3045374022.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.3028907198.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3017577594.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3008266392.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3054985603.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.3028489885.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3047877855.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3047426962.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.3048737599.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3014058075.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.3036392206.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3039178109.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3015022254.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.3045790077.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3050280645.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3036054251.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3010015146.0000000010037000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3040921469.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3036809299.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001C580 WSAGetLastError,socket,htons,bind,WSAGetLastError,	3_2_1001C580
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001DBF0 socket,bind,WSAGetLastError,SetLastError,WSAGetLastError,SetLastError,WSAGetLastError,SetLastError,	3_2_1001DBF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001C580 WSAGetLastError,socket,htons,bind,WSAGetLastError,	4_2_1001C580
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001DBF0 socket,bind,WSAGetLastError,SetLastError,WSAGetLastError,SetLastError,WSAGetLastError,SetLastError,	4_2_1001DBF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001C580 WSAGetLastError,socket,htons,bind,WSAGetLastError,	6_2_1001C580
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001DBF0 socket,bind,WSAGetLastError,SetLastError,WSAGetLastError,SetLastError,WSAGetLastError,SetLastError,	6_2_1001DBF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_1001C580 WSAGetLastError,socket,htons,bind,WSAGetLastError,	14_2_1001C580
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_1001DBF0 socket,bind,WSAGetLastError,SetLastError,WSAGetLastError,SetLastError,WSAGetLastError,SetLastError,	14_2_1001DBF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_1001C580 WSAGetLastError,socket,htons,bind,WSAGetLastError,	15_2_1001C580
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_1001DBF0 socket,bind,WSAGetLastError,SetLastError,WSAGetLastError,SetLastError,WSAGetLastError,SetLastError,	15_2_1001DBF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_1001C580 WSAGetLastError,socket,htons,bind,WSAGetLastError,	16_2_1001C580
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 16_2_1001DBF0 socket,bind,WSAGetLastError,SetLastError,WSAGetLastError,SetLastError,WSAGetLastError,SetLastError,	16_2_1001DBF0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	111 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	13 Native API	1 Valid Accounts	1 Valid Accounts	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	111 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	4 Windows Service	1 Access Token Manipulation	1 DLL Side-Loading	Security Account Manager	16 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	11 Registry Run Keys / Startup Folder	4 Windows Service	1 Valid Accounts	NTDS	151 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	112 Process Injection	1 Access Token Manipulation	LSA Secrets	23 Virtualization/Sandbox Evasion	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	23 Virtualization/Sandbox Evasion	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	112 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
c2A6GRyAwn.dll	12%	Virustotal		Browse
c2A6GRyAwn.dll	11%	ReversingLabs	Win32.Backdoor.GhostRAT

Name	IP	Active	Malicious	Reputation
286f37a9.ifconfig.cc.cname.hcnamedns.com	122.226.191.212	true	true	unknown
4.tcpdump.cn	104.21.42.47	true	true	unknown
ifconfig.cc	unknown	unknown	false	unknown
4.ipw.cn	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://4.ipw.cn/X	rundll32.exe, 00000007.00000003.3130524926.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://4.ipw.cn/	rundll32.exe, 00000007.00000003.3130524926.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3165789414.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3165789414.00000000007EF000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
122.226.191.212	286f37a9.ifconfig.cc.cname.hcnamedns.com	China	136190	CHINATELECOM-ZHEJIANG-JINHUA-IDCJINHUAZHEJIANGProvince	true
104.21.42.47	4.tcpdump.cn	United States	13335	CLOUDFLARENETUS	true
206.238.77.142	unknown	United States	174	COGENT-174US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578032
Start date and time:	2024-12-19 08:07:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	c2A6GRyAwn.dll renamed because original name is a hash value
Original Sample Name:	c25a973f8b0a24249c6e6894cef4d6b7.dll
Detection:	MAL
Classification:	mal96.troj.spyw.evad.winDLL@177/0@3/3
EGA Information:	Successful, ratio: 87.5%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target rundll32.exe, PID 1784 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:09:55	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Windows Update C:\Windows\SysWOW64\rundll32.exe
08:10:03	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Windows Update C:\Windows\SysWOW64\rundll32.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COGENT-174US	cbr.x86.elf	Get hash	malicious	Mirai	Browse	38.216.164.43
	1.elf	Get hash	malicious	Unknown	Browse	38.34.236.55
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	45.91.72.30
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	205.164.69.77
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	204.240.144.106
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	128.145.188.164
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	38.142.152.76
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	38.149.253.245
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	38.27.48.136
CLOUDFLARENETUS	script.hta	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.209.202
	Brooming.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.21.86.72
	469oyXQbRY.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	104.21.64.80
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.67.146
	1.elf	Get hash	malicious	Unknown	Browse	141.101.96.239
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	104.21.12.88
	https://d2kjcgrb1q4xt7.cloudfront.net/mULiCoBDj2Ug.exe	Get hash	malicious	Unknown	Browse	172.67.26.92
CHINATELECOM-ZHEJIANG-JINHUA-IDCJINHUAZHEJIANGProvince	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	183.134.25.181
	armv5l.elf	Get hash	malicious	Mirai	Browse	60.163.150.174
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	183.131.125.190
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	61.174.250.26
	jew.mpsl.elf	Get hash	malicious	Unknown	Browse	122.226.226.205
	x86_64.elf	Get hash	malicious	Mirai	Browse	115.238.214.3
	mpsl.elf	Get hash	malicious	Mirai	Browse	183.146.28.4
	file.exe	Get hash	malicious	Unknown	Browse	60.191.236.246
	file.exe	Get hash	malicious	Unknown	Browse	60.191.236.246
	nklarm.elf	Get hash	malicious	Unknown	Browse	115.231.144.11

File type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows, PECompact2 compressed
Entropy (8bit):	7.999295905537857
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 90.54% Win32 EXE PECompact compressed (v2.x) (59071/9) 5.34% Win32 EXE PECompact compressed (generic) (41571/9) 3.76% Generic Win/DOS Executable (2004/3) 0.18% DOS Executable Generic (2002/1) 0.18%
File name:	c2A6GRyAwn.dll
File size:	2'739'712 bytes
MD5:	c25a973f8b0a24249c6e6894cef4d6b7
SHA1:	ca709195fdae41296ce26a31f710f3d9a7495a8f
SHA256:	e5024fae6c595676b50f0a9b8ab6a3ccd0a9b36a069c5a3746ad07d73ef6cfb8
SHA512:	60fa67697707027555a96e1ae0e0a3b54284b7f9f989db5222ff2caf6f5d9798d43021af236abce848c507525f92fe861adbf8ae4adffe8aa0c60679a68165ea
SSDEEP:	49152:zp1hs0Y3clbb+0Mv8nFmTfazEVT84+gVSJ5QzKXVmOnVuSQ55QXvZB5OC:j+9slFBJgl8Ng8JKzKcOnV/Q0fZB3
TLSH:	45C53375587006CCFEBDBA3391E2DAEB7648623436F033610D9E207D91AD09B6AD9137
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"..]C.X]C.X]C.X.4=X\C.X..MXpC.X..NX.C.X..OX.B.X.4<XUC.X.4>XYC.X]C.X.@.X.49XxC.Xz.OX^C.Xz.JX\C.Xz.IX\C.X]C.X\C.Xz.LX\C.XRich]C.

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x10294020
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x669E40E9 [Mon Jul 22 11:22:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	6d967b24540c0dcbca853710eddbda14

Entrypoint Preview

Instruction
mov eax, 105D7E64h
push eax
push dword ptr fs:[00000000h]
mov dword ptr fs:[00000000h], esp
xor eax, eax
mov dword ptr [eax], ecx
push eax
inc ebp
inc ebx
outsd
insd
jo 00007FF2C4CF5BE3h
arpl word ptr [edx+esi+00h], si
cmp byte ptr [ecx-06h], bh
cdq
movsd
adc eax, 4F1F2EC4h
outsb
stosd
sbb dl, byte ptr [eax-7Ah]
dec esi
xor cl, byte ptr [edx+1559A0ACh]
pop ebp
fbstp [eax+ebp+2122F65Fh]
int3
dec edi
or ebp, dword ptr [esi+35h]
cmp byte ptr [ebx-2D075677h], 00000065h
out dx, eax
fbstp [esi-69h]
cli
idiv ah
movsb
add dword ptr [ebx], edi
out dx, eax
out DDh, al
inc ebx
test dword ptr [ebx], 9D6BD962h
daa
pop eax
scasb
and ecx, dword ptr [edx-0Dh]
aaa
xlatb
or eax, 1A6ABD03h
sbb ch, byte ptr fs:[edi+31h]
aad 22h
ret
fdiv dword ptr [ebp-1AA3D25Bh]
pop ebx
cld
cmp al, FDh
pop ebx
push 9D8C9189h
salc
xor esi, esi
cmp edi, ecx
mov edi, 1AF185CAh
mov dh, 48h
sbb ch, byte ptr [0D1D4AC3h]
jne 00007FF2C4CF5B77h
dec ecx
add dword ptr [edi+11BE5BBDh], edx
insb
fidiv dword ptr [edi]
salc

Rich Headers

Programming Language:

[C++] VS2012 build 50727
[EXP] VS2012 build 50727
[RES] VS2012 build 50727
[LNK] VS2012 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x5d52e0	0x15e8	.rsrc
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5d6e0c	0x3fd	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d5000	0x2d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5da000	0x1c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5d7f40	0x48	.rsrc
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5d4000	0x298400	033e1e609069d5aac750cc1aa80706f0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5d5000	0x5000	0x4400	d27e0c21185a9df30d3e51625b8551c9	False	0.58984375	data	6.4035865241497865	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x5da000	0x200	0x200	22e3743c4cd7d5f6adb4c28c88c50b84	False	0.07421875	data	0.31780982431271465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_RIBBON_XML	0x539000	0x381	empty	Chinese	China	0
RT_CURSOR	0x539388	0x134	empty	Chinese	China	0
RT_GROUP_CURSOR	0x5394c0	0x14	empty	Chinese	China	0
RT_MANIFEST	0x5d5150	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
kernel32.dll	LoadLibraryA, GetProcAddress, VirtualAlloc, VirtualFree
MSIMG32.dll	AlphaBlend
SHLWAPI.dll	PathStripToRootA
UxTheme.dll	OpenThemeData
dwmapi.dll	DwmDefWindowProc
OLEACC.dll	CreateStdAccessibleObject
gdiplus.dll	GdipDeleteGraphics
IMM32.dll	ImmGetContext
WINMM.dll	PlaySoundA
USER32.dll	MessageBeep
GDI32.dll	BitBlt
WINSPOOL.DRV	ClosePrinter
ADVAPI32.dll	RegCloseKey
SHELL32.dll	DragQueryFileA
ole32.dll	OleLockRunning
OLEAUT32.dll	VariantClear

Exports

Name	Ordinal	Address
cef_add_cross_origin_whitelist_entry	1	0x10006760
cef_add_web_plugin_directory	2	0x10006890
cef_add_web_plugin_path	3	0x10006ac0
cef_api_hash	4	0x10006c40
cef_base64decode	5	0x10006de0
cef_base64encode	6	0x10006f40
cef_begin_tracing	7	0x100070b0
cef_binary_value_create	8	0x100071d0
cef_browser_create	9	0x10007310
cef_browser_host_create_browser	10	0x10007470
cef_browser_host_create_browser_sync	11	0x100075d0
cef_browser_view_create	12	0x10007820
cef_browser_view_get_for_browser	13	0x10007a10
cef_build_revision	14	0x10007b80
cef_clear_cross_origin_whitelist	15	0x10007d40
cef_clear_scheme_handler_factories	16	0x10007ec0
cef_command_line_create	17	0x10008010
cef_command_line_get_global	18	0x10008150
cef_cookie_manager_create_manager	19	0x10008280
cef_cookie_manager_get_blocking_manager	20	0x10008420
cef_cookie_manager_get_global_manager	21	0x10008540
cef_crash_reporting_enabled	22	0x100086c0
cef_create_context_shared	23	0x10008820
cef_create_directory	24	0x10008970
cef_create_new_temp_directory	25	0x10008b50
cef_create_temp_directory_in_directory	26	0x10008cd0
cef_create_url	27	0x10008d70
cef_currently_on	28	0x10008fb0
cef_delete_file	29	0x100090e0
cef_dictionary_value_create	30	0x10009220
cef_directory_exists	31	0x10009360
cef_display_get_alls	32	0x100095a0
cef_display_get_count	33	0x10009730
cef_display_get_matching_bounds	34	0x10009900
cef_display_get_nearest_point	35	0x10009a50
cef_display_get_primary	36	0x10009c00
cef_do_message_loop_work	37	0x10009d70
cef_drag_data_create	38	0x10009f90
cef_enable_highdpi_support	39	0x1000a180
cef_end_tracing	40	0x1000a330
cef_execute_java_script_with_user_gesture_for_tests	41	0x1000a4d0
cef_execute_process	42	0x1000a670
cef_force_web_plugin_shutdown	43	0x1000a800
cef_format_url_for_security_display	44	0x1000a980
cef_get_current_platform_thread_id	45	0x1000ab80
cef_get_extensions_for_mime_type	46	0x1000ace0
cef_get_geolocation	47	0x1000aec0
cef_get_mime_type	48	0x1000b000
cef_get_min_log_level	49	0x1000b220
cef_get_path	50	0x1000b360
cef_get_temp_directory	51	0x1000b580
cef_image_create	52	0x1000b710
cef_initialize	53	0x1000b880
cef_is_cert_status_error	54	0x1000ba00
cef_is_cert_status_minor_error	55	0x1000bc10
cef_is_web_plugin_unstable	56	0x1000bdc0
cef_label_button_create	57	0x1000bf70
cef_launch_process	58	0x1000c0b0
cef_list_value_create	59	0x1000c180
cef_load_crlsets_file	60	0x1000c2c0
cef_log	61	0x1000c4f0
cef_menu_button_create	62	0x1000c670
cef_menu_model_create	63	0x1000c7d0
cef_now_from_system_trace_time	64	0x1000c9d0
cef_panel_create	65	0x1000ca90
cef_parse_csscolor	66	0x1000cc60
cef_parse_json	67	0x1000cf00
cef_parse_jsonand_return_error	68	0x1000d050
cef_parse_url	69	0x1000d1e0
cef_post_data_create	70	0x1000d3b0
cef_post_data_element_create	71	0x1000d5a0
cef_post_delayed_task	72	0x1000d740
cef_post_task	73	0x1000d830
cef_print_settings_create	74	0x1000d910
cef_process_message_create	75	0x1000dab0
cef_quit_message_loop	76	0x1000dc40
cef_refresh_web_plugins	77	0x1000dde0
cef_register_extension	78	0x1000def0
cef_register_scheme_handler_factory	79	0x1000e000
cef_register_web_plugin_crash	80	0x1000e130
cef_register_widevine_cdm	81	0x1000e2d0
cef_remove_cross_origin_whitelist_entry	82	0x1000e4b0
cef_remove_web_plugin_path	83	0x1000e650
cef_request_context_create_context	84	0x1000e860
cef_request_context_get_global_context	85	0x1000e9b0
cef_request_create	86	0x1000eb90
cef_response_create	87	0x1000ed10
cef_run_message_loop	88	0x1000eed0
cef_scroll_view_create	89	0x1000efe0
cef_server_create	90	0x1000f140
cef_set_crash_key_value	91	0x1000f2d0
cef_set_osmodal_loop	92	0x1000f440
cef_shutdown	93	0x1000f570
cef_stream_reader_create_for_data	94	0x1000f6b0
cef_stream_reader_create_for_file	95	0x1000f860
cef_stream_reader_create_for_handler	96	0x1000f9c0
cef_stream_writer_create_for_file	97	0x1000fb10
cef_stream_writer_create_for_handler	98	0x1000fd40
cef_string_ascii_to_utf16	99	0x1000fe10
cef_string_list_alloc	100	0x1000ff80
cef_string_list_append	101	0x100100c0
cef_string_list_copy	102	0x10010210
cef_string_list_free	103	0x10010300
cef_string_list_size	104	0x100104c0
cef_string_list_value	105	0x10010610
cef_string_map_alloc	106	0x10010780
cef_string_map_append	107	0x10010870
cef_string_map_free	108	0x10010a40
cef_string_map_key	109	0x10010b20
cef_string_map_size	110	0x10010c90
cef_string_map_value	111	0x10010e30
cef_string_multimap_alloc	112	0x10010f10
cef_string_multimap_append	113	0x10011100
cef_string_multimap_free	114	0x100112a0
cef_string_multimap_key	115	0x10011460
cef_string_multimap_size	116	0x10011690
cef_string_multimap_value	117	0x10011840
cef_string_userfree_utf16_free	118	0x100119b0
cef_string_utf16_clear	119	0x10011af0
cef_string_utf16_cmp	120	0x10011be0
cef_string_utf16_set	121	0x10011d40
cef_string_utf16_to_lower	122	0x10011f10
cef_string_utf16_to_utf8	123	0x10012070
cef_string_utf8_clear	124	0x10012230
cef_string_utf8_to_utf16	125	0x100123a0
cef_string_wide_set	126	0x10012560
cef_string_wide_to_utf8	127	0x100126c0
cef_task_runner_get_for_current_thread	128	0x10012920
cef_task_runner_get_for_thread	129	0x10012ad0
cef_textfield_create	130	0x10012c90
cef_time_delta	131	0x10012db0
cef_time_now	132	0x10012f10
cef_time_to_timet	133	0x10013040
cef_unregister_internal_web_plugin	134	0x100131f0
cef_uridecode	135	0x10013380
cef_uriencode	136	0x10013470
cef_urlrequest_create	137	0x10013610
cef_v8context_get_current_context	138	0x100137b0
cef_v8context_get_entered_context	139	0x100138f0
cef_v8context_in_context	140	0x10013ad0
cef_v8stack_trace_get_current	141	0x10013c50
cef_v8value_create_array	142	0x10013d50
cef_v8value_create_array_buffer	143	0x10013f50
cef_v8value_create_bool	144	0x100140a0
cef_v8value_create_date	145	0x10014230
cef_v8value_create_double	146	0x100143d0
cef_v8value_create_function	147	0x10014530
cef_v8value_create_int	148	0x100146b0
cef_v8value_create_null	149	0x100147d0
cef_v8value_create_object	150	0x10014950
cef_v8value_create_string	151	0x10014b60
cef_v8value_create_uint	152	0x10014cc0
cef_v8value_create_undefined	153	0x10014e20
cef_value_create	154	0x10014fb0
cef_visit_web_plugin_info	155	0x10015120
cef_window_create_top_level	156	0x100152e0
cef_write_json	157	0x10015430
cef_zip_directory	158	0x10015600
cef_zip_reader_create	159	0x100157b0
create_context_shared	160	0x10015970

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 08:09:53.040038109 CET	49757	1111	192.168.2.5	206.238.77.142
Dec 19, 2024 08:09:53.041610956 CET	49759	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:09:53.159595966 CET	1111	49757	206.238.77.142	192.168.2.5
Dec 19, 2024 08:09:53.159729004 CET	49757	1111	192.168.2.5	206.238.77.142
Dec 19, 2024 08:09:53.159990072 CET	49757	1111	192.168.2.5	206.238.77.142
Dec 19, 2024 08:09:53.161051035 CET	2222	49759	206.238.77.142	192.168.2.5
Dec 19, 2024 08:09:53.161134005 CET	49759	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:09:53.161248922 CET	49759	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:09:53.279448032 CET	1111	49757	206.238.77.142	192.168.2.5
Dec 19, 2024 08:09:53.279514074 CET	49757	1111	192.168.2.5	206.238.77.142
Dec 19, 2024 08:09:53.280646086 CET	2222	49759	206.238.77.142	192.168.2.5
Dec 19, 2024 08:09:53.280699015 CET	49759	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:09:53.399012089 CET	1111	49757	206.238.77.142	192.168.2.5
Dec 19, 2024 08:09:53.400193930 CET	2222	49759	206.238.77.142	192.168.2.5
Dec 19, 2024 08:09:56.574246883 CET	2222	49759	206.238.77.142	192.168.2.5
Dec 19, 2024 08:09:56.574301958 CET	49759	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:09:56.576122046 CET	49759	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:09:56.696073055 CET	2222	49759	206.238.77.142	192.168.2.5
Dec 19, 2024 08:09:58.730422974 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:09:58.764851093 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:09:58.849984884 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:09:58.850102901 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:09:58.884362936 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:09:58.884438038 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:09:58.925787926 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:09:58.950890064 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:09:59.045326948 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:09:59.070390940 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:00.119376898 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:00.120404959 CET	49778	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:00.162676096 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:00.163703918 CET	49757	1111	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:00.224189043 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:00.224328995 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:00.240145922 CET	2222	49778	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:00.240415096 CET	49778	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:00.240415096 CET	49778	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:00.283246040 CET	1111	49757	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:00.284081936 CET	49757	1111	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:00.359981060 CET	2222	49778	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:00.360236883 CET	49778	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:00.403527021 CET	1111	49757	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:00.482999086 CET	2222	49778	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:01.048355103 CET	1111	49757	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:01.184334993 CET	49757	1111	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:02.359489918 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:02.479001999 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:02.856461048 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:02.860909939 CET	49778	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:02.916848898 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:02.980382919 CET	2222	49778	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:02.980463028 CET	49778	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:03.100188971 CET	2222	49778	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:03.653760910 CET	2222	49778	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:03.655613899 CET	49778	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:03.662765026 CET	49778	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:03.662772894 CET	49785	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:03.782335997 CET	2222	49778	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:03.782368898 CET	2222	49785	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:03.785448074 CET	49785	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:03.785448074 CET	49785	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:03.904963017 CET	2222	49785	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:03.905101061 CET	49785	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:04.027036905 CET	2222	49785	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:04.722996950 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:04.842470884 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:05.227884054 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:05.228843927 CET	49785	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:05.293550968 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:05.348354101 CET	2222	49785	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:05.348426104 CET	49785	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:05.467915058 CET	2222	49785	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:07.199196100 CET	2222	49785	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:07.199259043 CET	49785	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:07.199357033 CET	49785	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:07.199640989 CET	49795	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:07.319051981 CET	2222	49785	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:07.319320917 CET	2222	49795	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:07.319396973 CET	49795	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:07.319638014 CET	49795	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:07.439033031 CET	2222	49795	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:07.439138889 CET	49795	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:07.558716059 CET	2222	49795	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:07.728404999 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:07.847937107 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:08.214782953 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:08.215475082 CET	49795	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:08.262315989 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:08.335062981 CET	2222	49795	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:08.336256027 CET	49795	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:08.455812931 CET	2222	49795	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:10.733333111 CET	2222	49795	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:10.735023022 CET	49795	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:10.736581087 CET	49795	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:10.741904020 CET	49806	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:10.856229067 CET	2222	49795	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:10.861440897 CET	2222	49806	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:10.861835957 CET	49806	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:10.861836910 CET	49806	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:11.005563021 CET	2222	49806	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:11.005686045 CET	49806	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:11.245191097 CET	2222	49806	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:11.522144079 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:11.641583920 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:12.013550997 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:12.014154911 CET	49806	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:12.059186935 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:12.133620977 CET	2222	49806	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:12.133672953 CET	49806	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:12.254740953 CET	2222	49806	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:14.267973900 CET	2222	49806	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:14.268074989 CET	49806	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:14.268183947 CET	49806	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:14.268457890 CET	49814	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:14.387609959 CET	2222	49806	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:14.387932062 CET	2222	49814	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:14.388184071 CET	49814	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:14.388489008 CET	49814	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:14.507901907 CET	2222	49814	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:14.508024931 CET	49814	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:14.627448082 CET	2222	49814	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:14.861768961 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:14.981295109 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:15.368319988 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:15.368899107 CET	49814	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:15.418582916 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:15.488439083 CET	2222	49814	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:15.488529921 CET	49814	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:15.608000994 CET	2222	49814	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:17.816397905 CET	2222	49814	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:17.816468954 CET	49814	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:17.816561937 CET	49814	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:17.817006111 CET	49824	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:17.936094046 CET	2222	49814	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:17.936595917 CET	2222	49824	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:17.936686039 CET	49824	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:17.942085028 CET	49824	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:18.061566114 CET	2222	49824	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:18.061630964 CET	49824	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:18.182688951 CET	2222	49824	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:18.480043888 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:18.599584103 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:18.985959053 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:18.995462894 CET	49824	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:19.043581963 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:19.115008116 CET	2222	49824	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:19.115077019 CET	49824	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:19.236129999 CET	2222	49824	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:21.367664099 CET	2222	49824	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:21.367741108 CET	49824	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:21.367839098 CET	49824	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:21.371335983 CET	49835	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:21.487407923 CET	2222	49824	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:21.490823984 CET	2222	49835	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:21.490897894 CET	49835	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:21.491101027 CET	49835	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:21.610589981 CET	2222	49835	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:21.610860109 CET	49835	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:21.730371952 CET	2222	49835	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:21.853686094 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:21.973156929 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:22.348196983 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:22.349162102 CET	49835	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:22.403003931 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:22.468801022 CET	2222	49835	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:22.468862057 CET	49835	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:22.589023113 CET	2222	49835	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:24.929610014 CET	2222	49835	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:24.929809093 CET	49835	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:24.929809093 CET	49835	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:24.930171013 CET	49841	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:25.049420118 CET	2222	49835	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:25.049631119 CET	2222	49841	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:25.049849987 CET	49841	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:25.050076008 CET	49841	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:25.170496941 CET	2222	49841	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:25.170577049 CET	49841	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:25.289983988 CET	2222	49841	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:25.493524075 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:25.612925053 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:26.000999928 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:26.001773119 CET	49841	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:26.043643951 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:26.121608019 CET	2222	49841	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:26.121929884 CET	49841	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:26.241584063 CET	2222	49841	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:28.456003904 CET	2222	49841	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:28.456123114 CET	49841	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:28.456252098 CET	49841	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:28.456501961 CET	49852	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:28.575999022 CET	2222	49841	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:28.576114893 CET	2222	49852	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:28.576201916 CET	49852	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:28.576436996 CET	49852	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:28.696393967 CET	2222	49852	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:28.696479082 CET	49852	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:28.816381931 CET	2222	49852	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:28.999010086 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:29.118685961 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:29.502334118 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:29.502907038 CET	49852	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:29.543657064 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:29.622358084 CET	2222	49852	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:29.622450113 CET	49852	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:29.741955042 CET	2222	49852	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:31.985094070 CET	2222	49852	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:31.985186100 CET	49852	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:31.985268116 CET	49852	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:31.985630035 CET	49859	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:32.104919910 CET	2222	49852	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:32.105290890 CET	2222	49859	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:32.105386019 CET	49859	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:32.105658054 CET	49859	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:32.225074053 CET	2222	49859	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:32.227087975 CET	49859	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:32.346621037 CET	2222	49859	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:32.524966955 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:32.644449949 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:33.032080889 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:33.032629013 CET	49859	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:33.074892044 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:33.152245045 CET	2222	49859	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:33.152401924 CET	49859	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:33.271876097 CET	2222	49859	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:35.521199942 CET	2222	49859	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:35.525130987 CET	49859	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:35.525232077 CET	49859	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:35.525501966 CET	49869	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:35.644629002 CET	2222	49859	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:35.644953012 CET	2222	49869	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:35.645176888 CET	49869	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:35.645282030 CET	49869	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:35.764802933 CET	2222	49869	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:35.764955997 CET	49869	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:35.884427071 CET	2222	49869	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:36.087780952 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:36.207199097 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:36.583295107 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:36.583870888 CET	49869	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:36.637502909 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:36.703324080 CET	2222	49869	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:36.703427076 CET	49869	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:36.823483944 CET	2222	49869	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:39.072808027 CET	2222	49869	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:39.073004961 CET	49869	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:39.073065996 CET	49869	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:39.073363066 CET	49880	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:39.192550898 CET	2222	49869	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:39.192841053 CET	2222	49880	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:39.192950010 CET	49880	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:39.193444014 CET	49880	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:39.312865019 CET	2222	49880	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:39.312933922 CET	49880	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:39.432524920 CET	2222	49880	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:39.533737898 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:39.653289080 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:40.027842999 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:40.028697014 CET	49880	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:40.074940920 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:40.148118019 CET	2222	49880	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:40.148194075 CET	49880	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:40.267687082 CET	2222	49880	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:42.597363949 CET	2222	49880	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:42.597449064 CET	49880	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:42.602727890 CET	49880	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:42.606806993 CET	49886	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:42.722265959 CET	2222	49880	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:42.726296902 CET	2222	49886	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:42.726389885 CET	49886	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:42.728312016 CET	49886	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:42.847817898 CET	2222	49886	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:42.847882986 CET	49886	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:42.967434883 CET	2222	49886	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:43.119726896 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:43.239274979 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:43.613964081 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:43.614563942 CET	49886	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:43.668770075 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:43.734020948 CET	2222	49886	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:43.734169960 CET	49886	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:43.853755951 CET	2222	49886	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:46.149447918 CET	2222	49886	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:46.149553061 CET	49886	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:46.149610996 CET	49886	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:46.149857998 CET	49897	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:46.269213915 CET	2222	49886	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:46.269409895 CET	2222	49897	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:46.269479036 CET	49897	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:46.269743919 CET	49897	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:46.389189005 CET	2222	49897	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:46.389277935 CET	49897	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:46.508826971 CET	2222	49897	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:46.762511969 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:46.882054090 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:47.254827023 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:47.257569075 CET	49897	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:47.309412003 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:47.377104044 CET	2222	49897	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:47.381242990 CET	49897	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:47.500883102 CET	2222	49897	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:49.675523043 CET	2222	49897	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:49.675700903 CET	49897	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:49.675815105 CET	49897	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:49.676256895 CET	49908	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:49.795537949 CET	2222	49897	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:49.795876980 CET	2222	49908	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:49.795990944 CET	49908	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:49.796238899 CET	49908	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:49.916779995 CET	2222	49908	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:49.916840076 CET	49908	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:50.036823034 CET	2222	49908	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:50.198714972 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:50.318803072 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:50.702821016 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:50.703408003 CET	49908	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:50.746840954 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:50.822779894 CET	2222	49908	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:50.822870970 CET	49908	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:50.942673922 CET	2222	49908	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:53.199153900 CET	2222	49908	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:53.199285984 CET	49908	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:53.199373960 CET	49908	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:53.199661970 CET	49914	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:53.319237947 CET	2222	49908	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:53.319427967 CET	2222	49914	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:53.319504976 CET	49914	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:53.319703102 CET	49914	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:53.440119982 CET	2222	49914	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:53.440201998 CET	49914	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:53.559932947 CET	2222	49914	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:53.686009884 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:53.805591106 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:54.194869995 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:54.195355892 CET	49914	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:54.246901989 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:54.314940929 CET	2222	49914	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:54.315020084 CET	49914	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:54.434499025 CET	2222	49914	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:56.738209963 CET	2222	49914	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:56.738298893 CET	49914	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:56.738389015 CET	49914	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:56.738801956 CET	49925	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:56.857914925 CET	2222	49914	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:56.858308077 CET	2222	49925	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:56.858534098 CET	49925	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:56.858819962 CET	49925	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:56.978411913 CET	2222	49925	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:56.978487968 CET	49925	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:10:57.098202944 CET	2222	49925	206.238.77.142	192.168.2.5
Dec 19, 2024 08:10:57.243702888 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:57.294521093 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:57.363208055 CET	80	49771	104.21.42.47	192.168.2.5
Dec 19, 2024 08:10:57.363322020 CET	49771	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:10:58.870009899 CET	49931	80	192.168.2.5	122.226.191.212
Dec 19, 2024 08:10:58.991516113 CET	80	49931	122.226.191.212	192.168.2.5
Dec 19, 2024 08:10:58.991645098 CET	49931	80	192.168.2.5	122.226.191.212
Dec 19, 2024 08:10:58.993473053 CET	49931	80	192.168.2.5	122.226.191.212
Dec 19, 2024 08:10:59.113164902 CET	80	49931	122.226.191.212	192.168.2.5
Dec 19, 2024 08:11:00.271002054 CET	2222	49925	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:00.271151066 CET	49925	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:00.271238089 CET	49925	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:00.390948057 CET	2222	49925	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:00.529135942 CET	80	49931	122.226.191.212	192.168.2.5
Dec 19, 2024 08:11:00.529932022 CET	49937	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:00.575031042 CET	49931	80	192.168.2.5	122.226.191.212
Dec 19, 2024 08:11:00.649509907 CET	2222	49937	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:00.649672985 CET	49937	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:00.649981976 CET	49937	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:00.769561052 CET	2222	49937	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:00.769701004 CET	49937	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:00.889385939 CET	2222	49937	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:01.049078941 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:01.059457064 CET	49757	1111	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:01.170470953 CET	80	49772	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:01.180047035 CET	1111	49757	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:01.293854952 CET	49772	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:01.294843912 CET	49931	80	192.168.2.5	122.226.191.212
Dec 19, 2024 08:11:01.414267063 CET	80	49931	122.226.191.212	192.168.2.5
Dec 19, 2024 08:11:01.637809038 CET	49757	1111	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:01.757635117 CET	1111	49757	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:01.757777929 CET	49757	1111	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:01.848136902 CET	80	49931	122.226.191.212	192.168.2.5
Dec 19, 2024 08:11:01.848700047 CET	49937	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:01.877767086 CET	1111	49757	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:01.903160095 CET	49931	80	192.168.2.5	122.226.191.212
Dec 19, 2024 08:11:01.968770027 CET	2222	49937	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:01.968838930 CET	49937	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:02.088602066 CET	2222	49937	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:04.073216915 CET	2222	49937	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:04.073364019 CET	49937	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:04.073462009 CET	49937	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:04.073981047 CET	49943	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:04.192871094 CET	2222	49937	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:04.193522930 CET	2222	49943	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:04.193609953 CET	49943	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:04.193972111 CET	49943	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:04.313523054 CET	2222	49943	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:04.313596010 CET	49943	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:04.433152914 CET	2222	49943	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:04.640177965 CET	49947	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:04.759821892 CET	80	49947	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:04.760093927 CET	49947	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:04.760202885 CET	49947	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:04.879646063 CET	80	49947	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:05.294507027 CET	49947	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:05.299588919 CET	49931	80	192.168.2.5	122.226.191.212
Dec 19, 2024 08:11:05.420042992 CET	80	49931	122.226.191.212	192.168.2.5
Dec 19, 2024 08:11:05.852078915 CET	80	49931	122.226.191.212	192.168.2.5
Dec 19, 2024 08:11:05.852514982 CET	49943	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:05.903162003 CET	49931	80	192.168.2.5	122.226.191.212
Dec 19, 2024 08:11:05.972079992 CET	2222	49943	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:05.972134113 CET	49943	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:06.091629028 CET	2222	49943	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:07.590677977 CET	2222	49943	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:07.590800047 CET	49943	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:07.590881109 CET	49943	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:07.591187954 CET	49955	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:07.710472107 CET	2222	49943	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:07.710695982 CET	2222	49955	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:07.710767984 CET	49955	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:07.711002111 CET	49955	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:07.830418110 CET	2222	49955	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:07.830472946 CET	49955	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:07.949959040 CET	2222	49955	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:08.075663090 CET	49956	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:08.373857975 CET	80	49956	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:08.373954058 CET	49956	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:08.374138117 CET	49956	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:08.493588924 CET	80	49956	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:09.293996096 CET	49956	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:09.295010090 CET	49931	80	192.168.2.5	122.226.191.212
Dec 19, 2024 08:11:09.414994955 CET	80	49931	122.226.191.212	192.168.2.5
Dec 19, 2024 08:11:09.848345041 CET	80	49931	122.226.191.212	192.168.2.5
Dec 19, 2024 08:11:09.848997116 CET	49955	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:09.903275013 CET	49931	80	192.168.2.5	122.226.191.212
Dec 19, 2024 08:11:09.968702078 CET	2222	49955	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:09.968791008 CET	49955	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:10.088670015 CET	2222	49955	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:11.130742073 CET	2222	49955	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:11.130855083 CET	49955	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:11.130958080 CET	49955	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:11.131242037 CET	49963	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:11.250478983 CET	2222	49955	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:11.250690937 CET	2222	49963	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:11.250762939 CET	49963	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:11.250961065 CET	49963	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:11.370820999 CET	2222	49963	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:11.370922089 CET	49963	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:11.490437031 CET	2222	49963	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:11.611821890 CET	49966	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:11.731334925 CET	80	49966	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:11.731456995 CET	49966	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:11.731646061 CET	49966	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:11.851891994 CET	80	49966	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:12.989423037 CET	80	49966	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:12.989839077 CET	49963	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:13.043768883 CET	49966	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:13.109941006 CET	2222	49963	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:13.110073090 CET	49963	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:13.229685068 CET	2222	49963	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:14.651066065 CET	2222	49963	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:14.651191950 CET	49963	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:14.651279926 CET	49963	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:14.651607037 CET	49972	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:14.770862103 CET	2222	49963	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:14.771179914 CET	2222	49972	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:14.771245956 CET	49972	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:14.771437883 CET	49972	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:14.890904903 CET	2222	49972	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:14.890966892 CET	49972	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:14.948231936 CET	49966	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:15.010432005 CET	2222	49972	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:15.067723989 CET	80	49966	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:15.454953909 CET	80	49966	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:15.455472946 CET	49972	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:15.496920109 CET	49966	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:15.575043917 CET	2222	49972	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:15.575130939 CET	49972	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:15.694719076 CET	2222	49972	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:18.174243927 CET	2222	49972	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:18.174367905 CET	49972	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:18.174446106 CET	49972	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:18.174770117 CET	49983	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:18.293926954 CET	2222	49972	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:18.294204950 CET	2222	49983	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:18.294306993 CET	49983	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:18.294523954 CET	49983	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:18.413944960 CET	2222	49983	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:18.414083004 CET	49983	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:18.533649921 CET	2222	49983	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:18.569248915 CET	49966	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:18.688747883 CET	80	49966	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:19.078119993 CET	80	49966	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:19.078660965 CET	49983	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:19.121973038 CET	49966	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:19.198196888 CET	2222	49983	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:19.198307037 CET	49983	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:19.317814112 CET	2222	49983	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:21.700474024 CET	2222	49983	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:21.700573921 CET	49983	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:21.700674057 CET	49983	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:21.700942039 CET	49991	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:21.821882010 CET	2222	49983	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:21.821898937 CET	2222	49991	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:21.822017908 CET	49991	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:21.822205067 CET	49991	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:21.941601992 CET	2222	49991	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:21.941725969 CET	49991	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:22.017446995 CET	49966	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:22.061172009 CET	2222	49991	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:22.136977911 CET	80	49966	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:22.511931896 CET	80	49966	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:22.512408018 CET	49991	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:22.559484005 CET	49966	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:22.631995916 CET	2222	49991	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:22.632110119 CET	49991	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:22.752451897 CET	2222	49991	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:25.240164042 CET	2222	49991	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:25.240281105 CET	49991	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:25.240360975 CET	49991	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:25.240659952 CET	50000	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:25.359816074 CET	2222	49991	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:25.360124111 CET	2222	50000	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:25.360203028 CET	50000	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:25.360382080 CET	50000	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:25.479911089 CET	2222	50000	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:25.480010033 CET	50000	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:25.599742889 CET	2222	50000	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:25.619628906 CET	49966	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:25.739156008 CET	80	49966	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:26.113868952 CET	80	49966	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:26.114455938 CET	50000	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:26.168853045 CET	49966	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:26.245129108 CET	2222	50000	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:26.245249033 CET	50000	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:26.364716053 CET	2222	50000	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:28.799896002 CET	2222	50000	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:28.799952984 CET	50000	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:28.800031900 CET	50000	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:28.800450087 CET	50009	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:28.919536114 CET	2222	50000	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:28.919900894 CET	2222	50009	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:28.920069933 CET	50009	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:28.920294046 CET	50009	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:29.039829969 CET	2222	50009	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:29.040138006 CET	50009	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:29.094314098 CET	49966	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:29.159760952 CET	2222	50009	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:29.213824987 CET	80	49966	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:29.293955088 CET	49966	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:29.294819117 CET	49931	80	192.168.2.5	122.226.191.212
Dec 19, 2024 08:11:29.414347887 CET	80	49931	122.226.191.212	192.168.2.5
Dec 19, 2024 08:11:29.889605999 CET	80	49931	122.226.191.212	192.168.2.5
Dec 19, 2024 08:11:29.890206099 CET	50009	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:29.934578896 CET	49931	80	192.168.2.5	122.226.191.212
Dec 19, 2024 08:11:30.009738922 CET	2222	50009	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:30.009819031 CET	50009	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:30.129323006 CET	2222	50009	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:32.351871967 CET	2222	50009	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:32.351977110 CET	50009	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:32.352024078 CET	50009	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:32.352281094 CET	50010	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:32.471520901 CET	2222	50009	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:32.471772909 CET	2222	50010	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:32.471868992 CET	50010	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:32.472019911 CET	50010	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:32.591393948 CET	2222	50010	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:32.591495037 CET	50010	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:32.643043041 CET	50011	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:32.710980892 CET	2222	50010	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:32.762587070 CET	80	50011	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:32.762676001 CET	50011	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:32.762868881 CET	50011	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:32.882307053 CET	80	50011	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:34.062380075 CET	80	50011	104.21.42.47	192.168.2.5
Dec 19, 2024 08:11:34.106364012 CET	50011	80	192.168.2.5	104.21.42.47
Dec 19, 2024 08:11:35.510400057 CET	50010	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:35.630042076 CET	2222	50010	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:35.630166054 CET	50010	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:35.749665976 CET	2222	50010	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:35.885374069 CET	2222	50010	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:35.885526896 CET	50010	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:36.041171074 CET	50010	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:36.041469097 CET	50012	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:36.161607027 CET	2222	50010	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:36.161922932 CET	2222	50012	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:36.162028074 CET	50012	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:36.162158012 CET	50012	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:36.281620026 CET	2222	50012	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:36.281733036 CET	50012	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:36.401328087 CET	2222	50012	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:39.583111048 CET	2222	50012	206.238.77.142	192.168.2.5
Dec 19, 2024 08:11:39.583251953 CET	50012	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:39.583303928 CET	50012	2222	192.168.2.5	206.238.77.142
Dec 19, 2024 08:11:39.702749968 CET	2222	50012	206.238.77.142	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 08:09:58.196500063 CET	54576	53	192.168.2.5	1.1.1.1
Dec 19, 2024 08:09:58.674978018 CET	53	54576	1.1.1.1	192.168.2.5
Dec 19, 2024 08:10:57.296947956 CET	59557	53	192.168.2.5	1.1.1.1
Dec 19, 2024 08:10:58.310949087 CET	59557	53	192.168.2.5	1.1.1.1
Dec 19, 2024 08:10:58.869010925 CET	53	59557	1.1.1.1	192.168.2.5
Dec 19, 2024 08:10:58.869055033 CET	53	59557	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 08:09:58.196500063 CET	192.168.2.5	1.1.1.1	0xfa93	Standard query (0)	4.ipw.cn	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:10:57.296947956 CET	192.168.2.5	1.1.1.1	0x8fc5	Standard query (0)	ifconfig.cc	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:10:58.310949087 CET	192.168.2.5	1.1.1.1	0x8fc5	Standard query (0)	ifconfig.cc	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 08:09:58.674978018 CET	1.1.1.1	192.168.2.5	0xfa93	No error (0)	4.ipw.cn	4.tcpdump.cn		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 08:09:58.674978018 CET	1.1.1.1	192.168.2.5	0xfa93	No error (0)	4.tcpdump.cn		104.21.42.47	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:09:58.674978018 CET	1.1.1.1	192.168.2.5	0xfa93	No error (0)	4.tcpdump.cn		172.67.156.54	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:10:58.869010925 CET	1.1.1.1	192.168.2.5	0x8fc5	No error (0)	ifconfig.cc	286f37a9.ifconfig.cc.cname.hcnamedns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 08:10:58.869010925 CET	1.1.1.1	192.168.2.5	0x8fc5	No error (0)	286f37a9.ifconfig.cc.cname.hcnamedns.com		122.226.191.212	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:10:58.869010925 CET	1.1.1.1	192.168.2.5	0x8fc5	No error (0)	286f37a9.ifconfig.cc.cname.hcnamedns.com		183.134.17.124	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:10:58.869010925 CET	1.1.1.1	192.168.2.5	0x8fc5	No error (0)	286f37a9.ifconfig.cc.cname.hcnamedns.com		183.134.17.27	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:10:58.869055033 CET	1.1.1.1	192.168.2.5	0x8fc5	No error (0)	ifconfig.cc	286f37a9.ifconfig.cc.cname.hcnamedns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 08:10:58.869055033 CET	1.1.1.1	192.168.2.5	0x8fc5	No error (0)	286f37a9.ifconfig.cc.cname.hcnamedns.com		122.226.191.212	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:10:58.869055033 CET	1.1.1.1	192.168.2.5	0x8fc5	No error (0)	286f37a9.ifconfig.cc.cname.hcnamedns.com		183.134.17.124	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:10:58.869055033 CET	1.1.1.1	192.168.2.5	0x8fc5	No error (0)	286f37a9.ifconfig.cc.cname.hcnamedns.com		183.134.17.27	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

4.ipw.cn

ifconfig.cc

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49771	104.21.42.47	80	1784	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:09:58.925787926 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:10:00.119376898 CET	867	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:09:59 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UYkY4nhzDDzOmry2Oi6zTNYvTA5H%2BDz0wXAucHLJ5VKi9DnPEdQG7Ha8QSSvY3GlgnMBFfzIDecP%2Fb%2FuJW6oYP4xG99uvBZ9CipEz9vUoTv1s%2BLe26OavxW%2B4w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f459200abca41d9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2026&min_rtt=2026&rtt_var=1013&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=83&delivery_rate=0&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:10:02.359489918 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:10:02.856461048 CET	870	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:10:02 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=37VmvXPbEgV3GOq6UWc%2BtBc6PRESlM6Ih5ktsDYrKfH5mYRDo341oiKAHB9MEZJZ%2BazfoGnNEFYK%2FxnhZMcLi6iTfadYW0Q42e6whfzpQIZ0KnQAqmUrIij3cg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f459211c91b41d9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3729&min_rtt=2026&rtt_var=4167&sent=3&recv=5&lost=0&retrans=0&sent_bytes=867&recv_bytes=166&delivery_rate=93249&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:10:07.728404999 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:10:08.214782953 CET	876	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:10:08 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XK2Utzq%2FP3MYBf%2BLZKU73NNqF8nYZ2li0UaBOFshqjEDRMPMeYOYsDSXsFEDSRknHnIXBGMqoKG5dJlXNCfspKDdaSrrJe%2BRD5CwZm8VcT5wZiK0zZr%2FjH%2B6xQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4592335ead41d9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4914&min_rtt=2026&rtt_var=5495&sent=5&recv=7&lost=0&retrans=0&sent_bytes=1737&recv_bytes=249&delivery_rate=110530&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:10:14.861768961 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:10:15.368319988 CET	878	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:10:15 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iua%2Fr2vrWTxE4Lq9M3qnMI6U3dj%2Ftvn%2BuAzWMdex51nQeF1Qynda1DKEoDhYy3Qm9wtyRuY9sQ4Xj%2FfuTe9ZfcgjwBqj17j54QtGjvxe%2BdOq1OGCfQthMI2T%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45925fed4141d9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6082&min_rtt=2026&rtt_var=6457&sent=7&recv=9&lost=0&retrans=0&sent_bytes=2613&recv_bytes=332&delivery_rate=110530&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:10:21.853686094 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:10:22.348196983 CET	875	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:10:22 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8x%2BFefBSucJjovwEld4kyllr5x%2FYL5sLyTWElrtyB%2Fy0P16FFI2cCU5aqbowK756vS6BULcYFRzxmt4RfQMZTQNHwm0sKlMMJPhSMubQHYSs0vewP1PoKOFu%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45928b9edb41d9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7442&min_rtt=2026&rtt_var=7562&sent=9&recv=11&lost=0&retrans=0&sent_bytes=3491&recv_bytes=415&delivery_rate=110530&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:10:28.999010086 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:10:29.502334118 CET	878	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:10:29 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O1TQOSUzt7LWhJ%2BruMH557zg%2FsB7IXKaCZB4ydjJyH6%2Fap9wiFIqLLPooanodbznEQrUD1lhBcDFL39oDycrHlCBEm6uV1gtrJ4N%2BaqOL%2FXIuFEIgo8BoeaWWg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4592b8485f41d9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9222&min_rtt=2026&rtt_var=9233&sent=11&recv=13&lost=0&retrans=0&sent_bytes=4366&recv_bytes=498&delivery_rate=110530&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:10:36.087780952 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:10:36.583295107 CET	870	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:10:36 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nOPIyYkJhtfTtAWR3UjQEBVm8vLW6sr4EMUUO9jOy2PLDwEOKGveIzX9GOWHI71NGv8IQjn5UPASer9LOnLRRKFjYOVYmD55buuNk1V1ZopmjhC0wtYGfHb31A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4592e4884a41d9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=11321&min_rtt=2026&rtt_var=11121&sent=13&recv=15&lost=0&retrans=0&sent_bytes=5244&recv_bytes=581&delivery_rate=110530&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:10:43.119726896 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:10:43.613964081 CET	876	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:10:43 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cpy6JgvVyCr6GQFU4I1jPmcM6UFpz%2FiyPEKxUZqTE3GHCctWl7WBdYmZOYxr0zwAZ26MZYZCM14CtAKTw5EnCLtzDBozYdaS1Ko%2F9vkiPSBpRP34fOE60%2FmkeQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4593108e5041d9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=12700&min_rtt=2026&rtt_var=11100&sent=15&recv=17&lost=0&retrans=0&sent_bytes=6114&recv_bytes=664&delivery_rate=110530&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:10:50.198714972 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:10:50.702821016 CET	880	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:10:50 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZthPQ0V69j445g%2BPaI6lfpm%2B0CQnyfRxy%2B%2BYP3hCFwnBj120vkmwjJVFrcx7IUic4YCu8rErFUOswR3d1IRQnzfKdRwHmLpHpm%2FvmDRZYMOp8WOPZbaekAtdxg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45933ccba341d9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13874&min_rtt=2026&rtt_var=10673&sent=17&recv=19&lost=0&retrans=0&sent_bytes=6990&recv_bytes=747&delivery_rate=110530&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:10:57.243702888 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49772	104.21.42.47	80	1784	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:09:58.950890064 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:10:00.162676096 CET	870	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:10:00 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e4Vl%2FwLZGrkBI%2BeUKWn%2BlWvowyduwLjBWoco%2Bra56MUqQ1YxLYi0JMM2J%2B23tNFD1fUVCGfrb87B%2FGVnaQNu77bIsH2wWQ8Cqe3Cy0TBnSOv15GJulsX%2FJ0OAg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f459200db6b42cc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1573&min_rtt=1573&rtt_var=786&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=83&delivery_rate=0&cwnd=167&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:10:04.722996950 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:10:05.227884054 CET	871	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:10:05 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fmOyQ%2FHQwPZ26CDbVAesYRuPSk2KctZ6lQDvxXcCLJWU%2F5QQZKFwJVGdZkMfAMTxSILAVJKS76P2ozsKMeKN9BrEoPjr5GsoFSr%2BFHqyKSDxjTodHVkIxHbj1w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4592208d0a42cc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7624&min_rtt=1573&rtt_var=12692&sent=3&recv=5&lost=0&retrans=0&sent_bytes=870&recv_bytes=166&delivery_rate=29209&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:10:11.522144079 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:10:12.013550997 CET	869	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:10:11 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oca6zypTmxKrIyIA9l9bAMf0Lj137UHB4P8YWp94DLY365roK%2FaDNxmSF2KUS45u3PsGk8CQtndtTFbm7szsGPgTeKdp6mlAjiaxUJEFqza9XFpGiEJpQCAFvg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45924b0afd42cc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=12570&min_rtt=1573&rtt_var=19411&sent=5&recv=7&lost=0&retrans=0&sent_bytes=1741&recv_bytes=249&delivery_rate=30939&cwnd=169&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:10:18.480043888 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:10:18.985959053 CET	877	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:10:18 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3hz5AGLbDHIVKZXVraH27zr4H6sCD8WvuwHLsKI%2BK8IEECXefWcoljHKC5V4kL0v8MfI6Ffs6jMfOJOz68C5%2FoK0KZjESPIbKeFw%2FjFOg%2F2ieG1SlPB3QDCU5Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45927688d842cc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=11196&min_rtt=1551&rtt_var=17305&sent=8&recv=9&lost=0&retrans=0&sent_bytes=2610&recv_bytes=332&delivery_rate=1846932&cwnd=171&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:10:25.493524075 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:10:26.000999928 CET	877	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:10:25 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yuhe9X59cRpddksYpyiUPH8Sm4kwwV8BMIF29Mcwc2ya76LiCizrx%2BroyHkyHUun4ddE9HcGhxB85%2BSwXOq%2FwInRjJO8yjvjAPFWhdNc6y5uKpTBxl77ZDvljw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4592a25c1642cc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=16714&min_rtt=1551&rtt_var=24015&sent=10&recv=11&lost=0&retrans=0&sent_bytes=3487&recv_bytes=415&delivery_rate=1846932&cwnd=172&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:10:32.524966955 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:10:33.032080889 CET	883	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:10:32 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pMPOujHtViLEBS2lzf4dN%2B16SReI5jE3efhiXTT6DRQNxFY36UOo%2BPsWzGrt75g%2FKimQ%2BRjPjeQ84%2FJoNCfFeo8ieXshZiR8D4gITSdiJqMDrAubh%2FYdwtbkWw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4592ce4d7742cc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=21605&min_rtt=1551&rtt_var=27794&sent=12&recv=13&lost=0&retrans=0&sent_bytes=4364&recv_bytes=498&delivery_rate=1846932&cwnd=173&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:10:39.533737898 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:10:40.027842999 CET	879	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:10:39 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4IDOPF9Nmf2LZRaKRMCTY%2Bc6NJ8Z%2FCD6TON5DXUdijilmW9%2BubGyAvhSb%2BHpEfbJu0Eq6SwlHX3ltQqAXkVEjdrJEwrJkUw0KT69jI6ee4BVGugX6MYt5vdDYA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4592fa1f5b42cc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=25931&min_rtt=1551&rtt_var=29496&sent=14&recv=15&lost=0&retrans=0&sent_bytes=5247&recv_bytes=581&delivery_rate=1846932&cwnd=174&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:10:46.762511969 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:10:47.254827023 CET	875	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:10:47 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ADE7O88h36YblLOZ4go21QT3qqpCSbb92cPxC41byZFb7I2NecUnR4%2FEd1%2Fif5MCGUfAxishcDuL6Vtdbvws9eMq05ySrNoxBN7OxmgRNHc3gg8tOLzv3bHeew%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4593274a0c42cc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=28316&min_rtt=1551&rtt_var=26892&sent=16&recv=17&lost=0&retrans=0&sent_bytes=6126&recv_bytes=664&delivery_rate=1846932&cwnd=175&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:10:53.686009884 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:10:54.194869995 CET	875	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:10:54 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8PRWHKv1Xlb9G7oKs9EZa7yMXfuNiul%2FG%2BBkJqrpDa386w2IpLM0gN3JZ7LEU0MKBHIYkwMSy79v1WebUnsqER2Ja6e50c6qdD2ErRyYyVJWjDHbroZrvuvvrg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4593528ba942cc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=31346&min_rtt=1551&rtt_var=26229&sent=18&recv=19&lost=0&retrans=0&sent_bytes=7001&recv_bytes=747&delivery_rate=1846932&cwnd=175&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:11:01.049078941 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49931	122.226.191.212	80	1784	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:10:58.993473053 CET	86	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: ifconfig.cc
Dec 19, 2024 08:11:00.529135942 CET	866	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:10:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: http_waf_cookie=695dd774-b5c5-43027384467a05de4744e7dda4a7581704d4; Expires=1734599455; Path=/; HttpOnly Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000;includeSubdomains;preload Web-Server: QC-BJ-QL03 Server: WAF Set-Cookie: sl-session=yMifWIQYZWeql1bTCWzIBA==; Path=/; Max-Age=86400; HttpOnly Set-Cookie: bc_bot_session=1734592255f30c26aaaf2e157f; Max-Age=3600; Domain=ifconfig.cc; Path=/; SameSite=Lax Set-Cookie: bc_bot_token=; Max-Age=0; Domain=ifconfig.cc; Path=/; SameSite=Lax Set-Cookie: bc_bot_rules=; Max-Age=0; Domain=ifconfig.cc; Path=/; SameSite=Lax X-Request-Id: 1d426d3718117c46e1b6fa16abac869d X-Cache: BYPASS Data Raw: 63 0d 0a 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a 30 0d 0a 0d 0a Data Ascii: c8.46.123.1890
Dec 19, 2024 08:11:01.294843912 CET	86	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: ifconfig.cc
Dec 19, 2024 08:11:01.848136902 CET	866	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:10:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: http_waf_cookie=ee506912-b49f-437811b53bb9bf6698f04a6f5dc9230f37e9; Expires=1734599457; Path=/; HttpOnly Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000;includeSubdomains;preload Web-Server: QC-BJ-QL03 Server: WAF Set-Cookie: sl-session=ANj3MIUYZWeEHHcjJ6yyvQ==; Path=/; Max-Age=86400; HttpOnly Set-Cookie: bc_bot_session=1734592257ea203cbee8f654f1; Max-Age=3600; Domain=ifconfig.cc; Path=/; SameSite=Lax Set-Cookie: bc_bot_token=; Max-Age=0; Domain=ifconfig.cc; Path=/; SameSite=Lax Set-Cookie: bc_bot_rules=; Max-Age=0; Domain=ifconfig.cc; Path=/; SameSite=Lax X-Request-Id: 4ed0956190a4ca510a2b3320ff97e765 X-Cache: BYPASS Data Raw: 63 0d 0a 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a 30 0d 0a 0d 0a Data Ascii: c8.46.123.1890
Dec 19, 2024 08:11:05.299588919 CET	86	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: ifconfig.cc
Dec 19, 2024 08:11:05.852078915 CET	866	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:11:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: http_waf_cookie=863ed349-123d-4504343d64d05ab929b51a41cc234c53370b; Expires=1734599461; Path=/; HttpOnly Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000;includeSubdomains;preload Web-Server: QC-BJ-QL03 Server: WAF Set-Cookie: sl-session=V2m+CokYZWed1f1vAZ07Fg==; Path=/; Max-Age=86400; HttpOnly Set-Cookie: bc_bot_session=173459226106e742ded5df2fb3; Max-Age=3600; Domain=ifconfig.cc; Path=/; SameSite=Lax Set-Cookie: bc_bot_token=; Max-Age=0; Domain=ifconfig.cc; Path=/; SameSite=Lax Set-Cookie: bc_bot_rules=; Max-Age=0; Domain=ifconfig.cc; Path=/; SameSite=Lax X-Request-Id: 886ae38966b7b013fee00b8a78d47650 X-Cache: BYPASS Data Raw: 63 0d 0a 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a 30 0d 0a 0d 0a Data Ascii: c8.46.123.1890
Dec 19, 2024 08:11:09.295010090 CET	86	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: ifconfig.cc
Dec 19, 2024 08:11:09.848345041 CET	866	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:11:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: http_waf_cookie=6622b4f8-a7a9-49bf5c72fac2925f4ef558527ad2e508ddb0; Expires=1734599465; Path=/; HttpOnly Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000;includeSubdomains;preload Web-Server: QC-BJ-QL03 Server: WAF Set-Cookie: sl-session=e0r1CI0YZWd5W3faapojww==; Path=/; Max-Age=86400; HttpOnly Set-Cookie: bc_bot_session=173459226591348cf4e88a8b87; Max-Age=3600; Domain=ifconfig.cc; Path=/; SameSite=Lax Set-Cookie: bc_bot_token=; Max-Age=0; Domain=ifconfig.cc; Path=/; SameSite=Lax Set-Cookie: bc_bot_rules=; Max-Age=0; Domain=ifconfig.cc; Path=/; SameSite=Lax X-Request-Id: 8aadebaf5d1d4813ef9e20e230ceab90 X-Cache: BYPASS Data Raw: 63 0d 0a 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a 30 0d 0a 0d 0a Data Ascii: c8.46.123.1890
Dec 19, 2024 08:11:29.294819117 CET	86	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: ifconfig.cc
Dec 19, 2024 08:11:29.889605999 CET	866	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:11:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: http_waf_cookie=128affdd-22bf-43a2a4d7e19a71961288db2611ca7bc59f20; Expires=1734599485; Path=/; HttpOnly Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000;includeSubdomains;preload Web-Server: QC-BJ-QL03 Server: WAF Set-Cookie: sl-session=odY5SaEYZWfT92HB9ldVBQ==; Path=/; Max-Age=86400; HttpOnly Set-Cookie: bc_bot_session=1734592285cad3338d4253610a; Max-Age=3600; Domain=ifconfig.cc; Path=/; SameSite=Lax Set-Cookie: bc_bot_token=; Max-Age=0; Domain=ifconfig.cc; Path=/; SameSite=Lax Set-Cookie: bc_bot_rules=; Max-Age=0; Domain=ifconfig.cc; Path=/; SameSite=Lax X-Request-Id: cd3df165ca78a2f0b32161ae1c381453 X-Cache: BYPASS Data Raw: 63 0d 0a 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a 30 0d 0a 0d 0a Data Ascii: c8.46.123.1890

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49947	104.21.42.47	80	1784	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:11:04.760202885 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49956	104.21.42.47	80	1784	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:11:08.374138117 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49966	104.21.42.47	80	1784	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:11:11.731646061 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:11:12.989423037 CET	864	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:11:12 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6H%2B2rKB6eVUb3XZMS5qBH04fFGfOiShvn0y%2B0gSji4H1Z3KVNyk3ZgYgcRRk7THeOwySuRIpUj2wAAocwWiQhRhlq%2F7u3a4bJj%2BJIjsJ7NYkAYDrX6BVJozj8Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4593c82a6b4251-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1598&min_rtt=1598&rtt_var=799&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=83&delivery_rate=0&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:11:14.948231936 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:11:15.454953909 CET	880	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:11:15 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BN5JWNVWACb%2F%2FdoTqNv012Nz%2FzeDSbkPLe%2FWdq6Sf%2Bmgi5ueDJq%2F2UL6jaxsD%2FZEACDNr5iF1mKs7i3IqRASTfmzsfmnLRzaK%2BaC1B7eoguwRLG3eiN2pA2vnw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4593d76f454251-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4132&min_rtt=1598&rtt_var=5668&sent=3&recv=5&lost=0&retrans=0&sent_bytes=864&recv_bytes=166&delivery_rate=66748&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:11:18.569248915 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:11:19.078119993 CET	877	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:11:18 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rFfSQRId%2BFyNUizarg2AXEsJ%2B5a%2FtQNwFlK5P%2FPDPJCglrppwvxQ3H%2FQ19U8yE4tyPFu1KgjDo9FF9c2s7O%2BKKZnIDv58UcOLxsLB5qNlxjesCh30zeNqQqR5Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4593ee1fde4251-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6730&min_rtt=1598&rtt_var=9447&sent=5&recv=7&lost=0&retrans=0&sent_bytes=1744&recv_bytes=249&delivery_rate=66748&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:11:22.017446995 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:11:22.511931896 CET	872	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:11:22 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OP13%2FxThhzB5MEBaj2Qkq3PSzawNkaPd1CfkpJ6NoNg97vWJ8LnhIzmIdcK0AZ2H8gNNpbfxq1%2FzYyxEFX9Q02oCoZp2aXtTvVD74IxCLl%2BHMMRvGO4MNTFmzA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45940398114251-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7300&min_rtt=1598&rtt_var=8225&sent=7&recv=9&lost=0&retrans=0&sent_bytes=2621&recv_bytes=332&delivery_rate=129329&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:11:25.619628906 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:11:26.113868952 CET	879	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:11:25 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GA%2Fdp54IkPAwMZ8pnjulWVJc6SWtXKQ3fP9BfO7j4rgzg148drpAXmFtpbBIHd%2FZAtPsNiI957bQs%2Ft0F%2Fgb2D802zywG5r%2FGQiopbOSdIErNEfgk%2F23mv2oaA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45941a29f64251-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8262&min_rtt=1598&rtt_var=8093&sent=9&recv=11&lost=0&retrans=0&sent_bytes=3493&recv_bytes=415&delivery_rate=129329&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189
Dec 19, 2024 08:11:29.094314098 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	50011	104.21.42.47	80	1784	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:11:32.762868881 CET	83	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.83.1 Host: 4.ipw.cn
Dec 19, 2024 08:11:34.062380075 CET	861	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:11:33 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://ipw.cn strict-transport-security: max-age=16070400;preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ATBh5oSmGNUiDWiw9STGt1JWLenjl4TgY990ojI8Dg5GNy1XnRfoP7NlUhV6eaRxPb%2BDNhorTozbewE10O3aYsKq3%2FovqWS8ehrqekUVdQmesLkHZ9WKrnZdXA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45944b98ad4313-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2473&min_rtt=2473&rtt_var=1236&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=83&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	02:08:26
Start date:	19/12/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll"
Imagebase:	0x4c0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	02:08:26
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	02:08:26
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",#1
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:08:26
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\c2A6GRyAwn.dll,cef_add_cross_origin_whitelist_entry
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000003.00000002.3052963500.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:08:26
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",#1
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000004.00000002.3008266392.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:08:29
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\c2A6GRyAwn.dll,cef_add_web_plugin_directory
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000006.00000002.3054985603.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:08:33
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\c2A6GRyAwn.dll,cef_add_web_plugin_path
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	02:08:33
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic cpu get processorid
Imagebase:	0x430000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:08:33
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:08:33
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic cpu get processorid
Imagebase:	0x430000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:08:33
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:08:37
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic cpu get processorid
Imagebase:	0x430000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:08:37
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:08:37
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_add_cross_origin_whitelist_entry
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000000E.00000002.3013317433.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:08:37
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_add_web_plugin_directory
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000000F.00000002.3008220827.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000000F.00000002.3007932543.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:08:37
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_add_web_plugin_path
Imagebase:	0x7ff6d64d0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000010.00000002.3016124444.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000010.00000002.3017577594.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:08:37
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",create_context_shared
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000011.00000002.3038214334.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000011.00000002.3040921469.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:08:37
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_zip_reader_create
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000012.00000002.2994205386.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000012.00000002.2994516394.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:08:37
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_zip_directory
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000013.00000002.3010385963.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000013.00000002.3010015146.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	02:08:37
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_write_json
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000014.00000002.2997697072.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000014.00000002.2996930195.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	02:08:37
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_window_create_top_level
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000015.00000002.3048776239.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000015.00000002.3045928626.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	02:08:37
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_visit_web_plugin_info
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000016.00000002.3049878489.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000016.00000002.3047426962.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_value_create
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000017.00000002.3047870662.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000017.00000002.3050280645.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_undefined
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000018.00000002.3041645495.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000018.00000002.3039178109.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_uint
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000019.00000002.3036054251.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000019.00000002.3036809299.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_string
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000001A.00000002.3028669862.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000001A.00000002.3028319982.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_object
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000001B.00000002.3018050041.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000001B.00000002.3016390156.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_null
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000001C.00000002.3036458003.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000001C.00000002.3036956799.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_int
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000001D.00000002.3046146995.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000001D.00000002.3048956174.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_function
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000001E.00000002.3014122900.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000001E.00000002.3015022254.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_double
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000001F.00000002.3017796393.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000001F.00000002.3016249210.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_date
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000020.00000002.3045577027.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000020.00000002.3043417699.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_bool
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000021.00000002.3049295552.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000021.00000002.3046734441.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_array_buffer
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000022.00000002.3014901718.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000022.00000002.3014058075.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8value_create_array
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000023.00000002.3043543087.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000023.00000002.3045748192.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8stack_trace_get_current
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000024.00000002.3045374022.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000024.00000002.3047877855.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8context_in_context
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000025.00000002.3036735360.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000025.00000002.3034740174.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8context_get_entered_context
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000026.00000002.3043646710.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000026.00000002.3045848548.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_v8context_get_current_context
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000027.00000002.3043643127.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000027.00000002.3045790077.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_urlrequest_create
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000028.00000002.3039825345.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000028.00000002.3036392206.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_uriencode
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000029.00000002.3028907198.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000029.00000002.3028489885.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_uridecode
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000002A.00000002.3051527334.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000002A.00000002.3048737599.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_unregister_internal_web_plugin
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000002B.00000002.3037447093.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000002B.00000002.3037998868.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	02:08:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\c2A6GRyAwn.dll",cef_time_to_timet
Imagebase:	0xbb0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000002C.00000002.3045359153.0000000010037000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 0000002C.00000002.3047979874.000000006C9C3000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.5%
Total number of Nodes:	27
Total number of Limit Nodes:	0

Executed Functions

Function 00F90A09 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 178nativememorywindowCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(-00000001,00000022,00F926FB,00000004,00000000), ref: 00F90A8A
NtSetInformationProcess.NTDLL(-00000001,00000022,?,00000004,00F909F7,0000005D), ref: 00F90AAA
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000004,00F909F7,0000005D), ref: 00F90ACC
wsprintfA.USER32(?,?,?,?), ref: 00F90B74
MessageBoxA.USER32(00000000,?,?,00000010), ref: 00F90B8C

Strings

SWVU, xrefs: 00F90A79, 00F90AD8, 00F90AEC, 00F90AF2, 00F90AF8, 00F90B15, 00F90BC8
Application error, xrefs: 00F90B88
The procedure %s could not be located in the DLL %s., xrefs: 00F90B6C

Memory Dump Source

Source File: 00000000.00000003.2205251796.0000000000F90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_f90000_loaddll32.jbxd

Similarity

API ID: InformationProcess$AllocMessageQueryVirtualwsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 2902211186-4283279704
Opcode ID: de0e8ee88c8a98f7b8a38ace4394a491acda8513ba92f7ded7199e416edf0d91
Instruction ID: 39dd9ca80b64c25a3632b8d1d06f8bfad3ae38926f0c3d3490264114ad43e1be
Opcode Fuzzy Hash: de0e8ee88c8a98f7b8a38ace4394a491acda8513ba92f7ded7199e416edf0d91
Instruction Fuzzy Hash: 0841BA72A01746AFEB359F24CC59FAB73A8EF44790F004528EE0697284DFB4AD10DB90

Function 00F90A95 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140memorynativewindowCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL(-00000001,00000022,?,00000004,00F909F7,0000005D), ref: 00F90AAA
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000004,00F909F7,0000005D), ref: 00F90ACC
wsprintfA.USER32(?,?,?,?), ref: 00F90B74
MessageBoxA.USER32(00000000,?,?,00000010), ref: 00F90B8C
ExitProcess.KERNEL32(00000000), ref: 00F90B94
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 00F90BE7

Strings

SWVU, xrefs: 00F90AD8, 00F90AEC, 00F90AF2, 00F90AF8, 00F90B15, 00F90BC8
Application error, xrefs: 00F90B88
The procedure %s could not be located in the DLL %s., xrefs: 00F90B6C

Memory Dump Source

Source File: 00000000.00000003.2205251796.0000000000F90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_f90000_loaddll32.jbxd

Similarity

API ID: ProcessVirtual$AllocExitFreeInformationMessagewsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 2788668848-4283279704
Opcode ID: f644d6bb55c65f053268db4f25cec8320b3bbf1d1d06db4825fff5ba47126e3b
Instruction ID: d41375b8f630b8f1daa07b94e8acfb437f6fd2a4b9d87f4b91e57e3a59c4f9bc
Opcode Fuzzy Hash: f644d6bb55c65f053268db4f25cec8320b3bbf1d1d06db4825fff5ba47126e3b
Instruction Fuzzy Hash: C331AA71641386AFEF399F20CC59FEB37A8EF44795F004129FE42C6285DE74A9109A60

Function 00F913BF Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,00001000,00000004,?,?), ref: 00F913EA
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 00F91403

Memory Dump Source

Source File: 00000000.00000003.2205251796.0000000000F90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_f90000_loaddll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 460e07aa1c6cfb092b5f976fa85d581fca477865be9a128e2591be7121e923ca
Instruction ID: b1d429a417b6c49ed05833987fabd77db929dafd5a81931b874044704500e5e3
Opcode Fuzzy Hash: 460e07aa1c6cfb092b5f976fa85d581fca477865be9a128e2591be7121e923ca
Instruction Fuzzy Hash: 74F08276200305AFDB19CF40C844FEA7779EB48391F104176EA42AB684C670F5148B10

Function 00F9082D Relevance: 2.6, APIs: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,-00000436,00001000,00000004), ref: 00F9087D
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00F908A9

Memory Dump Source

Source File: 00000000.00000003.2205251796.0000000000F90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_f90000_loaddll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7e515f7c385f7f07b94d9a5cb9b23266753d833ffbaa65bc10218dcc86593253
Instruction ID: b4e0170a658b6955a7bdb579520421f22f093817cd2c5495ebb7271aeb2cb413
Opcode Fuzzy Hash: 7e515f7c385f7f07b94d9a5cb9b23266753d833ffbaa65bc10218dcc86593253
Instruction Fuzzy Hash: 51018471A01114BBEB04CE99CC41FAEB7B9EBC8760F14C16AF61897385D678AD10CBA0

Non-executed Functions

Function 00F90C05 Relevance: 3.0, APIs: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00F90C14
GetProcAddress.KERNEL32(?,00000000), ref: 00F90C36

Memory Dump Source

Source File: 00000000.00000003.2205251796.0000000000F90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_f90000_loaddll32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 9efb803a854c71129ffb3ca0e189a60f352970df9509727b32eae53798b321fd
Instruction ID: fadeddaa0ed0e876b0a5324d61d01f0700a181dbc6993c46e2c89b9339e278c9
Opcode Fuzzy Hash: 9efb803a854c71129ffb3ca0e189a60f352970df9509727b32eae53798b321fd
Instruction Fuzzy Hash: BDF0E273A00100DFDB10CF18CDC069AB3B5FF903A53298939D84697704DA35FE459A10

Function 6C925420 Relevance: 3.0, APIs: 2, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,6C917EC1,?,00000017), ref: 6C925425
UnhandledExceptionFilter.KERNEL32(6C917EC1,?,6C917EC1,?,00000017), ref: 6C92542F

Memory Dump Source

Source File: 00000000.00000002.3972676804.000000006C681000.00000040.00000001.01000000.00000003.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.3972641799.000000006C680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3972676804.000000006C9C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3972676804.000000006CBAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3972676804.000000006CBB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3972676804.000000006CBB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3973179913.000000006CC55000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b3d4745fcf7748c4fb09b18705affbad89d2570ed4fdf24ada0852c9a31cb530
Instruction ID: fe18701f4d58c0ab72e89341deba62188aa8000ccb9ca15fd68843fcac929d2f
Opcode Fuzzy Hash: b3d4745fcf7748c4fb09b18705affbad89d2570ed4fdf24ada0852c9a31cb530
Instruction Fuzzy Hash: A2C09B35688249A7DF005BD6D54DB553BFCE705655F111004F50E86180C671B5004699

Function 6C917EA0 Relevance: 1.5, APIs: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,6C917FEE,6C9968D0,00000017), ref: 6C917EA3

Part of subcall function 6C925420: SetUnhandledExceptionFilter.KERNEL32(00000000,?,6C917EC1,?,00000017), ref: 6C925425
Part of subcall function 6C925420: UnhandledExceptionFilter.KERNEL32(6C917EC1,?,6C917EC1,?,00000017), ref: 6C92542F

Memory Dump Source

Source File: 00000000.00000002.3972676804.000000006C681000.00000040.00000001.01000000.00000003.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.3972641799.000000006C680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3972676804.000000006C9C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3972676804.000000006CBAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3972676804.000000006CBB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3972676804.000000006CBB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3973179913.000000006CC55000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a1902c1bac7503f64f9d6d5de14bfe02bcf2d2a5204357d81e098ee7286517f1
Instruction ID: 2af90933ebe1fd811e78808ba23b5debdf773cf937d0cac2745bf2c2e13a90c3
Opcode Fuzzy Hash: a1902c1bac7503f64f9d6d5de14bfe02bcf2d2a5204357d81e098ee7286517f1
Instruction Fuzzy Hash: 37E086F6D512445BFB045750F802BB53164473030CF440031EA4E86F46FAB5F958829B

Function 00F9000D Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2205251796.0000000000F90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_f90000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e99a0a01e1d4bce046b1382b355e78901f4974a24da72b781af35e7c32559e
Instruction ID: a2a5737b2e81f8abf1b5f56a0b1d622870d0f85f969613e34da87eacc98ab2b9
Opcode Fuzzy Hash: 91e99a0a01e1d4bce046b1382b355e78901f4974a24da72b781af35e7c32559e
Instruction Fuzzy Hash: FB42B873E041158FDF09CE69C8942ADBBB2FFD4350F2A826AD8599B344DA709A45CF90

Analysis Process: rundll32.exePID: 1224, Parent PID: 180COMMON

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	98.5%
Signature Coverage:	16.4%
Total number of Nodes:	457
Total number of Limit Nodes:	8

Executed Functions

Function 10013A20 Relevance: 50.9, APIs: 17, Strings: 12, Instructions: 185
filesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 10013A60
swprintf.LIBCMT ref: 10013A86
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 10013A99
GetLastError.KERNEL32 ref: 10013AA5

Part of subcall function 10022BD3: _doexit.LIBCMT ref: 10022BDD

Part of subcall function 100138F0: _memset.LIBCMT ref: 10013918
Part of subcall function 100138F0: RegOpenKeyExA.ADVAPI32(80000001,101AFE40,00000000,00020006,?), ref: 10013944
Part of subcall function 100138F0: _sprintf.LIBCMT ref: 1001397C
Part of subcall function 100138F0: _strlen.LIBCMT ref: 1001398B
Part of subcall function 100138F0: RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,?), ref: 100139D7
Part of subcall function 100138F0: RegCloseKey.ADVAPI32(?), ref: 100139EA

IsUserAnAdmin.SHELL32 ref: 10013AC2
ReleaseMutex.KERNEL32(00000000), ref: 10013ADC
_memset.LIBCMT ref: 10013B1C
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 10013B32
_sprintf.LIBCMT ref: 10013B4E
DeleteFileA.KERNEL32(?), ref: 10013B5D
MoveFileA.KERNEL32(?,?), ref: 10013B71
_wprintf.LIBCMT ref: 10013CAC
_strlen.LIBCMT ref: 10013CB9

Strings

EnOperationMode Error !, xrefs: 10013CA7
C:\Users\Public\Documents\, xrefs: 10013B3D
206.238.77.142, xrefs: 10013CB4, 10013CDA
%s:%hd, xrefs: 10013A75
Windows Update, xrefs: 10013B38, 10013C04
206.238.77.142, xrefs: 10013A70, 10013CF1
Eaiawk mgqwgoywasgymoeeuu, xrefs: 10013C75
service_is_exist !, xrefs: 10013C24
Yyickg caosusmk, xrefs: 10013C7A
RunService !, xrefs: 10013C68
TMzsft xtnogaqk, xrefs: 10013C31, 10013C5F, 10013C7F
%s%s, xrefs: 10013B42

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File_memset$Mutex_sprintf_strlen$AdminCloseCreateDeleteErrorLastModuleMoveNameOpenReleaseUserValue_doexit_wprintfswprintf
String ID: %s%s$%s:%hd$206.238.77.142$206.238.77.142$C:\Users\Public\Documents\$Eaiawk mgqwgoywasgymoeeuu$EnOperationMode Error !$RunService !$TMzsft xtnogaqk$Windows Update$Yyickg caosusmk$service_is_exist !
API String ID: 2228167989-1563067711
Opcode ID: 2fc02c7820abb1e6e7b02b1e9042d30205a633eb3f33f25fe0a671c5299acd93
Instruction ID: 8ce7a2c48d05da8e1d18419a98124d55002a878a035d7289134c72219816da3c
Opcode Fuzzy Hash: 2fc02c7820abb1e6e7b02b1e9042d30205a633eb3f33f25fe0a671c5299acd93
Instruction Fuzzy Hash: CB61ECB5944314AAE721D7A08C87BE977B8EF00741F804099F6496D5D3EB78DAC4CBA2

Function 1000D890 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 142
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000), ref: 1000D8B6
GetLastError.KERNEL32 ref: 1000D8C0
CryptCreateHash.ADVAPI32(00000000,00000000,00000000,00000000,?), ref: 1000D8E1
GetLastError.KERNEL32 ref: 1000D8EB
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 1000D8FA

Strings

%02X, xrefs: 1000D9C8

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorLast$AcquireCreateHashRelease
String ID: %02X
API String ID: 4104741015-436463671
Opcode ID: 783f6aeacaf77bddf85f865987ab6f2245b3743a8a3a9c8136557c6450919572
Instruction ID: e6624ba5d8ed9705aec1f79a9e38e76f649a0541b50efeb1c6887bd17401cf19
Opcode Fuzzy Hash: 783f6aeacaf77bddf85f865987ab6f2245b3743a8a3a9c8136557c6450919572
Instruction Fuzzy Hash: AE51C5B5A00219EFEB14DFA4CC85BEEB7B4FB48300F108559FA15AB295D778A940CF61

Function 02BF0A09 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 178nativememorywindowCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(-00000001,00000022,02BF26FB,00000004,00000000), ref: 02BF0A8A
NtSetInformationProcess.NTDLL(-00000001,00000022,?,00000004,02BF09F7,0000005D), ref: 02BF0AAA
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000004,02BF09F7,0000005D), ref: 02BF0ACC
wsprintfA.USER32(?,?,?,?), ref: 02BF0B74
MessageBoxA.USER32(00000000,?,?,00000010), ref: 02BF0B8C

Strings

Application error, xrefs: 02BF0B88
SWVU, xrefs: 02BF0A79, 02BF0AD8, 02BF0AEC, 02BF0AF2, 02BF0AF8, 02BF0B15, 02BF0BC8
The procedure %s could not be located in the DLL %s., xrefs: 02BF0B6C

Memory Dump Source

Source File: 00000003.00000003.2102313199.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_2bf0000_rundll32.jbxd

Similarity

API ID: InformationProcess$AllocMessageQueryVirtualwsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 2902211186-4283279704
Opcode ID: de0e8ee88c8a98f7b8a38ace4394a491acda8513ba92f7ded7199e416edf0d91
Instruction ID: 2e6d7425ae93ecafcc842582dcc318958a638f2a6041f4fad5f628471efc4e3f
Opcode Fuzzy Hash: de0e8ee88c8a98f7b8a38ace4394a491acda8513ba92f7ded7199e416edf0d91
Instruction Fuzzy Hash: 97410372601746AFEB75EF24CC44FAB73A8EF04784F004968EF0597289EB70A918CB50

Function 02BF0A95 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140memorynativewindowCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL(-00000001,00000022,?,00000004,02BF09F7,0000005D), ref: 02BF0AAA
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000004,02BF09F7,0000005D), ref: 02BF0ACC
wsprintfA.USER32(?,?,?,?), ref: 02BF0B74
MessageBoxA.USER32(00000000,?,?,00000010), ref: 02BF0B8C
ExitProcess.KERNEL32(00000000), ref: 02BF0B94
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 02BF0BE7

Strings

Application error, xrefs: 02BF0B88
SWVU, xrefs: 02BF0AD8, 02BF0AEC, 02BF0AF2, 02BF0AF8, 02BF0B15, 02BF0BC8
The procedure %s could not be located in the DLL %s., xrefs: 02BF0B6C

Memory Dump Source

Source File: 00000003.00000003.2102313199.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_2bf0000_rundll32.jbxd

Similarity

API ID: ProcessVirtual$AllocExitFreeInformationMessagewsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 2788668848-4283279704
Opcode ID: f644d6bb55c65f053268db4f25cec8320b3bbf1d1d06db4825fff5ba47126e3b
Instruction ID: 45de0763909d3c2616c7c9647734b9728d69f87c3c1ff09df710c382e6a84bf4
Opcode Fuzzy Hash: f644d6bb55c65f053268db4f25cec8320b3bbf1d1d06db4825fff5ba47126e3b
Instruction Fuzzy Hash: C231C2712413469BDB79AF20CC54FEF776CEF04785F004569EF468629AEB70A9188B10

Function 1000CFC0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 251
processpipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 1000D055
_memset.LIBCMT ref: 1000D08B
_memset.LIBCMT ref: 1000D09E
_memset.LIBCMT ref: 1000D0B1
CreatePipe.KERNELBASE(?,?,0000000C,00000000), ref: 1000D10C
GetStartupInfoA.KERNEL32(00000044), ref: 1000D12D
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,00000000), ref: 1000D17E
CloseHandle.KERNEL32(?,?), ref: 1000D39A
CloseHandle.KERNEL32(?), ref: 1000D3A7
CloseHandle.KERNEL32(?), ref: 1000D3B4
CloseHandle.KERNEL32(?), ref: 1000D3C1

Strings

D, xrefs: 1000D0CD
ProcessorId, xrefs: 1000D00B
wmic cpu get processorid, xrefs: 1000D000

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle_memset$Create$InfoPipeProcessStartup
String ID: D$ProcessorId$wmic cpu get processorid
API String ID: 1762129635-53154263
Opcode ID: 2faa9055df3024060b3a78fac8b67b6add4b8c37b23ad85aa60008f06d3c8044
Instruction ID: 29feaeb9d2e0a167578c768367cdbb99c1f13e7196a5b6bb9c176603c2bdf5a2
Opcode Fuzzy Hash: 2faa9055df3024060b3a78fac8b67b6add4b8c37b23ad85aa60008f06d3c8044
Instruction Fuzzy Hash: D1B14E75902228DFEB29DB60CC99BDEB7B4FB48340F1041DAE109A7181DB756B84CF50

Function 1000D420 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 250
processpipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 1000D4B4
_memset.LIBCMT ref: 1000D4EA
_memset.LIBCMT ref: 1000D4FD
_memset.LIBCMT ref: 1000D510
CreatePipe.KERNELBASE(?,?,0000000C,00000000), ref: 1000D56B
GetStartupInfoA.KERNEL32(00000044), ref: 1000D58C
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,00000000), ref: 1000D5DD
CloseHandle.KERNEL32(?,?), ref: 1000D7F9
CloseHandle.KERNEL32(?), ref: 1000D806
CloseHandle.KERNEL32(?), ref: 1000D813
CloseHandle.KERNEL32(?), ref: 1000D820

Strings

wmic diskdrive get serialnumber, xrefs: 1000D460
D, xrefs: 1000D52C
SerialNumber, xrefs: 1000D46A

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle_memset$Create$InfoPipeProcessStartup
String ID: D$SerialNumber$wmic diskdrive get serialnumber
API String ID: 1762129635-2526680146
Opcode ID: 284479aef56905e99ef7afbd9686248a6d4ef8a24c59542d99c3aafd4a34ee3f
Instruction ID: f7e6dc397231a2a0a1082a64f52227403f3a6002e1c9f0e787add4f7ccce3aad
Opcode Fuzzy Hash: 284479aef56905e99ef7afbd9686248a6d4ef8a24c59542d99c3aafd4a34ee3f
Instruction Fuzzy Hash: 8CB12B759162289BEB28DB64CC9DBEEB7B4FB48300F0041DAE50DAA191DB756B84CF50

Function 10026FE8 Relevance: 16.8, APIs: 11, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 10027021

Part of subcall function 100258DC: __getptd_noexit.LIBCMT ref: 100258DC

__gmtime64_s.LIBCMT ref: 100270BA
__gmtime64_s.LIBCMT ref: 100270F0
__gmtime64_s.LIBCMT ref: 1002710D
__allrem.LIBCMT ref: 10027163
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1002717F
__allrem.LIBCMT ref: 10027196
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 100271B4
__allrem.LIBCMT ref: 100271CB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 100271E9
__invoke_watson.LIBCMT ref: 1002725A

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: faf785f0e9591b3d4b811fc4296c87dcbc334db000ad1bf2518f1b08427d47ec
Instruction ID: 713491a1cde179dae1e75a0093b68b8f74a69f94e9f1ec33854f382ae24b7f6e
Opcode Fuzzy Hash: faf785f0e9591b3d4b811fc4296c87dcbc334db000ad1bf2518f1b08427d47ec
Instruction Fuzzy Hash: 6B71D476A00717EBE715DE78EC82B5AB3E8FF40364F91412AF918D6681E770ED448790

Function 6C696740 Relevance: 6.2, APIs: 4, Instructions: 243
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(0000FFFF,00000000,00001000,00000004), ref: 6C6969A4
_memset.LIBCMT ref: 6C696A4C
VirtualAlloc.KERNELBASE(0000FFFF,000000B8,00001000,00000004,?,6C698C38), ref: 6C696B0E
_memmove.LIBCMT ref: 6C696B70

Memory Dump Source

Source File: 00000003.00000002.3052963500.000000006C681000.00000040.00000001.01000000.00000003.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.3052780453.000000006C680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3052963500.000000006C9C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3052963500.000000006CBAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3052963500.000000006CBB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3052963500.000000006CBB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3056442540.000000006CC55000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocVirtual$_memmove_memset
String ID:
API String ID: 725130153-0
Opcode ID: af01bac3374c618721e138754d3ca3c72d74494653e4f821ac976264aae05339
Instruction ID: 395c12fc52dce5ac1d009dabf2c6e74aa10fdb6c514c0d7e02ec50b25f49a4c4
Opcode Fuzzy Hash: af01bac3374c618721e138754d3ca3c72d74494653e4f821ac976264aae05339
Instruction Fuzzy Hash: D9D16F75B0260DCFCB48CFD9E593A2DBBB1FB8A300B14821AD8A587754DB30A941CF49

Function 02BF13BF Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,00001000,00000004,?,?), ref: 02BF13EA
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 02BF1403

Memory Dump Source

Source File: 00000003.00000003.2102313199.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_2bf0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 460e07aa1c6cfb092b5f976fa85d581fca477865be9a128e2591be7121e923ca
Instruction ID: b1d429a417b6c49ed05833987fabd77db929dafd5a81931b874044704500e5e3
Opcode Fuzzy Hash: 460e07aa1c6cfb092b5f976fa85d581fca477865be9a128e2591be7121e923ca
Instruction Fuzzy Hash: 74F08276200305AFDB19CF40C844FEA7779EB48391F104176EA42AB684C670F5148B10

Function 1002CE25 Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 1002CE3C

Part of subcall function 10027FF1: __mtinitlocknum.LIBCMT ref: 10028003
Part of subcall function 10027FF1: __amsg_exit.LIBCMT ref: 1002800F
Part of subcall function 10027FF1: EnterCriticalSection.KERNEL32(?,?,10025D6D,0000000D), ref: 1002801C

__tzset_nolock.LIBCMT ref: 1002CE4F

Part of subcall function 1002D09F: __lock.LIBCMT ref: 1002D0C1
Part of subcall function 1002D09F: ____lc_codepage_func.LIBCMT ref: 1002D108
Part of subcall function 1002D09F: __getenv_helper_nolock.LIBCMT ref: 1002D129
Part of subcall function 1002D09F: _free.LIBCMT ref: 1002D15C
Part of subcall function 1002D09F: _strlen.LIBCMT ref: 1002D163
Part of subcall function 1002D09F: __malloc_crt.LIBCMT ref: 1002D16A

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: fc85f6cf18a6252e642b57c3e1c2b749fe30e0e1031c663e82c605452884cce2
Instruction ID: a2ad06c6b65e7629715c0b93b357caa5f945d3fedfb1b9c2ad21f9bf3716e497
Opcode Fuzzy Hash: fc85f6cf18a6252e642b57c3e1c2b749fe30e0e1031c663e82c605452884cce2
Instruction Fuzzy Hash: 0BE0C238451A48D9DF10EBF0AA4275C32F0FB04B66FE20209E004041D28F7D35888923

Function 10022833 Relevance: 3.0, APIs: 2, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 10022839

Part of subcall function 10022801: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,1002283E,00000000,?,100280A4,000000FF,0000001E,101B7BE8,00000008,10028008,00000000,?), ref: 10022810
Part of subcall function 10022801: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 10022822

ExitProcess.KERNEL32 ref: 10022842

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 3bf28b7052921138b5cd44a98d3311a828cfa0a63c341592180aa8684d3b340a
Instruction ID: c8f4cf039e012b41d150cd44d72804b099170dd8f7fcc5d26d0c23f5f7bd029f
Opcode Fuzzy Hash: 3bf28b7052921138b5cd44a98d3311a828cfa0a63c341592180aa8684d3b340a
Instruction Fuzzy Hash: B5B09230001108BFDB022F51DC4A8593FA9FB002A0B508020F80809032DF73BA929A81

Function 02BF082D Relevance: 2.6, APIs: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,-00000436,00001000,00000004), ref: 02BF087D
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02BF08A9

Memory Dump Source

Source File: 00000003.00000003.2102313199.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_2bf0000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7e515f7c385f7f07b94d9a5cb9b23266753d833ffbaa65bc10218dcc86593253
Instruction ID: 7df584ef912cda5252a14f66569b23305ad766fc0c6f7bbd9771dee905e076fa
Opcode Fuzzy Hash: 7e515f7c385f7f07b94d9a5cb9b23266753d833ffbaa65bc10218dcc86593253
Instruction Fuzzy Hash: 48018471A01118BBEB04DE99CC40FAEB7A9EBC8760F14C16AF61897785D674AD10CBA0

Function 10021DFA Relevance: 1.5, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 100258DC: __getptd_noexit.LIBCMT ref: 100258DC

_asctime.LIBCMT ref: 10021E5D

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: __getptd_noexit_asctime
String ID:
API String ID: 1865661205-0
Opcode ID: dcfe908546e3f88bc8117c10939122550607e7d39558988ca205b2cb5c272348
Instruction ID: 4125543197aa1fcd6f4b2a2d68e97bfeb0adc15cba48122be1fc6d66b0878a2d
Opcode Fuzzy Hash: dcfe908546e3f88bc8117c10939122550607e7d39558988ca205b2cb5c272348
Instruction Fuzzy Hash: 53F04939A002099EDF00DBA4EC56BCE77ECEF28255FD20469EC05EB091EB74E9848725

Function 10036500 Relevance: 1.5, APIs: 1, Instructions: 22
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202), ref: 1003651E

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: d3557ac59b8f8fefe8b80b3b61d78a442e21de74061af108e84e171f57d9cb46
Instruction ID: a027679b03284c68216ebb438d11db6f7a8099bc69e3ea9b22835e59c52e58d0
Opcode Fuzzy Hash: d3557ac59b8f8fefe8b80b3b61d78a442e21de74061af108e84e171f57d9cb46
Instruction Fuzzy Hash: ABE0DF74A04208ABCB00DBB4DD0755D77F4EF49200F80016CF9098B252EB34AA148A82

Function 10022BD3 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 10022BDD

Part of subcall function 10022AA4: __lock.LIBCMT ref: 10022AB2
Part of subcall function 10022AA4: DecodePointer.KERNEL32(101B78D8,0000001C,10022A1B,00000000,00000001,00000000,?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022AF1
Part of subcall function 10022AA4: DecodePointer.KERNEL32(?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B02
Part of subcall function 10022AA4: EncodePointer.KERNEL32(00000000,?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B1B
Part of subcall function 10022AA4: DecodePointer.KERNEL32(-00000004,?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B2B
Part of subcall function 10022AA4: EncodePointer.KERNEL32(00000000,?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B31
Part of subcall function 10022AA4: DecodePointer.KERNEL32(?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B47
Part of subcall function 10022AA4: DecodePointer.KERNEL32(?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B52
Part of subcall function 10022AA4: __initterm.LIBCMT ref: 10022B7A
Part of subcall function 10022AA4: __initterm.LIBCMT ref: 10022B8B

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode__initterm$__lock_doexit
String ID:
API String ID: 3712619029-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: cfc2533f0be627bc8b7b8cac997dbfbd0b87b13c6f736a1528db1b5c4a82aaa4
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: 06B0123158030C33E9201581FC03F093B1C8F80A60F500020FF0C1C5E1A593756080CA

Non-executed Functions

Function 10012550 Relevance: 54.6, APIs: 24, Strings: 7, Instructions: 308servicefileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,1AA35F0A,?,?,?,00000000,10023340,101B6C90,000000FE,?,10013C89,TMzsft xtnogaqk,Yyickg caosusmk,Eaiawk mgqwgoywasgymoeeuu), ref: 10012594
ExpandEnvironmentStringsA.KERNEL32(C:\Users\Public\Documents\,?,00000104,?,?,?,00000000,10023340,101B6C90,000000FE,?,10013C89,TMzsft xtnogaqk,Yyickg caosusmk,Eaiawk mgqwgoywasgymoeeuu), ref: 100125AB
_strlen.LIBCMT ref: 100125B8
_strncmp.LIBCMT ref: 100125CF
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 1001270E

Part of subcall function 10012300: _memset.LIBCMT ref: 10012328
Part of subcall function 10012300: _strlen.LIBCMT ref: 1001234F
Part of subcall function 10012300: _strncpy.LIBCMT ref: 10012382
Part of subcall function 10012300: CreateDirectoryA.KERNEL32(00000000,00000000), ref: 100123A9

wsprintfA.USER32 ref: 10012616
_strlen.LIBCMT ref: 10012626
_strlen.LIBCMT ref: 10012642
CopyFileA.KERNEL32(?,?,00000000), ref: 100126AE
_memset.LIBCMT ref: 100126C2
_strcat.LIBCMT ref: 100126D8
CreateServiceA.ADVAPI32(?,?,?,000F01FF,00000110,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000), ref: 10012756
LockServiceDatabase.ADVAPI32(?), ref: 10012769
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 10012799
ChangeServiceConfig2A.ADVAPI32(00000000,00000002,00015180), ref: 10012877
UnlockServiceDatabase.ADVAPI32(?), ref: 10012884
GetLastError.KERNEL32 ref: 10012893
OpenServiceA.ADVAPI32(?,?,000F01FF), ref: 100128B0

Strings

C:\Users\Public\Documents\, xrefs: 100125A6
SYSTEM\CurrentControlSet\Services\, xrefs: 10012983, 10012986
Windows Update, xrefs: 10012603
Description, xrefs: 10012A05, 10012A08
Yyickg caosusmk, xrefs: 1001277D
s, xrefs: 100125F5
%, xrefs: 100125EE

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Service$_strlen$ChangeConfig2CreateDatabaseFileOpen_memset$CopyDirectoryEnvironmentErrorExpandLastLockManagerModuleNameStringsUnlock_strcat_strncmp_strncpywsprintf
String ID: %$C:\Users\Public\Documents\$Description$SYSTEM\CurrentControlSet\Services\$Windows Update$Yyickg caosusmk$s
API String ID: 2269191997-3217403557
Opcode ID: da25e49445566c96217ba80189cd2cecd7e86491d1e1acde59f2152fe1c39007
Instruction ID: 58a78215622ab89836c283d46f1977e4f6cad2cf6e4b3b9b80a50220f8474d07
Opcode Fuzzy Hash: da25e49445566c96217ba80189cd2cecd7e86491d1e1acde59f2152fe1c39007
Instruction Fuzzy Hash: BEE17471D04298DFEB26CB94DC88BDE7BB8BB15704F0441D9E5486A2C1C7B95B88CF61

Function 1000E970 Relevance: 54.5, APIs: 26, Strings: 5, Instructions: 217stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000E9B6
_memset.LIBCMT ref: 1000E9D5
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 1000E9EB
StrCpyW.SHLWAPI(?,?), ref: 1000EA0A
PathRemoveFileSpecW.SHLWAPI(?), ref: 1000EA17
lstrlenW.KERNEL32(?), ref: 1000EA24

Strings

/c ping -n 4 127.0.0.1 > nul, xrefs: 1000EA8F
" > nul, xrefs: 1000EB85
COMSPEC, xrefs: 1000EA60
&& del ", xrefs: 1000EB63
D, xrefs: 1000EBD5

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File_memset$ModuleNamePathRemoveSpeclstrlen
String ID: && del "$ /c ping -n 4 127.0.0.1 > nul$" > nul$COMSPEC$D
API String ID: 322946884-2269649423
Opcode ID: 144a78e811b26684e0f96933bcd6fe390524fe62f1730313945f432d4c563e04
Instruction ID: 84f9132210fad28102cfca7cccb4be7a633d21108d91728e9d5e1e2c02768cad
Opcode Fuzzy Hash: 144a78e811b26684e0f96933bcd6fe390524fe62f1730313945f432d4c563e04
Instruction Fuzzy Hash: 17914F75A00219AFEB24DB64CC85BEA77B8FF48740F448599F20DAA191DF70AB84CF51

Function 1000EF10 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 213keyboardsleepstringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000EF55
_memset.LIBCMT ref: 1000EF72
_memset.LIBCMT ref: 1000EF88
Sleep.KERNEL32(00000005), ref: 1000EF92
lstrlenA.KERNEL32(00000000), ref: 1000EF9F
_memset.LIBCMT ref: 1000EFDC
GetKeyState.USER32(00000010), ref: 1000F035
GetAsyncKeyState.USER32(?), ref: 1000F05C
GetKeyState.USER32(00000014), ref: 1000F073

Strings

], xrefs: 1000F0CF
<BackSpace>, xrefs: 1000F15E
<Enter>, xrefs: 1000F1EB
e, xrefs: 1000F026

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$State$AsyncSleeplstrlen
String ID: <BackSpace>$<Enter>$]$e
API String ID: 607291201-3604511016
Opcode ID: da57c67bcd9e4523acf9165be53d619ee9f3dc396b189a0e504f25392de7e49e
Instruction ID: 971390b8b5f7826b9d9bd22f466c4ca9011c4cb2ed80f64febdb7f556ca07fc7
Opcode Fuzzy Hash: da57c67bcd9e4523acf9165be53d619ee9f3dc396b189a0e504f25392de7e49e
Instruction Fuzzy Hash: 6091F4B4900718DFEB20CFA0DC49BEA7375FB84346F1041EDE509A6186DB76AA94DF41

Function 100123C0 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 117libraryloaderprocessCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(userenv.dll), ref: 100123D8
GetProcAddress.KERNEL32(?,CreateEnvironmentBlock), ref: 100123EA
_memset.LIBCMT ref: 10012417
_memset.LIBCMT ref: 10012427
GetCurrentProcess.KERNEL32 ref: 10012459
OpenProcessToken.ADVAPI32(?,000F01FF,00000000), ref: 1001246F
DuplicateTokenEx.ADVAPI32(00000000,02000000,00000000,00000001,00000001,00000000), ref: 10012488
LoadLibraryA.KERNEL32(Kernel32.dll,WTSGetActiveConsoleSessionId), ref: 10012498
GetProcAddress.KERNEL32(00000000), ref: 1001249F
SetTokenInformation.ADVAPI32(00000000,0000000C,00000000,00000004), ref: 100124C0
CreateProcessAsUserA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000430,00000000,00000000,00000044,00000000), ref: 100124F6
CloseHandle.KERNEL32(00000000), ref: 10012506
CloseHandle.KERNEL32(00000000), ref: 10012510
FreeLibrary.KERNEL32(00000000), ref: 1001252F

Strings

D, xrefs: 1001244B
userenv.dll, xrefs: 100123D3
Kernel32.dll, xrefs: 10012493
WTSGetActiveConsoleSessionId, xrefs: 1001248E
CreateEnvironmentBlock, xrefs: 100123E1

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: LibraryProcessToken$AddressCloseHandleLoadProc_memset$CreateCurrentDuplicateFreeInformationOpenUser
String ID: CreateEnvironmentBlock$D$Kernel32.dll$WTSGetActiveConsoleSessionId$userenv.dll
API String ID: 2385095549-609967149
Opcode ID: ac44d7a654e1ecf9cefedaa459ffae167c2ab3953bef6485a400e85d30f059f2
Instruction ID: fd1ae4a91e3460f93e873eecc7cbeda63378566b322c9237b013182db1ce3722
Opcode Fuzzy Hash: ac44d7a654e1ecf9cefedaa459ffae167c2ab3953bef6485a400e85d30f059f2
Instruction Fuzzy Hash: B741B6B5E00218EFEB14DFE0CC99BAEBBB4FB48705F104518E6156B281D7B59944CF90

Function 10005CA0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetLogicalProcessorInformation,?,00000000), ref: 10005CC3
GetProcAddress.KERNEL32(00000000), ref: 10005CCA
GetLastError.KERNEL32 ref: 10005CEC
_free.LIBCMT ref: 10005CF8

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

_malloc.LIBCMT ref: 10005D04
_free.LIBCMT ref: 10005D3E
GetSystemInfo.KERNEL32(?), ref: 10005D54
_perror.LIBCMT ref: 10005D79

Strings

zstd, xrefs: 10005D74
GetLogicalProcessorInformation, xrefs: 10005CB3
kernel32, xrefs: 10005CBA

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLast_free$AddressFreeHandleHeapInfoModuleProcSystem_malloc_perror
String ID: GetLogicalProcessorInformation$kernel32$zstd
API String ID: 346688108-2576447550
Opcode ID: ebf4960832639757ba6ddf85c4acd03ed6aa7b5749e8a4a28e034f0c5179f344
Instruction ID: 534da2e331fe06abe5cc17a8b34cc9891e156add97b29abc730671e8849a38bb
Opcode Fuzzy Hash: ebf4960832639757ba6ddf85c4acd03ed6aa7b5749e8a4a28e034f0c5179f344
Instruction Fuzzy Hash: 3C212976A003115FF721E7249C89A4F73E8FF84292F940527FC0587215E73AEA4587D2

Function 1001DBF0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 104networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(?,00000001,00000006), ref: 1001DC4B
bind.WS2_32(00000000,00000002,0000001C), ref: 1001DC70
WSAGetLastError.WS2_32(?,?,?,?), ref: 1001DCA8
SetLastError.KERNEL32 ref: 1001DCB6
WSAGetLastError.WS2_32(?,?,?,?), ref: 1001DCD7
SetLastError.KERNEL32 ref: 1001DCE5
WSAGetLastError.WS2_32(?,?,?), ref: 1001DCF6
SetLastError.KERNEL32 ref: 1001DD04

Strings

0.0.0.0, xrefs: 1001DC17, 1001DC2D

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLast$bindsocket
String ID: 0.0.0.0
API String ID: 2672188334-3771769585
Opcode ID: 67e94f2010b34371f429a1fa7c81e8d84f1349c60049d7ca6e869d281ca33336
Instruction ID: 8216ced0d739489223f21362e87208fc090313cd3a371b7f6b63c1b20dd229cb
Opcode Fuzzy Hash: 67e94f2010b34371f429a1fa7c81e8d84f1349c60049d7ca6e869d281ca33336
Instruction Fuzzy Hash: 8231E672A002159FE720EF68DC85BAB77E8EF45350F00452EFD09CA181EAB5D885D7A0

Function 1000F2B0 Relevance: 12.1, APIs: 8, Instructions: 62processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 1000F2C3
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1000F2DD
Process32First.KERNEL32(000000FF,00000128), ref: 1000F30E
OpenProcess.KERNEL32(00000001,00000000,00000000,000000FF,00000128,00000002,00000000), ref: 1000F347
TerminateProcess.KERNEL32(00000000,00000000), ref: 1000F367
CloseHandle.KERNEL32(00000000), ref: 1000F374
Process32Next.KERNEL32(000000FF,00000128), ref: 1000F388
CloseHandle.KERNEL32(000000FF,000000FF,00000128,00000002,00000000), ref: 1000F39C

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleProcess32$CreateCurrentFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 477742948-0
Opcode ID: 0e5e03193292138b7c311efabc93a15d5f194d092c39daaf66340cd660e8982b
Instruction ID: d41c4376eefb6253570006433f593cac2f32630ea850329660a4d75d5b4afe3c
Opcode Fuzzy Hash: 0e5e03193292138b7c311efabc93a15d5f194d092c39daaf66340cd660e8982b
Instruction Fuzzy Hash: 4921C370900228DFDB25EB60CD89BEDB7B4FB48750F1045D9E609AB290D774AB80DF50

Function 10012A90 Relevance: 9.1, APIs: 6, Instructions: 115networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10012AB1

Part of subcall function 100122A0: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 100122C1
Part of subcall function 100122A0: GetProcAddress.KERNEL32(00000000), ref: 100122C8
Part of subcall function 100122A0: GetCurrentProcess.KERNEL32(00000000), ref: 100122DB

GetVersionExA.KERNEL32(0000009C), ref: 10012AED

Part of subcall function 10011EE0: LoadLibraryA.KERNEL32(ntdll.dll), ref: 10011EF9
Part of subcall function 10011EE0: GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 10011F11
Part of subcall function 10011EE0: FreeLibrary.KERNEL32(00000000), ref: 10011F4A

Part of subcall function 10011980: LoadLibraryA.KERNEL32(Ole32.dll), ref: 10011995
Part of subcall function 10011980: GetProcAddress.KERNEL32(?,CoInitialize), ref: 100119A7
Part of subcall function 10011980: GetProcAddress.KERNEL32(?,CoUninitialize), ref: 100119B9
Part of subcall function 10011980: GetProcAddress.KERNEL32(?,CoCreateInstance), ref: 100119CB
Part of subcall function 10011980: LoadLibraryA.KERNEL32(Oleaut32.dll), ref: 100119D9
Part of subcall function 10011980: GetProcAddress.KERNEL32(?,SysFreeString), ref: 100119EB

Part of subcall function 10011C40: _strncpy.LIBCMT ref: 10011D43

Part of subcall function 100121A0: _memset.LIBCMT ref: 100121D2

Part of subcall function 10011D80: GetSystemInfo.KERNEL32(?), ref: 10011DCD
Part of subcall function 10011D80: __snprintf.LIBCMT ref: 10011DE8

Part of subcall function 10012130: _memset.LIBCMT ref: 1001214F
Part of subcall function 10012130: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 10012162

Part of subcall function 10011E10: _memset.LIBCMT ref: 10011E5F
Part of subcall function 10011E10: _memset.LIBCMT ref: 10011E71
Part of subcall function 10011E10: lstrlenA.KERNEL32(?), ref: 10011EA4
Part of subcall function 10011E10: gethostname.WS2_32(?,10012B7F), ref: 10011EB6
Part of subcall function 10011E10: lstrlenA.KERNEL32(?), ref: 10011EC0

Part of subcall function 10013280: GetLastInputInfo.USER32(00000008), ref: 1001329B

_memmove.LIBCMT ref: 10012B9C
InternetGetConnectedState.WININET(?,00000000), ref: 10012BAD
_strlen.LIBCMT ref: 10012BB7

Part of subcall function 10006F00: _Func_class.LIBCPMTD ref: 10006F71

_Func_class.LIBCPMTD ref: 10012BD2

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$_memset$Library$Load$Func_classInfolstrlen$ConnectedCurrentFreeGlobalHandleInputInternetLastMemoryModuleProcessStateStatusSystemVersion__snprintf_memmove_strlen_strncpygethostname
String ID:
API String ID: 1392860501-0
Opcode ID: 43b44d29e576c7a7eab6005ce55aa7196c291a1fb8a4cd9e799f16c790759da6
Instruction ID: 6fcb611156f6b3c8081496a382b787b04c25c68574042c94e1e96bd79d1c608f
Opcode Fuzzy Hash: 43b44d29e576c7a7eab6005ce55aa7196c291a1fb8a4cd9e799f16c790759da6
Instruction Fuzzy Hash: 514186B9D4021A6BDB14DBA0DC46FEE7378EF14344F4045A8F51D6A182EE34B7888B91

Function 1000F017 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34keyboardsleepstringCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000005), ref: 1000EF92
lstrlenA.KERNEL32(00000000), ref: 1000EF9F
_memset.LIBCMT ref: 1000EFDC
GetKeyState.USER32(00000010), ref: 1000F035
GetAsyncKeyState.USER32(?), ref: 1000F05C
GetKeyState.USER32(00000014), ref: 1000F073

Strings

e, xrefs: 1000F026
], xrefs: 1000F092

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: State$AsyncSleep_memsetlstrlen
String ID: ]$e
API String ID: 1122937223-1460998272
Opcode ID: eed0b91c2744c895165e97b4f44415f78997a58abc4c3c7c85806ef0c703c4ee
Instruction ID: 764bce47da2be80fe97f0ee0a60544cb6e7be49dbe84d1d57fcac03222c10f19
Opcode Fuzzy Hash: eed0b91c2744c895165e97b4f44415f78997a58abc4c3c7c85806ef0c703c4ee
Instruction Fuzzy Hash: 35011A34901728CFFB64CF15CC85BA977B2FB80391F1082A9C4095695ACB779EA1EE01

Function 1001C580 Relevance: 7.7, APIs: 5, Instructions: 151networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32(?,?,?,?,?,?,1001C326,FFFFFFFF,?,?,?,FFFFFFFF,?), ref: 1001C5E3

Part of subcall function 100172C0: __CxxThrowException@8.LIBCMT ref: 100172D2
Part of subcall function 100172C0: EnterCriticalSection.KERNEL32(00000000,1AA35F0A,00000000,00000098,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005), ref: 10017312
Part of subcall function 100172C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005,?,100168C9,00000400,00000400), ref: 1001737B

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterErrorException@8LastLeaveThrow
String ID:
API String ID: 1367629879-0
Opcode ID: 1a78252def1050f5be20003a34375eeef4699fcd1b0fa4c910ffc5e1ea9ae854
Instruction ID: 2045c5cf5837c9daf880452df431a01197e78d674d59fb6298516e1ae159bddb
Opcode Fuzzy Hash: 1a78252def1050f5be20003a34375eeef4699fcd1b0fa4c910ffc5e1ea9ae854
Instruction Fuzzy Hash: 7851BEB5900218AFDB21DFA4C841AAE77B5FF44390F100219F8599F291E770EDD0DB91

Function 100143E0 Relevance: 7.6, APIs: 5, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 1001446A
_free.LIBCMT ref: 10014479
VirtualFree.KERNEL32(?,00000000,00008000,?,1001478E), ref: 10014498
GetProcessHeap.KERNEL32(00000000,00000000,?,1001478E), ref: 100144A4
HeapFree.KERNEL32(00000000,?,1001478E), ref: 100144AB

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Free$Heap$LibraryProcessVirtual_free
String ID:
API String ID: 3953351234-0
Opcode ID: d9d32f6ed72f362beb0b78fbb99d4c82a6959af6a865298871246b0d9bcbc94d
Instruction ID: e984664baf45058b12496fb5a6c08b784cfcca4bbda2656e475c534f62021b4f
Opcode Fuzzy Hash: d9d32f6ed72f362beb0b78fbb99d4c82a6959af6a865298871246b0d9bcbc94d
Instruction Fuzzy Hash: 6131B674A00208EFDB14CF94C598B9DB7B6FB49315F258288E9056B391C775EE86DF80

Function 100152A0 Relevance: 6.1, APIs: 4, Instructions: 62processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,10011CAA), ref: 100152B1

Part of subcall function 1001EF9C: _malloc.LIBCMT ref: 1001EFB4

Process32First.KERNEL32(10011CAA,1AA35F0A), ref: 100152E0
Process32Next.KERNEL32(10011CAA,1AA35F0A), ref: 10015316
lstrcmpiA.KERNEL32(1AA35EE6,00000000), ref: 1001532A

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32_malloclstrcmpi
String ID:
API String ID: 242301054-0
Opcode ID: 335c3f3c8a0e05f5839a3b8562ab9f751be2bf2361413e739464e8ead2f72be9
Instruction ID: 03fd10ac50de1202267bfae5930d06ed0f63b87ea6e01dd6c59341b656d33967
Opcode Fuzzy Hash: 335c3f3c8a0e05f5839a3b8562ab9f751be2bf2361413e739464e8ead2f72be9
Instruction Fuzzy Hash: 8321BAB4A04208EBDB14CB98C981A9EB7F5EF48745F2480A8E818AF341D771EF81DB54

Function 10010560 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 10015000: LoadLibraryA.KERNEL32(ADVAPI32.dll), ref: 10015019
Part of subcall function 10015000: GetProcAddress.KERNEL32(?,OpenProcessToken), ref: 1001502B
Part of subcall function 10015000: GetProcAddress.KERNEL32(?,AdjustTokenPrivileges), ref: 1001503D
Part of subcall function 10015000: GetProcAddress.KERNEL32(?,LookupPrivilegeValueA), ref: 1001504F
Part of subcall function 10015000: LoadLibraryA.KERNEL32(kernel32.dll), ref: 1001505D
Part of subcall function 10015000: GetProcAddress.KERNEL32(?,GetCurrentProcess), ref: 1001506F

ExitWindowsEx.USER32(?,00000000), ref: 10010578

Part of subcall function 10015000: LoadLibraryA.KERNEL32(KERNEL32.dll), ref: 100150F0
Part of subcall function 10015000: GetProcAddress.KERNEL32(?,GetLastError), ref: 10015102
Part of subcall function 10015000: CloseHandle.KERNEL32(?), ref: 1001511A
Part of subcall function 10015000: FreeLibrary.KERNEL32(00000000), ref: 1001512A
Part of subcall function 10015000: FreeLibrary.KERNEL32(00000000), ref: 1001513A

Strings

SeShutdownPrivilege, xrefs: 10010565, 10010580

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$Load$Free$CloseExitHandleWindows
String ID: SeShutdownPrivilege
API String ID: 3789203340-3733053543
Opcode ID: 1ee43cc076062974db8b991385aee2a4a112618670f0f8bd0dc99bd4091fe260
Instruction ID: 1f84b243cf82737e1a42207ec92b1639b24ad97c5d3f070e489050a92cf0a957
Opcode Fuzzy Hash: 1ee43cc076062974db8b991385aee2a4a112618670f0f8bd0dc99bd4091fe260
Instruction Fuzzy Hash: 5CD0C9BAA80318BBD625AAD1AC57FC936089714747F880014FA085D1C2E5A7B19042E2

Function 1001A470 Relevance: 3.0, APIs: 2, Instructions: 39networkCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,00000000,00000000), ref: 1001A49D
WSAGetLastError.WS2_32 ref: 1001A4A8

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLastRecv
String ID:
API String ID: 904507345-0
Opcode ID: 6d4a77044bf01599b4c4d9c9718d747d5542e35423cd9aede843caf72be793c6
Instruction ID: 82c1de10f7d51eada6aa726a5a3efe5d73ab1be028bbaf26b8a0bc00750a651c
Opcode Fuzzy Hash: 6d4a77044bf01599b4c4d9c9718d747d5542e35423cd9aede843caf72be793c6
Instruction Fuzzy Hash: 6EF0CD32A15118AFEB14CF94EC49BE97BA8EB05321F000289FD0C9B6C0D7B1AA40DBD1

Function 10013080 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

hXMV, xrefs: 100130CD
hXMV, xrefs: 100130C3

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: hXMV$hXMV
API String ID: 0-400149659
Opcode ID: e9df29b40b8b17f0cd111d63266152e2dca58cd2ba3867890a7f6b55724276bc
Instruction ID: 4894185f0b18a9b9ee3a77af486a92bf4d51351e367bba8918dec77b28b3b147
Opcode Fuzzy Hash: e9df29b40b8b17f0cd111d63266152e2dca58cd2ba3867890a7f6b55724276bc
Instruction Fuzzy Hash: 9D01D672A04358ABC704CF99CD8079EFBF8F709660F60466AF405D3B90D7395544C790

Function 10013000 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12050be9e66c5deb1d9325e021b636a37a4104aea8b1783f5f3b593b0ddfebef
Instruction ID: a7514d67e8f405398fbd76f14816f866ec2f0755db8d1a5e84f2eed078b58306
Opcode Fuzzy Hash: 12050be9e66c5deb1d9325e021b636a37a4104aea8b1783f5f3b593b0ddfebef
Instruction Fuzzy Hash: 9C0192B4D04208FBDB04CF95C45179EBBF4EF88744F20C0AED8156B240C7B95A889F14

Function 100153E0 Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 249libraryloaderCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10015432
_memset.LIBCMT ref: 10015448
_memset.LIBCMT ref: 1001545E
LoadLibraryA.KERNEL32(ADVAPI32.dll), ref: 1001546B
GetProcAddress.KERNEL32(00000000,RegQueryValueExA), ref: 10015493
GetProcAddress.KERNEL32(00000000,RegOpenKeyExA), ref: 100154AB
GetProcAddress.KERNEL32(00000000,RegEnumValueA), ref: 100154C3
GetProcAddress.KERNEL32(00000000,RegEnumKeyExA), ref: 100154DB
GetProcAddress.KERNEL32(00000000,RegCloseKey), ref: 100154F3
FreeLibrary.KERNEL32(00000000), ref: 1001553C

Strings

RegQueryValueExA, xrefs: 10015487
RegEnumKeyExA, xrefs: 100154CF
ADVAPI32.dll, xrefs: 10015466
RegEnumValueA, xrefs: 100154B7
RegCloseKey, xrefs: 100154E7
RegOpenKeyExA, xrefs: 1001549F

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$_memset$Library$FreeLoad
String ID: ADVAPI32.dll$RegCloseKey$RegEnumKeyExA$RegEnumValueA$RegOpenKeyExA$RegQueryValueExA
API String ID: 2029490530-3713883646
Opcode ID: ce21794f6d49dae7673cc83d0b588799919480882acf9cc9429ea4c88414c882
Instruction ID: 42d3faf0a6d82433ca9894e8e05647cd2437e6e791ab8efedd1cac75c6c50b36
Opcode Fuzzy Hash: ce21794f6d49dae7673cc83d0b588799919480882acf9cc9429ea4c88414c882
Instruction Fuzzy Hash: 4AB17EB5904629EFDB20DF64CC89BEEB7B4FB48306F0445D8E909AA290D7759AC4CF50

Function 10007130 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 183timeCOMMON

Download Yara Rule

APIs

WinHttpOpen.WINHTTP(curl/7.83.1,00000000,00000000,00000000,00000000), ref: 10007197
WinHttpSetTimeouts.WINHTTP(00000000,000003E8,000003E8,000003E8,000003E8), ref: 100071BE
WinHttpConnect.WINHTTP(00000000,?,00000050,00000000), ref: 100071D6
WinHttpOpenRequest.WINHTTP(00000000,GET,?,00000000,00000000,00000000,00000000), ref: 100071FA
WinHttpSendRequest.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 10007219
WinHttpReceiveResponse.WINHTTP(00000000,00000000), ref: 1000722E
WinHttpQueryHeaders.WINHTTP(00000000,20000013,00000000,00000000,00000004,00000000), ref: 10007264
__CxxThrowException@8.LIBCMT ref: 10007272
WinHttpQueryDataAvailable.WINHTTP(00000000,00000000), ref: 10007293
GetLastError.KERNEL32 ref: 1000729D
__CxxThrowException@8.LIBCMT ref: 100072AF
std::ios_base::clear.LIBCPMTD ref: 100072C8
WinHttpReadData.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000), ref: 100072E4
std::ios_base::clear.LIBCPMTD ref: 100072FF
GetLastError.KERNEL32(00000000), ref: 1000730A
_wprintf.LIBCMT ref: 10007316
WinHttpCloseHandle.WINHTTP(00000000), ref: 10007328
WinHttpCloseHandle.WINHTTP(00000000), ref: 10007338
WinHttpCloseHandle.WINHTTP(00000000), ref: 10007348

Strings

curl/7.83.1, xrefs: 10007192
Error %d has occurred., xrefs: 10007311
GET, xrefs: 100071F1

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Http$CloseHandle$DataErrorException@8LastOpenQueryRequestThrowstd::ios_base::clear$AvailableConnectHeadersReadReceiveResponseSendTimeouts_wprintf
String ID: Error %d has occurred.$GET$curl/7.83.1
API String ID: 3568891788-3281102068
Opcode ID: a0faf76c0c659e3c95fc50e059929233ef8cb015fb8e25ec05d524550362fc63
Instruction ID: 96198f7158a5b0440b015918e988b78723295c7c608185cc2ea97e2543ed712c
Opcode Fuzzy Hash: a0faf76c0c659e3c95fc50e059929233ef8cb015fb8e25ec05d524550362fc63
Instruction Fuzzy Hash: CF7107B1D40248EFEB15DFA0CC99BEEBBB4FB04741F104119F51AAA2D4CB786A45DB50

Function 10012C30 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 120sleepregistrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(TMzsft xtnogaqk,10012E80), ref: 10012C4D
FreeConsole.KERNEL32 ref: 10012C68
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012CB5
Sleep.KERNEL32(000001F4), ref: 10012CCA
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012CE6
CreateMutexA.KERNEL32(00000000,00000000,TMzsft xtnogaqk), ref: 10012D08
GetLastError.KERNEL32 ref: 10012D14
WSAStartup.WS2_32(00000202,?), ref: 10012D34
GetVersionExA.KERNEL32(00000094), ref: 10012D4B
Sleep.KERNEL32(000F4240,00000000), ref: 10012D73

Strings

%s Win7, xrefs: 10012DAF
TMzsft xtnogaqk, xrefs: 10012C48, 10012CFF

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Service$SleepStatus$ConsoleCreateCtrlErrorFreeHandlerLastMutexRegisterStartupVersion
String ID: %s Win7$TMzsft xtnogaqk
API String ID: 1415809075-2726583022
Opcode ID: 3c918adf2ea9c1f546c4a298ab0c77e3fc501175bd32b3641c86ff31aace8df7
Instruction ID: 16fc8e2a50e62427ded2aaa4a0275d88474e0d3da89c2d2dd2af286da20813d4
Opcode Fuzzy Hash: 3c918adf2ea9c1f546c4a298ab0c77e3fc501175bd32b3641c86ff31aace8df7
Instruction Fuzzy Hash: 9B518EB5904224DFE729EF60CC8DB9A77B4FB04306F804298E10D6A5A1D7786AC8DF52

Function 10015EB0 Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 139libraryloaderfileCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(wininet.dll), ref: 10015F01
GetProcAddress.KERNEL32(?,InternetOpenA), ref: 10015F19
FreeLibrary.KERNEL32(00000000), ref: 10015F57
GetProcAddress.KERNEL32(?,InternetOpenUrlA), ref: 10015F70
FreeLibrary.KERNEL32(00000000), ref: 10015FB7
CreateFileA.KERNEL32(1000F526,40000000,00000000,00000000,00000002,00000000,00000000), ref: 10015FD7
_memset.LIBCMT ref: 10015FFE
GetProcAddress.KERNEL32(?,InternetReadFile), ref: 10016012
WriteFile.KERNEL32(000000FF,?,00000000,00000000,00000000), ref: 10016086
CloseHandle.KERNEL32(000000FF), ref: 100160A0
Sleep.KERNEL32(00000001), ref: 100160A8
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 100160BA
FreeLibrary.KERNEL32(00000000), ref: 100160F0

Strings

InternetReadFile, xrefs: 10016006
InternetCloseHandle, xrefs: 100160AE
wininet.dll, xrefs: 10015EFC
MSIE 6.0, xrefs: 10015F2D
InternetOpenUrlA, xrefs: 10015F64
InternetOpenA, xrefs: 10015F0D

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$Free$File$CloseCreateHandleLoadSleepWrite_memset
String ID: InternetCloseHandle$InternetOpenA$InternetOpenUrlA$InternetReadFile$MSIE 6.0$wininet.dll
API String ID: 2728150189-4269851202
Opcode ID: 91acf4dff87506ba4283441e8002569b8e5cf21a0175855ebad90579deee730e
Instruction ID: e100d08a212eeccd1dc3a45c1d5aa8af2f61e991188d98dff4208e55cab7884c
Opcode Fuzzy Hash: 91acf4dff87506ba4283441e8002569b8e5cf21a0175855ebad90579deee730e
Instruction Fuzzy Hash: DA51CCF5900228DFEB31DB64CD89BDA77B8AB48305F5081D8F709AA181C7759AC5CF68

Function 10015000 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ADVAPI32.dll), ref: 10015019
GetProcAddress.KERNEL32(?,OpenProcessToken), ref: 1001502B
GetProcAddress.KERNEL32(?,AdjustTokenPrivileges), ref: 1001503D
GetProcAddress.KERNEL32(?,LookupPrivilegeValueA), ref: 1001504F
LoadLibraryA.KERNEL32(kernel32.dll), ref: 1001505D
GetProcAddress.KERNEL32(?,GetCurrentProcess), ref: 1001506F
LoadLibraryA.KERNEL32(KERNEL32.dll), ref: 100150F0
GetProcAddress.KERNEL32(?,GetLastError), ref: 10015102
CloseHandle.KERNEL32(?), ref: 1001511A
FreeLibrary.KERNEL32(00000000), ref: 1001512A
FreeLibrary.KERNEL32(00000000), ref: 1001513A

Strings

KERNEL32.dll, xrefs: 100150EB
kernel32.dll, xrefs: 10015058
ADVAPI32.dll, xrefs: 10015014
LookupPrivilegeValueA, xrefs: 10015046
AdjustTokenPrivileges, xrefs: 10015034
GetCurrentProcess, xrefs: 10015066
OpenProcessToken, xrefs: 10015022
GetLastError, xrefs: 100150F9

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$Load$Free$CloseHandle
String ID: ADVAPI32.dll$AdjustTokenPrivileges$GetCurrentProcess$GetLastError$KERNEL32.dll$LookupPrivilegeValueA$OpenProcessToken$kernel32.dll
API String ID: 2887716753-1648388921
Opcode ID: 09c34ea0c58a1937bffb1c09e732f69496aae19d3495c3a7a974608a733c4652
Instruction ID: 2ba7eb19521ecd2e0521120e7302f927c8c69f99e1a3e1b69f5f98f9208caa0c
Opcode Fuzzy Hash: 09c34ea0c58a1937bffb1c09e732f69496aae19d3495c3a7a974608a733c4652
Instruction Fuzzy Hash: 8441F775A00218EFEB16DFE4CC88BEEBBB5FB08301F144518F905AA291D7799940CBA0

Function 10015BC0 Relevance: 30.0, APIs: 10, Strings: 7, Instructions: 232libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ADVAPI32.dll,1AA35F0A), ref: 10015C0D
GetProcAddress.KERNEL32(00000000,RegCreateKeyExA), ref: 10015C2C
GetProcAddress.KERNEL32(00000000,RegSetValueExA), ref: 10015C3E
GetProcAddress.KERNEL32(00000000,RegDeleteKeyA), ref: 10015C50
GetProcAddress.KERNEL32(00000000,RegDeleteValueA), ref: 10015C62
GetProcAddress.KERNEL32(00000000,RegOpenKeyExA), ref: 10015C74
GetProcAddress.KERNEL32(00000000,RegCloseKey), ref: 10015C86
FreeLibrary.KERNEL32(00000000), ref: 10015CB7

Strings

RegDeleteValueA, xrefs: 10015C59
RegCreateKeyExA, xrefs: 10015C23
ADVAPI32.dll, xrefs: 10015C08
RegCloseKey, xrefs: 10015C7D
RegOpenKeyExA, xrefs: 10015C6B
RegSetValueExA, xrefs: 10015C35
RegDeleteKeyA, xrefs: 10015C47

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: ADVAPI32.dll$RegCloseKey$RegCreateKeyExA$RegDeleteKeyA$RegDeleteValueA$RegOpenKeyExA$RegSetValueExA
API String ID: 2449869053-3188892968
Opcode ID: a0bd9a62e12f23e275d41ab7552c4dc3de141cd94503504a1d0315d773db0a11
Instruction ID: 7e0e5bb135e0f492be458d9bdacf26a44bf840c8ddca4d957ca8ae1cdeebb231
Opcode Fuzzy Hash: a0bd9a62e12f23e275d41ab7552c4dc3de141cd94503504a1d0315d773db0a11
Instruction Fuzzy Hash: A791C575A00208EFDB14CFA4D988BEEBBB9FB48751F148519F505AB280D776E981CB60

Function 10011980 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 148libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Ole32.dll), ref: 10011995
GetProcAddress.KERNEL32(?,CoInitialize), ref: 100119A7
GetProcAddress.KERNEL32(?,CoUninitialize), ref: 100119B9
GetProcAddress.KERNEL32(?,CoCreateInstance), ref: 100119CB
LoadLibraryA.KERNEL32(Oleaut32.dll), ref: 100119D9
GetProcAddress.KERNEL32(?,SysFreeString), ref: 100119EB

Strings

CoInitialize, xrefs: 1001199E
CoUninitialize, xrefs: 100119B0
Oleaut32.dll, xrefs: 100119D4
SysFreeString, xrefs: 100119E2
Ole32.dll, xrefs: 10011990
CoCreateInstance, xrefs: 100119C2
FriendlyName, xrefs: 10011AB4

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CoCreateInstance$CoInitialize$CoUninitialize$FriendlyName$Ole32.dll$Oleaut32.dll$SysFreeString
API String ID: 2238633743-3340630095
Opcode ID: 1d44af109edd1136255a39dc8a1dfaf4e7fcfd6cc7004c71e0f7df510543376a
Instruction ID: 212faf0c9611e66aabaa8f64879106e5bf96d811b783168d703724af177fa0bf
Opcode Fuzzy Hash: 1d44af109edd1136255a39dc8a1dfaf4e7fcfd6cc7004c71e0f7df510543376a
Instruction Fuzzy Hash: 69519279E00218EFDB14DFE8D884AEEB7B5FF88701F108558E516AB290D774A985CF60

Function 10015950 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 94libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,1AA35F0A,?,?,?,00000000,10023340,101B6E88,000000FE,?,100158FA,00000000), ref: 1001598B
GetProcAddress.KERNEL32(?,GetThreadDesktop), ref: 100159A3
GetProcAddress.KERNEL32(?,GetUserObjectInformationA), ref: 100159BB
GetProcAddress.KERNEL32(?,SetThreadDesktop), ref: 100159D3
GetProcAddress.KERNEL32(?,CloseDesktop), ref: 100159EB
LoadLibraryA.KERNEL32(kernel32.dll,?,?,?,00000000,10023340,101B6E88,000000FE,?,100158FA,00000000), ref: 100159FC
GetProcAddress.KERNEL32(?,GetCurrentThreadId), ref: 10015A14

Strings

user32.dll, xrefs: 10015986
CloseDesktop, xrefs: 100159DF
GetThreadDesktop, xrefs: 10015997
kernel32.dll, xrefs: 100159F7
SetThreadDesktop, xrefs: 100159C7
GetUserObjectInformationA, xrefs: 100159AF
GetCurrentThreadId, xrefs: 10015A08

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseDesktop$GetCurrentThreadId$GetThreadDesktop$GetUserObjectInformationA$SetThreadDesktop$kernel32.dll$user32.dll
API String ID: 2238633743-588083535
Opcode ID: a1b5b4eb188306deb7be5c334ff11527cf8147aa92056ec69f43df2731cc529d
Instruction ID: 0747fb5764a0f845c2061594b4b15d20bfc1687557696379681bc3d3be76b4b8
Opcode Fuzzy Hash: a1b5b4eb188306deb7be5c334ff11527cf8147aa92056ec69f43df2731cc529d
Instruction Fuzzy Hash: 1641ED76901228EFDB21CFA4CC88BEEB7B4FF49311F104599F949AA251DB759A80CF50

Function 10013360 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

SocketClient.Connect %s,%d, xrefs: 10013497

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: SocketClient.Connect %s,%d
API String ID: 0-4086773378
Opcode ID: 806049d0937e817d2a7edc25e8aa56914ceb32bd5803814fc0c8e8b9f4b12fda
Instruction ID: 63baf142f1b2acfd1537a39fce8e3a032f44fd155c7a3820f2eaebd6526bdc0f
Opcode Fuzzy Hash: 806049d0937e817d2a7edc25e8aa56914ceb32bd5803814fc0c8e8b9f4b12fda
Instruction Fuzzy Hash: 3CC13479804A69CBDB21DF64CC907DEB7B5FF49340F0082D9E409AA291EB749AE4CF50

Function 1001AB90 Relevance: 21.2, APIs: 14, Instructions: 202memorytimeCOMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(00000001,00000001,00000000), ref: 1001ABD3
InterlockedCompareExchange.KERNEL32(00000001,00000001,00000000), ref: 1001ABE7
InterlockedDecrement.KERNEL32(00000005), ref: 1001AC11
DeleteCriticalSection.KERNEL32(?), ref: 1001AC61
DeleteCriticalSection.KERNEL32(?), ref: 1001AC6B
HeapFree.KERNEL32(00000000,00000000,?), ref: 1001AC75
InterlockedCompareExchange.KERNEL32(00000001,00000001,00000000), ref: 1001ACEB
timeGetTime.WINMM ref: 1001AD11
timeGetTime.WINMM ref: 1001AD1F
InterlockedDecrement.KERNEL32(00000005), ref: 1001AD52
DeleteCriticalSection.KERNEL32(?), ref: 1001ADA2
DeleteCriticalSection.KERNEL32(?), ref: 1001ADAC
HeapFree.KERNEL32(?,00000000,?), ref: 1001ADB7
InterlockedCompareExchange.KERNEL32(00000001,00000001,00000000), ref: 1001ADC5

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Interlocked$CompareCriticalDeleteExchangeSection$DecrementFreeHeapTimetime
String ID:
API String ID: 575379910-0
Opcode ID: 4b2b9e06dbfc7a189fe832d31680b9342d4a4f911797ed680ce7ed66d266748b
Instruction ID: 5fcf9dceec55b2fe5c3f5871ba84e04da2ee91e5bcf3991c6e7a15184a02e640
Opcode Fuzzy Hash: 4b2b9e06dbfc7a189fe832d31680b9342d4a4f911797ed680ce7ed66d266748b
Instruction Fuzzy Hash: A9719D7190065AEFDB11CF68CC84B5AB7F8FF05311F004669E81A9F691D774E984CBA1

Function 10022849 Relevance: 19.6, APIs: 13, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,00000001,10023AED,101B7938,00000008,10023C24,?,00000001,?,101B7958,0000000C,10023BC3,?,00000001,?), ref: 10022851
_free.LIBCMT ref: 1002286A

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

_free.LIBCMT ref: 1002287D
_free.LIBCMT ref: 1002289B
_free.LIBCMT ref: 100228AD
_free.LIBCMT ref: 100228BE
_free.LIBCMT ref: 100228C9
_free.LIBCMT ref: 100228E3
EncodePointer.KERNEL32(00000000), ref: 100228EA
_free.LIBCMT ref: 100228FF
_free.LIBCMT ref: 10022915
InterlockedDecrement.KERNEL32 ref: 10022927
_free.LIBCMT ref: 10022941

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeDecrementEncodeErrorFreeHeapInterlockedLast
String ID:
API String ID: 4264854383-0
Opcode ID: 6e45babb980946f711f94ecee9eb40fee16fb67e0b8076907215f6ffe089f320
Instruction ID: da1824f0f3d6086db6776b7d0893ce00e841dd68cd6532bffb288ba0f97f575f
Opcode Fuzzy Hash: 6e45babb980946f711f94ecee9eb40fee16fb67e0b8076907215f6ffe089f320
Instruction Fuzzy Hash: 64218DBA805231ABC715EF74FCC040A37B5FB043647E1466AF900E7A7ADB399881CB41

Function 10015160 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72libraryloaderstringCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 10015178
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 10015190
GetProcAddress.KERNEL32(?,Process32First), ref: 100151A8
GetProcAddress.KERNEL32(?,Process32Next), ref: 100151C0
lstrcmpiA.KERNEL32(1000E8DC,?), ref: 10015243
CloseHandle.KERNEL32(00000000), ref: 10015262
FreeLibrary.KERNEL32(00000000), ref: 10015278

Strings

kernel32.dll, xrefs: 10015173
Process32Next, xrefs: 100151B4
CreateToolhelp32Snapshot, xrefs: 10015184
Process32First, xrefs: 1001519C

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$CloseFreeHandleLoadlstrcmpi
String ID: CreateToolhelp32Snapshot$Process32First$Process32Next$kernel32.dll
API String ID: 1314729832-4285911020
Opcode ID: 1cd6a8fbb2155a4b1985ca30da2e4b0a3f5bfe765f9448f08b89226ab9c6a634
Instruction ID: b23b302b637ae1edde1f60404815d2dee06a1769a5a7b90f0171de9587be8fa8
Opcode Fuzzy Hash: 1cd6a8fbb2155a4b1985ca30da2e4b0a3f5bfe765f9448f08b89226ab9c6a634
Instruction Fuzzy Hash: 4B31AE75911228DBDB61DBA4CD88BEDB7B4FB49301F0005D8E90EAA250DB75AAC4CF50

Function 10018790 Relevance: 18.2, APIs: 12, Instructions: 172memorytimeCOMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 100187D0
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 100187DD
InterlockedDecrement.KERNEL32(00000000), ref: 100187FC
DeleteCriticalSection.KERNEL32(?), ref: 10018819
HeapFree.KERNEL32(?,00000000,?), ref: 10018824
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 100188AF
timeGetTime.WINMM ref: 100188D1
timeGetTime.WINMM ref: 100188DC
InterlockedDecrement.KERNEL32(00000000), ref: 1001890A
DeleteCriticalSection.KERNEL32(-00000018), ref: 10018933
HeapFree.KERNEL32(?,00000000,00000000), ref: 10018940
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 1001894E

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Interlocked$CompareExchange$CriticalDecrementDeleteFreeHeapSectionTimetime
String ID:
API String ID: 2485412644-0
Opcode ID: f37f0bf1c14315c2a0328e2bdc40fd7b1b2d9f8162c99514ea29b688ea27d9bd
Instruction ID: ccbf6a195e50664b114f756a4c275c858458adfb65b41e8f4299d56aa6b79b38
Opcode Fuzzy Hash: f37f0bf1c14315c2a0328e2bdc40fd7b1b2d9f8162c99514ea29b688ea27d9bd
Instruction Fuzzy Hash: 3C51AC76A00615EFDB11CF68CC84B9AB7F8FF04710F204569F919AB291D734EA80CB91

Function 1000E190 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E1DD
_memset.LIBCMT ref: 1000E1FA
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,?,?,?,?,?,?,1AA35F0A), ref: 1000E20F
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,\360se6\User Data\,00000000,?,?,?,?,?,?,1AA35F0A), ref: 1000E258
Sleep.KERNEL32(000003E8,Default,?,?,?,?,?,?,1AA35F0A), ref: 1000E273
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E298

Strings

360se6.exe, xrefs: 1000E1BB
Default, xrefs: 1000E25E
bak, xrefs: 1000E247
\360se6\User Data\, xrefs: 1000E22E

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: 360se6.exe$Default$\360se6\User Data\$bak
API String ID: 2742518391-1576209161
Opcode ID: cf5631d64cf3daff86f29a9e46f2c2e6785fc6ccd8703a21c0b353372ed7785e
Instruction ID: 701f933334c7848fb056ee3a11f22efabf5e93a761c2cecb354365ab54c774ad
Opcode Fuzzy Hash: cf5631d64cf3daff86f29a9e46f2c2e6785fc6ccd8703a21c0b353372ed7785e
Instruction Fuzzy Hash: B6316C75950258ABEB24DB60CC9ABDDB378EB14700F0001E9F5096A2D1EB787B84CF61

Function 1000E2F0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E33D
_memset.LIBCMT ref: 1000E35A
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001C,00000000,?,?,?,?,?,?,1AA35F0A), ref: 1000E36F
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,\Google\Chrome\User Data\,00000000,?,?,?,?,?,?,1AA35F0A), ref: 1000E3B8
Sleep.KERNEL32(000003E8,Default,?,?,?,?,?,?,1AA35F0A), ref: 1000E3D3
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E3F8

Strings

chrome.exe, xrefs: 1000E31B
\Google\Chrome\User Data\, xrefs: 1000E38E
Default, xrefs: 1000E3BE
bak, xrefs: 1000E3A7

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: Default$\Google\Chrome\User Data\$bak$chrome.exe
API String ID: 2742518391-1166745273
Opcode ID: 40d655d6cc16712bff4f2fb1f87b01a0d4e762ec64db6e7df24cb74d5259b5f4
Instruction ID: fecff77be065e459785ac47ee9805b112d0841096ecda917c53accf8bb13844d
Opcode Fuzzy Hash: 40d655d6cc16712bff4f2fb1f87b01a0d4e762ec64db6e7df24cb74d5259b5f4
Instruction Fuzzy Hash: 20316A75950258EBEB24DB60CC9ABD9B378EB14700F0002E9F5096A2D1EB787B84CF65

Function 1000E4A0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E4ED
_memset.LIBCMT ref: 1000E50A
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001C,00000000,?,?,?,?,?,?,1AA35F0A), ref: 1000E51F
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,\Tencent\QQBrowser\User Data\,00000000,?,?,?,?,?,?,1AA35F0A), ref: 1000E568
Sleep.KERNEL32(000003E8,Default,?,?,?,?,?,?,1AA35F0A), ref: 1000E583
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E5A8

Strings

\Tencent\QQBrowser\User Data\, xrefs: 1000E53E
Default, xrefs: 1000E56E
bak, xrefs: 1000E557
QQBrowser.exe, xrefs: 1000E4CB

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: Default$QQBrowser.exe$\Tencent\QQBrowser\User Data\$bak
API String ID: 2742518391-2429508344
Opcode ID: 0e54152de5e706dd32317b2883b6d9b22f54a27d1984d202d2b92858c0c27df3
Instruction ID: 303e9ac27bd1ca3b56e85ec31da4520ec1f556187fdca0bed45659d0685da91e
Opcode Fuzzy Hash: 0e54152de5e706dd32317b2883b6d9b22f54a27d1984d202d2b92858c0c27df3
Instruction Fuzzy Hash: 00316C75950258EFEB24DB60CC9ABD9B378EB14700F0001D9F5096A2D1EB787B84CF61

Function 1000E600 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E64D
_memset.LIBCMT ref: 1000E66A
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,?,?,?,?,?,?,1AA35F0A), ref: 1000E67F
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,\Microsoft\,00000000,?,?,?,?,?,?,1AA35F0A), ref: 1000E6C8
Sleep.KERNEL32(000003E8,Skype for Desktop,?,?,?,?,?,?,1AA35F0A), ref: 1000E6E3
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E708

Strings

Skype for Desktop, xrefs: 1000E6CE
bak, xrefs: 1000E6B7
\Microsoft\, xrefs: 1000E69E
Skype.exe, xrefs: 1000E62B

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: Skype for Desktop$Skype.exe$\Microsoft\$bak
API String ID: 2742518391-3712293284
Opcode ID: 609e6d69384bd8dc0245cb6b53dc543715522320479eba0b398141e820af1bdb
Instruction ID: 5cbbd60c3ee543de6939a2953fd336e89185860d59f2e57474878281ef46e463
Opcode Fuzzy Hash: 609e6d69384bd8dc0245cb6b53dc543715522320479eba0b398141e820af1bdb
Instruction Fuzzy Hash: FB316A75950258ABEB24DB64CC9ABD9B378EB14700F0002E9F5096A2D1EB787B84CF61

Function 100138F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 70registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10013918
RegOpenKeyExA.ADVAPI32(80000001,101AFE40,00000000,00020006,?), ref: 10013944
_sprintf.LIBCMT ref: 1001397C
_strlen.LIBCMT ref: 1001398B
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 100139A9
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,?), ref: 100139D7
RegCloseKey.ADVAPI32(?), ref: 100139EA

Strings

C:\Users\Public\Documents\, xrefs: 1001396B
Windows Update, xrefs: 10013966
%s%s, xrefs: 10013970

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseFileModuleNameOpenValue_memset_sprintf_strlen
String ID: %s%s$C:\Users\Public\Documents\$Windows Update
API String ID: 2914755242-3221868064
Opcode ID: a37f16671de4bf3d8217d41773bbf0f470df6e6be3ad6b2328483c6e46eca91b
Instruction ID: 74569bc2ad6f0a8eef20b1f4c122fea453a43a38896f5d2099743f1305caba47
Opcode Fuzzy Hash: a37f16671de4bf3d8217d41773bbf0f470df6e6be3ad6b2328483c6e46eca91b
Instruction Fuzzy Hash: 08210C75900218AFEB64DBA0CC86BD97778EB18701F404599E649AA181DBB46AC4CF91

Function 10007580 Relevance: 16.7, APIs: 11, Instructions: 233COMMONLIBRARYCODE

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 1000765B
char_traits.LIBCPMTD ref: 1000767F
char_traits.LIBCPMTD ref: 100076B0
char_traits.LIBCPMTD ref: 100076DA
char_traits.LIBCPMTD ref: 10007711
char_traits.LIBCPMTD ref: 10007735

Part of subcall function 10007520: _memmove.LIBCMT ref: 1000753E

char_traits.LIBCPMTD ref: 1000776F
char_traits.LIBCPMTD ref: 1000779B

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: char_traits$_memmove
String ID:
API String ID: 4015421094-0
Opcode ID: 8a46f27c53daf1bb3a5c5b26083eeb91bd03bd6e6ef27442f332e57adb46b26b
Instruction ID: 392e569acab4bc7803cc6a5d1307a5f36e8b576372a140fd2397c7b8e5873d66
Opcode Fuzzy Hash: 8a46f27c53daf1bb3a5c5b26083eeb91bd03bd6e6ef27442f332e57adb46b26b
Instruction Fuzzy Hash: 53A1B47AA00008EFDB04DF98DD92D9E77B6FF58298B248154F9099725ADB30FE50CB90

Function 10029B73 Relevance: 16.7, APIs: 11, Instructions: 229COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 10029B81

Part of subcall function 10027FF1: __mtinitlocknum.LIBCMT ref: 10028003
Part of subcall function 10027FF1: __amsg_exit.LIBCMT ref: 1002800F
Part of subcall function 10027FF1: EnterCriticalSection.KERNEL32(?,?,10025D6D,0000000D), ref: 1002801C

@_EH4_CallFilterFunc@8.LIBCMT ref: 10029B9F
__calloc_crt.LIBCMT ref: 10029BB8
@_EH4_CallFilterFunc@8.LIBCMT ref: 10029BD3
GetStartupInfoW.KERNEL32(?,101B7C90,00000064), ref: 10029C28
__calloc_crt.LIBCMT ref: 10029C73
GetFileType.KERNEL32(00000001), ref: 10029CBA
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 10029CF3
GetStdHandle.KERNEL32(-000000F6), ref: 10029DAC
GetFileType.KERNEL32(00000000), ref: 10029DBE
InitializeCriticalSectionAndSpinCount.KERNEL32(-101BEA54,00000FA0), ref: 10029DF3

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CallCountFileFilterFunc@8InitializeSpinType__calloc_crt$EnterHandleInfoStartup__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 301580142-0
Opcode ID: 253e1a18d07f7ed5b743515052310a273316cb8cc387dfcc17b4352ffc5cb5ed
Instruction ID: 539e413c7bcea522b47ae7ad5c28c4f5532b66027edab54cb976d1ebee692ea2
Opcode Fuzzy Hash: 253e1a18d07f7ed5b743515052310a273316cb8cc387dfcc17b4352ffc5cb5ed
Instruction Fuzzy Hash: D3910671D043558FDB20CF68E88069DBBF4FF463A0B60426EE4AAAB3D1C7349842DB10

Function 10010380 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 112filestringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1001039F
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000004,00000080,00000000), ref: 10010406
GetFileSize.KERNEL32(?,00000000), ref: 10010425
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 1001044A
lstrlenA.KERNEL32(1000EEB8), ref: 10010454
lstrlenA.KERNEL32(1000EEB8,00000000,00000000), ref: 100104D6
WriteFile.KERNEL32(?,?,00000000), ref: 100104EB
CloseHandle.KERNEL32(?), ref: 100104F8

Strings

.key, xrefs: 100103D9

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$lstrlen$CloseCreateDirectoryHandlePointerSizeSystemWrite
String ID: .key
API String ID: 1674266968-343438762
Opcode ID: ffe63ab53faeb08c4fabfe3c25abd14c77d86f4555a55f109598a67c17bf6787
Instruction ID: 1c9aefebe2efcbaba9d66af4461c31df970b4e064e3fc872ccff81242f4e36e7
Opcode Fuzzy Hash: ffe63ab53faeb08c4fabfe3c25abd14c77d86f4555a55f109598a67c17bf6787
Instruction Fuzzy Hash: 7A410CB590022CDFDB29CB64DC86BD9B7B5BF48700F0085D9F649AA241D774AAC4CF90

Function 1000FE50 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 1000FE67
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 1000FE93

Strings

open, xrefs: 1000FE8C
D, xrefs: 1000FF6D

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ExecuteShell_strlen
String ID: D$open
API String ID: 4170776411-2491301029
Opcode ID: 45e0c28ea66c154113347479300cd7af64224d28f2b9312c10382868c233d3c8
Instruction ID: 2f325713f910cbc9df21e4a28366f17d85fbec6a5c87df3961e0dadf8c324f84
Opcode Fuzzy Hash: 45e0c28ea66c154113347479300cd7af64224d28f2b9312c10382868c233d3c8
Instruction Fuzzy Hash: E3418475900318EBEB20DF50CC46BEA77B8EF45740F00409CF608AB581DBB5AA85DF51

Function 1000E760 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E7AD
_memset.LIBCMT ref: 1000E7CA
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,?,?,?,?,?,?,1AA35F0A), ref: 1000E7DF
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,101AF284,00000000,?,?,?,?,?,?,1AA35F0A), ref: 1000E828
Sleep.KERNEL32(000003E8,SogouExplorer,?,?,?,?,?,?,1AA35F0A), ref: 1000E843
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E868

Strings

SogouExplorer, xrefs: 1000E82E
bak, xrefs: 1000E817
SogouExplorer.exe, xrefs: 1000E78B

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: SogouExplorer$SogouExplorer.exe$bak
API String ID: 2742518391-538188596
Opcode ID: 387075a032f40cdf426803d7b8eb962ed2b699bce44bc087e450045890685a63
Instruction ID: cdfe1adb3a5306c7d49e930ca4d3ffe4328d7c09e084d7f548619efed37bff03
Opcode Fuzzy Hash: 387075a032f40cdf426803d7b8eb962ed2b699bce44bc087e450045890685a63
Instruction Fuzzy Hash: 14316C75950258ABEB24DBA0CC9ABD9B374EF14700F0001D9F5096A2D1EB787B84CB55

Function 10012C66 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 49sleepsynchronizationnetworkCOMMON

Download Yara Rule

APIs

SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012CB5
Sleep.KERNEL32(000001F4), ref: 10012CCA
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012CE6
CreateMutexA.KERNEL32(00000000,00000000,TMzsft xtnogaqk), ref: 10012D08
GetLastError.KERNEL32 ref: 10012D14

Part of subcall function 10022BD3: _doexit.LIBCMT ref: 10022BDD

WSAStartup.WS2_32(00000202,?), ref: 10012D34
GetVersionExA.KERNEL32(00000094), ref: 10012D4B
Sleep.KERNEL32(000F4240,00000000), ref: 10012D73

Strings

TMzsft xtnogaqk, xrefs: 10012CFF

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ServiceSleepStatus$CreateErrorLastMutexStartupVersion_doexit
String ID: TMzsft xtnogaqk
API String ID: 4049670039-2123815393
Opcode ID: a53748f86f27197abeafadced6f73c21d7a14410f93471b365f7083a90965c1a
Instruction ID: 51f78178352a1e6bbcd1a39a8c3a93efe3193938c267407751cb2d4182533f7a
Opcode Fuzzy Hash: a53748f86f27197abeafadced6f73c21d7a14410f93471b365f7083a90965c1a
Instruction Fuzzy Hash: E5216DB4504220DFE329AF60CC8EB5937B4F70430AF804298E1096A9A6D7BC6588CF12

Function 10011F60 Relevance: 15.1, APIs: 10, Instructions: 123COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10011F90
_memset.LIBCMT ref: 10011FAA
FindWindowA.USER32(101AF964,00000000), ref: 10011FBA

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$FindWindow
String ID:
API String ID: 3918834205-0
Opcode ID: 39f1a4b514bf7a49ce17fcebaa32398609855f0b54f364aa2f0891fbe461ef20
Instruction ID: d02908bb6393ccc6194f76cc94439ad83e97ec676181d408bc8d9695fa0a8030
Opcode Fuzzy Hash: 39f1a4b514bf7a49ce17fcebaa32398609855f0b54f364aa2f0891fbe461ef20
Instruction Fuzzy Hash: E44161B5901218EBEB64CBA4DC85F9D77B4FB48304F008699EA0D9F282D774AAD4CF54

Function 10006F00 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 156COMMON

Download Yara Rule

APIs

Part of subcall function 10007130: WinHttpOpen.WINHTTP(curl/7.83.1,00000000,00000000,00000000,00000000), ref: 10007197
Part of subcall function 10007130: WinHttpSetTimeouts.WINHTTP(00000000,000003E8,000003E8,000003E8,000003E8), ref: 100071BE
Part of subcall function 10007130: WinHttpConnect.WINHTTP(00000000,?,00000050,00000000), ref: 100071D6
Part of subcall function 10007130: WinHttpOpenRequest.WINHTTP(00000000,GET,?,00000000,00000000,00000000,00000000), ref: 100071FA
Part of subcall function 10007130: WinHttpSendRequest.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 10007219
Part of subcall function 10007130: WinHttpReceiveResponse.WINHTTP(00000000,00000000), ref: 1000722E
Part of subcall function 10007130: WinHttpQueryHeaders.WINHTTP(00000000,20000013,00000000,00000000,00000004,00000000), ref: 10007264
Part of subcall function 10007130: __CxxThrowException@8.LIBCMT ref: 10007272

Part of subcall function 10006250: operator!=.LIBCPMTD ref: 1000628B
Part of subcall function 10006250: operator!=.LIBCPMTD ref: 100062CD

_Func_class.LIBCPMTD ref: 10006F71
_Func_class.LIBCPMTD ref: 10006FDF

Strings

ip.ping0.cc, xrefs: 10007084
ifconfig.me, xrefs: 1000701C
ifconfig.cc, xrefs: 10006FAE
4.ipw.cn, xrefs: 10006F46

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Http$Func_classOpenRequestoperator!=$ConnectException@8HeadersQueryReceiveResponseSendThrowTimeouts
String ID: 4.ipw.cn$ifconfig.cc$ifconfig.me$ip.ping0.cc
API String ID: 2327121134-1054840108
Opcode ID: e5f02f596ccace418473e767889c4ca837b0525676b23f026339b6d6215960db
Instruction ID: 8fedc6d71d1ea5c4082eb8e8fcd3074e9b412fba7bcbbe1695d31a67eb8f4e53
Opcode Fuzzy Hash: e5f02f596ccace418473e767889c4ca837b0525676b23f026339b6d6215960db
Instruction Fuzzy Hash: 2E513D75D00508DBDB18DFA8CC52ADDB7B6FF4C3A0F548129E41A6B295EB306A49CF60

Function 10013E90 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 150libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 10013EBF
GetProcAddress.KERNEL32(?,IsBadReadPtr), ref: 10013ED1
LoadLibraryA.KERNEL32(?), ref: 10013F25
FreeLibrary.KERNEL32(00000000), ref: 10014063

Strings

IsBadReadPtr, xrefs: 10013EC8
kernel32.dll, xrefs: 10013EBA

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Library$Load$AddressFreeProc
String ID: IsBadReadPtr$kernel32.dll
API String ID: 2632591731-2271619998
Opcode ID: b8cf5a7d21cec9c91bc597fb19d05e0d91973cb50290725d0d54b057ef2bedf3
Instruction ID: 4d98165a6a2f5fd888ffb7798c0831731eea4b449ce7d88afba1872c43b950e1
Opcode Fuzzy Hash: b8cf5a7d21cec9c91bc597fb19d05e0d91973cb50290725d0d54b057ef2bedf3
Instruction Fuzzy Hash: 2F61B178A00209EFDB04CF95C484BAEBBB1FF48314F258599E915AB361C735AA85DF90

Function 1000F420 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 1000F44B
_malloc.LIBCMT ref: 1000F473
_memmove.LIBCMT ref: 1000F496

Strings

D, xrefs: 1000F551

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _malloc_memmove_strlen
String ID: D
API String ID: 3238260300-2746444292
Opcode ID: 6855c12a7bdc6e0bd8773f4745c8c759726946dada61b8ef62cf01ab51cda593
Instruction ID: 6d557a2bb59ac2ae05f88cec7faa246fa2e5727cbdb9c8dfb4b7bdd6368fabdf
Opcode Fuzzy Hash: 6855c12a7bdc6e0bd8773f4745c8c759726946dada61b8ef62cf01ab51cda593
Instruction Fuzzy Hash: 163173B5D00218EBDB64CF60DC45BEB7378EB58345F404598E60DAA241EBB6AAC4CF91

Function 100157F0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 101libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,1AA35F0A), ref: 10015828
GetProcAddress.KERNEL32(?,OpenInputDesktop), ref: 1001587D
GetProcAddress.KERNEL32(?,OpenDesktopA), ref: 1001588F
GetProcAddress.KERNEL32(?,CloseDesktop), ref: 100158A1

Part of subcall function 10015950: LoadLibraryA.KERNEL32(user32.dll,1AA35F0A,?,?,?,00000000,10023340,101B6E88,000000FE,?,100158FA,00000000), ref: 1001598B
Part of subcall function 10015950: GetProcAddress.KERNEL32(?,GetThreadDesktop), ref: 100159A3
Part of subcall function 10015950: GetProcAddress.KERNEL32(?,GetUserObjectInformationA), ref: 100159BB
Part of subcall function 10015950: GetProcAddress.KERNEL32(?,SetThreadDesktop), ref: 100159D3
Part of subcall function 10015950: GetProcAddress.KERNEL32(?,CloseDesktop), ref: 100159EB
Part of subcall function 10015950: LoadLibraryA.KERNEL32(kernel32.dll,?,?,?,00000000,10023340,101B6E88,000000FE,?,100158FA,00000000), ref: 100159FC
Part of subcall function 10015950: GetProcAddress.KERNEL32(?,GetCurrentThreadId), ref: 10015A14

Strings

user32.dll, xrefs: 10015823
CloseDesktop, xrefs: 10015898
OpenDesktopA, xrefs: 10015886
OpenInputDesktop, xrefs: 10015875, 10015878

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseDesktop$OpenDesktopA$OpenInputDesktop$user32.dll
API String ID: 2238633743-3711086354
Opcode ID: 1873b1d038e82ffe73c977c033c60f3efe240073f85bcd7195dda5366d5656d8
Instruction ID: 34810388ce7dedadcc66fe602c4080af1544b897567115cb541a18f1db2ea245
Opcode Fuzzy Hash: 1873b1d038e82ffe73c977c033c60f3efe240073f85bcd7195dda5366d5656d8
Instruction Fuzzy Hash: 16416975D08388EEEB11CBE4D888BDEBFB5EF09315F140119E405BA281CBBA5944CB65

Function 1001C3A0 Relevance: 13.6, APIs: 9, Instructions: 149memorynetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 1001B6A0: HeapAlloc.KERNEL32(?,00000000,?,?,?,?,?,?,1001D1A7,?,1001C0BB,?,?,?,?,1001EAD1), ref: 1001B6CA

EnterCriticalSection.KERNEL32(00000054,?,00000000,1AA35F0A,?,00000000), ref: 1001C3F8

Part of subcall function 1001BD70: timeGetTime.WINMM ref: 1001BD78
Part of subcall function 1001BD70: _memmove.LIBCMT ref: 1001BDDC

GetLastError.KERNEL32 ref: 1001C470
CreateIoCompletionPort.KERNEL32(?,?,00000000,00000000), ref: 1001C44A

Part of subcall function 100172C0: __CxxThrowException@8.LIBCMT ref: 100172D2
Part of subcall function 100172C0: EnterCriticalSection.KERNEL32(00000000,1AA35F0A,00000000,00000098,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005), ref: 10017312
Part of subcall function 100172C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005,?,100168C9,00000400,00000400), ref: 1001737B

connect.WS2_32(?,?,0000001C), ref: 1001C497
CreateIoCompletionPort.KERNEL32(?,?,00000000,00000000), ref: 1001C4CC
HeapFree.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 1001C552
LeaveCriticalSection.KERNEL32(00000054), ref: 1001C559

Part of subcall function 1001A870: ioctlsocket.WS2_32(?,8004667E,?), ref: 1001A87F

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CompletionCreateEnterHeapLeavePort$AllocErrorException@8FreeLastThrowTime_memmoveconnectioctlsockettime
String ID:
API String ID: 577898059-0
Opcode ID: fb6ef4b531d651df34b6af81ca114c1cb161ed1b6c4b7f8e2a56bc7a7bb065d0
Instruction ID: 13f5607a006f5134b6e7d624e793b95b5dada5aad690ad180316847aeaa3252a
Opcode Fuzzy Hash: fb6ef4b531d651df34b6af81ca114c1cb161ed1b6c4b7f8e2a56bc7a7bb065d0
Instruction Fuzzy Hash: CA518F75600208AFDB11DF64CC85FAA77AAFF44350F144428FD09EE2A1DB71E890DB60

Function 1001E560 Relevance: 13.6, APIs: 9, Instructions: 139COMMON

Download Yara Rule

APIs

_memmove_s.LIBCMT ref: 1001E5C0

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memmove_s
String ID:
API String ID: 800865076-0
Opcode ID: bfd165e00e761db38f2bdf525350d73678aeff4c921f7e730ca0ddaf86c9b7a3
Instruction ID: e53b5beb10ba7e09faa63e27da374d48c55a1d98f715c35b0f5f6325fba29714
Opcode Fuzzy Hash: bfd165e00e761db38f2bdf525350d73678aeff4c921f7e730ca0ddaf86c9b7a3
Instruction Fuzzy Hash: 59418D36200655AFD711DF68C888B9EF7E9FF44364F10402AF9098B291DB75EDA08BA0

Function 1000EDC0 Relevance: 13.6, APIs: 9, Instructions: 80stringtimeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000EDDF
GetForegroundWindow.USER32 ref: 1000EDE7
GetWindowTextA.USER32(00000000,101BC5F8,00000400), ref: 1000EE02
_memset.LIBCMT ref: 1000EE27
lstrlenA.KERNEL32(101BC5F8), ref: 1000EE47
GetLocalTime.KERNEL32(?), ref: 1000EE5C
wsprintfA.USER32 ref: 1000EEA3
_memset.LIBCMT ref: 1000EEC9
_memset.LIBCMT ref: 1000EEDD

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$Window$ForegroundLocalTextTimelstrlenwsprintf
String ID:
API String ID: 2818073195-0
Opcode ID: 75adef7124855e83a17f00d692abf37ea0045c21f2baa1bf399519b3b5abe7e2
Instruction ID: 03485689b72bf285f166b7c4cb3250636e2bcbf9ff048aaab2fc2e49669969a2
Opcode Fuzzy Hash: 75adef7124855e83a17f00d692abf37ea0045c21f2baa1bf399519b3b5abe7e2
Instruction Fuzzy Hash: 753168F5A0012D9BD734DB54CD85BE973B8EB44704F0041A8F7097A191EB787AC5CB69

Function 100298C9 Relevance: 13.6, APIs: 9, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

__ioinit.LIBCMT ref: 100298CC

Part of subcall function 10029B38: InitOnceExecuteOnce.KERNEL32(101BE634,10029B73,00000000,00000000,1003508B,101B7FB0,0000000C,10005D7E,zstd), ref: 10029B46

__get_osfhandle.LIBCMT ref: 100298E0
__get_osfhandle.LIBCMT ref: 1002990B
__get_osfhandle.LIBCMT ref: 10029914
__get_osfhandle.LIBCMT ref: 10029920
CloseHandle.KERNEL32(00000000,?,?,?,10029874,?,101B7C48,00000010,1002399B,00000000,?,?,?), ref: 10029927
GetLastError.KERNEL32(?,10029874,?,101B7C48,00000010,1002399B,00000000,?,?,?), ref: 10029931
__free_osfhnd.LIBCMT ref: 1002993E
__dosmaperr.LIBCMT ref: 10029960

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: __get_osfhandle$Once$CloseErrorExecuteHandleInitLast__dosmaperr__free_osfhnd__ioinit
String ID:
API String ID: 974577687-0
Opcode ID: aeb50e6623f9612fbfea4720a11a12ee66fd82b979432c8a2b3a73e6567c2db6
Instruction ID: 534cc79353f924f132b53f2d2c247f43b701ca5fdf2037831c5180732be56f73
Opcode Fuzzy Hash: aeb50e6623f9612fbfea4720a11a12ee66fd82b979432c8a2b3a73e6567c2db6
Instruction Fuzzy Hash: 491148326042A41AD261D63C798976E36CCDF42BF4FE6079DFD2EDB0D2EA24ACC18150

Function 10012E80 Relevance: 13.6, APIs: 9, Instructions: 62sleepCOMMON

Download Yara Rule

APIs

SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012EC6
Sleep.KERNEL32(000001F4), ref: 10012ED1
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012F10
Sleep.KERNEL32(000001F4), ref: 10012F1B
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012F5A
Sleep.KERNEL32(000001F4), ref: 10012F65
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012FA0
Sleep.KERNEL32(000001F4), ref: 10012FAB
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012FD1

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ServiceStatus$Sleep
String ID:
API String ID: 4108286180-0
Opcode ID: 3093577f81a1bfef1be0275f51949fcebcef33dae7894a088e6bc179c9b4736d
Instruction ID: 2eb2aa5b39fb85c5a3343167d6ecbcddaa6ef8ab947596cac2bc6c57621dfea1
Opcode Fuzzy Hash: 3093577f81a1bfef1be0275f51949fcebcef33dae7894a088e6bc179c9b4736d
Instruction Fuzzy Hash: 1C31F7B4104221DFE31DFF60CC98B957BB8F708308F804368E5095BAA5E7BD6598DB56

Function 10011580 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100115CC
GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 100115E0
CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 10011647
GetFileSize.KERNEL32(000000FF,00000000), ref: 10011669

Part of subcall function 1001EF9C: _malloc.LIBCMT ref: 1001EFB4

ReadFile.KERNEL32(000000FF,?,00000000,00000000,00000000), ref: 100116B4
CloseHandle.KERNEL32(000000FF), ref: 10011771

Strings

.key, xrefs: 1001161A

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateDirectoryHandleReadSizeSystem_malloc_memset
String ID: .key
API String ID: 1189190961-343438762
Opcode ID: e3cca6749972bda63ac77e56a70e5a53b244fe33762708ed0120600f45f4504f
Instruction ID: 3d4300d2710fecc02f3fab15f3df85ad30c21ba86dc6f63d814e5d622af92f7c
Opcode Fuzzy Hash: e3cca6749972bda63ac77e56a70e5a53b244fe33762708ed0120600f45f4504f
Instruction Fuzzy Hash: 2551EAB5D0022C9BDB69CB64DC82BD9B7B4AB58300F0045D8E64DAB281DB74AFC4CF91

Function 10011E10 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 59stringnetworkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10011E5F
_memset.LIBCMT ref: 10011E71

Part of subcall function 100153E0: _memset.LIBCMT ref: 10015432
Part of subcall function 100153E0: _memset.LIBCMT ref: 10015448
Part of subcall function 100153E0: _memset.LIBCMT ref: 1001545E
Part of subcall function 100153E0: LoadLibraryA.KERNEL32(ADVAPI32.dll), ref: 1001546B

lstrlenA.KERNEL32(?), ref: 10011EA4
gethostname.WS2_32(?,10012B7F), ref: 10011EB6
lstrlenA.KERNEL32(?), ref: 10011EC0

Strings

HostName, xrefs: 10011E87
SYSTEM\Setup, xrefs: 10011E23

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$lstrlen$LibraryLoadgethostname
String ID: HostName$SYSTEM\Setup
API String ID: 3877737349-3163474852
Opcode ID: 3c57c7ea14b851b5edd5a4aedf8599d14a790c5ab8a68f19adf55a60d148b559
Instruction ID: 6f4c2ddfbcec68ea414a63b34556a325c0cca03fb215b7fd9fe6e58d22cc8f59
Opcode Fuzzy Hash: 3c57c7ea14b851b5edd5a4aedf8599d14a790c5ab8a68f19adf55a60d148b559
Instruction Fuzzy Hash: B41133B9A40218EBD714DF94DC81FAA77B8EB88600F00815CFA0D5B281D635EB41CB94

Function 1001E990 Relevance: 12.2, APIs: 8, Instructions: 179threadnetworkCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000040,?,00000001,000000FF), ref: 1001EA1C
CloseHandle.KERNEL32(?,?,00000001,000000FF), ref: 1001EA33

Part of subcall function 1001A570: PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,1001E9C8,?), ref: 1001A57C

GetCurrentThreadId.KERNEL32 ref: 1001EA8E
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 1001EAB3
GetLastError.KERNEL32(?,?,?), ref: 1001EAEF
WSAGetOverlappedResult.WS2_32(00000000,?,?,00000000,?), ref: 1001EB11
WSAGetLastError.WS2_32 ref: 1001EB1B
GetCurrentThreadId.KERNEL32 ref: 1001EB41

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CompletionCurrentErrorLastQueuedStatusThread$CloseHandleMultipleObjectsOverlappedPostResultWait
String ID:
API String ID: 1776276126-0
Opcode ID: b262b485ae6c8d05e2cc6277a80d9fb5ca37b47e31c1310d56df349767435e47
Instruction ID: 66b5417a272267f179c33290e45a533a74909bc530ce5bb48fcf6268d69e9a86
Opcode Fuzzy Hash: b262b485ae6c8d05e2cc6277a80d9fb5ca37b47e31c1310d56df349767435e47
Instruction Fuzzy Hash: A8519275900219AFDB11DFA8C8C5AAEBBB9FF48350F504569FA169B211DB30FE40CB91

Function 10019E20 Relevance: 12.1, APIs: 8, Instructions: 133networkCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 10019EDE
getaddrinfo.WS2_32(?,00000000,00000C00,00000000), ref: 10019F03
_free.LIBCMT ref: 10019F1C
WSASetLastError.WS2_32(00000000,?,?,?,?,?,?,?,?), ref: 10019F29
_memmove.LIBCMT ref: 10019F6D
freeaddrinfo.WS2_32(00000000,?,?,?,?,?,?,?,?), ref: 10019F7B
htons.WS2_32(?), ref: 10019F88
WSASetLastError.WS2_32(00002AF9,?,?,?,?,?,?,?,?), ref: 10019FAA

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free_memcpy_s_memmovefreeaddrinfogetaddrinfohtons
String ID:
API String ID: 1080299913-0
Opcode ID: 38c9a16045676048a6fe288dd4f45fcc865443c53d635113eaf2434cff52915d
Instruction ID: 09d37e572ec1318aebb19466cc5ed3869c43ff4f8d51cd655d2081561f1130ca
Opcode Fuzzy Hash: 38c9a16045676048a6fe288dd4f45fcc865443c53d635113eaf2434cff52915d
Instruction Fuzzy Hash: FF416171A00229ABDB20CF64CC85BAAB7B4FF55240F4181A9F94DDB111EB719EC9CB90

Function 10002740 Relevance: 12.1, APIs: 8, Instructions: 56COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10002756

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

DeleteCriticalSection.KERNEL32(?), ref: 10002778
_free.LIBCMT ref: 1000277F
DeleteCriticalSection.KERNEL32(?,00000000), ref: 100027B2
_free.LIBCMT ref: 100027B9
_free.LIBCMT ref: 100027C2
_free.LIBCMT ref: 100027D1
_free.LIBCMT ref: 100027D7

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$CriticalDeleteSection$ErrorFreeHeapLast
String ID:
API String ID: 229044151-0
Opcode ID: 829fe4cc710feb83a16dcdc532ce873229ccf800336d69de1fb585340b12b445
Instruction ID: 16a73a784ab602da626493d70980f9eae99143d6bc0915a138f34a67110a4392
Opcode Fuzzy Hash: 829fe4cc710feb83a16dcdc532ce873229ccf800336d69de1fb585340b12b445
Instruction Fuzzy Hash: 560108B66007105BE612EF209C82A6B73AAEF80580F54442CF94A47207DB35F985C7E2

Function 10018DD0 Relevance: 10.7, APIs: 7, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,?,?,00000000,1AA35F0A), ref: 10018E77
HeapFree.KERNEL32(?,00000000,?), ref: 10018E84
_free.LIBCMT ref: 10018F18
HeapDestroy.KERNEL32(?), ref: 10018F8E
HeapCreate.KERNEL32(?,?,?), ref: 10018F9F
HeapDestroy.KERNEL32(00000000), ref: 10018FAC
HeapCreate.KERNEL32(?,?,?), ref: 10018FB7

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Heap$CreateDestroy$CriticalDeleteFreeSection_free
String ID:
API String ID: 1764084169-0
Opcode ID: c3f88b120b0d50cfdc866e451160b25d59f4e1943c12536e881b99dc529dd748
Instruction ID: 8cea0ffc507937525084062c29ae185d00e44530d60b22a0429b01e019052092
Opcode Fuzzy Hash: c3f88b120b0d50cfdc866e451160b25d59f4e1943c12536e881b99dc529dd748
Instruction Fuzzy Hash: 2B5148B1A00606EFDB05CFA4C881B9ABBF5FF08304F044569E909AF651DB35EA55CBA0

Function 100145C0 Relevance: 10.7, APIs: 7, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd34e201d1059666f78fc474e3004731cd6cb8f970c98b5a1a8be2d127c39e0
Instruction ID: df39f66d2745d17a7fe87e744aa0e03a21574858425a6f03c3f21479afaab56c
Opcode Fuzzy Hash: bfd34e201d1059666f78fc474e3004731cd6cb8f970c98b5a1a8be2d127c39e0
Instruction Fuzzy Hash: 536109B9E00209EFDB44CF94C884B9EB7B5FF48304F218598E905AB395D775EA81DB90

Function 10002070 Relevance: 10.6, APIs: 7, Instructions: 114COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 1000208B
WakeAllConditionVariable.KERNEL32(?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 100020AD
LeaveCriticalSection.KERNEL32(?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 100020B4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 100020EC
SleepConditionVariableCS.KERNEL32(?,?,000000FF,?,?,?,100025EE,?,?,?,10002B57,?), ref: 1000210D
LeaveCriticalSection.KERNEL32(?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 10002116
_free.LIBCMT ref: 1000213E

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveVariable$SleepWake_free
String ID:
API String ID: 1710734047-0
Opcode ID: e61bd854db23e898daa16de29f131cc90b3ab22f0d1ab1bd32c91fa0d06ec401
Instruction ID: 05dc04eb116ff6e28942813317816f3c30ed5ba661128168b5cad8891ce245dc
Opcode Fuzzy Hash: e61bd854db23e898daa16de29f131cc90b3ab22f0d1ab1bd32c91fa0d06ec401
Instruction Fuzzy Hash: 8D4190B1601B069FE724CF64C884796B7F4FF14390F51462AE91ACB695D730F894CBA1

Function 1001A6F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,?), ref: 1001A70C
GetProcAddress.KERNEL32(00000000,CreateFileTransactedA), ref: 1001A721
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?), ref: 1001A76A
GetFileSize.KERNEL32(?,?), ref: 1001A78C

Strings

kernel32.dll, xrefs: 1001A707
CreateFileTransactedA, xrefs: 1001A71B

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$AddressCreateHandleModuleProcSize
String ID: CreateFileTransactedA$kernel32.dll
API String ID: 381258031-3827029016
Opcode ID: 2b602c5be5b8ceff7d4341a465a72c2674a25abf06f1222532ee79990a52c5db
Instruction ID: 3fd96c11bbd7488a8a418e2e25c194671cc8f240b4c6ee697fb62349ff201565
Opcode Fuzzy Hash: 2b602c5be5b8ceff7d4341a465a72c2674a25abf06f1222532ee79990a52c5db
Instruction Fuzzy Hash: 0431AD34744205BBEB31CA649C45B9977F8EF02B61F20425AFE18EE1D0D7B1EAD0D654

Function 1001A8B0 Relevance: 10.6, APIs: 7, Instructions: 96COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000001,0000FFFF,000000FB,00000001,00000004), ref: 1001A8E5
setsockopt.WS2_32(00000001,0000FFFF,00000004,00000000,00000004), ref: 1001A8F7
setsockopt.WS2_32(00000001,0000FFFF,000000FB,00000000,00000004), ref: 1001A91E
setsockopt.WS2_32(00000001,0000FFFF,00000004,00000000,00000004), ref: 1001A930

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 7b82cd8a322e7eafe5a33a62bfc76d56978321d665ea09961d1f1c17fe74bef7
Instruction ID: 2534b507c7e92884fcc3b13e06d001a7cc937f1284d80b897d24f64fcb9b5863
Opcode Fuzzy Hash: 7b82cd8a322e7eafe5a33a62bfc76d56978321d665ea09961d1f1c17fe74bef7
Instruction Fuzzy Hash: 2521FBB674421E7AEB10C6959C81FA9775CDF45771F200272FF18DB2C1D971994887A0

Function 1001E880 Relevance: 10.6, APIs: 7, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000,1AA35F0A,?,00000000,?,?,00000000,10035FA8,000000FF,?,1001DB19,00000000,?,?,1001D937,?), ref: 1001E8BC
EnterCriticalSection.KERNEL32(00000000,1AA35F0A,?,00000000,?,?,00000000,10035FA8,000000FF,?,1001DB19,00000000,?,?,1001D937,?), ref: 1001E8F8
SetLastError.KERNEL32(00000000,?,1001DB19,00000000,?,?,1001D937,?,00000000,?,?,?,?,1001EB3A,?,?), ref: 1001E90D
LeaveCriticalSection.KERNEL32(?,?,1001DB19,00000000,?,?,1001D937,?,00000000,?,?,?,?,1001EB3A,?,?), ref: 1001E92C
InterlockedDecrement.KERNEL32(00000028), ref: 1001E948
HeapFree.KERNEL32(?,00000000,00000000,00000000,?,1001DB19,00000000,?,?,1001D937,?,00000000,?,?,?), ref: 1001E969

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalErrorLastSection$DecrementEnterFreeHeapInterlockedLeave
String ID:
API String ID: 2534375417-0
Opcode ID: 8a373b9e699bbe36eec3ad261a269d3c2d471c0edf0be97ca4a8e9b207caec58
Instruction ID: c19bc2cfbfcf6eb32c943866d2ea1f3cbf7c2381cbd68fa049da8d29006db6f8
Opcode Fuzzy Hash: 8a373b9e699bbe36eec3ad261a269d3c2d471c0edf0be97ca4a8e9b207caec58
Instruction Fuzzy Hash: 46315A32600645AFDB61CF64CC88B9ABBF9FF48361F04452AF91ADB660DB31E854CB50

Function 100137C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100137E8
_strcat.LIBCMT ref: 10013887
RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,000F003F,?), ref: 100138BD
RegCloseKey.ADVAPI32(?), ref: 100138CE

Strings

TMzsft xtnogaqk, xrefs: 1001388F
SYSTEM\CurrentControlSet\Services\, xrefs: 1001387C, 1001387F

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseOpen_memset_strcat
String ID: SYSTEM\CurrentControlSet\Services\$TMzsft xtnogaqk
API String ID: 3167732647-1014003165
Opcode ID: 2662b6faaf2599209bb8ca6bb403307948ab9ad392b1d5476d8a6161b5a9aa7b
Instruction ID: 22143534158840905b67e581eba63ca17ab0457cd731155eff119560de7604f3
Opcode Fuzzy Hash: 2662b6faaf2599209bb8ca6bb403307948ab9ad392b1d5476d8a6161b5a9aa7b
Instruction Fuzzy Hash: AD41D020D0C2C9D9EB02C7A888097DEBFB55B26749F0840D8D5887A282D7FE5758C7B6

Function 10003320 Relevance: 10.6, APIs: 7, Instructions: 80COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 10003330

Part of subcall function 10024166: __calloc_impl.LIBCMT ref: 10024179

InitializeCriticalSection.KERNEL32(00000018,00000000), ref: 1000335C
InitializeConditionVariable.KERNEL32(00000030), ref: 1000336C
InitializeConditionVariable.KERNEL32(00000034), ref: 10003372
__beginthreadex.LIBCMT ref: 100033A8

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Initialize$ConditionVariable$CriticalSection__beginthreadex__calloc_impl_calloc
String ID:
API String ID: 4275094566-0
Opcode ID: 1c90a2da0a09f1423271f63d7b8369d043ae484d91931262826aadb9d33fa527
Instruction ID: d63cbc47a989e61f8d5764840e3dc6a2f22de4f4aba891b4dc0ad6eac0f10f79
Opcode Fuzzy Hash: 1c90a2da0a09f1423271f63d7b8369d043ae484d91931262826aadb9d33fa527
Instruction Fuzzy Hash: 582192B660071AAFE711DF95EC84B97B7ECFB40350F504029EA08C7541EBB5B6598BA0

Function 100105B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 100105D3
_memset.LIBCMT ref: 100105FB
GetTempPathA.KERNEL32(00000104,?), ref: 1001060F

Strings

D, xrefs: 1001067A

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: PathTemp_memset_strrchr
String ID: D
API String ID: 3269299267-2746444292
Opcode ID: 65dff33f197481420d75febd2944a67fcb56e30f99d0bf04b3eaf0f89ed5e44e
Instruction ID: 94703a5b4a1e95a47fdd501beecf67a154b79f006fe411b9632ef845b5e6f6b1
Opcode Fuzzy Hash: 65dff33f197481420d75febd2944a67fcb56e30f99d0bf04b3eaf0f89ed5e44e
Instruction Fuzzy Hash: 2F218BB9D00218EBDB24DB50DC45BDA7378EB58305F444498F54D9E281EBB5ABC4CFA0

Function 10011FE0 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 10012026
_memset.LIBCMT ref: 10012042
GetWindowTextA.USER32(00000000,00000000,00000040), ref: 10012061
_strncpy.LIBCMT ref: 100120B5
_strncat.LIBCMT ref: 100120CA
GetWindow.USER32(00000000,00000002), ref: 100120EA
GetClassNameA.USER32(00000000,00000000,00000080), ref: 10012109

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Window$ClassNameText_memset_strncat_strncmp_strncpy
String ID:
API String ID: 3228922498-0
Opcode ID: 9b23a114edeb7ee68d8fe2a349bbd8718838ecac6987a0b2f96da892dcbfe533
Instruction ID: 88a1f005e2bcef45723d5467eb62586ba9483bdea00c3cbe37d0c3424b11e526
Opcode Fuzzy Hash: 9b23a114edeb7ee68d8fe2a349bbd8718838ecac6987a0b2f96da892dcbfe533
Instruction Fuzzy Hash: FF215CB5901219DBEB60CBA4CC85F9D77B4FB48304F108698EA0DAB182D774AAC4CF64

Function 10011B40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 10011B57
_memset.LIBCMT ref: 10011B99
Process32First.KERNEL32(000000FF,00000128), ref: 10011BB9
Process32Next.KERNEL32(000000FF,00000128), ref: 10011BF4
CloseHandle.KERNEL32(000000FF,000000FF,00000128,?,00000002,00000000), ref: 10011C04

Strings

WeChat.exe, xrefs: 10011BC2

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
String ID: WeChat.exe
API String ID: 2526126748-2865290047
Opcode ID: 39a29232ca075c726fda8ef9c875e25e6892fe3647a628bb6ce209c239f2d104
Instruction ID: de72c953fd82724fd2484dccbf463224b55a824a9cf3277821e8854a41679b26
Opcode Fuzzy Hash: 39a29232ca075c726fda8ef9c875e25e6892fe3647a628bb6ce209c239f2d104
Instruction Fuzzy Hash: 49212E759002199BDB64DBA0CD85BEDB3B4EF48301F1001E8E50DAB291EB74AE85CF90

Function 10001220 Relevance: 10.6, APIs: 7, Instructions: 58COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10001236

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

_free.LIBCMT ref: 10001275
_free.LIBCMT ref: 1000128D
_free.LIBCMT ref: 100012A8
DeleteCriticalSection.KERNEL32(8415FF68,?), ref: 100012C6
_free.LIBCMT ref: 100012CD
_free.LIBCMT ref: 100012D6

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$CriticalDeleteErrorFreeHeapLastSection
String ID:
API String ID: 2933665753-0
Opcode ID: 2361ccc68d43a71e868931a2596d9ac44d138912533a7e2e7945e83494bb7265
Instruction ID: aaf221896ecc1e09f6eeffe9c750e8d10df9c6965350f993c9d4ceeb60f37a7f
Opcode Fuzzy Hash: 2361ccc68d43a71e868931a2596d9ac44d138912533a7e2e7945e83494bb7265
Instruction Fuzzy Hash: F81104B1800B455BE721EB61F8817A773E1FF00250F948439E55B4220AD731B9E8CBA2

Function 1000F630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54processsynchronizationCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000F648
CreateProcessA.KERNEL32(00000000,1000F402,00000000,00000000,00000001,08000020,00000000,00000000,00000044,00000000), ref: 1000F686
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1000F696
CloseHandle.KERNEL32(00000000), ref: 1000F6A0
CloseHandle.KERNEL32(?), ref: 1000F6AA

Strings

D, xrefs: 1000F650

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateObjectProcessSingleWait_memset
String ID: D
API String ID: 3422168109-2746444292
Opcode ID: 6aa504984eda8c7b5acce5dc33e2805d2fb05eccdb010cb75b9960ebb1134bfa
Instruction ID: cb5451c512472725f5a4df07bad1c41973f3ae078433712cb33367d9263f6d2b
Opcode Fuzzy Hash: 6aa504984eda8c7b5acce5dc33e2805d2fb05eccdb010cb75b9960ebb1134bfa
Instruction Fuzzy Hash: CA113071A00248EFEB24DFE4DC46BAD7BB8EF48700F10421DF619AE2D4DBB5A9448B54

Function 10025DD7 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 10025DD7

Part of subcall function 10022A20: EncodePointer.KERNEL32(00000000,00000001,10025DDC,10023A64,101B7938,00000008,10023C24,?,00000001,?,101B7958,0000000C,10023BC3,?,00000001,?), ref: 10022A23
Part of subcall function 10022A20: __initp_misc_winsig.LIBCMT ref: 10022A44

__mtinitlocks.LIBCMT ref: 10025DDC

Part of subcall function 10028120: InitializeCriticalSectionAndSpinCount.KERNEL32(101BB940,00000FA0,?,00000001,10025DE1,10023A64,101B7938,00000008,10023C24,?,00000001,?,101B7958,0000000C,10023BC3,?), ref: 1002813E

__mtterm.LIBCMT ref: 10025DE5

Part of subcall function 10025E4D: DeleteCriticalSection.KERNEL32(?,?,?,?,10023B29,10023B0F,101B7938,00000008,10023C24,?,00000001,?,101B7958,0000000C,10023BC3,?), ref: 1002803C
Part of subcall function 10025E4D: _free.LIBCMT ref: 10028043
Part of subcall function 10025E4D: DeleteCriticalSection.KERNEL32(101BB940,?,?,10023B29,10023B0F,101B7938,00000008,10023C24,?,00000001,?,101B7958,0000000C,10023BC3,?,00000001), ref: 10028065

__calloc_crt.LIBCMT ref: 10025E0A
__initptd.LIBCMT ref: 10025E2C
GetCurrentThreadId.KERNEL32 ref: 10025E33

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Delete$CountCurrentEncodeInitializePointerSpinThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 757573777-0
Opcode ID: 5305d30ccda45478ab966d2ea542fe534dde36908a179f48a9bcc1fc7b76229d
Instruction ID: 58ec3693b2f49863f7a8b2837ed69b9cb9c38201cd79a3fee43b5d8399986583
Opcode Fuzzy Hash: 5305d30ccda45478ab966d2ea542fe534dde36908a179f48a9bcc1fc7b76229d
Instruction Fuzzy Hash: 31F0243A1093225AE779E7383C0724B37C8DF02272BA2461DF5A6C84D5FF72A9424658

Function 10023833 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,100238FC,?), ref: 1002384D
GetProcAddress.KERNEL32(00000000), ref: 10023854
EncodePointer.KERNEL32(00000000), ref: 10023860
DecodePointer.KERNEL32(00000001,100238FC,?), ref: 1002387D

Strings

combase.dll, xrefs: 10023848
RoInitialize, xrefs: 1002383C

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 8a1acb73c590863b49b739fc2dd12772df6c41613cc91e6a01cbeba2b542fb8d
Instruction ID: 1191a88cc48d34fd9790489e5a8225d39aecb065cdaa85872b62c02564ac10b9
Opcode Fuzzy Hash: 8a1acb73c590863b49b739fc2dd12772df6c41613cc91e6a01cbeba2b542fb8d
Instruction Fuzzy Hash: 05E09A70240322AFEB247F30CDCEB4536B5F708702F908120F002DD0A0EBB88440CA52

Function 10023908 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,10023822), ref: 10023922
GetProcAddress.KERNEL32(00000000), ref: 10023929
EncodePointer.KERNEL32(00000000), ref: 10023934
DecodePointer.KERNEL32(10023822), ref: 1002394F

Strings

combase.dll, xrefs: 1002391D
RoUninitialize, xrefs: 10023911

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 4920fa68460fbff39facb883f69098808d4252d96aa017c2b93aa0396bf9b739
Instruction ID: 1f88319e3d8987e8e0ffa380cb3ac5eb2f489078ab51b11df1e274af2f38050d
Opcode Fuzzy Hash: 4920fa68460fbff39facb883f69098808d4252d96aa017c2b93aa0396bf9b739
Instruction Fuzzy Hash: 06E04678600221AFEBA56F20CC8DB463BB5F715301F918620F105D80A5EBFA9580CF92

Function 10016140 Relevance: 9.2, APIs: 6, Instructions: 151COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 100161B4

Part of subcall function 10020474: __FF_MSGBANNER.LIBCMT ref: 1002048B
Part of subcall function 10020474: __NMSG_WRITE.LIBCMT ref: 10020492
Part of subcall function 10020474: HeapAlloc.KERNEL32(02FE0000,00000000,00000001,?,?,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 100204B7

_free.LIBCMT ref: 10016270
std::exception::exception.LIBCMT ref: 100162BC
__CxxThrowException@8.LIBCMT ref: 100162D1
SetLastError.KERNEL32(00000018,?,101B722C,?,1001640E,80004005,?,100168C9,00000400,00000400), ref: 100162DC
_free.LIBCMT ref: 100162E7

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$AllocErrorException@8HeapLastThrow_mallocstd::exception::exception
String ID:
API String ID: 3049299895-0
Opcode ID: c4e75bb467dcd632cc6794f0c5e8569d33c960b951e8937276adff62c409ee6a
Instruction ID: ed2824db1dae17bfd308ba5dcb0e615037e45c0d1587b7e3fee2415e99e90dce
Opcode Fuzzy Hash: c4e75bb467dcd632cc6794f0c5e8569d33c960b951e8937276adff62c409ee6a
Instruction Fuzzy Hash: A0519AB6A006199FCB01CF98DC80B9EBBF4EB49710F554169E914AB341D775ED80CB90

Function 100285A2 Relevance: 9.1, APIs: 6, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

__ioinit.LIBCMT ref: 100285A6

Part of subcall function 10029B38: InitOnceExecuteOnce.KERNEL32(101BE634,10029B73,00000000,00000000,1003508B,101B7FB0,0000000C,10005D7E,zstd), ref: 10029B46

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Once$ExecuteInit__ioinit
String ID:
API String ID: 129814473-0
Opcode ID: 5f84c9e2474b48f1b5df84408ea3fed00915e9808a8aa5c3ede1912be93b9b93
Instruction ID: eb12839c2236a0a66080d8b7707541b2b015dfdafb5b4036e193e8b83220f103
Opcode Fuzzy Hash: 5f84c9e2474b48f1b5df84408ea3fed00915e9808a8aa5c3ede1912be93b9b93
Instruction Fuzzy Hash: 7A415679902B058FD320CB78E885A6E77E4EF413B0B90871DF8AB876D1D774EA408B10

Function 1001E0D0 Relevance: 9.1, APIs: 6, Instructions: 127memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000094,00000000,?,00000000,00000000), ref: 1001E132
_memmove.LIBCMT ref: 1001E18D
InterlockedExchangeAdd.KERNEL32(-00000040,?), ref: 1001E19D
InterlockedDecrement.KERNEL32(00000028), ref: 1001E1B6
HeapFree.KERNEL32(?,00000000,00000000,00000000), ref: 1001E1E0
InterlockedExchangeAdd.KERNEL32(-00000040,?), ref: 1001E1F7

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Interlocked$ExchangeHeap$AllocDecrementFree_memmove
String ID:
API String ID: 3475820249-0
Opcode ID: 8410d57850f0f56a72160be52005f4586bc43fc5666634ebf8d9ae9adf307239
Instruction ID: 7998932e740281b790ced908d299ef40af193b578d293305540e12fdeb0e7596
Opcode Fuzzy Hash: 8410d57850f0f56a72160be52005f4586bc43fc5666634ebf8d9ae9adf307239
Instruction Fuzzy Hash: F5410D72900259AFDB11CF99C884A9EBBF8FF49314F1145AAEC199F211D770ED54CB90

Function 1001D950 Relevance: 9.1, APIs: 6, Instructions: 107memorytimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(1AA35F0A,?,?,00000000,?,?,10035FD8,000000FF,?,1001D925,?,00000000,?,?,?), ref: 1001D984
EnterCriticalSection.KERNEL32(00000054,1AA35F0A,?,?,00000000,?,?,10035FD8,000000FF,?,1001D925,?,00000000,?,?,?), ref: 1001D9A8
SetLastError.KERNEL32(00000000,?,1001D925,?,00000000,?,?,?,?,1001EB3A,?,?), ref: 1001D9BD
LeaveCriticalSection.KERNEL32(00000054,?,1001D925,?,00000000,?,?,?,?,1001EB3A,?,?), ref: 1001D9E0
GetLastError.KERNEL32(?,00000000), ref: 1001DA42
HeapFree.KERNEL32(?,00000000,?,?,?,00000000), ref: 1001DA77

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalErrorLastSection$EnterFreeHeapLeaveTimetime
String ID:
API String ID: 340097737-0
Opcode ID: 63cb6f8e7694ae6483c047f050ef8b7d6c6ce7c6f04acb454207dabb1f28742f
Instruction ID: 651f3edefb78460789619dc2c76435f0b6e471a6de73fc66fbbe7bd7a0e23f04
Opcode Fuzzy Hash: 63cb6f8e7694ae6483c047f050ef8b7d6c6ce7c6f04acb454207dabb1f28742f
Instruction Fuzzy Hash: 5641AEB1600619AFDB11EF54CC85BAAB7F8FF08320F40452AF915CB691D774E940CBA1

Function 1000C230 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 1000C28F
std::error_category::default_error_condition.LIBCPMTD ref: 1000C2B0
std::error_category::default_error_condition.LIBCPMTD ref: 1000C2CA
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 1000C2D6
_Copy_impl.LIBCPMTD ref: 1000C2F1
std::error_category::default_error_condition.LIBCPMTD ref: 1000C323

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: std::error_category::default_error_condition$Affinity::operator!=Concurrency::details::Hardware$Copy_impl
String ID:
API String ID: 1600619793-0
Opcode ID: b1d60bd1d2c90ce81873208b493584433b2c3e2ab3f7430867161bbb174af34e
Instruction ID: d7a5fca912ec06086403f1c670a1a813a5f108e565bd240dc1cb7e9a7b1914b0
Opcode Fuzzy Hash: b1d60bd1d2c90ce81873208b493584433b2c3e2ab3f7430867161bbb174af34e
Instruction Fuzzy Hash: ED310079910119ABDB08DF95CC91DFFB3B9FF88240B50852DB515A7296DF30BA05CB90

Function 10009900 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 1000995F
std::error_category::default_error_condition.LIBCPMTD ref: 10009980
std::error_category::default_error_condition.LIBCPMTD ref: 1000999A
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 100099A6
_Copy_impl.LIBCPMTD ref: 100099C1
std::error_category::default_error_condition.LIBCPMTD ref: 100099F3

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: std::error_category::default_error_condition$Affinity::operator!=Concurrency::details::Hardware$Copy_impl
String ID:
API String ID: 1600619793-0
Opcode ID: 2ed96429231faa1b98a0dfe9f2b9f2661ec804e65a12f5b07c9e7ace5e47c8cf
Instruction ID: fd5af44e1f88a068f71331fad6f74fd73f7a6a584799292872335351018ebe79
Opcode Fuzzy Hash: 2ed96429231faa1b98a0dfe9f2b9f2661ec804e65a12f5b07c9e7ace5e47c8cf
Instruction Fuzzy Hash: AD31FE79900519ABDB08DF95CC91DFFB3B9FF88240B50852DB515AB296DF30BA05CB90

Function 1001A9D0 Relevance: 9.1, APIs: 6, Instructions: 86networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 1001A9E7
WSAAddressToStringA.WS2_32(?,0000001C,00000000,?,?), ref: 1001AA10
htons.WS2_32(?), ref: 1001AA2D
StrPBrkA.SHLWAPI(?,101B05A8,?,?,?,?,1001A154,?,?,?), ref: 1001AA53
StrChrA.SHLWAPI(?,00000025,?,?,?,?,1001A154,?,?,?), ref: 1001AA5E
_memmove.LIBCMT ref: 1001AA80

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: htons$AddressString_memmove
String ID:
API String ID: 2092185379-0
Opcode ID: 1da62bb18fa6672f18f6b109637b5a37ed39d3a7a0056215d56cfa2b173f808e
Instruction ID: 0d8a7e0632666a9e584c7e0b1c50e51ce1a1bb8526f63a46b25b18e10d486f15
Opcode Fuzzy Hash: 1da62bb18fa6672f18f6b109637b5a37ed39d3a7a0056215d56cfa2b173f808e
Instruction Fuzzy Hash: 2F218E36200326ABEB119FA4DD84BAA37ECEF49355F418025FD098A151D3B4D9C4D761

Function 10017B90 Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10017BAA

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

_free.LIBCMT ref: 10017BB2
_malloc.LIBCMT ref: 10017C09
_malloc.LIBCMT ref: 10017C16
_memset.LIBCMT ref: 10017C22
_memset.LIBCMT ref: 10017C2E

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free_malloc_memset$ErrorFreeHeapLast
String ID:
API String ID: 3649356292-0
Opcode ID: e2ce2a3dfe1de264b51823140416de6bf36e0b396c0ae9a07080b5863090727e
Instruction ID: 4c7394fda08d7e2547570c27631cca39768b6331ab3c3b2927f712e97e116122
Opcode Fuzzy Hash: e2ce2a3dfe1de264b51823140416de6bf36e0b396c0ae9a07080b5863090727e
Instruction Fuzzy Hash: 91111BB55012009BDB10DF15DD85B867FA5FF51304F4880B8FA089E29BD776E554CBA4

Function 10014850 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100148E9
_sprintf.LIBCMT ref: 1001491C
DeleteFileA.KERNEL32(00000000), ref: 1001492B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 1001494A

Strings

%s%u, xrefs: 10014910

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: DeleteFileFreeVirtual_memset_sprintf
String ID: %s%u
API String ID: 510910084-679674701
Opcode ID: adc25b0c065f21cbd1dfded628025ccd8d207bb86f6a67400b9d615e7817787c
Instruction ID: e4550e76bca269e0cd4f0d0c42d540de692b114aa9dc25b4e6c159d00a62e7eb
Opcode Fuzzy Hash: adc25b0c065f21cbd1dfded628025ccd8d207bb86f6a67400b9d615e7817787c
Instruction Fuzzy Hash: 3D31D4B59042689FC725CF14CC41BEEBBB4EB45315F108199FA585B3D1CB34AA81CF90

Function 1000B5A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 1000B5E8
inet_addr.WS2_32(?), ref: 1000B5F9
_wprintf.LIBCMT ref: 1000B613

Strings

2, xrefs: 1000B5B3
OnConnect: %s,%d, xrefs: 1000B60E

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _wprintfhtonsinet_addr
String ID: 2$OnConnect: %s,%d
API String ID: 3872430831-1911175251
Opcode ID: c5e6b32b25000850bdcfd3e7752fad518d315f21ca028ddb3caaaf99291d32ff
Instruction ID: b422dd61b17a844059851ccc93c32e4f95b7dbd58dc7ab89f53cd95de4c22344
Opcode Fuzzy Hash: c5e6b32b25000850bdcfd3e7752fad518d315f21ca028ddb3caaaf99291d32ff
Instruction Fuzzy Hash: B111D6B5A00208AFCB14DFA4D9809AEB7B9FF88200F108159F9099B251EB35AA45CB50

Function 100106D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100106F8
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 1001070E
_memset.LIBCMT ref: 10010729
ShellExecuteExA.SHELL32(0000003C), ref: 10010761

Part of subcall function 10022BD3: _doexit.LIBCMT ref: 10022BDD

Strings

<, xrefs: 10010714

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$ExecuteFileModuleNameShell_doexit
String ID: <
API String ID: 862106238-4251816714
Opcode ID: 20cf96c7f9d228022f40f64b64e5aa891d9eb85aec194889f2121776d6cbdfe6
Instruction ID: ed08ded1bf864bf3e223a1e7aee1529ee6b636ef57dacc8919679b4bfa0f8810
Opcode Fuzzy Hash: 20cf96c7f9d228022f40f64b64e5aa891d9eb85aec194889f2121776d6cbdfe6
Instruction Fuzzy Hash: F5112174A443189BDB60DF60DC86BD977B8EB58701F4040D8E54CAA2D1DBB46BC8CF51

Function 10011D80 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 100153E0: _memset.LIBCMT ref: 10015432
Part of subcall function 100153E0: _memset.LIBCMT ref: 10015448
Part of subcall function 100153E0: _memset.LIBCMT ref: 1001545E
Part of subcall function 100153E0: LoadLibraryA.KERNEL32(ADVAPI32.dll), ref: 1001546B

GetSystemInfo.KERNEL32(?), ref: 10011DCD
__snprintf.LIBCMT ref: 10011DE8

Strings

HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 10011DB7
~MHz, xrefs: 10011DB2
%d*%sMHz, xrefs: 10011DDB

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$InfoLibraryLoadSystem__snprintf
String ID: %d*%sMHz$HARDWARE\DESCRIPTION\System\CentralProcessor\0$~MHz
API String ID: 4072208565-2169120903
Opcode ID: 8cfe9623471b1fdf1c554914f6860f425b5aeaa8db3a3f010a36363e40d3c6a7
Instruction ID: d45dab53a83cfac9e0a1e2a4c9fe7e981714f2b5fce01b97ec9512f60cfb67df
Opcode Fuzzy Hash: 8cfe9623471b1fdf1c554914f6860f425b5aeaa8db3a3f010a36363e40d3c6a7
Instruction Fuzzy Hash: F6010075A10248EFDB00DBE8CD46BAEB7B4EF48604F50415DBA08EB281E6756A44C761

Function 100118D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100118F8
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 1001190E
_memset.LIBCMT ref: 10011929
ShellExecuteExA.SHELL32(0000003C), ref: 10011961

Part of subcall function 10022BD3: _doexit.LIBCMT ref: 10022BDD

Strings

<, xrefs: 10011914

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$ExecuteFileModuleNameShell_doexit
String ID: <
API String ID: 862106238-4251816714
Opcode ID: 3b53686e11ed67b0b73857ac907e37981459c7ca599cd7ab1f7b00ff7bdf5b39
Instruction ID: 184780f53a04bf753c675ecee7cc99bb54cbc30637577b5367bcbf7d21cbf3cf
Opcode Fuzzy Hash: 3b53686e11ed67b0b73857ac907e37981459c7ca599cd7ab1f7b00ff7bdf5b39
Instruction Fuzzy Hash: 6A112D789043189BDB64DF60DC86BD977B8AF58700F4040D8E54CAA2D1DBB46BC8CF51

Function 10011EE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll), ref: 10011EF9
GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 10011F11
FreeLibrary.KERNEL32(00000000), ref: 10011F4A

Strings

ntdll.dll, xrefs: 10011EF4
RtlGetNtVersionNumbers, xrefs: 10011F08

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlGetNtVersionNumbers$ntdll.dll
API String ID: 145871493-1263206204
Opcode ID: cf38a511d7e8b4ae8d17f5c5b92b7a0423aa2ce6899e0fe5ee67ae0bceb075ab
Instruction ID: fc6e9e5f567ed89b3598dd89ccb3c317c7ae0145ebb98ab299a18f454954bdf5
Opcode Fuzzy Hash: cf38a511d7e8b4ae8d17f5c5b92b7a0423aa2ce6899e0fe5ee67ae0bceb075ab
Instruction Fuzzy Hash: EF01A579901208EFDB14DF94C988B9EBBB5FF48305F108598F8059B290D7759A45DF50

Function 100122A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 100122C1
GetProcAddress.KERNEL32(00000000), ref: 100122C8
GetCurrentProcess.KERNEL32(00000000), ref: 100122DB

Strings

IsWow64Process, xrefs: 100122B7
kernel32, xrefs: 100122BC

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32
API String ID: 4190356694-3789238822
Opcode ID: 4dbbbb52112192865a612101614944367de734d12e029e91dbf73928284f9556
Instruction ID: d8b697d57578edb345ad90496a9b557fc7605fd1813d4f5a4f7f5f71a7bdeb36
Opcode Fuzzy Hash: 4dbbbb52112192865a612101614944367de734d12e029e91dbf73928284f9556
Instruction Fuzzy Hash: 74F0FE75D00208FFDB10EFE4C94879DBBB8EF08205F404099E80997251DB389648DB50

Function 10016750 Relevance: 7.7, APIs: 5, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 100184E0: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,100167AB,1AA35F0A,00000000,?,?,?,1001849E), ref: 100184FB
Part of subcall function 100184E0: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,100167AB,1AA35F0A,00000000,?,?,?,1001849E), ref: 10018516

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,1AA35F0A,00000000,?,?,?,1001849E), ref: 100167F5
HeapCreate.KERNEL32(00000004,00000000,00000000,?,?,?,1001849E), ref: 10016889
_free.LIBCMT ref: 1001693E
_free.LIBCMT ref: 10016946
_free.LIBCMT ref: 100169A9

Part of subcall function 100172C0: __CxxThrowException@8.LIBCMT ref: 100172D2
Part of subcall function 100172C0: EnterCriticalSection.KERNEL32(00000000,1AA35F0A,00000000,00000098,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005), ref: 10017312
Part of subcall function 100172C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005,?,100168C9,00000400,00000400), ref: 1001737B

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$CreateCriticalInfoNativeSectionSystem$EnterEventException@8HeapLeaveThrow
String ID:
API String ID: 471852966-0
Opcode ID: 62dcc8071ba77636672d3d9cd1e185c692ae9957d13345a13a02519507dda5e3
Instruction ID: d7e5b155edf1d74aaead93eb83c8ab603744e77deffcff0117244fe85bcfb593
Opcode Fuzzy Hash: 62dcc8071ba77636672d3d9cd1e185c692ae9957d13345a13a02519507dda5e3
Instruction Fuzzy Hash: C37118B0501B419FE761CF64C958787BBF4FF04308F108A1DE6AA9B691DBB9B148CB90

Function 1001CCD0 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

getsockopt.WS2_32(?,0000FFFF,00001001,?,?), ref: 1001CD1D
InterlockedCompareExchange.KERNEL32(00000004,00000000,00000001), ref: 1001CD64
EnterCriticalSection.KERNEL32(?), ref: 1001CD7A
LeaveCriticalSection.KERNEL32(?), ref: 1001CD89
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,10035AC4), ref: 1001CDCC

Part of subcall function 1001E2B0: InterlockedExchangeAdd.KERNEL32(00000044,?), ref: 1001E328
Part of subcall function 1001E2B0: InterlockedDecrement.KERNEL32(?), ref: 1001E33E
Part of subcall function 1001E2B0: HeapFree.KERNEL32(?,00000000,?,?), ref: 1001E36E

Part of subcall function 1001BE40: timeGetTime.WINMM(00000007,00000000,00000000,00000000,?,00000001,?,?,00000001,00000000), ref: 1001BE7F

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalInterlockedSection$ExchangeLeave$CompareDecrementEnterFreeHeapTimegetsockopttime
String ID:
API String ID: 1051621181-0
Opcode ID: 47ef961c13baaeb1f1c3f54f41a175c5428382baf7d5d31f1b2d3631bcd46669
Instruction ID: aa49a767c170bc5356aa645f39eb09f20ade229693a97dd4efdc251de6f66d51
Opcode Fuzzy Hash: 47ef961c13baaeb1f1c3f54f41a175c5428382baf7d5d31f1b2d3631bcd46669
Instruction Fuzzy Hash: ED41D072A00619AFD711CF94DC81F9EBBF8FB04351F10423AEA059B690D775E9A0CB90

Function 1003285D Relevance: 7.6, APIs: 5, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

__malloc_crt.LIBCMT ref: 10032879
std::exception::exception.LIBCMT ref: 10032893
__CxxThrowException@8.LIBCMT ref: 100328C9

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw__malloc_crtstd::exception::exception
String ID:
API String ID: 3183362523-0
Opcode ID: 12067b7f50e60089eb0c5929b79bbc81da0302d8a13d9fc531a0150228292b0c
Instruction ID: 3afcd033efa841a0b0f27a91848f479c7de1b815caadbdc1d716f9ba00caeb03
Opcode Fuzzy Hash: 12067b7f50e60089eb0c5929b79bbc81da0302d8a13d9fc531a0150228292b0c
Instruction Fuzzy Hash: B021FC3950420DAECB02EF64DC426CEB7B8EF00241F40C565FD45AE250EB34E680CB93

Function 1002354C Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 10023558

Part of subcall function 10020474: __FF_MSGBANNER.LIBCMT ref: 1002048B
Part of subcall function 10020474: __NMSG_WRITE.LIBCMT ref: 10020492
Part of subcall function 10020474: HeapAlloc.KERNEL32(02FE0000,00000000,00000001,?,?,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 100204B7

_free.LIBCMT ref: 1002356B

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: bad27d9961e6c256fd05d00a16dcfa7813a2fc78cb849604c55e28e4d427328b
Instruction ID: 8f73b662920d403f089da30250cd819716aaae5841175fa17ded837e2a866512
Opcode Fuzzy Hash: bad27d9961e6c256fd05d00a16dcfa7813a2fc78cb849604c55e28e4d427328b
Instruction Fuzzy Hash: 28112731900A366FCB21DB70BC4564E37E4EF003A0FE18525F90D9A1A1DF349940D794

Function 1001DFB0 Relevance: 7.6, APIs: 5, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 1001DFDE

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

_free.LIBCMT ref: 1001DFE9
HeapDestroy.KERNEL32(?,?,80004005,?,1001E736), ref: 1001E03E
HeapCreate.KERNEL32(?,?,?,?,80004005,?,1001E736), ref: 1001E056
SetEvent.KERNEL32(?,?,80004005,?,1001E736), ref: 1001E093

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Heap$_free$CreateDestroyErrorEventFreeLast
String ID:
API String ID: 840158118-0
Opcode ID: 0e583d642f774632f9c27456ec0f16af5b2d05b50993fe6db7455c841bf81a0b
Instruction ID: 1bce1808b3a2e791fe6ccda0018e989c211068b54a4ee0f2cf5caece12fc7c46
Opcode Fuzzy Hash: 0e583d642f774632f9c27456ec0f16af5b2d05b50993fe6db7455c841bf81a0b
Instruction Fuzzy Hash: 3221D071401B428BE7229F35D908787BAE1BF49304F50891DE5AA96651DBBAB884CF40

Function 1001B630 Relevance: 7.5, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B651
EnterCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B657
LeaveCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B675
LeaveCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B678
LeaveCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B68A
LeaveCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B68D

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: c76d05b3fccb81bbde97bbe8f299796e80221eabea18b0df9aee05efc5887d01
Instruction ID: 15876e7cb504465c55ff25fd79a18e235aef5e7f8048034f6523b5cd64803c08
Opcode Fuzzy Hash: c76d05b3fccb81bbde97bbe8f299796e80221eabea18b0df9aee05efc5887d01
Instruction Fuzzy Hash: 43F044722016146FD711AB6EDCC0A9BB7ECFFC9224B520136E908DB611C779E8458AB0

Function 100278EA Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 10025CA4: __getptd_noexit.LIBCMT ref: 10025CA5
Part of subcall function 10025CA4: __amsg_exit.LIBCMT ref: 10025CB2

__amsg_exit.LIBCMT ref: 10027917
__lock.LIBCMT ref: 10027927
InterlockedDecrement.KERNEL32(?), ref: 10027944
_free.LIBCMT ref: 10027957
InterlockedIncrement.KERNEL32(02FFD9A8), ref: 1002796F

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 1231874560-0
Opcode ID: 5b52af1cc653b6a68240cb3c15142706c47bbd1bbb99473af2bdf0793a479e8c
Instruction ID: e038a616fc268b6b30c8c800e06b11c4754edae7854568c1c2ca9af5bccd002d
Opcode Fuzzy Hash: 5b52af1cc653b6a68240cb3c15142706c47bbd1bbb99473af2bdf0793a479e8c
Instruction Fuzzy Hash: 0701C036A01732ABDB21DB69BA8174D77B0FF01650FD10145E8086BA92CB386981CFC1

Function 10003400 Relevance: 7.5, APIs: 5, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000018,00000000,0000003C,00000000,?,?,100033DA), ref: 1000340C
WakeAllConditionVariable.KERNEL32 ref: 1000341D
LeaveCriticalSection.KERNEL32(00000018), ref: 10003424
WaitForSingleObject.KERNEL32(?,000000FF,?), ref: 1000345C
GetLastError.KERNEL32 ref: 1000346D

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterErrorLastLeaveObjectSingleVariableWaitWake
String ID:
API String ID: 2002041392-0
Opcode ID: e75bfb5a0ad93df77c66187c49ea81158b5d7819f7b5d557b30da283341fa316
Instruction ID: 32492cade0fa7766ae1656b716e42035eae87337b4a1db3a89480abb877ebfd1
Opcode Fuzzy Hash: e75bfb5a0ad93df77c66187c49ea81158b5d7819f7b5d557b30da283341fa316
Instruction Fuzzy Hash: 8301B1325002169FEB52EF58DCC469773ECFF45391B018525EA589B119D730E989CBA2

Function 1001D760 Relevance: 6.3, APIs: 5, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1001A990: setsockopt.WS2_32(?,0000FFFF,00007010,00000000,00000004), ref: 1001A9A6

EnterCriticalSection.KERNEL32 ref: 1001D7AC
LeaveCriticalSection.KERNEL32(00000054), ref: 1001D7C7

Part of subcall function 1001BE40: timeGetTime.WINMM(00000007,00000000,00000000,00000000,?,00000001,?,?,00000001,00000000), ref: 1001BE7F

SetLastError.KERNEL32(00000000), ref: 1001D7D1
LeaveCriticalSection.KERNEL32(00000054), ref: 1001D7EC
HeapFree.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 1001D842

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterErrorFreeHeapLastTimesetsockopttime
String ID:
API String ID: 4191520005-0
Opcode ID: d82dbdcae07a67b72c96c9c25426668b2813c80c10765768011baf3510c592d9
Instruction ID: 8b7f9298d96b99960fdb9572d67dbc8946c541a3fe55414fa74220fd8c56f37f
Opcode Fuzzy Hash: d82dbdcae07a67b72c96c9c25426668b2813c80c10765768011baf3510c592d9
Instruction Fuzzy Hash: E131C372600214EFD711DF48CC85B9EB7B8FF49721F10422AF9299B291DB75A840CB60

Function 100268E6 Relevance: 6.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 1002696A
_memmove.LIBCMT ref: 100269B1
___AdjustPointer.LIBCMT ref: 100269FF
_memmove.LIBCMT ref: 10026A08

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AdjustPointer_memmove
String ID:
API String ID: 1721217611-0
Opcode ID: b405e0998ef0b9efc1edcd27beb66ba5646d659d8eec6f86d97dda6a22f7c017
Instruction ID: 0e35a04b9f418c62776a7450ae1d75bb5788a7e2c58344f017f8f72862e36527
Opcode Fuzzy Hash: b405e0998ef0b9efc1edcd27beb66ba5646d659d8eec6f86d97dda6a22f7c017
Instruction Fuzzy Hash: DC4192766043469AEB25CF50FC42F6A37F4DF097A0FA1401DF849AA5D1DF71E880DA62

Function 1002F1F7 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 1002F22B
__isleadbyte_l.LIBCMT ref: 1002F259
MultiByteToWideChar.KERNEL32(00000000,00000009,0000000C,00000000,00000000,00000000), ref: 1002F287
MultiByteToWideChar.KERNEL32(00000000,00000009,0000000C,00000001,00000000,00000000), ref: 1002F2BD

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2b3d1593b62abf2a8beba7a4b33d3e542d277218e77fbf3ac6909a8a0f39df84
Instruction ID: 88f6cfa15c5d6d04ed07b041f1d82007708ea3ed43a2cafbe05b56c4a286dddd
Opcode Fuzzy Hash: 2b3d1593b62abf2a8beba7a4b33d3e542d277218e77fbf3ac6909a8a0f39df84
Instruction Fuzzy Hash: 1D31BC3560029AEFDB11CE64E845BBA3BE5FF422A0F52443DE8249B1A1D770E844DB50

Function 1001E3A0 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(?), ref: 1001E41B
UnmapViewOfFile.KERNEL32(00000000), ref: 1001E441
CloseHandle.KERNEL32(00000000), ref: 1001E461
CloseHandle.KERNEL32(00000000), ref: 1001E483

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle$ErrorFileLastUnmapView
String ID:
API String ID: 4017539725-0
Opcode ID: 496f3fa893c77ec6c9c64e1aa7dc66e4b9ed660e755f62b2c78ec002215d3852
Instruction ID: cba275ec36c653788e4822474d84c3c335d5b1142b70863171b6aa198203d996
Opcode Fuzzy Hash: 496f3fa893c77ec6c9c64e1aa7dc66e4b9ed660e755f62b2c78ec002215d3852
Instruction Fuzzy Hash: 1E3118B5A002599BDB11CFA4CC48BAFBBF8FF48754F004219F805EB241EB75E9448BA0

Function 1001B710 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(00000000,?,00000000), ref: 1001B765
InterlockedCompareExchange.KERNEL32(?,?,?), ref: 1001B777

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CompareExchangeInterlocked
String ID:
API String ID: 3335655927-0
Opcode ID: 9484bcffa374807802c2175ff6f6c2d2e59b0392790023a2fe2f7dd29207cd47
Instruction ID: a411b3ee14b548daa5b868b1c8f2e50aeeae3c08791ef6b703bc2ef0cd82c7fc
Opcode Fuzzy Hash: 9484bcffa374807802c2175ff6f6c2d2e59b0392790023a2fe2f7dd29207cd47
Instruction Fuzzy Hash: 6E219F36304A09ABD720DF6DDD80E96F3EDFBC8311F00456AEA89C7240DB31E9548BA0

Function 10014070 Relevance: 6.1, APIs: 4, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00000000,00001000,00000004), ref: 100140EE
_memset.LIBCMT ref: 1001410A
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,100146FE), ref: 1001412C
_memmove.LIBCMT ref: 1001414A

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocVirtual$_memmove_memset
String ID:
API String ID: 725130153-0
Opcode ID: f53fd65b4befc706c090b7c927cf75363b07fbc3177beadfb71f7d900ef2fefc
Instruction ID: 93ed00f0eb9094769ecb9556d8f7921b1dd27d8a6f78ffda3dd0833cdc577a5f
Opcode Fuzzy Hash: f53fd65b4befc706c090b7c927cf75363b07fbc3177beadfb71f7d900ef2fefc
Instruction Fuzzy Hash: F631EA74A00209EFCB08CF94C995EAEB7B1FF48704F218598E915AB351D770EE81DB50

Function 1001A3A0 Relevance: 6.1, APIs: 4, Instructions: 84fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(00000002,00000004,?,?,?,00000002,00000004), ref: 1001A3B3
CreateFileMappingA.KERNEL32(00000002,00000000,00000004,00000004,00000000,00000000), ref: 1001A3E0
MapViewOfFileEx.KERNEL32(00000000,?,?,?,?,00000000,?,00000002,00000004), ref: 1001A429
CloseHandle.KERNEL32(?,?,00000002,00000004), ref: 1001A43F

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleMappingSizeView
String ID:
API String ID: 1374251026-0
Opcode ID: 4b8af0a805cdf8347236f9c71f45033270cfc3b78af84c4974c8e4d52b637325
Instruction ID: 8fce67c6ff09011a8acf264d9e13d81355b447303082185ad91e7b9cb9a6a423
Opcode Fuzzy Hash: 4b8af0a805cdf8347236f9c71f45033270cfc3b78af84c4974c8e4d52b637325
Instruction Fuzzy Hash: 272167B5A0061AAFD714DF69DC45A5AF7F8FB49350F10812AFD19D7200D770E9A09BD0

Function 1001B090 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 1001B152

Part of subcall function 1001B190: HeapFree.KERNEL32(?,00000000,?), ref: 1001B1E5

DeleteCriticalSection.KERNEL32(?,1AA35F0A), ref: 1001B113
DeleteCriticalSection.KERNEL32(?), ref: 1001B124
HeapFree.KERNEL32(?,00000000), ref: 1001B132

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalDeleteFreeHeapSection$_free
String ID:
API String ID: 210024702-0
Opcode ID: 2457e78313824737e41231bfbb3820b753e3b2e9e7e39901a1bfba69df0cf740
Instruction ID: 33c100260f324d21ff77bf2896aba4d0bbdecf1759cfcc0eaa01cd95da98a8db
Opcode Fuzzy Hash: 2457e78313824737e41231bfbb3820b753e3b2e9e7e39901a1bfba69df0cf740
Instruction Fuzzy Hash: 63319E71A00616EFDB11DFA8C884B5AFBF8FF05315F118269E9199F291D731E944CBA0

Function 10003480 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,10001499,?,?,00000000,?,?,?), ref: 100034A7
SleepConditionVariableCS.KERNEL32(00000000,?,00000000), ref: 100034CB
LeaveCriticalSection.KERNEL32(?), ref: 100034D2
SleepConditionVariableCS.KERNEL32(00000000,?,000000FF), ref: 1000350E

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ConditionCriticalSectionSleepVariable$EnterLeave
String ID:
API String ID: 3020340620-0
Opcode ID: 05074beb6edb66eb96e78de5814604b12c6efd175baefdef2757970339633dab
Instruction ID: f135a66ef4c3fa2a34bb39291fcdf00077fd575a97a3f57769656b34936bebed
Opcode Fuzzy Hash: 05074beb6edb66eb96e78de5814604b12c6efd175baefdef2757970339633dab
Instruction Fuzzy Hash: 42110471500B558FE772CA58D9C4B5773E8FB007A6F51DE1DE4938A899C374F8888B21

Function 1000ECF0 Relevance: 6.1, APIs: 4, Instructions: 60windowstringCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 1000ED07
_memset.LIBCMT ref: 1000ED30
SendMessageA.USER32(?,0000000D,00000400,00000000), ref: 1000ED4A
lstrlenA.KERNEL32(00000000), ref: 1000ED57

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: MessageSendVisibleWindow_memsetlstrlen
String ID:
API String ID: 1293396957-0
Opcode ID: c0acd891ebef83d26f17d4d1390c8d3953d1a4ad271df1068977982f2c5964a8
Instruction ID: 5b252e65773c6f6e6056f087db140e16ac5e3367f8d3fdb97bb4e1eeb390b3d9
Opcode Fuzzy Hash: c0acd891ebef83d26f17d4d1390c8d3953d1a4ad271df1068977982f2c5964a8
Instruction Fuzzy Hash: 7311B6F5A00205EBEB14DF60CD45BDA7368DF54340F0044A9FB09FB285EA75EA858B95

Function 10003280 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 10003292
SleepConditionVariableCS.KERNEL32(?,?,000000FF), ref: 100032BD
EnterCriticalSection.KERNEL32(?), ref: 100032ED
WakeConditionVariable.KERNEL32(?), ref: 100032FA

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ConditionCriticalEnterSectionVariable$SleepWake
String ID:
API String ID: 1272541424-0
Opcode ID: d2ef4d3d3bece3ecb2957c56201156f867af3ba4ab4f7a9e8506c951494b066a
Instruction ID: d287fa8a1d97e4fb1d990ba0663406a79fc7a6a744e69c2c1aa7d7a44e5ccb06
Opcode Fuzzy Hash: d2ef4d3d3bece3ecb2957c56201156f867af3ba4ab4f7a9e8506c951494b066a
Instruction Fuzzy Hash: 2C115572100B159FE336DF68DCC485BB3F9FB44360B418E19E4A683A45CB30F8498B60

Function 1001EB80 Relevance: 6.1, APIs: 4, Instructions: 57windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(1001C8E6,00000000,00000000,00000000,00000001), ref: 1001EB99
TranslateMessage.USER32(?), ref: 1001EBBE
DispatchMessageA.USER32(?), ref: 1001EBC4
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 1001EBD6

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 5f19f8642b326884221ac1f2436e0d1f5125d6a111024dfe36bdec5d200537f7
Instruction ID: 4683bdf92f3b324d92ef008ada9b145ce160014bd2fbc826a850825f78051344
Opcode Fuzzy Hash: 5f19f8642b326884221ac1f2436e0d1f5125d6a111024dfe36bdec5d200537f7
Instruction Fuzzy Hash: 0D018833A4421D67EB20DAD99CC1FEEF3ACEB44750F5005A2FE08EB1C0D6A5E94146A0

Function 10012300 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10012328
_strlen.LIBCMT ref: 1001234F
_strncpy.LIBCMT ref: 10012382
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 100123A9

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateDirectory_memset_strlen_strncpy
String ID:
API String ID: 3994138041-0
Opcode ID: 5146f0f5f6924dacce34261d64f74e5090e561bcbd4e5be505613ef66d126bf7
Instruction ID: 101a95c8069f775dae9c248aff8c456d68721b5b320a68391b460c7f447a75fb
Opcode Fuzzy Hash: 5146f0f5f6924dacce34261d64f74e5090e561bcbd4e5be505613ef66d126bf7
Instruction Fuzzy Hash: CB1194B9D041189BCB10DB64DC81BDD77B8EF65304F0082E9E59D9B281DAB4EBD48F91

Function 10016B30 Relevance: 6.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10017520: _free.LIBCMT ref: 1001755A

HeapDestroy.KERNEL32(00000000,1AA35F0A,?,?,?,?,100359E3,000000FF), ref: 10016B70
HeapCreate.KERNEL32(00000001,?,?,1AA35F0A,?,?,?,?,100359E3,000000FF), ref: 10016B7F
_free.LIBCMT ref: 10016B8F
HeapDestroy.KERNEL32(?,?,?,?,?,100359E3,000000FF), ref: 10016BBD

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Heap$Destroy_free$Create
String ID:
API String ID: 3093871995-0
Opcode ID: 16e0c79affba40acb3f9a94d92ca98c28378774c059c7bd50a370be0c89aea4a
Instruction ID: d00498a318c3039bf53502062df662130d8b902564dd33ec98044163ccf8f0fc
Opcode Fuzzy Hash: 16e0c79affba40acb3f9a94d92ca98c28378774c059c7bd50a370be0c89aea4a
Instruction Fuzzy Hash: F71136B6904B149FD720CF69DC44B56BBF8FB08750F004A2DE89AC7651E775E944CB90

Function 10026230 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 10026247

Part of subcall function 10026858: ___AdjustPointer.LIBCMT ref: 100268A1

_UnwindNestedFrames.LIBCMT ref: 1002625E
___FrameUnwindToState.LIBCMT ref: 10026270
CallCatchBlock.LIBCMT ref: 10026294

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 6092b50bab1218cd8aabaab9e12c658e2e0f1782f2186364ed2301dcdcc7d9c1
Instruction ID: 780a5d68346db81fedf9f8d85dc8351bab79c3fb61c7619bb358afdc1328406f
Opcode Fuzzy Hash: 6092b50bab1218cd8aabaab9e12c658e2e0f1782f2186364ed2301dcdcc7d9c1
Instruction Fuzzy Hash: 88011732000109FBCF12CF95EC05EDA3BBAFF8C754F518115FA1865121C776E865ABA0

Function 10028BC3 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 10028BE7

Part of subcall function 100292C6: __fltout2.LIBCMT ref: 100292EF

__cftog_l.LIBCMT ref: 10028C0D
__cftoe_l.LIBCMT ref: 10028C3F

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: c2eb68e8ade19565e9c0612c28aff17bdb070db1da49cc9352462dfe7f7478ea
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: 1201407A40214EBBCF529E84EC51CDD3F72FB18294BA58415FE1858031C336DAB1AB91

Function 10015350 Relevance: 6.0, APIs: 4, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 10015381
__beginthreadex.LIBCMT ref: 100153A3
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 100153B4
CloseHandle.KERNEL32(00000000), ref: 100153BE

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseCreateEventHandleObjectSingleWait__beginthreadex
String ID:
API String ID: 2993629242-0
Opcode ID: d7dcd88de3af4c7a17b78a3c7ea8846737ab5e00941b9493fb9a3973c1d0ec84
Instruction ID: 28439952cb9d60efeb8680ab5036a31f0774e1b625031860cf64c459a7230e8b
Opcode Fuzzy Hash: d7dcd88de3af4c7a17b78a3c7ea8846737ab5e00941b9493fb9a3973c1d0ec84
Instruction Fuzzy Hash: 9A111EB5A04249AFDB14DFA8CC81BEE7BB4EF49310F504249F919AB381D730AA40CB90

Function 100327EB Relevance: 6.0, APIs: 4, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

__malloc_crt.LIBCMT ref: 10032807
std::exception::exception.LIBCMT ref: 10032821
__CxxThrowException@8.LIBCMT ref: 10032857

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw__malloc_crtstd::exception::exception
String ID:
API String ID: 3183362523-0
Opcode ID: c060a18d73b796a30dd2a53eb01a138e769d2f3d535d15112ec57b6c053b814d
Instruction ID: 61d3b0669a0cbb4b249a077222c69809c774bd9a0b89fdd2f935691ba84154ea
Opcode Fuzzy Hash: c060a18d73b796a30dd2a53eb01a138e769d2f3d535d15112ec57b6c053b814d
Instruction Fuzzy Hash: AEF04F799002097ACB05DFA4D9859CDB7FCEA10284F80C056FD15AB141DB78E384CA91

Function 10016AC0 Relevance: 6.0, APIs: 4, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 100174B0: HeapFree.KERNEL32(10016ACC,00000000,?,?,?,?,10016ACC,?,?,10016FF0), ref: 100174D5
Part of subcall function 100174B0: _free.LIBCMT ref: 100174EF

HeapDestroy.KERNEL32(00000000,?,?,10016FF0), ref: 10016AD3
HeapCreate.KERNEL32(?,?,?,?,?,10016FF0), ref: 10016AE2
_free.LIBCMT ref: 10016AF2
HeapDestroy.KERNEL32(?,10016FF0), ref: 10016B22

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Heap$Destroy_free$CreateFree
String ID:
API String ID: 4097506873-0
Opcode ID: 5821550070371558d6326ac293e511f2d9706211c5074b01848d33611e582a02
Instruction ID: 26b69236e6c287892c4b939c4df5092f0c49b63a1c7adf96395978ecd4ddac7a
Opcode Fuzzy Hash: 5821550070371558d6326ac293e511f2d9706211c5074b01848d33611e582a02
Instruction Fuzzy Hash: 07F01DB5200602AFEB05DF75DC48B46BBB8FF08345F404218E409CBA51DB35E4A5CBD0

Function 1001BB70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 1001BB2C
Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 1001BB66

Part of subcall function 1001ED68: std::exception::exception.LIBCMT ref: 1001ED7E
Part of subcall function 1001ED68: __CxxThrowException@8.LIBCMT ref: 1001ED93

Strings

vector<T> too long, xrefs: 1001BBD8

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Exception@8Internal_throw_exceptionThrow_memmovestd::exception::exception
String ID: vector<T> too long
API String ID: 3224774664-3788999226
Opcode ID: 6098c6dfe018a0d1be71fac0227d1825c4ecc01241087ebe161bd52a6db14e3a
Instruction ID: eae54de508585d01ba0ea4a69c7d47a938ab1ba8a2878b9bbe041104eb365bc3
Opcode Fuzzy Hash: 6098c6dfe018a0d1be71fac0227d1825c4ecc01241087ebe161bd52a6db14e3a
Instruction Fuzzy Hash: 3C312876700A295BC714CEADDCC189ABB99EB88370724823AF918CB644D771F991C7D0

Function 100065C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 10006720
construct.LIBCPMTD ref: 1000674A

Strings

wmic cpu get processorid, xrefs: 100065E0

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: char_traitsconstruct
String ID: wmic cpu get processorid
API String ID: 489808500-2204115948
Opcode ID: 1010ae759fa7e10457475eff9b78d9461d1f2c37ab24339ddda26cbfa1624876
Instruction ID: dd645ee37d0e35d6a0c4dc76963d6f74060cdeeedd1d1d5c8c6965c7acc1db0f
Opcode Fuzzy Hash: 1010ae759fa7e10457475eff9b78d9461d1f2c37ab24339ddda26cbfa1624876
Instruction Fuzzy Hash: 01410F75E00209DFDB08CF98D891AEEB7B6FF4C750F208129E915A7385DB35A941CBA4

Function 100113C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81fileCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 10011461
DeleteFileA.KERNEL32(?), ref: 100114B6

Part of subcall function 10011580: _memset.LIBCMT ref: 100115CC
Part of subcall function 10011580: GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 100115E0
Part of subcall function 10011580: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 10011647
Part of subcall function 10011580: GetFileSize.KERNEL32(000000FF,00000000), ref: 10011669
Part of subcall function 10011580: ReadFile.KERNEL32(000000FF,?,00000000,00000000,00000000), ref: 100116B4

Strings

.key, xrefs: 1001149B

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$DirectorySystem$CreateDeleteReadSize_memset
String ID: .key
API String ID: 3518743009-343438762
Opcode ID: eb43b5ddff7011dff6964891f9a77986a6cb4ad83d3904fe4c7462824836723d
Instruction ID: c5e3bf08ea98db34f13579d809896ca9d031d76340f358e502fc38b765e240d6
Opcode Fuzzy Hash: eb43b5ddff7011dff6964891f9a77986a6cb4ad83d3904fe4c7462824836723d
Instruction Fuzzy Hash: 9F31E675A0025C9BDB28CF64DC42BEEB7B9EB45310F5081A9F9059B281DB35AE85CB90

Function 10019CC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

StrChrA.SHLWAPI(?,0000003A,?), ref: 10019CE4
_swscanf.LIBCMT ref: 10019D1E

Strings

%d.%d.%d.%d%c, xrefs: 10019D18

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _swscanf
String ID: %d.%d.%d.%d%c
API String ID: 2748852333-2398565245
Opcode ID: 18e54956b6ff5e5e5f09465d7c17339f29108a54fe6fde34eeeaabc51fafe8c6
Instruction ID: ed2d36106069c91f8a44cef8226e493977f524409a11eb0d6646e4ffefc909ba
Opcode Fuzzy Hash: 18e54956b6ff5e5e5f09465d7c17339f29108a54fe6fde34eeeaabc51fafe8c6
Instruction Fuzzy Hash: 37118232A001189BEB15DFA4D841AFE73BCEF19201F4101AEE90ADB151DB71EA848792

Function 1000F5B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40windowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 1000F5EB
MessageBoxA.USER32(00000000), ref: 1000F5F2

Strings

Shell_TrayWnd, xrefs: 1000F5E6

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: FindMessageWindow
String ID: Shell_TrayWnd
API String ID: 2823233367-2988720461
Opcode ID: fa6ae15565b281fa731f87bbf66bd491b581fbd42e31be7702e6434cd4fda3cb
Instruction ID: 8a2575e9232a4e6788a4e3303b54ed8dbf7533174b6017679d5c7ff6e03b4625
Opcode Fuzzy Hash: fa6ae15565b281fa731f87bbf66bd491b581fbd42e31be7702e6434cd4fda3cb
Instruction Fuzzy Hash: 240116B4D00208EFEB10CFA4D949B9EB7F4FB48341F2084A9E905A7394D675AF40AB54

Function 10012130 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1001214F
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 10012162

Strings

@, xrefs: 10012157

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus_memset
String ID: @
API String ID: 587104284-2766056989
Opcode ID: d7d7f9b0b0953cb5caef1f62c0310114e2340016ed59b2748a12603957ba9fb6
Instruction ID: 3d7f5f32418326eb2dbc6e30da0d634f8bec6cfce8173ea13a502be2592b4bca
Opcode Fuzzy Hash: d7d7f9b0b0953cb5caef1f62c0310114e2340016ed59b2748a12603957ba9fb6
Instruction Fuzzy Hash: 20F06DB0A10208ABDB14DFA4C941B9DBBF8EF18300F50412CE909EB381DB34EA45CB80

Function 1000F3B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000F3D5
wsprintfA.USER32 ref: 1000F3ED

Part of subcall function 1000F630: _memset.LIBCMT ref: 1000F648
Part of subcall function 1000F630: CreateProcessA.KERNEL32(00000000,1000F402,00000000,00000000,00000001,08000020,00000000,00000000,00000044,00000000), ref: 1000F686
Part of subcall function 1000F630: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1000F696
Part of subcall function 1000F630: CloseHandle.KERNEL32(00000000), ref: 1000F6A0
Part of subcall function 1000F630: CloseHandle.KERNEL32(?), ref: 1000F6AA

Strings

taskkill /f /t /im %s, xrefs: 1000F3E1

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle_memset$CreateObjectProcessSingleWaitwsprintf
String ID: taskkill /f /t /im %s
API String ID: 1221303216-1431264914
Opcode ID: e147f47295d6159a0972dd24f2dc00c959dda93d6aa0ae33a39929a26f1210c1
Instruction ID: 7a26d32dd3a77ef8c91e8ca8fb8e6281576ca4a882f0339c21baba38ccc25a09
Opcode Fuzzy Hash: e147f47295d6159a0972dd24f2dc00c959dda93d6aa0ae33a39929a26f1210c1
Instruction Fuzzy Hash: 33F05475E00108ABDF10DBA4DD46BA973B8EF54204F4040A8F94DDB182EE75BB58CB91

Function 1001BBF0 Relevance: 5.1, APIs: 4, Instructions: 133memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000054,?,00000000), ref: 1001BC70
SetLastError.KERNEL32(00000000), ref: 1001BC7F
LeaveCriticalSection.KERNEL32(00000054), ref: 1001BCA7
HeapFree.KERNEL32(?,00000000,?,?), ref: 1001BD36

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterErrorFreeHeapLastLeave
String ID:
API String ID: 132244544-0
Opcode ID: 5ee7b2dd0110e595599aec328bd6a18fa6e2e8a676dff69a3f1635a7451a1511
Instruction ID: 85bd10d27e0b442e1dab5c9d78a6aaa91c45580178b632b1c4d7f06aa4383219
Opcode Fuzzy Hash: 5ee7b2dd0110e595599aec328bd6a18fa6e2e8a676dff69a3f1635a7451a1511
Instruction Fuzzy Hash: 90418E75A00649AFDB14CFA8D884BAEB7F8FF48350F10052AED05DB351DB35E9808B91

Function 1001CEA0 Relevance: 5.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,1AA35F0A,?,?,?,?,0000000F,10035F78,000000FF,?,1001CE86), ref: 1001CED9
EnterCriticalSection.KERNEL32(?,1AA35F0A,?,?,?,?,0000000F,10035F78,000000FF,?,1001CE86), ref: 1001CF09
LeaveCriticalSection.KERNEL32(?,?,?,?,0000000F,10035F78,000000FF,?,1001CE86), ref: 1001CF3A
SetLastError.KERNEL32(00000057,1AA35F0A,?,?,?,?,0000000F,10035F78,000000FF,?,1001CE86), ref: 1001CF6A

Memory Dump Source

Source File: 00000003.00000002.3050953885.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3050210685.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3051276828.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3052456947.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: 5a7bbe1e01743a2055287aad97c0971164d7a590c1f1937ca8fb7b3f6b1a058c
Instruction ID: 7325f94427708edb1f6ad39a4a2f2957c0187faf522ed9944e05cc5fe4afe9c1
Opcode Fuzzy Hash: 5a7bbe1e01743a2055287aad97c0971164d7a590c1f1937ca8fb7b3f6b1a058c
Instruction Fuzzy Hash: B0218932A04248EFDB11CF58CC84F9ABBBAFB89761F10466EE8149A291D735D981CB50

Analysis Process: rundll32.exePID: 2472, Parent PID: 612COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	98.6%
Signature Coverage:	0%
Total number of Nodes:	503
Total number of Limit Nodes:	10

Executed Functions

Function 10013A20 Relevance: 50.9, APIs: 17, Strings: 12, Instructions: 185
filesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 10013A60
swprintf.LIBCMT ref: 10013A86
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 10013A99
GetLastError.KERNEL32 ref: 10013AA5

Part of subcall function 10022BD3: _doexit.LIBCMT ref: 10022BDD

Part of subcall function 100138F0: _memset.LIBCMT ref: 10013918
Part of subcall function 100138F0: RegOpenKeyExA.ADVAPI32(80000001,101AFE40,00000000,00020006,?), ref: 10013944
Part of subcall function 100138F0: _sprintf.LIBCMT ref: 1001397C
Part of subcall function 100138F0: _strlen.LIBCMT ref: 1001398B
Part of subcall function 100138F0: RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,?), ref: 100139D7
Part of subcall function 100138F0: RegCloseKey.ADVAPI32(?), ref: 100139EA

IsUserAnAdmin.SHELL32 ref: 10013AC2
ReleaseMutex.KERNEL32(00000000), ref: 10013ADC
_memset.LIBCMT ref: 10013B1C
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 10013B32
_sprintf.LIBCMT ref: 10013B4E
DeleteFileA.KERNEL32(?), ref: 10013B5D
MoveFileA.KERNEL32(?,?), ref: 10013B71
_wprintf.LIBCMT ref: 10013CAC
_strlen.LIBCMT ref: 10013CB9

Strings

RunService !, xrefs: 10013C68
service_is_exist !, xrefs: 10013C24
Windows Update, xrefs: 10013B38, 10013C04
Eaiawk mgqwgoywasgymoeeuu, xrefs: 10013C75
TMzsft xtnogaqk, xrefs: 10013C31, 10013C5F, 10013C7F
206.238.77.142, xrefs: 10013A70, 10013CF1
%s:%hd, xrefs: 10013A75
%s%s, xrefs: 10013B42
Yyickg caosusmk, xrefs: 10013C7A
C:\Users\Public\Documents\, xrefs: 10013B3D
206.238.77.142, xrefs: 10013CB4, 10013CDA
EnOperationMode Error !, xrefs: 10013CA7

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File_memset$Mutex_sprintf_strlen$AdminCloseCreateDeleteErrorLastModuleMoveNameOpenReleaseUserValue_doexit_wprintfswprintf
String ID: %s%s$%s:%hd$206.238.77.142$206.238.77.142$C:\Users\Public\Documents\$Eaiawk mgqwgoywasgymoeeuu$EnOperationMode Error !$RunService !$TMzsft xtnogaqk$Windows Update$Yyickg caosusmk$service_is_exist !
API String ID: 2228167989-1563067711
Opcode ID: 2fc02c7820abb1e6e7b02b1e9042d30205a633eb3f33f25fe0a671c5299acd93
Instruction ID: 8ce7a2c48d05da8e1d18419a98124d55002a878a035d7289134c72219816da3c
Opcode Fuzzy Hash: 2fc02c7820abb1e6e7b02b1e9042d30205a633eb3f33f25fe0a671c5299acd93
Instruction Fuzzy Hash: CB61ECB5944314AAE721D7A08C87BE977B8EF00741F804099F6496D5D3EB78DAC4CBA2

Function 1000D890 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 142
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000), ref: 1000D8B6
GetLastError.KERNEL32 ref: 1000D8C0
CryptCreateHash.ADVAPI32(00000000,00000000,00000000,00000000,?), ref: 1000D8E1
GetLastError.KERNEL32 ref: 1000D8EB
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 1000D8FA

Strings

%02X, xrefs: 1000D9C8

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorLast$AcquireCreateHashRelease
String ID: %02X
API String ID: 4104741015-436463671
Opcode ID: 783f6aeacaf77bddf85f865987ab6f2245b3743a8a3a9c8136557c6450919572
Instruction ID: e6624ba5d8ed9705aec1f79a9e38e76f649a0541b50efeb1c6887bd17401cf19
Opcode Fuzzy Hash: 783f6aeacaf77bddf85f865987ab6f2245b3743a8a3a9c8136557c6450919572
Instruction Fuzzy Hash: AE51C5B5A00219EFEB14DFA4CC85BEEB7B4FB48300F108559FA15AB295D778A940CF61

Function 00BA0A09 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 178nativememorywindowCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(-00000001,00000022,00BA26FB,00000004,00000000), ref: 00BA0A8A
NtSetInformationProcess.NTDLL(-00000001,00000022,?,00000004,00BA09F7,0000005D), ref: 00BA0AAA
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000004,00BA09F7,0000005D), ref: 00BA0ACC
wsprintfA.USER32(?,?,?,?), ref: 00BA0B74
MessageBoxA.USER32(00000000,?,?,00000010), ref: 00BA0B8C

Strings

Application error, xrefs: 00BA0B88
SWVU, xrefs: 00BA0A79, 00BA0AD8, 00BA0AEC, 00BA0AF2, 00BA0AF8, 00BA0B15, 00BA0BC8
The procedure %s could not be located in the DLL %s., xrefs: 00BA0B6C

Memory Dump Source

Source File: 00000004.00000003.2102098932.0000000000BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_ba0000_rundll32.jbxd

Similarity

API ID: InformationProcess$AllocMessageQueryVirtualwsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 2902211186-4283279704
Opcode ID: de0e8ee88c8a98f7b8a38ace4394a491acda8513ba92f7ded7199e416edf0d91
Instruction ID: 1507bff5166aa447380ee8c788899a7be47e8659a5c9016a5bdac0032a5328cf
Opcode Fuzzy Hash: de0e8ee88c8a98f7b8a38ace4394a491acda8513ba92f7ded7199e416edf0d91
Instruction Fuzzy Hash: 7741E172605746AFEB35AF24CC55FAB73E8EF06780F004568EE0697284DB70AD14CB94

Function 00BA0A95 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140memorynativewindowCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL(-00000001,00000022,?,00000004,00BA09F7,0000005D), ref: 00BA0AAA
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000004,00BA09F7,0000005D), ref: 00BA0ACC
wsprintfA.USER32(?,?,?,?), ref: 00BA0B74
MessageBoxA.USER32(00000000,?,?,00000010), ref: 00BA0B8C
ExitProcess.KERNEL32(00000000), ref: 00BA0B94
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 00BA0BE7

Strings

Application error, xrefs: 00BA0B88
SWVU, xrefs: 00BA0AD8, 00BA0AEC, 00BA0AF2, 00BA0AF8, 00BA0B15, 00BA0BC8
The procedure %s could not be located in the DLL %s., xrefs: 00BA0B6C

Memory Dump Source

Source File: 00000004.00000003.2102098932.0000000000BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_ba0000_rundll32.jbxd

Similarity

API ID: ProcessVirtual$AllocExitFreeInformationMessagewsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 2788668848-4283279704
Opcode ID: f644d6bb55c65f053268db4f25cec8320b3bbf1d1d06db4825fff5ba47126e3b
Instruction ID: 707e21e045b3e88ea457f0d55cdb48ffe7c65bf5acdb455907d30351f97a4e68
Opcode Fuzzy Hash: f644d6bb55c65f053268db4f25cec8320b3bbf1d1d06db4825fff5ba47126e3b
Instruction Fuzzy Hash: F731CE71255386ABDB39AF20CC55FEF37ACEF06781F004169FE4686285DB74A9108B20

Function 1000CFC0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 251
processpipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 1000D055
_memset.LIBCMT ref: 1000D08B
_memset.LIBCMT ref: 1000D09E
_memset.LIBCMT ref: 1000D0B1
CreatePipe.KERNELBASE(?,?,0000000C,00000000), ref: 1000D10C
GetStartupInfoA.KERNEL32(00000044), ref: 1000D12D
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,00000000), ref: 1000D17E
CloseHandle.KERNEL32(?,?), ref: 1000D39A
CloseHandle.KERNEL32(?), ref: 1000D3A7
CloseHandle.KERNEL32(?), ref: 1000D3B4
CloseHandle.KERNEL32(?), ref: 1000D3C1

Strings

D, xrefs: 1000D0CD
wmic cpu get processorid, xrefs: 1000D000
ProcessorId, xrefs: 1000D00B

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle_memset$Create$InfoPipeProcessStartup
String ID: D$ProcessorId$wmic cpu get processorid
API String ID: 1762129635-53154263
Opcode ID: 2faa9055df3024060b3a78fac8b67b6add4b8c37b23ad85aa60008f06d3c8044
Instruction ID: 29feaeb9d2e0a167578c768367cdbb99c1f13e7196a5b6bb9c176603c2bdf5a2
Opcode Fuzzy Hash: 2faa9055df3024060b3a78fac8b67b6add4b8c37b23ad85aa60008f06d3c8044
Instruction Fuzzy Hash: D1B14E75902228DFEB29DB60CC99BDEB7B4FB48340F1041DAE109A7181DB756B84CF50

Function 1000D420 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 250
processpipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 1000D4B4
_memset.LIBCMT ref: 1000D4EA
_memset.LIBCMT ref: 1000D4FD
_memset.LIBCMT ref: 1000D510
CreatePipe.KERNELBASE(?,?,0000000C,00000000), ref: 1000D56B
GetStartupInfoA.KERNEL32(00000044), ref: 1000D58C
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,00000000), ref: 1000D5DD
CloseHandle.KERNEL32(?,?), ref: 1000D7F9
CloseHandle.KERNEL32(?), ref: 1000D806
CloseHandle.KERNEL32(?), ref: 1000D813
CloseHandle.KERNEL32(?), ref: 1000D820

Strings

SerialNumber, xrefs: 1000D46A
D, xrefs: 1000D52C
wmic diskdrive get serialnumber, xrefs: 1000D460

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle_memset$Create$InfoPipeProcessStartup
String ID: D$SerialNumber$wmic diskdrive get serialnumber
API String ID: 1762129635-2526680146
Opcode ID: 284479aef56905e99ef7afbd9686248a6d4ef8a24c59542d99c3aafd4a34ee3f
Instruction ID: f7e6dc397231a2a0a1082a64f52227403f3a6002e1c9f0e787add4f7ccce3aad
Opcode Fuzzy Hash: 284479aef56905e99ef7afbd9686248a6d4ef8a24c59542d99c3aafd4a34ee3f
Instruction Fuzzy Hash: 8CB12B759162289BEB28DB64CC9DBEEB7B4FB48300F0041DAE50DAA191DB756B84CF50

Function 10026FE8 Relevance: 16.8, APIs: 11, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 10027021

Part of subcall function 100258DC: __getptd_noexit.LIBCMT ref: 100258DC

__gmtime64_s.LIBCMT ref: 100270BA
__gmtime64_s.LIBCMT ref: 100270F0
__gmtime64_s.LIBCMT ref: 1002710D
__allrem.LIBCMT ref: 10027163
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1002717F
__allrem.LIBCMT ref: 10027196
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 100271B4
__allrem.LIBCMT ref: 100271CB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 100271E9
__invoke_watson.LIBCMT ref: 1002725A

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: faf785f0e9591b3d4b811fc4296c87dcbc334db000ad1bf2518f1b08427d47ec
Instruction ID: 713491a1cde179dae1e75a0093b68b8f74a69f94e9f1ec33854f382ae24b7f6e
Opcode Fuzzy Hash: faf785f0e9591b3d4b811fc4296c87dcbc334db000ad1bf2518f1b08427d47ec
Instruction Fuzzy Hash: 6B71D476A00717EBE715DE78EC82B5AB3E8FF40364F91412AF918D6681E770ED448790

Function 10029B73 Relevance: 16.7, APIs: 11, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 10029B81

Part of subcall function 10027FF1: __mtinitlocknum.LIBCMT ref: 10028003
Part of subcall function 10027FF1: __amsg_exit.LIBCMT ref: 1002800F
Part of subcall function 10027FF1: EnterCriticalSection.KERNEL32(?,?,10025D6D,0000000D), ref: 1002801C

@_EH4_CallFilterFunc@8.LIBCMT ref: 10029B9F
__calloc_crt.LIBCMT ref: 10029BB8
@_EH4_CallFilterFunc@8.LIBCMT ref: 10029BD3
GetStartupInfoW.KERNEL32(?,101B7C90,00000064), ref: 10029C28
__calloc_crt.LIBCMT ref: 10029C73
GetFileType.KERNEL32(00000001), ref: 10029CBA
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 10029CF3
GetStdHandle.KERNEL32(-000000F6), ref: 10029DAC
GetFileType.KERNELBASE(00000000), ref: 10029DBE
InitializeCriticalSectionAndSpinCount.KERNEL32(-101BEA54,00000FA0), ref: 10029DF3

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CallCountFileFilterFunc@8InitializeSpinType__calloc_crt$EnterHandleInfoStartup__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 301580142-0
Opcode ID: 253e1a18d07f7ed5b743515052310a273316cb8cc387dfcc17b4352ffc5cb5ed
Instruction ID: 539e413c7bcea522b47ae7ad5c28c4f5532b66027edab54cb976d1ebee692ea2
Opcode Fuzzy Hash: 253e1a18d07f7ed5b743515052310a273316cb8cc387dfcc17b4352ffc5cb5ed
Instruction Fuzzy Hash: D3910671D043558FDB20CF68E88069DBBF4FF463A0B60426EE4AAAB3D1C7349842DB10

Function 6C696740 Relevance: 6.2, APIs: 4, Instructions: 243
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(0000FFFF,00000000,00001000,00000004), ref: 6C6969A4
_memset.LIBCMT ref: 6C696A4C
VirtualAlloc.KERNELBASE(0000FFFF,000000B8,00001000,00000004,?,6C698C38), ref: 6C696B0E
_memmove.LIBCMT ref: 6C696B70

Memory Dump Source

Source File: 00000004.00000002.3008266392.000000006C681000.00000040.00000001.01000000.00000003.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000004.00000002.3008223401.000000006C680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3008266392.000000006C9C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3008266392.000000006CBAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3008266392.000000006CBB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3008266392.000000006CBB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3009093322.000000006CC55000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c680000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocVirtual$_memmove_memset
String ID:
API String ID: 725130153-0
Opcode ID: af01bac3374c618721e138754d3ca3c72d74494653e4f821ac976264aae05339
Instruction ID: 395c12fc52dce5ac1d009dabf2c6e74aa10fdb6c514c0d7e02ec50b25f49a4c4
Opcode Fuzzy Hash: af01bac3374c618721e138754d3ca3c72d74494653e4f821ac976264aae05339
Instruction Fuzzy Hash: D9D16F75B0260DCFCB48CFD9E593A2DBBB1FB8A300B14821AD8A587754DB30A941CF49

Function 00BA13BF Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,00001000,00000004,?,?), ref: 00BA13EA
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 00BA1403

Memory Dump Source

Source File: 00000004.00000003.2102098932.0000000000BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_ba0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 460e07aa1c6cfb092b5f976fa85d581fca477865be9a128e2591be7121e923ca
Instruction ID: b1d429a417b6c49ed05833987fabd77db929dafd5a81931b874044704500e5e3
Opcode Fuzzy Hash: 460e07aa1c6cfb092b5f976fa85d581fca477865be9a128e2591be7121e923ca
Instruction Fuzzy Hash: 74F08276200305AFDB19CF40C844FEA7779EB48391F104176EA42AB684C670F5148B10

Function 1002CE25 Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 1002CE3C

Part of subcall function 10027FF1: __mtinitlocknum.LIBCMT ref: 10028003
Part of subcall function 10027FF1: __amsg_exit.LIBCMT ref: 1002800F
Part of subcall function 10027FF1: EnterCriticalSection.KERNEL32(?,?,10025D6D,0000000D), ref: 1002801C

__tzset_nolock.LIBCMT ref: 1002CE4F

Part of subcall function 1002D09F: __lock.LIBCMT ref: 1002D0C1
Part of subcall function 1002D09F: ____lc_codepage_func.LIBCMT ref: 1002D108
Part of subcall function 1002D09F: __getenv_helper_nolock.LIBCMT ref: 1002D129
Part of subcall function 1002D09F: _free.LIBCMT ref: 1002D15C
Part of subcall function 1002D09F: _strlen.LIBCMT ref: 1002D163
Part of subcall function 1002D09F: __malloc_crt.LIBCMT ref: 1002D16A

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: fc85f6cf18a6252e642b57c3e1c2b749fe30e0e1031c663e82c605452884cce2
Instruction ID: a2ad06c6b65e7629715c0b93b357caa5f945d3fedfb1b9c2ad21f9bf3716e497
Opcode Fuzzy Hash: fc85f6cf18a6252e642b57c3e1c2b749fe30e0e1031c663e82c605452884cce2
Instruction Fuzzy Hash: 0BE0C238451A48D9DF10EBF0AA4275C32F0FB04B66FE20209E004041D28F7D35888923

Function 10022833 Relevance: 3.0, APIs: 2, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 10022839

Part of subcall function 10022801: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,1002283E,00000000,?,100280A4,000000FF,0000001E,101B7BE8,00000008,10028008,00000000,?), ref: 10022810
Part of subcall function 10022801: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 10022822

ExitProcess.KERNEL32 ref: 10022842

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 3bf28b7052921138b5cd44a98d3311a828cfa0a63c341592180aa8684d3b340a
Instruction ID: c8f4cf039e012b41d150cd44d72804b099170dd8f7fcc5d26d0c23f5f7bd029f
Opcode Fuzzy Hash: 3bf28b7052921138b5cd44a98d3311a828cfa0a63c341592180aa8684d3b340a
Instruction Fuzzy Hash: B5B09230001108BFDB022F51DC4A8593FA9FB002A0B508020F80809032DF73BA929A81

Function 00BA082D Relevance: 2.6, APIs: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,-00000436,00001000,00000004), ref: 00BA087D
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00BA08A9

Memory Dump Source

Source File: 00000004.00000003.2102098932.0000000000BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_ba0000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7e515f7c385f7f07b94d9a5cb9b23266753d833ffbaa65bc10218dcc86593253
Instruction ID: 4181723301e8cfe3003c47583f47c12635cb7fa25731b05452caf335562b3efa
Opcode Fuzzy Hash: 7e515f7c385f7f07b94d9a5cb9b23266753d833ffbaa65bc10218dcc86593253
Instruction Fuzzy Hash: B0018471A01118BBEB14DE99CC41FAEB7E9EBC8760F14C16AF61897385D674AD10CBA0

Function 100287C6 Relevance: 1.5, APIs: 1, Instructions: 39
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vsnprintf_helper.LIBCMT ref: 10028804

Part of subcall function 100258DC: __getptd_noexit.LIBCMT ref: 100258DC

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__vsnprintf_helper
String ID:
API String ID: 3160531876-0
Opcode ID: 27c6404f2f0232317e85ccf06d5d21fea70814579ac9fa2ba3f76d9bc6ee1ddf
Instruction ID: bfddb452ae6b37b50ba7c24d6e5f6263054393a432078eca8de479b56f7627c6
Opcode Fuzzy Hash: 27c6404f2f0232317e85ccf06d5d21fea70814579ac9fa2ba3f76d9bc6ee1ddf
Instruction Fuzzy Hash: A7F0C23980214DAECF019FA4BC0578E3BE4EF01370FD14251FA2C4A1D1CFB6955097A6

Function 10021DFA Relevance: 1.5, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 100258DC: __getptd_noexit.LIBCMT ref: 100258DC

_asctime.LIBCMT ref: 10021E5D

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: __getptd_noexit_asctime
String ID:
API String ID: 1865661205-0
Opcode ID: dcfe908546e3f88bc8117c10939122550607e7d39558988ca205b2cb5c272348
Instruction ID: 4125543197aa1fcd6f4b2a2d68e97bfeb0adc15cba48122be1fc6d66b0878a2d
Opcode Fuzzy Hash: dcfe908546e3f88bc8117c10939122550607e7d39558988ca205b2cb5c272348
Instruction Fuzzy Hash: 53F04939A002099EDF00DBA4EC56BCE77ECEF28255FD20469EC05EB091EB74E9848725

Function 10036500 Relevance: 1.5, APIs: 1, Instructions: 22
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202), ref: 1003651E

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: d3557ac59b8f8fefe8b80b3b61d78a442e21de74061af108e84e171f57d9cb46
Instruction ID: a027679b03284c68216ebb438d11db6f7a8099bc69e3ea9b22835e59c52e58d0
Opcode Fuzzy Hash: d3557ac59b8f8fefe8b80b3b61d78a442e21de74061af108e84e171f57d9cb46
Instruction Fuzzy Hash: ABE0DF74A04208ABCB00DBB4DD0755D77F4EF49200F80016CF9098B252EB34AA148A82

Function 10022BD3 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 10022BDD

Part of subcall function 10022AA4: __lock.LIBCMT ref: 10022AB2
Part of subcall function 10022AA4: DecodePointer.KERNEL32(101B78D8,0000001C,10022A1B,00000000,00000001,00000000,?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022AF1
Part of subcall function 10022AA4: DecodePointer.KERNEL32(?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B02
Part of subcall function 10022AA4: EncodePointer.KERNEL32(00000000,?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B1B
Part of subcall function 10022AA4: DecodePointer.KERNEL32(-00000004,?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B2B
Part of subcall function 10022AA4: EncodePointer.KERNEL32(00000000,?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B31
Part of subcall function 10022AA4: DecodePointer.KERNEL32(?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B47
Part of subcall function 10022AA4: DecodePointer.KERNEL32(?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B52
Part of subcall function 10022AA4: __initterm.LIBCMT ref: 10022B7A
Part of subcall function 10022AA4: __initterm.LIBCMT ref: 10022B8B

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode__initterm$__lock_doexit
String ID:
API String ID: 3712619029-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: cfc2533f0be627bc8b7b8cac997dbfbd0b87b13c6f736a1528db1b5c4a82aaa4
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: 06B0123158030C33E9201581FC03F093B1C8F80A60F500020FF0C1C5E1A593756080CA

Function 10036790 Relevance: 1.3, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?), ref: 1003679A

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: f611d1dd42dff66c0d1eb48c861494fca37600f237e2205797fc90e11b86f92c
Instruction ID: 8c8dd9ba5464cc4f96c2d7dd6b4eaa4fb058b5ebf7e2d6a9fdb27c8fe52b3e30
Opcode Fuzzy Hash: f611d1dd42dff66c0d1eb48c861494fca37600f237e2205797fc90e11b86f92c
Instruction Fuzzy Hash: 1BF05434301512CFEB16DF19CC44945B3E9FF413A67564669E495CF668D774DC00CA50

Non-executed Functions

Function 10012550 Relevance: 54.6, APIs: 24, Strings: 7, Instructions: 308servicefileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,1A75B7EA,?,?,?,00000000,10023340,101B6C90,000000FE,?,10013C89,TMzsft xtnogaqk,Yyickg caosusmk,Eaiawk mgqwgoywasgymoeeuu), ref: 10012594
ExpandEnvironmentStringsA.KERNEL32(C:\Users\Public\Documents\,?,00000104,?,?,?,00000000,10023340,101B6C90,000000FE,?,10013C89,TMzsft xtnogaqk,Yyickg caosusmk,Eaiawk mgqwgoywasgymoeeuu), ref: 100125AB
_strlen.LIBCMT ref: 100125B8
_strncmp.LIBCMT ref: 100125CF
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 1001270E

Part of subcall function 10012300: _memset.LIBCMT ref: 10012328
Part of subcall function 10012300: _strlen.LIBCMT ref: 1001234F
Part of subcall function 10012300: _strncpy.LIBCMT ref: 10012382
Part of subcall function 10012300: CreateDirectoryA.KERNEL32(00000000,00000000), ref: 100123A9

wsprintfA.USER32 ref: 10012616
_strlen.LIBCMT ref: 10012626
_strlen.LIBCMT ref: 10012642
CopyFileA.KERNEL32(?,?,00000000), ref: 100126AE
_memset.LIBCMT ref: 100126C2
_strcat.LIBCMT ref: 100126D8
CreateServiceA.ADVAPI32(?,?,?,000F01FF,00000110,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000), ref: 10012756
LockServiceDatabase.ADVAPI32(?), ref: 10012769
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 10012799
ChangeServiceConfig2A.ADVAPI32(00000000,00000002,00015180), ref: 10012877
UnlockServiceDatabase.ADVAPI32(?), ref: 10012884
GetLastError.KERNEL32 ref: 10012893
OpenServiceA.ADVAPI32(?,?,000F01FF), ref: 100128B0

Strings

Windows Update, xrefs: 10012603
SYSTEM\CurrentControlSet\Services\, xrefs: 10012983, 10012986
s, xrefs: 100125F5
%, xrefs: 100125EE
Yyickg caosusmk, xrefs: 1001277D
C:\Users\Public\Documents\, xrefs: 100125A6
Description, xrefs: 10012A05, 10012A08

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Service$_strlen$ChangeConfig2CreateDatabaseFileOpen_memset$CopyDirectoryEnvironmentErrorExpandLastLockManagerModuleNameStringsUnlock_strcat_strncmp_strncpywsprintf
String ID: %$C:\Users\Public\Documents\$Description$SYSTEM\CurrentControlSet\Services\$Windows Update$Yyickg caosusmk$s
API String ID: 2269191997-3217403557
Opcode ID: da25e49445566c96217ba80189cd2cecd7e86491d1e1acde59f2152fe1c39007
Instruction ID: 58a78215622ab89836c283d46f1977e4f6cad2cf6e4b3b9b80a50220f8474d07
Opcode Fuzzy Hash: da25e49445566c96217ba80189cd2cecd7e86491d1e1acde59f2152fe1c39007
Instruction Fuzzy Hash: BEE17471D04298DFEB26CB94DC88BDE7BB8BB15704F0441D9E5486A2C1C7B95B88CF61

Function 1000E970 Relevance: 54.5, APIs: 26, Strings: 5, Instructions: 217stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000E9B6
_memset.LIBCMT ref: 1000E9D5
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 1000E9EB
StrCpyW.SHLWAPI(?,?), ref: 1000EA0A
PathRemoveFileSpecW.SHLWAPI(?), ref: 1000EA17
lstrlenW.KERNEL32(?), ref: 1000EA24

Strings

D, xrefs: 1000EBD5
COMSPEC, xrefs: 1000EA60
&& del ", xrefs: 1000EB63
/c ping -n 4 127.0.0.1 > nul, xrefs: 1000EA8F
" > nul, xrefs: 1000EB85

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File_memset$ModuleNamePathRemoveSpeclstrlen
String ID: && del "$ /c ping -n 4 127.0.0.1 > nul$" > nul$COMSPEC$D
API String ID: 322946884-2269649423
Opcode ID: 144a78e811b26684e0f96933bcd6fe390524fe62f1730313945f432d4c563e04
Instruction ID: 84f9132210fad28102cfca7cccb4be7a633d21108d91728e9d5e1e2c02768cad
Opcode Fuzzy Hash: 144a78e811b26684e0f96933bcd6fe390524fe62f1730313945f432d4c563e04
Instruction Fuzzy Hash: 17914F75A00219AFEB24DB64CC85BEA77B8FF48740F448599F20DAA191DF70AB84CF51

Function 1000EF10 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 213keyboardsleepstringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000EF55
_memset.LIBCMT ref: 1000EF72
_memset.LIBCMT ref: 1000EF88
Sleep.KERNEL32(00000005), ref: 1000EF92
lstrlenA.KERNEL32(00000000), ref: 1000EF9F
_memset.LIBCMT ref: 1000EFDC
GetKeyState.USER32(00000010), ref: 1000F035
GetAsyncKeyState.USER32(?), ref: 1000F05C
GetKeyState.USER32(00000014), ref: 1000F073

Strings

e, xrefs: 1000F026
<Enter>, xrefs: 1000F1EB
], xrefs: 1000F0CF
<BackSpace>, xrefs: 1000F15E

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$State$AsyncSleeplstrlen
String ID: <BackSpace>$<Enter>$]$e
API String ID: 607291201-3604511016
Opcode ID: da57c67bcd9e4523acf9165be53d619ee9f3dc396b189a0e504f25392de7e49e
Instruction ID: 971390b8b5f7826b9d9bd22f466c4ca9011c4cb2ed80f64febdb7f556ca07fc7
Opcode Fuzzy Hash: da57c67bcd9e4523acf9165be53d619ee9f3dc396b189a0e504f25392de7e49e
Instruction Fuzzy Hash: 6091F4B4900718DFEB20CFA0DC49BEA7375FB84346F1041EDE509A6186DB76AA94DF41

Function 1001DBF0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 104networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(?,00000001,00000006), ref: 1001DC4B
bind.WS2_32(00000000,00000002,0000001C), ref: 1001DC70
WSAGetLastError.WS2_32(?,?,?,?), ref: 1001DCA8
SetLastError.KERNEL32 ref: 1001DCB6
WSAGetLastError.WS2_32(?,?,?,?), ref: 1001DCD7
SetLastError.KERNEL32 ref: 1001DCE5
WSAGetLastError.WS2_32(?,?,?), ref: 1001DCF6
SetLastError.KERNEL32 ref: 1001DD04

Strings

0.0.0.0, xrefs: 1001DC17, 1001DC2D

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLast$bindsocket
String ID: 0.0.0.0
API String ID: 2672188334-3771769585
Opcode ID: 67e94f2010b34371f429a1fa7c81e8d84f1349c60049d7ca6e869d281ca33336
Instruction ID: 8216ced0d739489223f21362e87208fc090313cd3a371b7f6b63c1b20dd229cb
Opcode Fuzzy Hash: 67e94f2010b34371f429a1fa7c81e8d84f1349c60049d7ca6e869d281ca33336
Instruction Fuzzy Hash: 8231E672A002159FE720EF68DC85BAB77E8EF45350F00452EFD09CA181EAB5D885D7A0

Function 1001C580 Relevance: 7.7, APIs: 5, Instructions: 151networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32(?,?,?,?,?,?,1001C326,FFFFFFFF,?,?,?,FFFFFFFF,?), ref: 1001C5E3

Part of subcall function 100172C0: __CxxThrowException@8.LIBCMT ref: 100172D2
Part of subcall function 100172C0: EnterCriticalSection.KERNEL32(00000000,1A75B7EA,00000000,00000098,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005), ref: 10017312
Part of subcall function 100172C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005,?,100168C9,00000400,00000400), ref: 1001737B

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterErrorException@8LastLeaveThrow
String ID:
API String ID: 1367629879-0
Opcode ID: 1a78252def1050f5be20003a34375eeef4699fcd1b0fa4c910ffc5e1ea9ae854
Instruction ID: 2045c5cf5837c9daf880452df431a01197e78d674d59fb6298516e1ae159bddb
Opcode Fuzzy Hash: 1a78252def1050f5be20003a34375eeef4699fcd1b0fa4c910ffc5e1ea9ae854
Instruction Fuzzy Hash: 7851BEB5900218AFDB21DFA4C841AAE77B5FF44390F100219F8599F291E770EDD0DB91

Function 100153E0 Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 249libraryloaderCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10015432
_memset.LIBCMT ref: 10015448
_memset.LIBCMT ref: 1001545E
LoadLibraryA.KERNEL32(ADVAPI32.dll), ref: 1001546B
GetProcAddress.KERNEL32(00000000,RegQueryValueExA), ref: 10015493
GetProcAddress.KERNEL32(00000000,RegOpenKeyExA), ref: 100154AB
GetProcAddress.KERNEL32(00000000,RegEnumValueA), ref: 100154C3
GetProcAddress.KERNEL32(00000000,RegEnumKeyExA), ref: 100154DB
GetProcAddress.KERNEL32(00000000,RegCloseKey), ref: 100154F3
FreeLibrary.KERNEL32(00000000), ref: 1001553C

Strings

RegOpenKeyExA, xrefs: 1001549F
RegEnumKeyExA, xrefs: 100154CF
RegQueryValueExA, xrefs: 10015487
RegEnumValueA, xrefs: 100154B7
RegCloseKey, xrefs: 100154E7
ADVAPI32.dll, xrefs: 10015466

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$_memset$Library$FreeLoad
String ID: ADVAPI32.dll$RegCloseKey$RegEnumKeyExA$RegEnumValueA$RegOpenKeyExA$RegQueryValueExA
API String ID: 2029490530-3713883646
Opcode ID: ce21794f6d49dae7673cc83d0b588799919480882acf9cc9429ea4c88414c882
Instruction ID: 42d3faf0a6d82433ca9894e8e05647cd2437e6e791ab8efedd1cac75c6c50b36
Opcode Fuzzy Hash: ce21794f6d49dae7673cc83d0b588799919480882acf9cc9429ea4c88414c882
Instruction Fuzzy Hash: 4AB17EB5904629EFDB20DF64CC89BEEB7B4FB48306F0445D8E909AA290D7759AC4CF50

Function 10007130 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 183timeCOMMON

Download Yara Rule

APIs

WinHttpOpen.WINHTTP(curl/7.83.1,00000000,00000000,00000000,00000000), ref: 10007197
WinHttpSetTimeouts.WINHTTP(00000000,000003E8,000003E8,000003E8,000003E8), ref: 100071BE
WinHttpConnect.WINHTTP(00000000,?,00000050,00000000), ref: 100071D6
WinHttpOpenRequest.WINHTTP(00000000,GET,?,00000000,00000000,00000000,00000000), ref: 100071FA
WinHttpSendRequest.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 10007219
WinHttpReceiveResponse.WINHTTP(00000000,00000000), ref: 1000722E
WinHttpQueryHeaders.WINHTTP(00000000,20000013,00000000,00000000,00000004,00000000), ref: 10007264
__CxxThrowException@8.LIBCMT ref: 10007272
WinHttpQueryDataAvailable.WINHTTP(00000000,00000000), ref: 10007293
GetLastError.KERNEL32 ref: 1000729D
__CxxThrowException@8.LIBCMT ref: 100072AF
std::ios_base::clear.LIBCPMTD ref: 100072C8
WinHttpReadData.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000), ref: 100072E4
std::ios_base::clear.LIBCPMTD ref: 100072FF
GetLastError.KERNEL32(00000000), ref: 1000730A
_wprintf.LIBCMT ref: 10007316
WinHttpCloseHandle.WINHTTP(00000000), ref: 10007328
WinHttpCloseHandle.WINHTTP(00000000), ref: 10007338
WinHttpCloseHandle.WINHTTP(00000000), ref: 10007348

Strings

Error %d has occurred., xrefs: 10007311
curl/7.83.1, xrefs: 10007192
GET, xrefs: 100071F1

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Http$CloseHandle$DataErrorException@8LastOpenQueryRequestThrowstd::ios_base::clear$AvailableConnectHeadersReadReceiveResponseSendTimeouts_wprintf
String ID: Error %d has occurred.$GET$curl/7.83.1
API String ID: 3568891788-3281102068
Opcode ID: a0faf76c0c659e3c95fc50e059929233ef8cb015fb8e25ec05d524550362fc63
Instruction ID: 96198f7158a5b0440b015918e988b78723295c7c608185cc2ea97e2543ed712c
Opcode Fuzzy Hash: a0faf76c0c659e3c95fc50e059929233ef8cb015fb8e25ec05d524550362fc63
Instruction Fuzzy Hash: CF7107B1D40248EFEB15DFA0CC99BEEBBB4FB04741F104119F51AAA2D4CB786A45DB50

Function 10012C30 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 120sleepregistrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(TMzsft xtnogaqk,10012E80), ref: 10012C4D
FreeConsole.KERNEL32 ref: 10012C68
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012CB5
Sleep.KERNEL32(000001F4), ref: 10012CCA
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012CE6
CreateMutexA.KERNEL32(00000000,00000000,TMzsft xtnogaqk), ref: 10012D08
GetLastError.KERNEL32 ref: 10012D14
WSAStartup.WS2_32(00000202,?), ref: 10012D34
GetVersionExA.KERNEL32(00000094), ref: 10012D4B
Sleep.KERNEL32(000F4240,00000000), ref: 10012D73

Strings

TMzsft xtnogaqk, xrefs: 10012C48, 10012CFF
%s Win7, xrefs: 10012DAF

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Service$SleepStatus$ConsoleCreateCtrlErrorFreeHandlerLastMutexRegisterStartupVersion
String ID: %s Win7$TMzsft xtnogaqk
API String ID: 1415809075-2726583022
Opcode ID: 3c918adf2ea9c1f546c4a298ab0c77e3fc501175bd32b3641c86ff31aace8df7
Instruction ID: 16fc8e2a50e62427ded2aaa4a0275d88474e0d3da89c2d2dd2af286da20813d4
Opcode Fuzzy Hash: 3c918adf2ea9c1f546c4a298ab0c77e3fc501175bd32b3641c86ff31aace8df7
Instruction Fuzzy Hash: 9B518EB5904224DFE729EF60CC8DB9A77B4FB04306F804298E10D6A5A1D7786AC8DF52

Function 10015EB0 Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 139libraryloaderfileCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(wininet.dll), ref: 10015F01
GetProcAddress.KERNEL32(?,InternetOpenA), ref: 10015F19
FreeLibrary.KERNEL32(00000000), ref: 10015F57
GetProcAddress.KERNEL32(?,InternetOpenUrlA), ref: 10015F70
FreeLibrary.KERNEL32(00000000), ref: 10015FB7
CreateFileA.KERNEL32(1000F526,40000000,00000000,00000000,00000002,00000000,00000000), ref: 10015FD7
_memset.LIBCMT ref: 10015FFE
GetProcAddress.KERNEL32(?,InternetReadFile), ref: 10016012
WriteFile.KERNEL32(000000FF,?,00000000,00000000,00000000), ref: 10016086
CloseHandle.KERNEL32(000000FF), ref: 100160A0
Sleep.KERNEL32(00000001), ref: 100160A8
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 100160BA
FreeLibrary.KERNEL32(00000000), ref: 100160F0

Strings

InternetReadFile, xrefs: 10016006
wininet.dll, xrefs: 10015EFC
InternetOpenUrlA, xrefs: 10015F64
MSIE 6.0, xrefs: 10015F2D
InternetOpenA, xrefs: 10015F0D
InternetCloseHandle, xrefs: 100160AE

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$Free$File$CloseCreateHandleLoadSleepWrite_memset
String ID: InternetCloseHandle$InternetOpenA$InternetOpenUrlA$InternetReadFile$MSIE 6.0$wininet.dll
API String ID: 2728150189-4269851202
Opcode ID: 91acf4dff87506ba4283441e8002569b8e5cf21a0175855ebad90579deee730e
Instruction ID: e100d08a212eeccd1dc3a45c1d5aa8af2f61e991188d98dff4208e55cab7884c
Opcode Fuzzy Hash: 91acf4dff87506ba4283441e8002569b8e5cf21a0175855ebad90579deee730e
Instruction Fuzzy Hash: DA51CCF5900228DFEB31DB64CD89BDA77B8AB48305F5081D8F709AA181C7759AC5CF68

Function 100123C0 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 117libraryloaderprocessCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(userenv.dll), ref: 100123D8
GetProcAddress.KERNEL32(?,CreateEnvironmentBlock), ref: 100123EA
_memset.LIBCMT ref: 10012417
_memset.LIBCMT ref: 10012427
GetCurrentProcess.KERNEL32 ref: 10012459
OpenProcessToken.ADVAPI32(?,000F01FF,00000000), ref: 1001246F
DuplicateTokenEx.ADVAPI32(00000000,02000000,00000000,00000001,00000001,00000000), ref: 10012488
LoadLibraryA.KERNEL32(Kernel32.dll,WTSGetActiveConsoleSessionId), ref: 10012498
GetProcAddress.KERNEL32(00000000), ref: 1001249F
SetTokenInformation.ADVAPI32(00000000,0000000C,00000000,00000004), ref: 100124C0
CreateProcessAsUserA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000430,00000000,00000000,00000044,00000000), ref: 100124F6
CloseHandle.KERNEL32(00000000), ref: 10012506
CloseHandle.KERNEL32(00000000), ref: 10012510
FreeLibrary.KERNEL32(00000000), ref: 1001252F

Strings

D, xrefs: 1001244B
userenv.dll, xrefs: 100123D3
Kernel32.dll, xrefs: 10012493
WTSGetActiveConsoleSessionId, xrefs: 1001248E
CreateEnvironmentBlock, xrefs: 100123E1

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: LibraryProcessToken$AddressCloseHandleLoadProc_memset$CreateCurrentDuplicateFreeInformationOpenUser
String ID: CreateEnvironmentBlock$D$Kernel32.dll$WTSGetActiveConsoleSessionId$userenv.dll
API String ID: 2385095549-609967149
Opcode ID: ac44d7a654e1ecf9cefedaa459ffae167c2ab3953bef6485a400e85d30f059f2
Instruction ID: fd1ae4a91e3460f93e873eecc7cbeda63378566b322c9237b013182db1ce3722
Opcode Fuzzy Hash: ac44d7a654e1ecf9cefedaa459ffae167c2ab3953bef6485a400e85d30f059f2
Instruction Fuzzy Hash: B741B6B5E00218EFEB14DFE0CC99BAEBBB4FB48705F104518E6156B281D7B59944CF90

Function 10015000 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ADVAPI32.dll), ref: 10015019
GetProcAddress.KERNEL32(?,OpenProcessToken), ref: 1001502B
GetProcAddress.KERNEL32(?,AdjustTokenPrivileges), ref: 1001503D
GetProcAddress.KERNEL32(?,LookupPrivilegeValueA), ref: 1001504F
LoadLibraryA.KERNEL32(kernel32.dll), ref: 1001505D
GetProcAddress.KERNEL32(?,GetCurrentProcess), ref: 1001506F
LoadLibraryA.KERNEL32(KERNEL32.dll), ref: 100150F0
GetProcAddress.KERNEL32(?,GetLastError), ref: 10015102
CloseHandle.KERNEL32(?), ref: 1001511A
FreeLibrary.KERNEL32(00000000), ref: 1001512A
FreeLibrary.KERNEL32(00000000), ref: 1001513A

Strings

OpenProcessToken, xrefs: 10015022
AdjustTokenPrivileges, xrefs: 10015034
kernel32.dll, xrefs: 10015058
LookupPrivilegeValueA, xrefs: 10015046
GetCurrentProcess, xrefs: 10015066
GetLastError, xrefs: 100150F9
KERNEL32.dll, xrefs: 100150EB
ADVAPI32.dll, xrefs: 10015014

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$Load$Free$CloseHandle
String ID: ADVAPI32.dll$AdjustTokenPrivileges$GetCurrentProcess$GetLastError$KERNEL32.dll$LookupPrivilegeValueA$OpenProcessToken$kernel32.dll
API String ID: 2887716753-1648388921
Opcode ID: 09c34ea0c58a1937bffb1c09e732f69496aae19d3495c3a7a974608a733c4652
Instruction ID: 2ba7eb19521ecd2e0521120e7302f927c8c69f99e1a3e1b69f5f98f9208caa0c
Opcode Fuzzy Hash: 09c34ea0c58a1937bffb1c09e732f69496aae19d3495c3a7a974608a733c4652
Instruction Fuzzy Hash: 8441F775A00218EFEB16DFE4CC88BEEBBB5FB08301F144518F905AA291D7799940CBA0

Function 10015BC0 Relevance: 30.0, APIs: 10, Strings: 7, Instructions: 232libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ADVAPI32.dll,1A75B7EA), ref: 10015C0D
GetProcAddress.KERNEL32(00000000,RegCreateKeyExA), ref: 10015C2C
GetProcAddress.KERNEL32(00000000,RegSetValueExA), ref: 10015C3E
GetProcAddress.KERNEL32(00000000,RegDeleteKeyA), ref: 10015C50
GetProcAddress.KERNEL32(00000000,RegDeleteValueA), ref: 10015C62
GetProcAddress.KERNEL32(00000000,RegOpenKeyExA), ref: 10015C74
GetProcAddress.KERNEL32(00000000,RegCloseKey), ref: 10015C86
FreeLibrary.KERNEL32(00000000), ref: 10015CB7

Strings

RegOpenKeyExA, xrefs: 10015C6B
RegDeleteKeyA, xrefs: 10015C47
RegCreateKeyExA, xrefs: 10015C23
RegDeleteValueA, xrefs: 10015C59
RegSetValueExA, xrefs: 10015C35
RegCloseKey, xrefs: 10015C7D
ADVAPI32.dll, xrefs: 10015C08

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: ADVAPI32.dll$RegCloseKey$RegCreateKeyExA$RegDeleteKeyA$RegDeleteValueA$RegOpenKeyExA$RegSetValueExA
API String ID: 2449869053-3188892968
Opcode ID: a0bd9a62e12f23e275d41ab7552c4dc3de141cd94503504a1d0315d773db0a11
Instruction ID: 7e0e5bb135e0f492be458d9bdacf26a44bf840c8ddca4d957ca8ae1cdeebb231
Opcode Fuzzy Hash: a0bd9a62e12f23e275d41ab7552c4dc3de141cd94503504a1d0315d773db0a11
Instruction Fuzzy Hash: A791C575A00208EFDB14CFA4D988BEEBBB9FB48751F148519F505AB280D776E981CB60

Function 10011980 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 148libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Ole32.dll), ref: 10011995
GetProcAddress.KERNEL32(?,CoInitialize), ref: 100119A7
GetProcAddress.KERNEL32(?,CoUninitialize), ref: 100119B9
GetProcAddress.KERNEL32(?,CoCreateInstance), ref: 100119CB
LoadLibraryA.KERNEL32(Oleaut32.dll), ref: 100119D9
GetProcAddress.KERNEL32(?,SysFreeString), ref: 100119EB

Strings

Oleaut32.dll, xrefs: 100119D4
FriendlyName, xrefs: 10011AB4
CoUninitialize, xrefs: 100119B0
Ole32.dll, xrefs: 10011990
SysFreeString, xrefs: 100119E2
CoInitialize, xrefs: 1001199E
CoCreateInstance, xrefs: 100119C2

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CoCreateInstance$CoInitialize$CoUninitialize$FriendlyName$Ole32.dll$Oleaut32.dll$SysFreeString
API String ID: 2238633743-3340630095
Opcode ID: 1d44af109edd1136255a39dc8a1dfaf4e7fcfd6cc7004c71e0f7df510543376a
Instruction ID: 212faf0c9611e66aabaa8f64879106e5bf96d811b783168d703724af177fa0bf
Opcode Fuzzy Hash: 1d44af109edd1136255a39dc8a1dfaf4e7fcfd6cc7004c71e0f7df510543376a
Instruction Fuzzy Hash: 69519279E00218EFDB14DFE8D884AEEB7B5FF88701F108558E516AB290D774A985CF60

Function 10015950 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 94libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,1A75B7EA,?,?,?,00000000,10023340,101B6E88,000000FE,?,100158FA,00000000), ref: 1001598B
GetProcAddress.KERNEL32(?,GetThreadDesktop), ref: 100159A3
GetProcAddress.KERNEL32(?,GetUserObjectInformationA), ref: 100159BB
GetProcAddress.KERNEL32(?,SetThreadDesktop), ref: 100159D3
GetProcAddress.KERNEL32(?,CloseDesktop), ref: 100159EB
LoadLibraryA.KERNEL32(kernel32.dll,?,?,?,00000000,10023340,101B6E88,000000FE,?,100158FA,00000000), ref: 100159FC
GetProcAddress.KERNEL32(?,GetCurrentThreadId), ref: 10015A14

Strings

CloseDesktop, xrefs: 100159DF
GetUserObjectInformationA, xrefs: 100159AF
GetCurrentThreadId, xrefs: 10015A08
kernel32.dll, xrefs: 100159F7
user32.dll, xrefs: 10015986
GetThreadDesktop, xrefs: 10015997
SetThreadDesktop, xrefs: 100159C7

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseDesktop$GetCurrentThreadId$GetThreadDesktop$GetUserObjectInformationA$SetThreadDesktop$kernel32.dll$user32.dll
API String ID: 2238633743-588083535
Opcode ID: a1b5b4eb188306deb7be5c334ff11527cf8147aa92056ec69f43df2731cc529d
Instruction ID: 0747fb5764a0f845c2061594b4b15d20bfc1687557696379681bc3d3be76b4b8
Opcode Fuzzy Hash: a1b5b4eb188306deb7be5c334ff11527cf8147aa92056ec69f43df2731cc529d
Instruction Fuzzy Hash: 1641ED76901228EFDB21CFA4CC88BEEB7B4FF49311F104599F949AA251DB759A80CF50

Function 10013360 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

SocketClient.Connect %s,%d, xrefs: 10013497

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: SocketClient.Connect %s,%d
API String ID: 0-4086773378
Opcode ID: 806049d0937e817d2a7edc25e8aa56914ceb32bd5803814fc0c8e8b9f4b12fda
Instruction ID: 63baf142f1b2acfd1537a39fce8e3a032f44fd155c7a3820f2eaebd6526bdc0f
Opcode Fuzzy Hash: 806049d0937e817d2a7edc25e8aa56914ceb32bd5803814fc0c8e8b9f4b12fda
Instruction Fuzzy Hash: 3CC13479804A69CBDB21DF64CC907DEB7B5FF49340F0082D9E409AA291EB749AE4CF50

Function 1001AB90 Relevance: 21.2, APIs: 14, Instructions: 202memorytimeCOMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(00000001,00000001,00000000), ref: 1001ABD3
InterlockedCompareExchange.KERNEL32(00000001,00000001,00000000), ref: 1001ABE7
InterlockedDecrement.KERNEL32(00000005), ref: 1001AC11
DeleteCriticalSection.KERNEL32(?), ref: 1001AC61
DeleteCriticalSection.KERNEL32(?), ref: 1001AC6B
HeapFree.KERNEL32(00000000,00000000,?), ref: 1001AC75
InterlockedCompareExchange.KERNEL32(00000001,00000001,00000000), ref: 1001ACEB
timeGetTime.WINMM ref: 1001AD11
timeGetTime.WINMM ref: 1001AD1F
InterlockedDecrement.KERNEL32(00000005), ref: 1001AD52
DeleteCriticalSection.KERNEL32(?), ref: 1001ADA2
DeleteCriticalSection.KERNEL32(?), ref: 1001ADAC
HeapFree.KERNEL32(?,00000000,?), ref: 1001ADB7
InterlockedCompareExchange.KERNEL32(00000001,00000001,00000000), ref: 1001ADC5

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Interlocked$CompareCriticalDeleteExchangeSection$DecrementFreeHeapTimetime
String ID:
API String ID: 575379910-0
Opcode ID: 4b2b9e06dbfc7a189fe832d31680b9342d4a4f911797ed680ce7ed66d266748b
Instruction ID: 5fcf9dceec55b2fe5c3f5871ba84e04da2ee91e5bcf3991c6e7a15184a02e640
Opcode Fuzzy Hash: 4b2b9e06dbfc7a189fe832d31680b9342d4a4f911797ed680ce7ed66d266748b
Instruction Fuzzy Hash: A9719D7190065AEFDB11CF68CC84B5AB7F8FF05311F004669E81A9F691D774E984CBA1

Function 10022849 Relevance: 19.6, APIs: 13, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,00000001,10023AED,101B7938,00000008,10023C24,?,00000001,?,101B7958,0000000C,10023BC3,?,00000001,?), ref: 10022851
_free.LIBCMT ref: 1002286A

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

_free.LIBCMT ref: 1002287D
_free.LIBCMT ref: 1002289B
_free.LIBCMT ref: 100228AD
_free.LIBCMT ref: 100228BE
_free.LIBCMT ref: 100228C9
_free.LIBCMT ref: 100228E3
EncodePointer.KERNEL32(00000000), ref: 100228EA
_free.LIBCMT ref: 100228FF
_free.LIBCMT ref: 10022915
InterlockedDecrement.KERNEL32 ref: 10022927
_free.LIBCMT ref: 10022941

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeDecrementEncodeErrorFreeHeapInterlockedLast
String ID:
API String ID: 4264854383-0
Opcode ID: 6e45babb980946f711f94ecee9eb40fee16fb67e0b8076907215f6ffe089f320
Instruction ID: da1824f0f3d6086db6776b7d0893ce00e841dd68cd6532bffb288ba0f97f575f
Opcode Fuzzy Hash: 6e45babb980946f711f94ecee9eb40fee16fb67e0b8076907215f6ffe089f320
Instruction Fuzzy Hash: 64218DBA805231ABC715EF74FCC040A37B5FB043647E1466AF900E7A7ADB399881CB41

Function 10005CA0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetLogicalProcessorInformation,?,00000000), ref: 10005CC3
GetProcAddress.KERNEL32(00000000), ref: 10005CCA
GetLastError.KERNEL32 ref: 10005CEC
_free.LIBCMT ref: 10005CF8

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

_malloc.LIBCMT ref: 10005D04
_free.LIBCMT ref: 10005D3E
GetSystemInfo.KERNEL32(?), ref: 10005D54
_perror.LIBCMT ref: 10005D79

Strings

kernel32, xrefs: 10005CBA
zstd, xrefs: 10005D74
GetLogicalProcessorInformation, xrefs: 10005CB3

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLast_free$AddressFreeHandleHeapInfoModuleProcSystem_malloc_perror
String ID: GetLogicalProcessorInformation$kernel32$zstd
API String ID: 346688108-2576447550
Opcode ID: ebf4960832639757ba6ddf85c4acd03ed6aa7b5749e8a4a28e034f0c5179f344
Instruction ID: 534da2e331fe06abe5cc17a8b34cc9891e156add97b29abc730671e8849a38bb
Opcode Fuzzy Hash: ebf4960832639757ba6ddf85c4acd03ed6aa7b5749e8a4a28e034f0c5179f344
Instruction Fuzzy Hash: 3C212976A003115FF721E7249C89A4F73E8FF84292F940527FC0587215E73AEA4587D2

Function 10015160 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72libraryloaderstringCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 10015178
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 10015190
GetProcAddress.KERNEL32(?,Process32First), ref: 100151A8
GetProcAddress.KERNEL32(?,Process32Next), ref: 100151C0
lstrcmpiA.KERNEL32(1000E8DC,?), ref: 10015243
CloseHandle.KERNEL32(00000000), ref: 10015262
FreeLibrary.KERNEL32(00000000), ref: 10015278

Strings

kernel32.dll, xrefs: 10015173
Process32Next, xrefs: 100151B4
CreateToolhelp32Snapshot, xrefs: 10015184
Process32First, xrefs: 1001519C

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$CloseFreeHandleLoadlstrcmpi
String ID: CreateToolhelp32Snapshot$Process32First$Process32Next$kernel32.dll
API String ID: 1314729832-4285911020
Opcode ID: 1cd6a8fbb2155a4b1985ca30da2e4b0a3f5bfe765f9448f08b89226ab9c6a634
Instruction ID: b23b302b637ae1edde1f60404815d2dee06a1769a5a7b90f0171de9587be8fa8
Opcode Fuzzy Hash: 1cd6a8fbb2155a4b1985ca30da2e4b0a3f5bfe765f9448f08b89226ab9c6a634
Instruction Fuzzy Hash: 4B31AE75911228DBDB61DBA4CD88BEDB7B4FB49301F0005D8E90EAA250DB75AAC4CF50

Function 10018790 Relevance: 18.2, APIs: 12, Instructions: 172memorytimeCOMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 100187D0
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 100187DD
InterlockedDecrement.KERNEL32(00000000), ref: 100187FC
DeleteCriticalSection.KERNEL32(?), ref: 10018819
HeapFree.KERNEL32(?,00000000,?), ref: 10018824
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 100188AF
timeGetTime.WINMM ref: 100188D1
timeGetTime.WINMM ref: 100188DC
InterlockedDecrement.KERNEL32(00000000), ref: 1001890A
DeleteCriticalSection.KERNEL32(-00000018), ref: 10018933
HeapFree.KERNEL32(?,00000000,00000000), ref: 10018940
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 1001894E

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Interlocked$CompareExchange$CriticalDecrementDeleteFreeHeapSectionTimetime
String ID:
API String ID: 2485412644-0
Opcode ID: f37f0bf1c14315c2a0328e2bdc40fd7b1b2d9f8162c99514ea29b688ea27d9bd
Instruction ID: ccbf6a195e50664b114f756a4c275c858458adfb65b41e8f4299d56aa6b79b38
Opcode Fuzzy Hash: f37f0bf1c14315c2a0328e2bdc40fd7b1b2d9f8162c99514ea29b688ea27d9bd
Instruction Fuzzy Hash: 3C51AC76A00615EFDB11CF68CC84B9AB7F8FF04710F204569F919AB291D734EA80CB91

Function 1000E190 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E1DD
_memset.LIBCMT ref: 1000E1FA
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,?,?,?,?,?,?,1A75B7EA), ref: 1000E20F
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,\360se6\User Data\,00000000,?,?,?,?,?,?,1A75B7EA), ref: 1000E258
Sleep.KERNEL32(000003E8,Default,?,?,?,?,?,?,1A75B7EA), ref: 1000E273
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E298

Strings

bak, xrefs: 1000E247
\360se6\User Data\, xrefs: 1000E22E
360se6.exe, xrefs: 1000E1BB
Default, xrefs: 1000E25E

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: 360se6.exe$Default$\360se6\User Data\$bak
API String ID: 2742518391-1576209161
Opcode ID: cf5631d64cf3daff86f29a9e46f2c2e6785fc6ccd8703a21c0b353372ed7785e
Instruction ID: 701f933334c7848fb056ee3a11f22efabf5e93a761c2cecb354365ab54c774ad
Opcode Fuzzy Hash: cf5631d64cf3daff86f29a9e46f2c2e6785fc6ccd8703a21c0b353372ed7785e
Instruction Fuzzy Hash: B6316C75950258ABEB24DB60CC9ABDDB378EB14700F0001E9F5096A2D1EB787B84CF61

Function 1000E2F0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E33D
_memset.LIBCMT ref: 1000E35A
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001C,00000000,?,?,?,?,?,?,1A75B7EA), ref: 1000E36F
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,\Google\Chrome\User Data\,00000000,?,?,?,?,?,?,1A75B7EA), ref: 1000E3B8
Sleep.KERNEL32(000003E8,Default,?,?,?,?,?,?,1A75B7EA), ref: 1000E3D3
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E3F8

Strings

bak, xrefs: 1000E3A7
chrome.exe, xrefs: 1000E31B
Default, xrefs: 1000E3BE
\Google\Chrome\User Data\, xrefs: 1000E38E

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: Default$\Google\Chrome\User Data\$bak$chrome.exe
API String ID: 2742518391-1166745273
Opcode ID: 40d655d6cc16712bff4f2fb1f87b01a0d4e762ec64db6e7df24cb74d5259b5f4
Instruction ID: fecff77be065e459785ac47ee9805b112d0841096ecda917c53accf8bb13844d
Opcode Fuzzy Hash: 40d655d6cc16712bff4f2fb1f87b01a0d4e762ec64db6e7df24cb74d5259b5f4
Instruction Fuzzy Hash: 20316A75950258EBEB24DB60CC9ABD9B378EB14700F0002E9F5096A2D1EB787B84CF65

Function 1000E4A0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E4ED
_memset.LIBCMT ref: 1000E50A
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001C,00000000,?,?,?,?,?,?,1A75B7EA), ref: 1000E51F
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,\Tencent\QQBrowser\User Data\,00000000,?,?,?,?,?,?,1A75B7EA), ref: 1000E568
Sleep.KERNEL32(000003E8,Default,?,?,?,?,?,?,1A75B7EA), ref: 1000E583
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E5A8

Strings

bak, xrefs: 1000E557
QQBrowser.exe, xrefs: 1000E4CB
\Tencent\QQBrowser\User Data\, xrefs: 1000E53E
Default, xrefs: 1000E56E

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: Default$QQBrowser.exe$\Tencent\QQBrowser\User Data\$bak
API String ID: 2742518391-2429508344
Opcode ID: 0e54152de5e706dd32317b2883b6d9b22f54a27d1984d202d2b92858c0c27df3
Instruction ID: 303e9ac27bd1ca3b56e85ec31da4520ec1f556187fdca0bed45659d0685da91e
Opcode Fuzzy Hash: 0e54152de5e706dd32317b2883b6d9b22f54a27d1984d202d2b92858c0c27df3
Instruction Fuzzy Hash: 00316C75950258EFEB24DB60CC9ABD9B378EB14700F0001D9F5096A2D1EB787B84CF61

Function 1000E600 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E64D
_memset.LIBCMT ref: 1000E66A
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,?,?,?,?,?,?,1A75B7EA), ref: 1000E67F
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,\Microsoft\,00000000,?,?,?,?,?,?,1A75B7EA), ref: 1000E6C8
Sleep.KERNEL32(000003E8,Skype for Desktop,?,?,?,?,?,?,1A75B7EA), ref: 1000E6E3
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E708

Strings

bak, xrefs: 1000E6B7
Skype for Desktop, xrefs: 1000E6CE
\Microsoft\, xrefs: 1000E69E
Skype.exe, xrefs: 1000E62B

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: Skype for Desktop$Skype.exe$\Microsoft\$bak
API String ID: 2742518391-3712293284
Opcode ID: 609e6d69384bd8dc0245cb6b53dc543715522320479eba0b398141e820af1bdb
Instruction ID: 5cbbd60c3ee543de6939a2953fd336e89185860d59f2e57474878281ef46e463
Opcode Fuzzy Hash: 609e6d69384bd8dc0245cb6b53dc543715522320479eba0b398141e820af1bdb
Instruction Fuzzy Hash: FB316A75950258ABEB24DB64CC9ABD9B378EB14700F0002E9F5096A2D1EB787B84CF61

Function 100138F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 70registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10013918
RegOpenKeyExA.ADVAPI32(80000001,101AFE40,00000000,00020006,?), ref: 10013944
_sprintf.LIBCMT ref: 1001397C
_strlen.LIBCMT ref: 1001398B
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 100139A9
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,?), ref: 100139D7
RegCloseKey.ADVAPI32(?), ref: 100139EA

Strings

Windows Update, xrefs: 10013966
%s%s, xrefs: 10013970
C:\Users\Public\Documents\, xrefs: 1001396B

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseFileModuleNameOpenValue_memset_sprintf_strlen
String ID: %s%s$C:\Users\Public\Documents\$Windows Update
API String ID: 2914755242-3221868064
Opcode ID: a37f16671de4bf3d8217d41773bbf0f470df6e6be3ad6b2328483c6e46eca91b
Instruction ID: 74569bc2ad6f0a8eef20b1f4c122fea453a43a38896f5d2099743f1305caba47
Opcode Fuzzy Hash: a37f16671de4bf3d8217d41773bbf0f470df6e6be3ad6b2328483c6e46eca91b
Instruction Fuzzy Hash: 08210C75900218AFEB64DBA0CC86BD97778EB18701F404599E649AA181DBB46AC4CF91

Function 10007580 Relevance: 16.7, APIs: 11, Instructions: 233COMMONLIBRARYCODE

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 1000765B
char_traits.LIBCPMTD ref: 1000767F
char_traits.LIBCPMTD ref: 100076B0
char_traits.LIBCPMTD ref: 100076DA
char_traits.LIBCPMTD ref: 10007711
char_traits.LIBCPMTD ref: 10007735

Part of subcall function 10007520: _memmove.LIBCMT ref: 1000753E

char_traits.LIBCPMTD ref: 1000776F
char_traits.LIBCPMTD ref: 1000779B

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: char_traits$_memmove
String ID:
API String ID: 4015421094-0
Opcode ID: 8a46f27c53daf1bb3a5c5b26083eeb91bd03bd6e6ef27442f332e57adb46b26b
Instruction ID: 392e569acab4bc7803cc6a5d1307a5f36e8b576372a140fd2397c7b8e5873d66
Opcode Fuzzy Hash: 8a46f27c53daf1bb3a5c5b26083eeb91bd03bd6e6ef27442f332e57adb46b26b
Instruction Fuzzy Hash: 53A1B47AA00008EFDB04DF98DD92D9E77B6FF58298B248154F9099725ADB30FE50CB90

Function 10010380 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 112filestringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1001039F
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000004,00000080,00000000), ref: 10010406
GetFileSize.KERNEL32(?,00000000), ref: 10010425
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 1001044A
lstrlenA.KERNEL32(1000EEB8), ref: 10010454
lstrlenA.KERNEL32(1000EEB8,00000000,00000000), ref: 100104D6
WriteFile.KERNEL32(?,?,00000000), ref: 100104EB
CloseHandle.KERNEL32(?), ref: 100104F8

Strings

.key, xrefs: 100103D9

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$lstrlen$CloseCreateDirectoryHandlePointerSizeSystemWrite
String ID: .key
API String ID: 1674266968-343438762
Opcode ID: ffe63ab53faeb08c4fabfe3c25abd14c77d86f4555a55f109598a67c17bf6787
Instruction ID: 1c9aefebe2efcbaba9d66af4461c31df970b4e064e3fc872ccff81242f4e36e7
Opcode Fuzzy Hash: ffe63ab53faeb08c4fabfe3c25abd14c77d86f4555a55f109598a67c17bf6787
Instruction Fuzzy Hash: 7A410CB590022CDFDB29CB64DC86BD9B7B5BF48700F0085D9F649AA241D774AAC4CF90

Function 1000FE50 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 1000FE67
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 1000FE93

Strings

open, xrefs: 1000FE8C
D, xrefs: 1000FF6D

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ExecuteShell_strlen
String ID: D$open
API String ID: 4170776411-2491301029
Opcode ID: 45e0c28ea66c154113347479300cd7af64224d28f2b9312c10382868c233d3c8
Instruction ID: 2f325713f910cbc9df21e4a28366f17d85fbec6a5c87df3961e0dadf8c324f84
Opcode Fuzzy Hash: 45e0c28ea66c154113347479300cd7af64224d28f2b9312c10382868c233d3c8
Instruction Fuzzy Hash: E3418475900318EBEB20DF50CC46BEA77B8EF45740F00409CF608AB581DBB5AA85DF51

Function 1000E760 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E7AD
_memset.LIBCMT ref: 1000E7CA
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,?,?,?,?,?,?,1A75B7EA), ref: 1000E7DF
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,101AF284,00000000,?,?,?,?,?,?,1A75B7EA), ref: 1000E828
Sleep.KERNEL32(000003E8,SogouExplorer,?,?,?,?,?,?,1A75B7EA), ref: 1000E843
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E868

Strings

SogouExplorer.exe, xrefs: 1000E78B
bak, xrefs: 1000E817
SogouExplorer, xrefs: 1000E82E

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: SogouExplorer$SogouExplorer.exe$bak
API String ID: 2742518391-538188596
Opcode ID: 387075a032f40cdf426803d7b8eb962ed2b699bce44bc087e450045890685a63
Instruction ID: cdfe1adb3a5306c7d49e930ca4d3ffe4328d7c09e084d7f548619efed37bff03
Opcode Fuzzy Hash: 387075a032f40cdf426803d7b8eb962ed2b699bce44bc087e450045890685a63
Instruction Fuzzy Hash: 14316C75950258ABEB24DBA0CC9ABD9B374EF14700F0001D9F5096A2D1EB787B84CB55

Function 10012C66 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 49sleepsynchronizationnetworkCOMMON

Download Yara Rule

APIs

SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012CB5
Sleep.KERNEL32(000001F4), ref: 10012CCA
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012CE6
CreateMutexA.KERNEL32(00000000,00000000,TMzsft xtnogaqk), ref: 10012D08
GetLastError.KERNEL32 ref: 10012D14

Part of subcall function 10022BD3: _doexit.LIBCMT ref: 10022BDD

WSAStartup.WS2_32(00000202,?), ref: 10012D34
GetVersionExA.KERNEL32(00000094), ref: 10012D4B
Sleep.KERNEL32(000F4240,00000000), ref: 10012D73

Strings

TMzsft xtnogaqk, xrefs: 10012CFF

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ServiceSleepStatus$CreateErrorLastMutexStartupVersion_doexit
String ID: TMzsft xtnogaqk
API String ID: 4049670039-2123815393
Opcode ID: a53748f86f27197abeafadced6f73c21d7a14410f93471b365f7083a90965c1a
Instruction ID: 51f78178352a1e6bbcd1a39a8c3a93efe3193938c267407751cb2d4182533f7a
Opcode Fuzzy Hash: a53748f86f27197abeafadced6f73c21d7a14410f93471b365f7083a90965c1a
Instruction Fuzzy Hash: E5216DB4504220DFE329AF60CC8EB5937B4F70430AF804298E1096A9A6D7BC6588CF12

Function 10011F60 Relevance: 15.1, APIs: 10, Instructions: 123COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10011F90
_memset.LIBCMT ref: 10011FAA
FindWindowA.USER32(101AF964,00000000), ref: 10011FBA

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$FindWindow
String ID:
API String ID: 3918834205-0
Opcode ID: 39f1a4b514bf7a49ce17fcebaa32398609855f0b54f364aa2f0891fbe461ef20
Instruction ID: d02908bb6393ccc6194f76cc94439ad83e97ec676181d408bc8d9695fa0a8030
Opcode Fuzzy Hash: 39f1a4b514bf7a49ce17fcebaa32398609855f0b54f364aa2f0891fbe461ef20
Instruction Fuzzy Hash: E44161B5901218EBEB64CBA4DC85F9D77B4FB48304F008699EA0D9F282D774AAD4CF54

Function 10006F00 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 156COMMON

Download Yara Rule

APIs

Part of subcall function 10007130: WinHttpOpen.WINHTTP(curl/7.83.1,00000000,00000000,00000000,00000000), ref: 10007197
Part of subcall function 10007130: WinHttpSetTimeouts.WINHTTP(00000000,000003E8,000003E8,000003E8,000003E8), ref: 100071BE
Part of subcall function 10007130: WinHttpConnect.WINHTTP(00000000,?,00000050,00000000), ref: 100071D6
Part of subcall function 10007130: WinHttpOpenRequest.WINHTTP(00000000,GET,?,00000000,00000000,00000000,00000000), ref: 100071FA
Part of subcall function 10007130: WinHttpSendRequest.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 10007219
Part of subcall function 10007130: WinHttpReceiveResponse.WINHTTP(00000000,00000000), ref: 1000722E
Part of subcall function 10007130: WinHttpQueryHeaders.WINHTTP(00000000,20000013,00000000,00000000,00000004,00000000), ref: 10007264
Part of subcall function 10007130: __CxxThrowException@8.LIBCMT ref: 10007272

Part of subcall function 10006250: operator!=.LIBCPMTD ref: 1000628B
Part of subcall function 10006250: operator!=.LIBCPMTD ref: 100062CD

_Func_class.LIBCPMTD ref: 10006F71
_Func_class.LIBCPMTD ref: 10006FDF

Strings

ifconfig.cc, xrefs: 10006FAE
ip.ping0.cc, xrefs: 10007084
ifconfig.me, xrefs: 1000701C
4.ipw.cn, xrefs: 10006F46

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Http$Func_classOpenRequestoperator!=$ConnectException@8HeadersQueryReceiveResponseSendThrowTimeouts
String ID: 4.ipw.cn$ifconfig.cc$ifconfig.me$ip.ping0.cc
API String ID: 2327121134-1054840108
Opcode ID: e5f02f596ccace418473e767889c4ca837b0525676b23f026339b6d6215960db
Instruction ID: 8fedc6d71d1ea5c4082eb8e8fcd3074e9b412fba7bcbbe1695d31a67eb8f4e53
Opcode Fuzzy Hash: e5f02f596ccace418473e767889c4ca837b0525676b23f026339b6d6215960db
Instruction Fuzzy Hash: 2E513D75D00508DBDB18DFA8CC52ADDB7B6FF4C3A0F548129E41A6B295EB306A49CF60

Function 10013E90 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 150libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 10013EBF
GetProcAddress.KERNEL32(?,IsBadReadPtr), ref: 10013ED1
LoadLibraryA.KERNEL32(?), ref: 10013F25
FreeLibrary.KERNEL32(00000000), ref: 10014063

Strings

IsBadReadPtr, xrefs: 10013EC8
kernel32.dll, xrefs: 10013EBA

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Library$Load$AddressFreeProc
String ID: IsBadReadPtr$kernel32.dll
API String ID: 2632591731-2271619998
Opcode ID: b8cf5a7d21cec9c91bc597fb19d05e0d91973cb50290725d0d54b057ef2bedf3
Instruction ID: 4d98165a6a2f5fd888ffb7798c0831731eea4b449ce7d88afba1872c43b950e1
Opcode Fuzzy Hash: b8cf5a7d21cec9c91bc597fb19d05e0d91973cb50290725d0d54b057ef2bedf3
Instruction Fuzzy Hash: 2F61B178A00209EFDB04CF95C484BAEBBB1FF48314F258599E915AB361C735AA85DF90

Function 1000F420 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 1000F44B
_malloc.LIBCMT ref: 1000F473
_memmove.LIBCMT ref: 1000F496

Strings

D, xrefs: 1000F551

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _malloc_memmove_strlen
String ID: D
API String ID: 3238260300-2746444292
Opcode ID: 6855c12a7bdc6e0bd8773f4745c8c759726946dada61b8ef62cf01ab51cda593
Instruction ID: 6d557a2bb59ac2ae05f88cec7faa246fa2e5727cbdb9c8dfb4b7bdd6368fabdf
Opcode Fuzzy Hash: 6855c12a7bdc6e0bd8773f4745c8c759726946dada61b8ef62cf01ab51cda593
Instruction Fuzzy Hash: 163173B5D00218EBDB64CF60DC45BEB7378EB58345F404598E60DAA241EBB6AAC4CF91

Function 100157F0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 101libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,1A75B7EA), ref: 10015828
GetProcAddress.KERNEL32(?,OpenInputDesktop), ref: 1001587D
GetProcAddress.KERNEL32(?,OpenDesktopA), ref: 1001588F
GetProcAddress.KERNEL32(?,CloseDesktop), ref: 100158A1

Part of subcall function 10015950: LoadLibraryA.KERNEL32(user32.dll,1A75B7EA,?,?,?,00000000,10023340,101B6E88,000000FE,?,100158FA,00000000), ref: 1001598B
Part of subcall function 10015950: GetProcAddress.KERNEL32(?,GetThreadDesktop), ref: 100159A3
Part of subcall function 10015950: GetProcAddress.KERNEL32(?,GetUserObjectInformationA), ref: 100159BB
Part of subcall function 10015950: GetProcAddress.KERNEL32(?,SetThreadDesktop), ref: 100159D3
Part of subcall function 10015950: GetProcAddress.KERNEL32(?,CloseDesktop), ref: 100159EB
Part of subcall function 10015950: LoadLibraryA.KERNEL32(kernel32.dll,?,?,?,00000000,10023340,101B6E88,000000FE,?,100158FA,00000000), ref: 100159FC
Part of subcall function 10015950: GetProcAddress.KERNEL32(?,GetCurrentThreadId), ref: 10015A14

Strings

CloseDesktop, xrefs: 10015898
OpenInputDesktop, xrefs: 10015875, 10015878
OpenDesktopA, xrefs: 10015886
user32.dll, xrefs: 10015823

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseDesktop$OpenDesktopA$OpenInputDesktop$user32.dll
API String ID: 2238633743-3711086354
Opcode ID: 1873b1d038e82ffe73c977c033c60f3efe240073f85bcd7195dda5366d5656d8
Instruction ID: 34810388ce7dedadcc66fe602c4080af1544b897567115cb541a18f1db2ea245
Opcode Fuzzy Hash: 1873b1d038e82ffe73c977c033c60f3efe240073f85bcd7195dda5366d5656d8
Instruction Fuzzy Hash: 16416975D08388EEEB11CBE4D888BDEBFB5EF09315F140119E405BA281CBBA5944CB65

Function 1001C3A0 Relevance: 13.6, APIs: 9, Instructions: 149memorynetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 1001B6A0: HeapAlloc.KERNEL32(?,00000000,?,?,?,?,?,?,1001D1A7,?,1001C0BB,?,?,?,?,1001EAD1), ref: 1001B6CA

EnterCriticalSection.KERNEL32(00000054,?,00000000,1A75B7EA,?,00000000), ref: 1001C3F8

Part of subcall function 1001BD70: timeGetTime.WINMM ref: 1001BD78
Part of subcall function 1001BD70: _memmove.LIBCMT ref: 1001BDDC

GetLastError.KERNEL32 ref: 1001C470
CreateIoCompletionPort.KERNEL32(?,?,00000000,00000000), ref: 1001C44A

Part of subcall function 100172C0: __CxxThrowException@8.LIBCMT ref: 100172D2
Part of subcall function 100172C0: EnterCriticalSection.KERNEL32(00000000,1A75B7EA,00000000,00000098,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005), ref: 10017312
Part of subcall function 100172C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005,?,100168C9,00000400,00000400), ref: 1001737B

connect.WS2_32(?,?,0000001C), ref: 1001C497
CreateIoCompletionPort.KERNEL32(?,?,00000000,00000000), ref: 1001C4CC
HeapFree.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 1001C552
LeaveCriticalSection.KERNEL32(00000054), ref: 1001C559

Part of subcall function 1001A870: ioctlsocket.WS2_32(?,8004667E,?), ref: 1001A87F

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CompletionCreateEnterHeapLeavePort$AllocErrorException@8FreeLastThrowTime_memmoveconnectioctlsockettime
String ID:
API String ID: 577898059-0
Opcode ID: fb6ef4b531d651df34b6af81ca114c1cb161ed1b6c4b7f8e2a56bc7a7bb065d0
Instruction ID: 13f5607a006f5134b6e7d624e793b95b5dada5aad690ad180316847aeaa3252a
Opcode Fuzzy Hash: fb6ef4b531d651df34b6af81ca114c1cb161ed1b6c4b7f8e2a56bc7a7bb065d0
Instruction Fuzzy Hash: CA518F75600208AFDB11DF64CC85FAA77AAFF44350F144428FD09EE2A1DB71E890DB60

Function 1001E560 Relevance: 13.6, APIs: 9, Instructions: 139COMMON

Download Yara Rule

APIs

_memmove_s.LIBCMT ref: 1001E5C0

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memmove_s
String ID:
API String ID: 800865076-0
Opcode ID: bfd165e00e761db38f2bdf525350d73678aeff4c921f7e730ca0ddaf86c9b7a3
Instruction ID: e53b5beb10ba7e09faa63e27da374d48c55a1d98f715c35b0f5f6325fba29714
Opcode Fuzzy Hash: bfd165e00e761db38f2bdf525350d73678aeff4c921f7e730ca0ddaf86c9b7a3
Instruction Fuzzy Hash: 59418D36200655AFD711DF68C888B9EF7E9FF44364F10402AF9098B291DB75EDA08BA0

Function 1000EDC0 Relevance: 13.6, APIs: 9, Instructions: 80stringtimeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000EDDF
GetForegroundWindow.USER32 ref: 1000EDE7
GetWindowTextA.USER32(00000000,101BC5F8,00000400), ref: 1000EE02
_memset.LIBCMT ref: 1000EE27
lstrlenA.KERNEL32(101BC5F8), ref: 1000EE47
GetLocalTime.KERNEL32(?), ref: 1000EE5C
wsprintfA.USER32 ref: 1000EEA3
_memset.LIBCMT ref: 1000EEC9
_memset.LIBCMT ref: 1000EEDD

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$Window$ForegroundLocalTextTimelstrlenwsprintf
String ID:
API String ID: 2818073195-0
Opcode ID: 75adef7124855e83a17f00d692abf37ea0045c21f2baa1bf399519b3b5abe7e2
Instruction ID: 03485689b72bf285f166b7c4cb3250636e2bcbf9ff048aaab2fc2e49669969a2
Opcode Fuzzy Hash: 75adef7124855e83a17f00d692abf37ea0045c21f2baa1bf399519b3b5abe7e2
Instruction Fuzzy Hash: 753168F5A0012D9BD734DB54CD85BE973B8EB44704F0041A8F7097A191EB787AC5CB69

Function 100298C9 Relevance: 13.6, APIs: 9, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

__ioinit.LIBCMT ref: 100298CC

Part of subcall function 10029B38: InitOnceExecuteOnce.KERNEL32(101BE634,10029B73,00000000,00000000,1003508B,101B7FB0,0000000C,10005D7E,zstd), ref: 10029B46

__get_osfhandle.LIBCMT ref: 100298E0
__get_osfhandle.LIBCMT ref: 1002990B
__get_osfhandle.LIBCMT ref: 10029914
__get_osfhandle.LIBCMT ref: 10029920
CloseHandle.KERNEL32(00000000,?,?,?,10029874,?,101B7C48,00000010,1002399B,00000000,?,?,?), ref: 10029927
GetLastError.KERNEL32(?,10029874,?,101B7C48,00000010,1002399B,00000000,?,?,?), ref: 10029931
__free_osfhnd.LIBCMT ref: 1002993E
__dosmaperr.LIBCMT ref: 10029960

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: __get_osfhandle$Once$CloseErrorExecuteHandleInitLast__dosmaperr__free_osfhnd__ioinit
String ID:
API String ID: 974577687-0
Opcode ID: aeb50e6623f9612fbfea4720a11a12ee66fd82b979432c8a2b3a73e6567c2db6
Instruction ID: 534cc79353f924f132b53f2d2c247f43b701ca5fdf2037831c5180732be56f73
Opcode Fuzzy Hash: aeb50e6623f9612fbfea4720a11a12ee66fd82b979432c8a2b3a73e6567c2db6
Instruction Fuzzy Hash: 491148326042A41AD261D63C798976E36CCDF42BF4FE6079DFD2EDB0D2EA24ACC18150

Function 10012E80 Relevance: 13.6, APIs: 9, Instructions: 62sleepCOMMON

Download Yara Rule

APIs

SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012EC6
Sleep.KERNEL32(000001F4), ref: 10012ED1
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012F10
Sleep.KERNEL32(000001F4), ref: 10012F1B
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012F5A
Sleep.KERNEL32(000001F4), ref: 10012F65
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012FA0
Sleep.KERNEL32(000001F4), ref: 10012FAB
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012FD1

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ServiceStatus$Sleep
String ID:
API String ID: 4108286180-0
Opcode ID: 3093577f81a1bfef1be0275f51949fcebcef33dae7894a088e6bc179c9b4736d
Instruction ID: 2eb2aa5b39fb85c5a3343167d6ecbcddaa6ef8ab947596cac2bc6c57621dfea1
Opcode Fuzzy Hash: 3093577f81a1bfef1be0275f51949fcebcef33dae7894a088e6bc179c9b4736d
Instruction Fuzzy Hash: 1C31F7B4104221DFE31DFF60CC98B957BB8F708308F804368E5095BAA5E7BD6598DB56

Function 10011580 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100115CC
GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 100115E0
CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 10011647
GetFileSize.KERNEL32(000000FF,00000000), ref: 10011669

Part of subcall function 1001EF9C: _malloc.LIBCMT ref: 1001EFB4

ReadFile.KERNEL32(000000FF,?,00000000,00000000,00000000), ref: 100116B4
CloseHandle.KERNEL32(000000FF), ref: 10011771

Strings

.key, xrefs: 1001161A

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateDirectoryHandleReadSizeSystem_malloc_memset
String ID: .key
API String ID: 1189190961-343438762
Opcode ID: e3cca6749972bda63ac77e56a70e5a53b244fe33762708ed0120600f45f4504f
Instruction ID: 3d4300d2710fecc02f3fab15f3df85ad30c21ba86dc6f63d814e5d622af92f7c
Opcode Fuzzy Hash: e3cca6749972bda63ac77e56a70e5a53b244fe33762708ed0120600f45f4504f
Instruction Fuzzy Hash: 2551EAB5D0022C9BDB69CB64DC82BD9B7B4AB58300F0045D8E64DAB281DB74AFC4CF91

Function 10011E10 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 59stringnetworkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10011E5F
_memset.LIBCMT ref: 10011E71

Part of subcall function 100153E0: _memset.LIBCMT ref: 10015432
Part of subcall function 100153E0: _memset.LIBCMT ref: 10015448
Part of subcall function 100153E0: _memset.LIBCMT ref: 1001545E
Part of subcall function 100153E0: LoadLibraryA.KERNEL32(ADVAPI32.dll), ref: 1001546B

lstrlenA.KERNEL32(?), ref: 10011EA4
gethostname.WS2_32(?,10012B7F), ref: 10011EB6
lstrlenA.KERNEL32(?), ref: 10011EC0

Strings

HostName, xrefs: 10011E87
SYSTEM\Setup, xrefs: 10011E23

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$lstrlen$LibraryLoadgethostname
String ID: HostName$SYSTEM\Setup
API String ID: 3877737349-3163474852
Opcode ID: 3c57c7ea14b851b5edd5a4aedf8599d14a790c5ab8a68f19adf55a60d148b559
Instruction ID: 6f4c2ddfbcec68ea414a63b34556a325c0cca03fb215b7fd9fe6e58d22cc8f59
Opcode Fuzzy Hash: 3c57c7ea14b851b5edd5a4aedf8599d14a790c5ab8a68f19adf55a60d148b559
Instruction Fuzzy Hash: B41133B9A40218EBD714DF94DC81FAA77B8EB88600F00815CFA0D5B281D635EB41CB94

Function 1001E990 Relevance: 12.2, APIs: 8, Instructions: 179threadnetworkCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000040,?,00000001,000000FF), ref: 1001EA1C
CloseHandle.KERNEL32(?,?,00000001,000000FF), ref: 1001EA33

Part of subcall function 1001A570: PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,1001E9C8,?), ref: 1001A57C

GetCurrentThreadId.KERNEL32 ref: 1001EA8E
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 1001EAB3
GetLastError.KERNEL32(?,?,?), ref: 1001EAEF
WSAGetOverlappedResult.WS2_32(00000000,?,?,00000000,?), ref: 1001EB11
WSAGetLastError.WS2_32 ref: 1001EB1B
GetCurrentThreadId.KERNEL32 ref: 1001EB41

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CompletionCurrentErrorLastQueuedStatusThread$CloseHandleMultipleObjectsOverlappedPostResultWait
String ID:
API String ID: 1776276126-0
Opcode ID: b262b485ae6c8d05e2cc6277a80d9fb5ca37b47e31c1310d56df349767435e47
Instruction ID: 66b5417a272267f179c33290e45a533a74909bc530ce5bb48fcf6268d69e9a86
Opcode Fuzzy Hash: b262b485ae6c8d05e2cc6277a80d9fb5ca37b47e31c1310d56df349767435e47
Instruction Fuzzy Hash: A8519275900219AFDB11DFA8C8C5AAEBBB9FF48350F504569FA169B211DB30FE40CB91

Function 10019E20 Relevance: 12.1, APIs: 8, Instructions: 133networkCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 10019EDE
getaddrinfo.WS2_32(?,00000000,00000C00,00000000), ref: 10019F03
_free.LIBCMT ref: 10019F1C
WSASetLastError.WS2_32(00000000,?,?,?,?,?,?,?,?), ref: 10019F29
_memmove.LIBCMT ref: 10019F6D
freeaddrinfo.WS2_32(00000000,?,?,?,?,?,?,?,?), ref: 10019F7B
htons.WS2_32(?), ref: 10019F88
WSASetLastError.WS2_32(00002AF9,?,?,?,?,?,?,?,?), ref: 10019FAA

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free_memcpy_s_memmovefreeaddrinfogetaddrinfohtons
String ID:
API String ID: 1080299913-0
Opcode ID: 38c9a16045676048a6fe288dd4f45fcc865443c53d635113eaf2434cff52915d
Instruction ID: 09d37e572ec1318aebb19466cc5ed3869c43ff4f8d51cd655d2081561f1130ca
Opcode Fuzzy Hash: 38c9a16045676048a6fe288dd4f45fcc865443c53d635113eaf2434cff52915d
Instruction Fuzzy Hash: FF416171A00229ABDB20CF64CC85BAAB7B4FF55240F4181A9F94DDB111EB719EC9CB90

Function 1000F2B0 Relevance: 12.1, APIs: 8, Instructions: 62processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 1000F2C3
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1000F2DD
Process32First.KERNEL32(000000FF,00000128), ref: 1000F30E
OpenProcess.KERNEL32(00000001,00000000,00000000,000000FF,00000128,00000002,00000000), ref: 1000F347
TerminateProcess.KERNEL32(00000000,00000000), ref: 1000F367
CloseHandle.KERNEL32(00000000), ref: 1000F374
Process32Next.KERNEL32(000000FF,00000128), ref: 1000F388
CloseHandle.KERNEL32(000000FF,000000FF,00000128,00000002,00000000), ref: 1000F39C

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleProcess32$CreateCurrentFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 477742948-0
Opcode ID: 0e5e03193292138b7c311efabc93a15d5f194d092c39daaf66340cd660e8982b
Instruction ID: d41c4376eefb6253570006433f593cac2f32630ea850329660a4d75d5b4afe3c
Opcode Fuzzy Hash: 0e5e03193292138b7c311efabc93a15d5f194d092c39daaf66340cd660e8982b
Instruction Fuzzy Hash: 4921C370900228DFDB25EB60CD89BEDB7B4FB48750F1045D9E609AB290D774AB80DF50

Function 10002740 Relevance: 12.1, APIs: 8, Instructions: 56COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10002756

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

DeleteCriticalSection.KERNEL32(?), ref: 10002778
_free.LIBCMT ref: 1000277F
DeleteCriticalSection.KERNEL32(?,00000000), ref: 100027B2
_free.LIBCMT ref: 100027B9
_free.LIBCMT ref: 100027C2
_free.LIBCMT ref: 100027D1
_free.LIBCMT ref: 100027D7

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$CriticalDeleteSection$ErrorFreeHeapLast
String ID:
API String ID: 229044151-0
Opcode ID: 829fe4cc710feb83a16dcdc532ce873229ccf800336d69de1fb585340b12b445
Instruction ID: 16a73a784ab602da626493d70980f9eae99143d6bc0915a138f34a67110a4392
Opcode Fuzzy Hash: 829fe4cc710feb83a16dcdc532ce873229ccf800336d69de1fb585340b12b445
Instruction Fuzzy Hash: 560108B66007105BE612EF209C82A6B73AAEF80580F54442CF94A47207DB35F985C7E2

Function 10018DD0 Relevance: 10.7, APIs: 7, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,?,?,00000000,1A75B7EA), ref: 10018E77
HeapFree.KERNEL32(?,00000000,?), ref: 10018E84
_free.LIBCMT ref: 10018F18
HeapDestroy.KERNEL32(?), ref: 10018F8E
HeapCreate.KERNEL32(?,?,?), ref: 10018F9F
HeapDestroy.KERNEL32(00000000), ref: 10018FAC
HeapCreate.KERNEL32(?,?,?), ref: 10018FB7

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Heap$CreateDestroy$CriticalDeleteFreeSection_free
String ID:
API String ID: 1764084169-0
Opcode ID: c3f88b120b0d50cfdc866e451160b25d59f4e1943c12536e881b99dc529dd748
Instruction ID: 8cea0ffc507937525084062c29ae185d00e44530d60b22a0429b01e019052092
Opcode Fuzzy Hash: c3f88b120b0d50cfdc866e451160b25d59f4e1943c12536e881b99dc529dd748
Instruction Fuzzy Hash: 2B5148B1A00606EFDB05CFA4C881B9ABBF5FF08304F044569E909AF651DB35EA55CBA0

Function 100145C0 Relevance: 10.7, APIs: 7, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd34e201d1059666f78fc474e3004731cd6cb8f970c98b5a1a8be2d127c39e0
Instruction ID: df39f66d2745d17a7fe87e744aa0e03a21574858425a6f03c3f21479afaab56c
Opcode Fuzzy Hash: bfd34e201d1059666f78fc474e3004731cd6cb8f970c98b5a1a8be2d127c39e0
Instruction Fuzzy Hash: 536109B9E00209EFDB44CF94C884B9EB7B5FF48304F218598E905AB395D775EA81DB90

Function 10002070 Relevance: 10.6, APIs: 7, Instructions: 114COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 1000208B
WakeAllConditionVariable.KERNEL32(?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 100020AD
LeaveCriticalSection.KERNEL32(?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 100020B4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 100020EC
SleepConditionVariableCS.KERNEL32(?,?,000000FF,?,?,?,100025EE,?,?,?,10002B57,?), ref: 1000210D
LeaveCriticalSection.KERNEL32(?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 10002116
_free.LIBCMT ref: 1000213E

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveVariable$SleepWake_free
String ID:
API String ID: 1710734047-0
Opcode ID: e61bd854db23e898daa16de29f131cc90b3ab22f0d1ab1bd32c91fa0d06ec401
Instruction ID: 05dc04eb116ff6e28942813317816f3c30ed5ba661128168b5cad8891ce245dc
Opcode Fuzzy Hash: e61bd854db23e898daa16de29f131cc90b3ab22f0d1ab1bd32c91fa0d06ec401
Instruction Fuzzy Hash: 8D4190B1601B069FE724CF64C884796B7F4FF14390F51462AE91ACB695D730F894CBA1

Function 1001A6F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,?), ref: 1001A70C
GetProcAddress.KERNEL32(00000000,CreateFileTransactedA), ref: 1001A721
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?), ref: 1001A76A
GetFileSize.KERNEL32(?,?), ref: 1001A78C

Strings

kernel32.dll, xrefs: 1001A707
CreateFileTransactedA, xrefs: 1001A71B

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$AddressCreateHandleModuleProcSize
String ID: CreateFileTransactedA$kernel32.dll
API String ID: 381258031-3827029016
Opcode ID: 2b602c5be5b8ceff7d4341a465a72c2674a25abf06f1222532ee79990a52c5db
Instruction ID: 3fd96c11bbd7488a8a418e2e25c194671cc8f240b4c6ee697fb62349ff201565
Opcode Fuzzy Hash: 2b602c5be5b8ceff7d4341a465a72c2674a25abf06f1222532ee79990a52c5db
Instruction Fuzzy Hash: 0431AD34744205BBEB31CA649C45B9977F8EF02B61F20425AFE18EE1D0D7B1EAD0D654

Function 1001A8B0 Relevance: 10.6, APIs: 7, Instructions: 96COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000001,0000FFFF,000000FB,00000001,00000004), ref: 1001A8E5
setsockopt.WS2_32(00000001,0000FFFF,00000004,00000000,00000004), ref: 1001A8F7
setsockopt.WS2_32(00000001,0000FFFF,000000FB,00000000,00000004), ref: 1001A91E
setsockopt.WS2_32(00000001,0000FFFF,00000004,00000000,00000004), ref: 1001A930

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 7b82cd8a322e7eafe5a33a62bfc76d56978321d665ea09961d1f1c17fe74bef7
Instruction ID: 2534b507c7e92884fcc3b13e06d001a7cc937f1284d80b897d24f64fcb9b5863
Opcode Fuzzy Hash: 7b82cd8a322e7eafe5a33a62bfc76d56978321d665ea09961d1f1c17fe74bef7
Instruction Fuzzy Hash: 2521FBB674421E7AEB10C6959C81FA9775CDF45771F200272FF18DB2C1D971994887A0

Function 1001E880 Relevance: 10.6, APIs: 7, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000,1A75B7EA,?,00000000,?,?,00000000,10035FA8,000000FF,?,1001DB19,00000000,?,?,1001D937,?), ref: 1001E8BC
EnterCriticalSection.KERNEL32(00000000,1A75B7EA,?,00000000,?,?,00000000,10035FA8,000000FF,?,1001DB19,00000000,?,?,1001D937,?), ref: 1001E8F8
SetLastError.KERNEL32(00000000,?,1001DB19,00000000,?,?,1001D937,?,00000000,?,?,?,?,1001EB3A,?,?), ref: 1001E90D
LeaveCriticalSection.KERNEL32(?,?,1001DB19,00000000,?,?,1001D937,?,00000000,?,?,?,?,1001EB3A,?,?), ref: 1001E92C
InterlockedDecrement.KERNEL32(00000028), ref: 1001E948
HeapFree.KERNEL32(?,00000000,00000000,00000000,?,1001DB19,00000000,?,?,1001D937,?,00000000,?,?,?), ref: 1001E969

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalErrorLastSection$DecrementEnterFreeHeapInterlockedLeave
String ID:
API String ID: 2534375417-0
Opcode ID: 8a373b9e699bbe36eec3ad261a269d3c2d471c0edf0be97ca4a8e9b207caec58
Instruction ID: c19bc2cfbfcf6eb32c943866d2ea1f3cbf7c2381cbd68fa049da8d29006db6f8
Opcode Fuzzy Hash: 8a373b9e699bbe36eec3ad261a269d3c2d471c0edf0be97ca4a8e9b207caec58
Instruction Fuzzy Hash: 46315A32600645AFDB61CF64CC88B9ABBF9FF48361F04452AF91ADB660DB31E854CB50

Function 100137C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100137E8
_strcat.LIBCMT ref: 10013887
RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,000F003F,?), ref: 100138BD
RegCloseKey.ADVAPI32(?), ref: 100138CE

Strings

TMzsft xtnogaqk, xrefs: 1001388F
SYSTEM\CurrentControlSet\Services\, xrefs: 1001387C, 1001387F

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseOpen_memset_strcat
String ID: SYSTEM\CurrentControlSet\Services\$TMzsft xtnogaqk
API String ID: 3167732647-1014003165
Opcode ID: 2662b6faaf2599209bb8ca6bb403307948ab9ad392b1d5476d8a6161b5a9aa7b
Instruction ID: 22143534158840905b67e581eba63ca17ab0457cd731155eff119560de7604f3
Opcode Fuzzy Hash: 2662b6faaf2599209bb8ca6bb403307948ab9ad392b1d5476d8a6161b5a9aa7b
Instruction Fuzzy Hash: AD41D020D0C2C9D9EB02C7A888097DEBFB55B26749F0840D8D5887A282D7FE5758C7B6

Function 10003320 Relevance: 10.6, APIs: 7, Instructions: 80COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 10003330

Part of subcall function 10024166: __calloc_impl.LIBCMT ref: 10024179

InitializeCriticalSection.KERNEL32(00000018,00000000), ref: 1000335C
InitializeConditionVariable.KERNEL32(00000030), ref: 1000336C
InitializeConditionVariable.KERNEL32(00000034), ref: 10003372
__beginthreadex.LIBCMT ref: 100033A8

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Initialize$ConditionVariable$CriticalSection__beginthreadex__calloc_impl_calloc
String ID:
API String ID: 4275094566-0
Opcode ID: 1c90a2da0a09f1423271f63d7b8369d043ae484d91931262826aadb9d33fa527
Instruction ID: d63cbc47a989e61f8d5764840e3dc6a2f22de4f4aba891b4dc0ad6eac0f10f79
Opcode Fuzzy Hash: 1c90a2da0a09f1423271f63d7b8369d043ae484d91931262826aadb9d33fa527
Instruction Fuzzy Hash: 582192B660071AAFE711DF95EC84B97B7ECFB40350F504029EA08C7541EBB5B6598BA0

Function 100105B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 100105D3
_memset.LIBCMT ref: 100105FB
GetTempPathA.KERNEL32(00000104,?), ref: 1001060F

Strings

D, xrefs: 1001067A

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: PathTemp_memset_strrchr
String ID: D
API String ID: 3269299267-2746444292
Opcode ID: 65dff33f197481420d75febd2944a67fcb56e30f99d0bf04b3eaf0f89ed5e44e
Instruction ID: 94703a5b4a1e95a47fdd501beecf67a154b79f006fe411b9632ef845b5e6f6b1
Opcode Fuzzy Hash: 65dff33f197481420d75febd2944a67fcb56e30f99d0bf04b3eaf0f89ed5e44e
Instruction Fuzzy Hash: 2F218BB9D00218EBDB24DB50DC45BDA7378EB58305F444498F54D9E281EBB5ABC4CFA0

Function 10011FE0 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 10012026
_memset.LIBCMT ref: 10012042
GetWindowTextA.USER32(00000000,00000000,00000040), ref: 10012061
_strncpy.LIBCMT ref: 100120B5
_strncat.LIBCMT ref: 100120CA
GetWindow.USER32(00000000,00000002), ref: 100120EA
GetClassNameA.USER32(00000000,00000000,00000080), ref: 10012109

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Window$ClassNameText_memset_strncat_strncmp_strncpy
String ID:
API String ID: 3228922498-0
Opcode ID: 9b23a114edeb7ee68d8fe2a349bbd8718838ecac6987a0b2f96da892dcbfe533
Instruction ID: 88a1f005e2bcef45723d5467eb62586ba9483bdea00c3cbe37d0c3424b11e526
Opcode Fuzzy Hash: 9b23a114edeb7ee68d8fe2a349bbd8718838ecac6987a0b2f96da892dcbfe533
Instruction Fuzzy Hash: FF215CB5901219DBEB60CBA4CC85F9D77B4FB48304F108698EA0DAB182D774AAC4CF64

Function 10011B40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 10011B57
_memset.LIBCMT ref: 10011B99
Process32First.KERNEL32(000000FF,00000128), ref: 10011BB9
Process32Next.KERNEL32(000000FF,00000128), ref: 10011BF4
CloseHandle.KERNEL32(000000FF,000000FF,00000128,?,00000002,00000000), ref: 10011C04

Strings

WeChat.exe, xrefs: 10011BC2

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
String ID: WeChat.exe
API String ID: 2526126748-2865290047
Opcode ID: 39a29232ca075c726fda8ef9c875e25e6892fe3647a628bb6ce209c239f2d104
Instruction ID: de72c953fd82724fd2484dccbf463224b55a824a9cf3277821e8854a41679b26
Opcode Fuzzy Hash: 39a29232ca075c726fda8ef9c875e25e6892fe3647a628bb6ce209c239f2d104
Instruction Fuzzy Hash: 49212E759002199BDB64DBA0CD85BEDB3B4EF48301F1001E8E50DAB291EB74AE85CF90

Function 10001220 Relevance: 10.6, APIs: 7, Instructions: 58COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10001236

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

_free.LIBCMT ref: 10001275
_free.LIBCMT ref: 1000128D
_free.LIBCMT ref: 100012A8
DeleteCriticalSection.KERNEL32(8415FF68,?), ref: 100012C6
_free.LIBCMT ref: 100012CD
_free.LIBCMT ref: 100012D6

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$CriticalDeleteErrorFreeHeapLastSection
String ID:
API String ID: 2933665753-0
Opcode ID: 2361ccc68d43a71e868931a2596d9ac44d138912533a7e2e7945e83494bb7265
Instruction ID: aaf221896ecc1e09f6eeffe9c750e8d10df9c6965350f993c9d4ceeb60f37a7f
Opcode Fuzzy Hash: 2361ccc68d43a71e868931a2596d9ac44d138912533a7e2e7945e83494bb7265
Instruction Fuzzy Hash: F81104B1800B455BE721EB61F8817A773E1FF00250F948439E55B4220AD731B9E8CBA2

Function 1000F630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54processsynchronizationCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000F648
CreateProcessA.KERNEL32(00000000,1000F402,00000000,00000000,00000001,08000020,00000000,00000000,00000044,00000000), ref: 1000F686
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1000F696
CloseHandle.KERNEL32(00000000), ref: 1000F6A0
CloseHandle.KERNEL32(?), ref: 1000F6AA

Strings

D, xrefs: 1000F650

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateObjectProcessSingleWait_memset
String ID: D
API String ID: 3422168109-2746444292
Opcode ID: 6aa504984eda8c7b5acce5dc33e2805d2fb05eccdb010cb75b9960ebb1134bfa
Instruction ID: cb5451c512472725f5a4df07bad1c41973f3ae078433712cb33367d9263f6d2b
Opcode Fuzzy Hash: 6aa504984eda8c7b5acce5dc33e2805d2fb05eccdb010cb75b9960ebb1134bfa
Instruction Fuzzy Hash: CA113071A00248EFEB24DFE4DC46BAD7BB8EF48700F10421DF619AE2D4DBB5A9448B54

Function 10025DD7 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 10025DD7

Part of subcall function 10022A20: EncodePointer.KERNEL32(00000000,00000001,10025DDC,10023A64,101B7938,00000008,10023C24,?,00000001,?,101B7958,0000000C,10023BC3,?,00000001,?), ref: 10022A23
Part of subcall function 10022A20: __initp_misc_winsig.LIBCMT ref: 10022A44

__mtinitlocks.LIBCMT ref: 10025DDC

Part of subcall function 10028120: InitializeCriticalSectionAndSpinCount.KERNEL32(101BB940,00000FA0,?,00000001,10025DE1,10023A64,101B7938,00000008,10023C24,?,00000001,?,101B7958,0000000C,10023BC3,?), ref: 1002813E

__mtterm.LIBCMT ref: 10025DE5

Part of subcall function 10025E4D: DeleteCriticalSection.KERNEL32(?,?,?,?,10023B29,10023B0F,101B7938,00000008,10023C24,?,00000001,?,101B7958,0000000C,10023BC3,?), ref: 1002803C
Part of subcall function 10025E4D: _free.LIBCMT ref: 10028043
Part of subcall function 10025E4D: DeleteCriticalSection.KERNEL32(101BB940,?,?,10023B29,10023B0F,101B7938,00000008,10023C24,?,00000001,?,101B7958,0000000C,10023BC3,?,00000001), ref: 10028065

__calloc_crt.LIBCMT ref: 10025E0A
__initptd.LIBCMT ref: 10025E2C
GetCurrentThreadId.KERNEL32 ref: 10025E33

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Delete$CountCurrentEncodeInitializePointerSpinThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 757573777-0
Opcode ID: 5305d30ccda45478ab966d2ea542fe534dde36908a179f48a9bcc1fc7b76229d
Instruction ID: 58ec3693b2f49863f7a8b2837ed69b9cb9c38201cd79a3fee43b5d8399986583
Opcode Fuzzy Hash: 5305d30ccda45478ab966d2ea542fe534dde36908a179f48a9bcc1fc7b76229d
Instruction Fuzzy Hash: 31F0243A1093225AE779E7383C0724B37C8DF02272BA2461DF5A6C84D5FF72A9424658

Function 10023833 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,100238FC,?), ref: 1002384D
GetProcAddress.KERNEL32(00000000), ref: 10023854
EncodePointer.KERNEL32(00000000), ref: 10023860
DecodePointer.KERNEL32(00000001,100238FC,?), ref: 1002387D

Strings

RoInitialize, xrefs: 1002383C
combase.dll, xrefs: 10023848

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 8a1acb73c590863b49b739fc2dd12772df6c41613cc91e6a01cbeba2b542fb8d
Instruction ID: 1191a88cc48d34fd9790489e5a8225d39aecb065cdaa85872b62c02564ac10b9
Opcode Fuzzy Hash: 8a1acb73c590863b49b739fc2dd12772df6c41613cc91e6a01cbeba2b542fb8d
Instruction Fuzzy Hash: 05E09A70240322AFEB247F30CDCEB4536B5F708702F908120F002DD0A0EBB88440CA52

Function 10023908 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,10023822), ref: 10023922
GetProcAddress.KERNEL32(00000000), ref: 10023929
EncodePointer.KERNEL32(00000000), ref: 10023934
DecodePointer.KERNEL32(10023822), ref: 1002394F

Strings

RoUninitialize, xrefs: 10023911
combase.dll, xrefs: 1002391D

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 4920fa68460fbff39facb883f69098808d4252d96aa017c2b93aa0396bf9b739
Instruction ID: 1f88319e3d8987e8e0ffa380cb3ac5eb2f489078ab51b11df1e274af2f38050d
Opcode Fuzzy Hash: 4920fa68460fbff39facb883f69098808d4252d96aa017c2b93aa0396bf9b739
Instruction Fuzzy Hash: 06E04678600221AFEBA56F20CC8DB463BB5F715301F918620F105D80A5EBFA9580CF92

Function 10016140 Relevance: 9.2, APIs: 6, Instructions: 151COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 100161B4

Part of subcall function 10020474: __FF_MSGBANNER.LIBCMT ref: 1002048B
Part of subcall function 10020474: __NMSG_WRITE.LIBCMT ref: 10020492
Part of subcall function 10020474: HeapAlloc.KERNEL32(008B0000,00000000,00000001,?,?,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 100204B7

_free.LIBCMT ref: 10016270
std::exception::exception.LIBCMT ref: 100162BC
__CxxThrowException@8.LIBCMT ref: 100162D1
SetLastError.KERNEL32(00000018,?,101B722C,?,1001640E,80004005,?,100168C9,00000400,00000400), ref: 100162DC
_free.LIBCMT ref: 100162E7

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$AllocErrorException@8HeapLastThrow_mallocstd::exception::exception
String ID:
API String ID: 3049299895-0
Opcode ID: c4e75bb467dcd632cc6794f0c5e8569d33c960b951e8937276adff62c409ee6a
Instruction ID: ed2824db1dae17bfd308ba5dcb0e615037e45c0d1587b7e3fee2415e99e90dce
Opcode Fuzzy Hash: c4e75bb467dcd632cc6794f0c5e8569d33c960b951e8937276adff62c409ee6a
Instruction Fuzzy Hash: A0519AB6A006199FCB01CF98DC80B9EBBF4EB49710F554169E914AB341D775ED80CB90

Function 100285A2 Relevance: 9.1, APIs: 6, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

__ioinit.LIBCMT ref: 100285A6

Part of subcall function 10029B38: InitOnceExecuteOnce.KERNEL32(101BE634,10029B73,00000000,00000000,1003508B,101B7FB0,0000000C,10005D7E,zstd), ref: 10029B46

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Once$ExecuteInit__ioinit
String ID:
API String ID: 129814473-0
Opcode ID: 5f84c9e2474b48f1b5df84408ea3fed00915e9808a8aa5c3ede1912be93b9b93
Instruction ID: eb12839c2236a0a66080d8b7707541b2b015dfdafb5b4036e193e8b83220f103
Opcode Fuzzy Hash: 5f84c9e2474b48f1b5df84408ea3fed00915e9808a8aa5c3ede1912be93b9b93
Instruction Fuzzy Hash: 7A415679902B058FD320CB78E885A6E77E4EF413B0B90871DF8AB876D1D774EA408B10

Function 1001E0D0 Relevance: 9.1, APIs: 6, Instructions: 127memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000094,00000000,?,00000000,00000000), ref: 1001E132
_memmove.LIBCMT ref: 1001E18D
InterlockedExchangeAdd.KERNEL32(-00000040,?), ref: 1001E19D
InterlockedDecrement.KERNEL32(00000028), ref: 1001E1B6
HeapFree.KERNEL32(?,00000000,00000000,00000000), ref: 1001E1E0
InterlockedExchangeAdd.KERNEL32(-00000040,?), ref: 1001E1F7

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Interlocked$ExchangeHeap$AllocDecrementFree_memmove
String ID:
API String ID: 3475820249-0
Opcode ID: 8410d57850f0f56a72160be52005f4586bc43fc5666634ebf8d9ae9adf307239
Instruction ID: 7998932e740281b790ced908d299ef40af193b578d293305540e12fdeb0e7596
Opcode Fuzzy Hash: 8410d57850f0f56a72160be52005f4586bc43fc5666634ebf8d9ae9adf307239
Instruction Fuzzy Hash: F5410D72900259AFDB11CF99C884A9EBBF8FF49314F1145AAEC199F211D770ED54CB90

Function 10012A90 Relevance: 9.1, APIs: 6, Instructions: 115networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10012AB1

Part of subcall function 100122A0: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 100122C1
Part of subcall function 100122A0: GetProcAddress.KERNEL32(00000000), ref: 100122C8
Part of subcall function 100122A0: GetCurrentProcess.KERNEL32(00000000), ref: 100122DB

GetVersionExA.KERNEL32(0000009C), ref: 10012AED

Part of subcall function 10011EE0: LoadLibraryA.KERNEL32(ntdll.dll), ref: 10011EF9
Part of subcall function 10011EE0: GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 10011F11
Part of subcall function 10011EE0: FreeLibrary.KERNEL32(00000000), ref: 10011F4A

Part of subcall function 10011980: LoadLibraryA.KERNEL32(Ole32.dll), ref: 10011995
Part of subcall function 10011980: GetProcAddress.KERNEL32(?,CoInitialize), ref: 100119A7
Part of subcall function 10011980: GetProcAddress.KERNEL32(?,CoUninitialize), ref: 100119B9
Part of subcall function 10011980: GetProcAddress.KERNEL32(?,CoCreateInstance), ref: 100119CB
Part of subcall function 10011980: LoadLibraryA.KERNEL32(Oleaut32.dll), ref: 100119D9
Part of subcall function 10011980: GetProcAddress.KERNEL32(?,SysFreeString), ref: 100119EB

Part of subcall function 10011C40: _strncpy.LIBCMT ref: 10011D43

Part of subcall function 100121A0: _memset.LIBCMT ref: 100121D2

Part of subcall function 10011D80: GetSystemInfo.KERNEL32(?), ref: 10011DCD
Part of subcall function 10011D80: __snprintf.LIBCMT ref: 10011DE8

Part of subcall function 10012130: _memset.LIBCMT ref: 1001214F
Part of subcall function 10012130: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 10012162

Part of subcall function 10011E10: _memset.LIBCMT ref: 10011E5F
Part of subcall function 10011E10: _memset.LIBCMT ref: 10011E71
Part of subcall function 10011E10: lstrlenA.KERNEL32(?), ref: 10011EA4
Part of subcall function 10011E10: gethostname.WS2_32(?,10012B7F), ref: 10011EB6
Part of subcall function 10011E10: lstrlenA.KERNEL32(?), ref: 10011EC0

Part of subcall function 10013280: GetLastInputInfo.USER32(00000008), ref: 1001329B

_memmove.LIBCMT ref: 10012B9C
InternetGetConnectedState.WININET(?,00000000), ref: 10012BAD
_strlen.LIBCMT ref: 10012BB7

Part of subcall function 10006F00: _Func_class.LIBCPMTD ref: 10006F71

_Func_class.LIBCPMTD ref: 10012BD2

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$_memset$Library$Load$Func_classInfolstrlen$ConnectedCurrentFreeGlobalHandleInputInternetLastMemoryModuleProcessStateStatusSystemVersion__snprintf_memmove_strlen_strncpygethostname
String ID:
API String ID: 1392860501-0
Opcode ID: 43b44d29e576c7a7eab6005ce55aa7196c291a1fb8a4cd9e799f16c790759da6
Instruction ID: 6fcb611156f6b3c8081496a382b787b04c25c68574042c94e1e96bd79d1c608f
Opcode Fuzzy Hash: 43b44d29e576c7a7eab6005ce55aa7196c291a1fb8a4cd9e799f16c790759da6
Instruction Fuzzy Hash: 514186B9D4021A6BDB14DBA0DC46FEE7378EF14344F4045A8F51D6A182EE34B7888B91

Function 1001D950 Relevance: 9.1, APIs: 6, Instructions: 107memorytimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(1A75B7EA,?,?,00000000,?,?,10035FD8,000000FF,?,1001D925,?,00000000,?,?,?), ref: 1001D984
EnterCriticalSection.KERNEL32(00000054,1A75B7EA,?,?,00000000,?,?,10035FD8,000000FF,?,1001D925,?,00000000,?,?,?), ref: 1001D9A8
SetLastError.KERNEL32(00000000,?,1001D925,?,00000000,?,?,?,?,1001EB3A,?,?), ref: 1001D9BD
LeaveCriticalSection.KERNEL32(00000054,?,1001D925,?,00000000,?,?,?,?,1001EB3A,?,?), ref: 1001D9E0
GetLastError.KERNEL32(?,00000000), ref: 1001DA42
HeapFree.KERNEL32(?,00000000,?,?,?,00000000), ref: 1001DA77

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalErrorLastSection$EnterFreeHeapLeaveTimetime
String ID:
API String ID: 340097737-0
Opcode ID: 63cb6f8e7694ae6483c047f050ef8b7d6c6ce7c6f04acb454207dabb1f28742f
Instruction ID: 651f3edefb78460789619dc2c76435f0b6e471a6de73fc66fbbe7bd7a0e23f04
Opcode Fuzzy Hash: 63cb6f8e7694ae6483c047f050ef8b7d6c6ce7c6f04acb454207dabb1f28742f
Instruction Fuzzy Hash: 5641AEB1600619AFDB11EF54CC85BAAB7F8FF08320F40452AF915CB691D774E940CBA1

Function 1000C230 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 1000C28F
std::error_category::default_error_condition.LIBCPMTD ref: 1000C2B0
std::error_category::default_error_condition.LIBCPMTD ref: 1000C2CA
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 1000C2D6
_Copy_impl.LIBCPMTD ref: 1000C2F1
std::error_category::default_error_condition.LIBCPMTD ref: 1000C323

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: std::error_category::default_error_condition$Affinity::operator!=Concurrency::details::Hardware$Copy_impl
String ID:
API String ID: 1600619793-0
Opcode ID: b1d60bd1d2c90ce81873208b493584433b2c3e2ab3f7430867161bbb174af34e
Instruction ID: d7a5fca912ec06086403f1c670a1a813a5f108e565bd240dc1cb7e9a7b1914b0
Opcode Fuzzy Hash: b1d60bd1d2c90ce81873208b493584433b2c3e2ab3f7430867161bbb174af34e
Instruction Fuzzy Hash: ED310079910119ABDB08DF95CC91DFFB3B9FF88240B50852DB515A7296DF30BA05CB90

Function 10009900 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 1000995F
std::error_category::default_error_condition.LIBCPMTD ref: 10009980
std::error_category::default_error_condition.LIBCPMTD ref: 1000999A
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 100099A6
_Copy_impl.LIBCPMTD ref: 100099C1
std::error_category::default_error_condition.LIBCPMTD ref: 100099F3

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: std::error_category::default_error_condition$Affinity::operator!=Concurrency::details::Hardware$Copy_impl
String ID:
API String ID: 1600619793-0
Opcode ID: 2ed96429231faa1b98a0dfe9f2b9f2661ec804e65a12f5b07c9e7ace5e47c8cf
Instruction ID: fd5af44e1f88a068f71331fad6f74fd73f7a6a584799292872335351018ebe79
Opcode Fuzzy Hash: 2ed96429231faa1b98a0dfe9f2b9f2661ec804e65a12f5b07c9e7ace5e47c8cf
Instruction Fuzzy Hash: AD31FE79900519ABDB08DF95CC91DFFB3B9FF88240B50852DB515AB296DF30BA05CB90

Function 1001A9D0 Relevance: 9.1, APIs: 6, Instructions: 86networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 1001A9E7
WSAAddressToStringA.WS2_32(?,0000001C,00000000,?,?), ref: 1001AA10
htons.WS2_32(?), ref: 1001AA2D
StrPBrkA.SHLWAPI(?,101B05A8,?,?,?,?,1001A154,?,?,?), ref: 1001AA53
StrChrA.SHLWAPI(?,00000025,?,?,?,?,1001A154,?,?,?), ref: 1001AA5E
_memmove.LIBCMT ref: 1001AA80

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: htons$AddressString_memmove
String ID:
API String ID: 2092185379-0
Opcode ID: 1da62bb18fa6672f18f6b109637b5a37ed39d3a7a0056215d56cfa2b173f808e
Instruction ID: 0d8a7e0632666a9e584c7e0b1c50e51ce1a1bb8526f63a46b25b18e10d486f15
Opcode Fuzzy Hash: 1da62bb18fa6672f18f6b109637b5a37ed39d3a7a0056215d56cfa2b173f808e
Instruction Fuzzy Hash: 2F218E36200326ABEB119FA4DD84BAA37ECEF49355F418025FD098A151D3B4D9C4D761

Function 10017B90 Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10017BAA

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

_free.LIBCMT ref: 10017BB2
_malloc.LIBCMT ref: 10017C09
_malloc.LIBCMT ref: 10017C16
_memset.LIBCMT ref: 10017C22
_memset.LIBCMT ref: 10017C2E

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free_malloc_memset$ErrorFreeHeapLast
String ID:
API String ID: 3649356292-0
Opcode ID: e2ce2a3dfe1de264b51823140416de6bf36e0b396c0ae9a07080b5863090727e
Instruction ID: 4c7394fda08d7e2547570c27631cca39768b6331ab3c3b2927f712e97e116122
Opcode Fuzzy Hash: e2ce2a3dfe1de264b51823140416de6bf36e0b396c0ae9a07080b5863090727e
Instruction Fuzzy Hash: 91111BB55012009BDB10DF15DD85B867FA5FF51304F4880B8FA089E29BD776E554CBA4

Function 10014850 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100148E9
_sprintf.LIBCMT ref: 1001491C
DeleteFileA.KERNEL32(00000000), ref: 1001492B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 1001494A

Strings

%s%u, xrefs: 10014910

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: DeleteFileFreeVirtual_memset_sprintf
String ID: %s%u
API String ID: 510910084-679674701
Opcode ID: adc25b0c065f21cbd1dfded628025ccd8d207bb86f6a67400b9d615e7817787c
Instruction ID: e4550e76bca269e0cd4f0d0c42d540de692b114aa9dc25b4e6c159d00a62e7eb
Opcode Fuzzy Hash: adc25b0c065f21cbd1dfded628025ccd8d207bb86f6a67400b9d615e7817787c
Instruction Fuzzy Hash: 3D31D4B59042689FC725CF14CC41BEEBBB4EB45315F108199FA585B3D1CB34AA81CF90

Function 1000B5A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 1000B5E8
inet_addr.WS2_32(?), ref: 1000B5F9
_wprintf.LIBCMT ref: 1000B613

Strings

2, xrefs: 1000B5B3
OnConnect: %s,%d, xrefs: 1000B60E

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _wprintfhtonsinet_addr
String ID: 2$OnConnect: %s,%d
API String ID: 3872430831-1911175251
Opcode ID: c5e6b32b25000850bdcfd3e7752fad518d315f21ca028ddb3caaaf99291d32ff
Instruction ID: b422dd61b17a844059851ccc93c32e4f95b7dbd58dc7ab89f53cd95de4c22344
Opcode Fuzzy Hash: c5e6b32b25000850bdcfd3e7752fad518d315f21ca028ddb3caaaf99291d32ff
Instruction Fuzzy Hash: B111D6B5A00208AFCB14DFA4D9809AEB7B9FF88200F108159F9099B251EB35AA45CB50

Function 100106D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100106F8
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 1001070E
_memset.LIBCMT ref: 10010729
ShellExecuteExA.SHELL32(0000003C), ref: 10010761

Part of subcall function 10022BD3: _doexit.LIBCMT ref: 10022BDD

Strings

<, xrefs: 10010714

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$ExecuteFileModuleNameShell_doexit
String ID: <
API String ID: 862106238-4251816714
Opcode ID: 20cf96c7f9d228022f40f64b64e5aa891d9eb85aec194889f2121776d6cbdfe6
Instruction ID: ed08ded1bf864bf3e223a1e7aee1529ee6b636ef57dacc8919679b4bfa0f8810
Opcode Fuzzy Hash: 20cf96c7f9d228022f40f64b64e5aa891d9eb85aec194889f2121776d6cbdfe6
Instruction Fuzzy Hash: F5112174A443189BDB60DF60DC86BD977B8EB58701F4040D8E54CAA2D1DBB46BC8CF51

Function 10011D80 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 100153E0: _memset.LIBCMT ref: 10015432
Part of subcall function 100153E0: _memset.LIBCMT ref: 10015448
Part of subcall function 100153E0: _memset.LIBCMT ref: 1001545E
Part of subcall function 100153E0: LoadLibraryA.KERNEL32(ADVAPI32.dll), ref: 1001546B

GetSystemInfo.KERNEL32(?), ref: 10011DCD
__snprintf.LIBCMT ref: 10011DE8

Strings

HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 10011DB7
%d*%sMHz, xrefs: 10011DDB
~MHz, xrefs: 10011DB2

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$InfoLibraryLoadSystem__snprintf
String ID: %d*%sMHz$HARDWARE\DESCRIPTION\System\CentralProcessor\0$~MHz
API String ID: 4072208565-2169120903
Opcode ID: 8cfe9623471b1fdf1c554914f6860f425b5aeaa8db3a3f010a36363e40d3c6a7
Instruction ID: d45dab53a83cfac9e0a1e2a4c9fe7e981714f2b5fce01b97ec9512f60cfb67df
Opcode Fuzzy Hash: 8cfe9623471b1fdf1c554914f6860f425b5aeaa8db3a3f010a36363e40d3c6a7
Instruction Fuzzy Hash: F6010075A10248EFDB00DBE8CD46BAEB7B4EF48604F50415DBA08EB281E6756A44C761

Function 100118D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100118F8
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 1001190E
_memset.LIBCMT ref: 10011929
ShellExecuteExA.SHELL32(0000003C), ref: 10011961

Part of subcall function 10022BD3: _doexit.LIBCMT ref: 10022BDD

Strings

<, xrefs: 10011914

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$ExecuteFileModuleNameShell_doexit
String ID: <
API String ID: 862106238-4251816714
Opcode ID: 3b53686e11ed67b0b73857ac907e37981459c7ca599cd7ab1f7b00ff7bdf5b39
Instruction ID: 184780f53a04bf753c675ecee7cc99bb54cbc30637577b5367bcbf7d21cbf3cf
Opcode Fuzzy Hash: 3b53686e11ed67b0b73857ac907e37981459c7ca599cd7ab1f7b00ff7bdf5b39
Instruction Fuzzy Hash: 6A112D789043189BDB64DF60DC86BD977B8AF58700F4040D8E54CAA2D1DBB46BC8CF51

Function 10011EE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll), ref: 10011EF9
GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 10011F11
FreeLibrary.KERNEL32(00000000), ref: 10011F4A

Strings

ntdll.dll, xrefs: 10011EF4
RtlGetNtVersionNumbers, xrefs: 10011F08

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlGetNtVersionNumbers$ntdll.dll
API String ID: 145871493-1263206204
Opcode ID: cf38a511d7e8b4ae8d17f5c5b92b7a0423aa2ce6899e0fe5ee67ae0bceb075ab
Instruction ID: fc6e9e5f567ed89b3598dd89ccb3c317c7ae0145ebb98ab299a18f454954bdf5
Opcode Fuzzy Hash: cf38a511d7e8b4ae8d17f5c5b92b7a0423aa2ce6899e0fe5ee67ae0bceb075ab
Instruction Fuzzy Hash: EF01A579901208EFDB14DF94C988B9EBBB5FF48305F108598F8059B290D7759A45DF50

Function 1000F017 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34keyboardsleepstringCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000005), ref: 1000EF92
lstrlenA.KERNEL32(00000000), ref: 1000EF9F
_memset.LIBCMT ref: 1000EFDC
GetKeyState.USER32(00000010), ref: 1000F035
GetAsyncKeyState.USER32(?), ref: 1000F05C
GetKeyState.USER32(00000014), ref: 1000F073

Strings

e, xrefs: 1000F026
], xrefs: 1000F092

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: State$AsyncSleep_memsetlstrlen
String ID: ]$e
API String ID: 1122937223-1460998272
Opcode ID: eed0b91c2744c895165e97b4f44415f78997a58abc4c3c7c85806ef0c703c4ee
Instruction ID: 764bce47da2be80fe97f0ee0a60544cb6e7be49dbe84d1d57fcac03222c10f19
Opcode Fuzzy Hash: eed0b91c2744c895165e97b4f44415f78997a58abc4c3c7c85806ef0c703c4ee
Instruction Fuzzy Hash: 35011A34901728CFFB64CF15CC85BA977B2FB80391F1082A9C4095695ACB779EA1EE01

Function 100122A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 100122C1
GetProcAddress.KERNEL32(00000000), ref: 100122C8
GetCurrentProcess.KERNEL32(00000000), ref: 100122DB

Strings

kernel32, xrefs: 100122BC
IsWow64Process, xrefs: 100122B7

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32
API String ID: 4190356694-3789238822
Opcode ID: 4dbbbb52112192865a612101614944367de734d12e029e91dbf73928284f9556
Instruction ID: d8b697d57578edb345ad90496a9b557fc7605fd1813d4f5a4f7f5f71a7bdeb36
Opcode Fuzzy Hash: 4dbbbb52112192865a612101614944367de734d12e029e91dbf73928284f9556
Instruction Fuzzy Hash: 74F0FE75D00208FFDB10EFE4C94879DBBB8EF08205F404099E80997251DB389648DB50

Function 10016750 Relevance: 7.7, APIs: 5, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 100184E0: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,100167AB,1A75B7EA,00000000,?,?,?,1001849E), ref: 100184FB
Part of subcall function 100184E0: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,100167AB,1A75B7EA,00000000,?,?,?,1001849E), ref: 10018516

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,1A75B7EA,00000000,?,?,?,1001849E), ref: 100167F5
HeapCreate.KERNEL32(00000004,00000000,00000000,?,?,?,1001849E), ref: 10016889
_free.LIBCMT ref: 1001693E
_free.LIBCMT ref: 10016946
_free.LIBCMT ref: 100169A9

Part of subcall function 100172C0: __CxxThrowException@8.LIBCMT ref: 100172D2
Part of subcall function 100172C0: EnterCriticalSection.KERNEL32(00000000,1A75B7EA,00000000,00000098,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005), ref: 10017312
Part of subcall function 100172C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005,?,100168C9,00000400,00000400), ref: 1001737B

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$CreateCriticalInfoNativeSectionSystem$EnterEventException@8HeapLeaveThrow
String ID:
API String ID: 471852966-0
Opcode ID: 62dcc8071ba77636672d3d9cd1e185c692ae9957d13345a13a02519507dda5e3
Instruction ID: d7e5b155edf1d74aaead93eb83c8ab603744e77deffcff0117244fe85bcfb593
Opcode Fuzzy Hash: 62dcc8071ba77636672d3d9cd1e185c692ae9957d13345a13a02519507dda5e3
Instruction Fuzzy Hash: C37118B0501B419FE761CF64C958787BBF4FF04308F108A1DE6AA9B691DBB9B148CB90

Function 1001CCD0 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

getsockopt.WS2_32(?,0000FFFF,00001001,?,?), ref: 1001CD1D
InterlockedCompareExchange.KERNEL32(00000004,00000000,00000001), ref: 1001CD64
EnterCriticalSection.KERNEL32(?), ref: 1001CD7A
LeaveCriticalSection.KERNEL32(?), ref: 1001CD89
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,10035AC4), ref: 1001CDCC

Part of subcall function 1001E2B0: InterlockedExchangeAdd.KERNEL32(00000044,?), ref: 1001E328
Part of subcall function 1001E2B0: InterlockedDecrement.KERNEL32(?), ref: 1001E33E
Part of subcall function 1001E2B0: HeapFree.KERNEL32(?,00000000,?,?), ref: 1001E36E

Part of subcall function 1001BE40: timeGetTime.WINMM(00000007,00000000,00000000,00000000,?,00000001,?,?,00000001,00000000), ref: 1001BE7F

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalInterlockedSection$ExchangeLeave$CompareDecrementEnterFreeHeapTimegetsockopttime
String ID:
API String ID: 1051621181-0
Opcode ID: 47ef961c13baaeb1f1c3f54f41a175c5428382baf7d5d31f1b2d3631bcd46669
Instruction ID: aa49a767c170bc5356aa645f39eb09f20ade229693a97dd4efdc251de6f66d51
Opcode Fuzzy Hash: 47ef961c13baaeb1f1c3f54f41a175c5428382baf7d5d31f1b2d3631bcd46669
Instruction Fuzzy Hash: ED41D072A00619AFD711CF94DC81F9EBBF8FB04351F10423AEA059B690D775E9A0CB90

Function 100143E0 Relevance: 7.6, APIs: 5, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 1001446A
_free.LIBCMT ref: 10014479
VirtualFree.KERNEL32(?,00000000,00008000,?,1001478E), ref: 10014498
GetProcessHeap.KERNEL32(00000000,00000000,?,1001478E), ref: 100144A4
HeapFree.KERNEL32(00000000,?,1001478E), ref: 100144AB

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Free$Heap$LibraryProcessVirtual_free
String ID:
API String ID: 3953351234-0
Opcode ID: d9d32f6ed72f362beb0b78fbb99d4c82a6959af6a865298871246b0d9bcbc94d
Instruction ID: e984664baf45058b12496fb5a6c08b784cfcca4bbda2656e475c534f62021b4f
Opcode Fuzzy Hash: d9d32f6ed72f362beb0b78fbb99d4c82a6959af6a865298871246b0d9bcbc94d
Instruction Fuzzy Hash: 6131B674A00208EFDB14CF94C598B9DB7B6FB49315F258288E9056B391C775EE86DF80

Function 1003285D Relevance: 7.6, APIs: 5, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

__malloc_crt.LIBCMT ref: 10032879
std::exception::exception.LIBCMT ref: 10032893
__CxxThrowException@8.LIBCMT ref: 100328C9

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw__malloc_crtstd::exception::exception
String ID:
API String ID: 3183362523-0
Opcode ID: 12067b7f50e60089eb0c5929b79bbc81da0302d8a13d9fc531a0150228292b0c
Instruction ID: 3afcd033efa841a0b0f27a91848f479c7de1b815caadbdc1d716f9ba00caeb03
Opcode Fuzzy Hash: 12067b7f50e60089eb0c5929b79bbc81da0302d8a13d9fc531a0150228292b0c
Instruction Fuzzy Hash: B021FC3950420DAECB02EF64DC426CEB7B8EF00241F40C565FD45AE250EB34E680CB93

Function 1002354C Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 10023558

Part of subcall function 10020474: __FF_MSGBANNER.LIBCMT ref: 1002048B
Part of subcall function 10020474: __NMSG_WRITE.LIBCMT ref: 10020492
Part of subcall function 10020474: HeapAlloc.KERNEL32(008B0000,00000000,00000001,?,?,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 100204B7

_free.LIBCMT ref: 1002356B

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: bad27d9961e6c256fd05d00a16dcfa7813a2fc78cb849604c55e28e4d427328b
Instruction ID: 8f73b662920d403f089da30250cd819716aaae5841175fa17ded837e2a866512
Opcode Fuzzy Hash: bad27d9961e6c256fd05d00a16dcfa7813a2fc78cb849604c55e28e4d427328b
Instruction Fuzzy Hash: 28112731900A366FCB21DB70BC4564E37E4EF003A0FE18525F90D9A1A1DF349940D794

Function 1001DFB0 Relevance: 7.6, APIs: 5, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 1001DFDE

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

_free.LIBCMT ref: 1001DFE9
HeapDestroy.KERNEL32(?,?,80004005,?,1001E736), ref: 1001E03E
HeapCreate.KERNEL32(?,?,?,?,80004005,?,1001E736), ref: 1001E056
SetEvent.KERNEL32(?,?,80004005,?,1001E736), ref: 1001E093

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Heap$_free$CreateDestroyErrorEventFreeLast
String ID:
API String ID: 840158118-0
Opcode ID: 0e583d642f774632f9c27456ec0f16af5b2d05b50993fe6db7455c841bf81a0b
Instruction ID: 1bce1808b3a2e791fe6ccda0018e989c211068b54a4ee0f2cf5caece12fc7c46
Opcode Fuzzy Hash: 0e583d642f774632f9c27456ec0f16af5b2d05b50993fe6db7455c841bf81a0b
Instruction Fuzzy Hash: 3221D071401B428BE7229F35D908787BAE1BF49304F50891DE5AA96651DBBAB884CF40

Function 1001B630 Relevance: 7.5, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B651
EnterCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B657
LeaveCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B675
LeaveCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B678
LeaveCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B68A
LeaveCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B68D

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: c76d05b3fccb81bbde97bbe8f299796e80221eabea18b0df9aee05efc5887d01
Instruction ID: 15876e7cb504465c55ff25fd79a18e235aef5e7f8048034f6523b5cd64803c08
Opcode Fuzzy Hash: c76d05b3fccb81bbde97bbe8f299796e80221eabea18b0df9aee05efc5887d01
Instruction Fuzzy Hash: 43F044722016146FD711AB6EDCC0A9BB7ECFFC9224B520136E908DB611C779E8458AB0

Function 100278EA Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 10025CA4: __getptd_noexit.LIBCMT ref: 10025CA5
Part of subcall function 10025CA4: __amsg_exit.LIBCMT ref: 10025CB2

__amsg_exit.LIBCMT ref: 10027917
__lock.LIBCMT ref: 10027927
InterlockedDecrement.KERNEL32(?), ref: 10027944
_free.LIBCMT ref: 10027957
InterlockedIncrement.KERNEL32(008CD788), ref: 1002796F

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 1231874560-0
Opcode ID: 5b52af1cc653b6a68240cb3c15142706c47bbd1bbb99473af2bdf0793a479e8c
Instruction ID: e038a616fc268b6b30c8c800e06b11c4754edae7854568c1c2ca9af5bccd002d
Opcode Fuzzy Hash: 5b52af1cc653b6a68240cb3c15142706c47bbd1bbb99473af2bdf0793a479e8c
Instruction Fuzzy Hash: 0701C036A01732ABDB21DB69BA8174D77B0FF01650FD10145E8086BA92CB386981CFC1

Function 10003400 Relevance: 7.5, APIs: 5, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000018,00000000,0000003C,00000000,?,?,100033DA), ref: 1000340C
WakeAllConditionVariable.KERNEL32 ref: 1000341D
LeaveCriticalSection.KERNEL32(00000018), ref: 10003424
WaitForSingleObject.KERNEL32(?,000000FF,?), ref: 1000345C
GetLastError.KERNEL32 ref: 1000346D

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterErrorLastLeaveObjectSingleVariableWaitWake
String ID:
API String ID: 2002041392-0
Opcode ID: e75bfb5a0ad93df77c66187c49ea81158b5d7819f7b5d557b30da283341fa316
Instruction ID: 32492cade0fa7766ae1656b716e42035eae87337b4a1db3a89480abb877ebfd1
Opcode Fuzzy Hash: e75bfb5a0ad93df77c66187c49ea81158b5d7819f7b5d557b30da283341fa316
Instruction Fuzzy Hash: 8301B1325002169FEB52EF58DCC469773ECFF45391B018525EA589B119D730E989CBA2

Function 1001D760 Relevance: 6.3, APIs: 5, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1001A990: setsockopt.WS2_32(?,0000FFFF,00007010,00000000,00000004), ref: 1001A9A6

EnterCriticalSection.KERNEL32 ref: 1001D7AC
LeaveCriticalSection.KERNEL32(00000054), ref: 1001D7C7

Part of subcall function 1001BE40: timeGetTime.WINMM(00000007,00000000,00000000,00000000,?,00000001,?,?,00000001,00000000), ref: 1001BE7F

SetLastError.KERNEL32(00000000), ref: 1001D7D1
LeaveCriticalSection.KERNEL32(00000054), ref: 1001D7EC
HeapFree.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 1001D842

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterErrorFreeHeapLastTimesetsockopttime
String ID:
API String ID: 4191520005-0
Opcode ID: d82dbdcae07a67b72c96c9c25426668b2813c80c10765768011baf3510c592d9
Instruction ID: 8b7f9298d96b99960fdb9572d67dbc8946c541a3fe55414fa74220fd8c56f37f
Opcode Fuzzy Hash: d82dbdcae07a67b72c96c9c25426668b2813c80c10765768011baf3510c592d9
Instruction Fuzzy Hash: E131C372600214EFD711DF48CC85B9EB7B8FF49721F10422AF9299B291DB75A840CB60

Function 100268E6 Relevance: 6.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 1002696A
_memmove.LIBCMT ref: 100269B1
___AdjustPointer.LIBCMT ref: 100269FF
_memmove.LIBCMT ref: 10026A08

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AdjustPointer_memmove
String ID:
API String ID: 1721217611-0
Opcode ID: b405e0998ef0b9efc1edcd27beb66ba5646d659d8eec6f86d97dda6a22f7c017
Instruction ID: 0e35a04b9f418c62776a7450ae1d75bb5788a7e2c58344f017f8f72862e36527
Opcode Fuzzy Hash: b405e0998ef0b9efc1edcd27beb66ba5646d659d8eec6f86d97dda6a22f7c017
Instruction Fuzzy Hash: DC4192766043469AEB25CF50FC42F6A37F4DF097A0FA1401DF849AA5D1DF71E880DA62

Function 1002F1F7 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 1002F22B
__isleadbyte_l.LIBCMT ref: 1002F259
MultiByteToWideChar.KERNEL32(00000000,00000009,0000000C,00000000,00000000,00000000), ref: 1002F287
MultiByteToWideChar.KERNEL32(00000000,00000009,0000000C,00000001,00000000,00000000), ref: 1002F2BD

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2b3d1593b62abf2a8beba7a4b33d3e542d277218e77fbf3ac6909a8a0f39df84
Instruction ID: 88f6cfa15c5d6d04ed07b041f1d82007708ea3ed43a2cafbe05b56c4a286dddd
Opcode Fuzzy Hash: 2b3d1593b62abf2a8beba7a4b33d3e542d277218e77fbf3ac6909a8a0f39df84
Instruction Fuzzy Hash: 1D31BC3560029AEFDB11CE64E845BBA3BE5FF422A0F52443DE8249B1A1D770E844DB50

Function 1001E3A0 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(?), ref: 1001E41B
UnmapViewOfFile.KERNEL32(00000000), ref: 1001E441
CloseHandle.KERNEL32(00000000), ref: 1001E461
CloseHandle.KERNEL32(00000000), ref: 1001E483

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle$ErrorFileLastUnmapView
String ID:
API String ID: 4017539725-0
Opcode ID: 496f3fa893c77ec6c9c64e1aa7dc66e4b9ed660e755f62b2c78ec002215d3852
Instruction ID: cba275ec36c653788e4822474d84c3c335d5b1142b70863171b6aa198203d996
Opcode Fuzzy Hash: 496f3fa893c77ec6c9c64e1aa7dc66e4b9ed660e755f62b2c78ec002215d3852
Instruction Fuzzy Hash: 1E3118B5A002599BDB11CFA4CC48BAFBBF8FF48754F004219F805EB241EB75E9448BA0

Function 1001B710 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(00000000,?,00000000), ref: 1001B765
InterlockedCompareExchange.KERNEL32(?,?,?), ref: 1001B777

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CompareExchangeInterlocked
String ID:
API String ID: 3335655927-0
Opcode ID: 9484bcffa374807802c2175ff6f6c2d2e59b0392790023a2fe2f7dd29207cd47
Instruction ID: a411b3ee14b548daa5b868b1c8f2e50aeeae3c08791ef6b703bc2ef0cd82c7fc
Opcode Fuzzy Hash: 9484bcffa374807802c2175ff6f6c2d2e59b0392790023a2fe2f7dd29207cd47
Instruction Fuzzy Hash: 6E219F36304A09ABD720DF6DDD80E96F3EDFBC8311F00456AEA89C7240DB31E9548BA0

Function 10014070 Relevance: 6.1, APIs: 4, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00000000,00001000,00000004), ref: 100140EE
_memset.LIBCMT ref: 1001410A
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,100146FE), ref: 1001412C
_memmove.LIBCMT ref: 1001414A

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocVirtual$_memmove_memset
String ID:
API String ID: 725130153-0
Opcode ID: f53fd65b4befc706c090b7c927cf75363b07fbc3177beadfb71f7d900ef2fefc
Instruction ID: 93ed00f0eb9094769ecb9556d8f7921b1dd27d8a6f78ffda3dd0833cdc577a5f
Opcode Fuzzy Hash: f53fd65b4befc706c090b7c927cf75363b07fbc3177beadfb71f7d900ef2fefc
Instruction Fuzzy Hash: F631EA74A00209EFCB08CF94C995EAEB7B1FF48704F218598E915AB351D770EE81DB50

Function 1001A3A0 Relevance: 6.1, APIs: 4, Instructions: 84fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(00000002,00000004,?,?,?,00000002,00000004), ref: 1001A3B3
CreateFileMappingA.KERNEL32(00000002,00000000,00000004,00000004,00000000,00000000), ref: 1001A3E0
MapViewOfFileEx.KERNEL32(00000000,?,?,?,?,00000000,?,00000002,00000004), ref: 1001A429
CloseHandle.KERNEL32(?,?,00000002,00000004), ref: 1001A43F

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleMappingSizeView
String ID:
API String ID: 1374251026-0
Opcode ID: 4b8af0a805cdf8347236f9c71f45033270cfc3b78af84c4974c8e4d52b637325
Instruction ID: 8fce67c6ff09011a8acf264d9e13d81355b447303082185ad91e7b9cb9a6a423
Opcode Fuzzy Hash: 4b8af0a805cdf8347236f9c71f45033270cfc3b78af84c4974c8e4d52b637325
Instruction Fuzzy Hash: 272167B5A0061AAFD714DF69DC45A5AF7F8FB49350F10812AFD19D7200D770E9A09BD0

Function 1001B090 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 1001B152

Part of subcall function 1001B190: HeapFree.KERNEL32(?,00000000,?), ref: 1001B1E5

DeleteCriticalSection.KERNEL32(?,1A75B7EA), ref: 1001B113
DeleteCriticalSection.KERNEL32(?), ref: 1001B124
HeapFree.KERNEL32(?,00000000), ref: 1001B132

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalDeleteFreeHeapSection$_free
String ID:
API String ID: 210024702-0
Opcode ID: 2457e78313824737e41231bfbb3820b753e3b2e9e7e39901a1bfba69df0cf740
Instruction ID: 33c100260f324d21ff77bf2896aba4d0bbdecf1759cfcc0eaa01cd95da98a8db
Opcode Fuzzy Hash: 2457e78313824737e41231bfbb3820b753e3b2e9e7e39901a1bfba69df0cf740
Instruction Fuzzy Hash: 63319E71A00616EFDB11DFA8C884B5AFBF8FF05315F118269E9199F291D731E944CBA0

Function 100152A0 Relevance: 6.1, APIs: 4, Instructions: 62processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,10011CAA), ref: 100152B1

Part of subcall function 1001EF9C: _malloc.LIBCMT ref: 1001EFB4

Process32First.KERNEL32(10011CAA,1A75B7EA), ref: 100152E0
Process32Next.KERNEL32(10011CAA,1A75B7EA), ref: 10015316
lstrcmpiA.KERNEL32(1A75B7C6,00000000), ref: 1001532A

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32_malloclstrcmpi
String ID:
API String ID: 242301054-0
Opcode ID: 335c3f3c8a0e05f5839a3b8562ab9f751be2bf2361413e739464e8ead2f72be9
Instruction ID: 03fd10ac50de1202267bfae5930d06ed0f63b87ea6e01dd6c59341b656d33967
Opcode Fuzzy Hash: 335c3f3c8a0e05f5839a3b8562ab9f751be2bf2361413e739464e8ead2f72be9
Instruction Fuzzy Hash: 8321BAB4A04208EBDB14CB98C981A9EB7F5EF48745F2480A8E818AF341D771EF81DB54

Function 10003480 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,10001499,?,?,00000000,?,?,?), ref: 100034A7
SleepConditionVariableCS.KERNEL32(00000000,?,00000000), ref: 100034CB
LeaveCriticalSection.KERNEL32(?), ref: 100034D2
SleepConditionVariableCS.KERNEL32(00000000,?,000000FF), ref: 1000350E

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ConditionCriticalSectionSleepVariable$EnterLeave
String ID:
API String ID: 3020340620-0
Opcode ID: 05074beb6edb66eb96e78de5814604b12c6efd175baefdef2757970339633dab
Instruction ID: f135a66ef4c3fa2a34bb39291fcdf00077fd575a97a3f57769656b34936bebed
Opcode Fuzzy Hash: 05074beb6edb66eb96e78de5814604b12c6efd175baefdef2757970339633dab
Instruction Fuzzy Hash: 42110471500B558FE772CA58D9C4B5773E8FB007A6F51DE1DE4938A899C374F8888B21

Function 1000ECF0 Relevance: 6.1, APIs: 4, Instructions: 60windowstringCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 1000ED07
_memset.LIBCMT ref: 1000ED30
SendMessageA.USER32(?,0000000D,00000400,00000000), ref: 1000ED4A
lstrlenA.KERNEL32(00000000), ref: 1000ED57

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: MessageSendVisibleWindow_memsetlstrlen
String ID:
API String ID: 1293396957-0
Opcode ID: c0acd891ebef83d26f17d4d1390c8d3953d1a4ad271df1068977982f2c5964a8
Instruction ID: 5b252e65773c6f6e6056f087db140e16ac5e3367f8d3fdb97bb4e1eeb390b3d9
Opcode Fuzzy Hash: c0acd891ebef83d26f17d4d1390c8d3953d1a4ad271df1068977982f2c5964a8
Instruction Fuzzy Hash: 7311B6F5A00205EBEB14DF60CD45BDA7368DF54340F0044A9FB09FB285EA75EA858B95

Function 10003280 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 10003292
SleepConditionVariableCS.KERNEL32(?,?,000000FF), ref: 100032BD
EnterCriticalSection.KERNEL32(?), ref: 100032ED
WakeConditionVariable.KERNEL32(?), ref: 100032FA

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ConditionCriticalEnterSectionVariable$SleepWake
String ID:
API String ID: 1272541424-0
Opcode ID: d2ef4d3d3bece3ecb2957c56201156f867af3ba4ab4f7a9e8506c951494b066a
Instruction ID: d287fa8a1d97e4fb1d990ba0663406a79fc7a6a744e69c2c1aa7d7a44e5ccb06
Opcode Fuzzy Hash: d2ef4d3d3bece3ecb2957c56201156f867af3ba4ab4f7a9e8506c951494b066a
Instruction Fuzzy Hash: 2C115572100B159FE336DF68DCC485BB3F9FB44360B418E19E4A683A45CB30F8498B60

Function 1001EB80 Relevance: 6.1, APIs: 4, Instructions: 57windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(1001C8E6,00000000,00000000,00000000,00000001), ref: 1001EB99
TranslateMessage.USER32(?), ref: 1001EBBE
DispatchMessageA.USER32(?), ref: 1001EBC4
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 1001EBD6

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 5f19f8642b326884221ac1f2436e0d1f5125d6a111024dfe36bdec5d200537f7
Instruction ID: 4683bdf92f3b324d92ef008ada9b145ce160014bd2fbc826a850825f78051344
Opcode Fuzzy Hash: 5f19f8642b326884221ac1f2436e0d1f5125d6a111024dfe36bdec5d200537f7
Instruction Fuzzy Hash: 0D018833A4421D67EB20DAD99CC1FEEF3ACEB44750F5005A2FE08EB1C0D6A5E94146A0

Function 10012300 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10012328
_strlen.LIBCMT ref: 1001234F
_strncpy.LIBCMT ref: 10012382
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 100123A9

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateDirectory_memset_strlen_strncpy
String ID:
API String ID: 3994138041-0
Opcode ID: 5146f0f5f6924dacce34261d64f74e5090e561bcbd4e5be505613ef66d126bf7
Instruction ID: 101a95c8069f775dae9c248aff8c456d68721b5b320a68391b460c7f447a75fb
Opcode Fuzzy Hash: 5146f0f5f6924dacce34261d64f74e5090e561bcbd4e5be505613ef66d126bf7
Instruction Fuzzy Hash: CB1194B9D041189BCB10DB64DC81BDD77B8EF65304F0082E9E59D9B281DAB4EBD48F91

Function 10016B30 Relevance: 6.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10017520: _free.LIBCMT ref: 1001755A

HeapDestroy.KERNEL32(00000000,1A75B7EA,?,?,?,?,100359E3,000000FF), ref: 10016B70
HeapCreate.KERNEL32(00000001,?,?,1A75B7EA,?,?,?,?,100359E3,000000FF), ref: 10016B7F
_free.LIBCMT ref: 10016B8F
HeapDestroy.KERNEL32(?,?,?,?,?,100359E3,000000FF), ref: 10016BBD

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Heap$Destroy_free$Create
String ID:
API String ID: 3093871995-0
Opcode ID: 16e0c79affba40acb3f9a94d92ca98c28378774c059c7bd50a370be0c89aea4a
Instruction ID: d00498a318c3039bf53502062df662130d8b902564dd33ec98044163ccf8f0fc
Opcode Fuzzy Hash: 16e0c79affba40acb3f9a94d92ca98c28378774c059c7bd50a370be0c89aea4a
Instruction Fuzzy Hash: F71136B6904B149FD720CF69DC44B56BBF8FB08750F004A2DE89AC7651E775E944CB90

Function 10026230 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 10026247

Part of subcall function 10026858: ___AdjustPointer.LIBCMT ref: 100268A1

_UnwindNestedFrames.LIBCMT ref: 1002625E
___FrameUnwindToState.LIBCMT ref: 10026270
CallCatchBlock.LIBCMT ref: 10026294

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 6092b50bab1218cd8aabaab9e12c658e2e0f1782f2186364ed2301dcdcc7d9c1
Instruction ID: 780a5d68346db81fedf9f8d85dc8351bab79c3fb61c7619bb358afdc1328406f
Opcode Fuzzy Hash: 6092b50bab1218cd8aabaab9e12c658e2e0f1782f2186364ed2301dcdcc7d9c1
Instruction Fuzzy Hash: 88011732000109FBCF12CF95EC05EDA3BBAFF8C754F518115FA1865121C776E865ABA0

Function 10028BC3 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 10028BE7

Part of subcall function 100292C6: __fltout2.LIBCMT ref: 100292EF

__cftog_l.LIBCMT ref: 10028C0D
__cftoe_l.LIBCMT ref: 10028C3F

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: c2eb68e8ade19565e9c0612c28aff17bdb070db1da49cc9352462dfe7f7478ea
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: 1201407A40214EBBCF529E84EC51CDD3F72FB18294BA58415FE1858031C336DAB1AB91

Function 10015350 Relevance: 6.0, APIs: 4, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 10015381
__beginthreadex.LIBCMT ref: 100153A3
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 100153B4
CloseHandle.KERNEL32(00000000), ref: 100153BE

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseCreateEventHandleObjectSingleWait__beginthreadex
String ID:
API String ID: 2993629242-0
Opcode ID: d7dcd88de3af4c7a17b78a3c7ea8846737ab5e00941b9493fb9a3973c1d0ec84
Instruction ID: 28439952cb9d60efeb8680ab5036a31f0774e1b625031860cf64c459a7230e8b
Opcode Fuzzy Hash: d7dcd88de3af4c7a17b78a3c7ea8846737ab5e00941b9493fb9a3973c1d0ec84
Instruction Fuzzy Hash: 9A111EB5A04249AFDB14DFA8CC81BEE7BB4EF49310F504249F919AB381D730AA40CB90

Function 100327EB Relevance: 6.0, APIs: 4, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

__malloc_crt.LIBCMT ref: 10032807
std::exception::exception.LIBCMT ref: 10032821
__CxxThrowException@8.LIBCMT ref: 10032857

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw__malloc_crtstd::exception::exception
String ID:
API String ID: 3183362523-0
Opcode ID: c060a18d73b796a30dd2a53eb01a138e769d2f3d535d15112ec57b6c053b814d
Instruction ID: 61d3b0669a0cbb4b249a077222c69809c774bd9a0b89fdd2f935691ba84154ea
Opcode Fuzzy Hash: c060a18d73b796a30dd2a53eb01a138e769d2f3d535d15112ec57b6c053b814d
Instruction Fuzzy Hash: AEF04F799002097ACB05DFA4D9859CDB7FCEA10284F80C056FD15AB141DB78E384CA91

Function 10016AC0 Relevance: 6.0, APIs: 4, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 100174B0: HeapFree.KERNEL32(10016ACC,00000000,?,?,?,?,10016ACC,?,?,10016FF0), ref: 100174D5
Part of subcall function 100174B0: _free.LIBCMT ref: 100174EF

HeapDestroy.KERNEL32(00000000,?,?,10016FF0), ref: 10016AD3
HeapCreate.KERNEL32(?,?,?,?,?,10016FF0), ref: 10016AE2
_free.LIBCMT ref: 10016AF2
HeapDestroy.KERNEL32(?,10016FF0), ref: 10016B22

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Heap$Destroy_free$CreateFree
String ID:
API String ID: 4097506873-0
Opcode ID: 5821550070371558d6326ac293e511f2d9706211c5074b01848d33611e582a02
Instruction ID: 26b69236e6c287892c4b939c4df5092f0c49b63a1c7adf96395978ecd4ddac7a
Opcode Fuzzy Hash: 5821550070371558d6326ac293e511f2d9706211c5074b01848d33611e582a02
Instruction Fuzzy Hash: 07F01DB5200602AFEB05DF75DC48B46BBB8FF08345F404218E409CBA51DB35E4A5CBD0

Function 1001BB70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 1001BB2C
Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 1001BB66

Part of subcall function 1001ED68: std::exception::exception.LIBCMT ref: 1001ED7E
Part of subcall function 1001ED68: __CxxThrowException@8.LIBCMT ref: 1001ED93

Strings

vector<T> too long, xrefs: 1001BBD8

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Exception@8Internal_throw_exceptionThrow_memmovestd::exception::exception
String ID: vector<T> too long
API String ID: 3224774664-3788999226
Opcode ID: 6098c6dfe018a0d1be71fac0227d1825c4ecc01241087ebe161bd52a6db14e3a
Instruction ID: eae54de508585d01ba0ea4a69c7d47a938ab1ba8a2878b9bbe041104eb365bc3
Opcode Fuzzy Hash: 6098c6dfe018a0d1be71fac0227d1825c4ecc01241087ebe161bd52a6db14e3a
Instruction Fuzzy Hash: 3C312876700A295BC714CEADDCC189ABB99EB88370724823AF918CB644D771F991C7D0

Function 100065C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 10006720
construct.LIBCPMTD ref: 1000674A

Strings

wmic cpu get processorid, xrefs: 100065E0

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: char_traitsconstruct
String ID: wmic cpu get processorid
API String ID: 489808500-2204115948
Opcode ID: 1010ae759fa7e10457475eff9b78d9461d1f2c37ab24339ddda26cbfa1624876
Instruction ID: dd645ee37d0e35d6a0c4dc76963d6f74060cdeeedd1d1d5c8c6965c7acc1db0f
Opcode Fuzzy Hash: 1010ae759fa7e10457475eff9b78d9461d1f2c37ab24339ddda26cbfa1624876
Instruction Fuzzy Hash: 01410F75E00209DFDB08CF98D891AEEB7B6FF4C750F208129E915A7385DB35A941CBA4

Function 100113C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81fileCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 10011461
DeleteFileA.KERNEL32(?), ref: 100114B6

Part of subcall function 10011580: _memset.LIBCMT ref: 100115CC
Part of subcall function 10011580: GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 100115E0
Part of subcall function 10011580: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 10011647
Part of subcall function 10011580: GetFileSize.KERNEL32(000000FF,00000000), ref: 10011669
Part of subcall function 10011580: ReadFile.KERNEL32(000000FF,?,00000000,00000000,00000000), ref: 100116B4

Strings

.key, xrefs: 1001149B

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$DirectorySystem$CreateDeleteReadSize_memset
String ID: .key
API String ID: 3518743009-343438762
Opcode ID: eb43b5ddff7011dff6964891f9a77986a6cb4ad83d3904fe4c7462824836723d
Instruction ID: c5e3bf08ea98db34f13579d809896ca9d031d76340f358e502fc38b765e240d6
Opcode Fuzzy Hash: eb43b5ddff7011dff6964891f9a77986a6cb4ad83d3904fe4c7462824836723d
Instruction Fuzzy Hash: 9F31E675A0025C9BDB28CF64DC42BEEB7B9EB45310F5081A9F9059B281DB35AE85CB90

Function 10019CC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

StrChrA.SHLWAPI(?,0000003A,?), ref: 10019CE4
_swscanf.LIBCMT ref: 10019D1E

Strings

%d.%d.%d.%d%c, xrefs: 10019D18

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _swscanf
String ID: %d.%d.%d.%d%c
API String ID: 2748852333-2398565245
Opcode ID: 18e54956b6ff5e5e5f09465d7c17339f29108a54fe6fde34eeeaabc51fafe8c6
Instruction ID: ed2d36106069c91f8a44cef8226e493977f524409a11eb0d6646e4ffefc909ba
Opcode Fuzzy Hash: 18e54956b6ff5e5e5f09465d7c17339f29108a54fe6fde34eeeaabc51fafe8c6
Instruction Fuzzy Hash: 37118232A001189BEB15DFA4D841AFE73BCEF19201F4101AEE90ADB151DB71EA848792

Function 1000F5B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40windowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 1000F5EB
MessageBoxA.USER32(00000000), ref: 1000F5F2

Strings

Shell_TrayWnd, xrefs: 1000F5E6

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: FindMessageWindow
String ID: Shell_TrayWnd
API String ID: 2823233367-2988720461
Opcode ID: fa6ae15565b281fa731f87bbf66bd491b581fbd42e31be7702e6434cd4fda3cb
Instruction ID: 8a2575e9232a4e6788a4e3303b54ed8dbf7533174b6017679d5c7ff6e03b4625
Opcode Fuzzy Hash: fa6ae15565b281fa731f87bbf66bd491b581fbd42e31be7702e6434cd4fda3cb
Instruction Fuzzy Hash: 240116B4D00208EFEB10CFA4D949B9EB7F4FB48341F2084A9E905A7394D675AF40AB54

Function 10012130 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1001214F
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 10012162

Strings

@, xrefs: 10012157

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus_memset
String ID: @
API String ID: 587104284-2766056989
Opcode ID: d7d7f9b0b0953cb5caef1f62c0310114e2340016ed59b2748a12603957ba9fb6
Instruction ID: 3d7f5f32418326eb2dbc6e30da0d634f8bec6cfce8173ea13a502be2592b4bca
Opcode Fuzzy Hash: d7d7f9b0b0953cb5caef1f62c0310114e2340016ed59b2748a12603957ba9fb6
Instruction Fuzzy Hash: 20F06DB0A10208ABDB14DFA4C941B9DBBF8EF18300F50412CE909EB381DB34EA45CB80

Function 1000F3B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000F3D5
wsprintfA.USER32 ref: 1000F3ED

Part of subcall function 1000F630: _memset.LIBCMT ref: 1000F648
Part of subcall function 1000F630: CreateProcessA.KERNEL32(00000000,1000F402,00000000,00000000,00000001,08000020,00000000,00000000,00000044,00000000), ref: 1000F686
Part of subcall function 1000F630: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1000F696
Part of subcall function 1000F630: CloseHandle.KERNEL32(00000000), ref: 1000F6A0
Part of subcall function 1000F630: CloseHandle.KERNEL32(?), ref: 1000F6AA

Strings

taskkill /f /t /im %s, xrefs: 1000F3E1

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle_memset$CreateObjectProcessSingleWaitwsprintf
String ID: taskkill /f /t /im %s
API String ID: 1221303216-1431264914
Opcode ID: e147f47295d6159a0972dd24f2dc00c959dda93d6aa0ae33a39929a26f1210c1
Instruction ID: 7a26d32dd3a77ef8c91e8ca8fb8e6281576ca4a882f0339c21baba38ccc25a09
Opcode Fuzzy Hash: e147f47295d6159a0972dd24f2dc00c959dda93d6aa0ae33a39929a26f1210c1
Instruction Fuzzy Hash: 33F05475E00108ABDF10DBA4DD46BA973B8EF54204F4040A8F94DDB182EE75BB58CB91

Function 1001BBF0 Relevance: 5.1, APIs: 4, Instructions: 133memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000054,?,00000000), ref: 1001BC70
SetLastError.KERNEL32(00000000), ref: 1001BC7F
LeaveCriticalSection.KERNEL32(00000054), ref: 1001BCA7
HeapFree.KERNEL32(?,00000000,?,?), ref: 1001BD36

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterErrorFreeHeapLastLeave
String ID:
API String ID: 132244544-0
Opcode ID: 5ee7b2dd0110e595599aec328bd6a18fa6e2e8a676dff69a3f1635a7451a1511
Instruction ID: 85bd10d27e0b442e1dab5c9d78a6aaa91c45580178b632b1c4d7f06aa4383219
Opcode Fuzzy Hash: 5ee7b2dd0110e595599aec328bd6a18fa6e2e8a676dff69a3f1635a7451a1511
Instruction Fuzzy Hash: 90418E75A00649AFDB14CFA8D884BAEB7F8FF48350F10052AED05DB351DB35E9808B91

Function 1001CEA0 Relevance: 5.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,1A75B7EA,?,?,?,?,0000000F,10035F78,000000FF,?,1001CE86), ref: 1001CED9
EnterCriticalSection.KERNEL32(?,1A75B7EA,?,?,?,?,0000000F,10035F78,000000FF,?,1001CE86), ref: 1001CF09
LeaveCriticalSection.KERNEL32(?,?,?,?,0000000F,10035F78,000000FF,?,1001CE86), ref: 1001CF3A
SetLastError.KERNEL32(00000057,1A75B7EA,?,?,?,?,0000000F,10035F78,000000FF,?,1001CE86), ref: 1001CF6A

Memory Dump Source

Source File: 00000004.00000002.3007906861.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3007867521.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3007965752.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.3008143605.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: 5a7bbe1e01743a2055287aad97c0971164d7a590c1f1937ca8fb7b3f6b1a058c
Instruction ID: 7325f94427708edb1f6ad39a4a2f2957c0187faf522ed9944e05cc5fe4afe9c1
Opcode Fuzzy Hash: 5a7bbe1e01743a2055287aad97c0971164d7a590c1f1937ca8fb7b3f6b1a058c
Instruction Fuzzy Hash: B0218932A04248EFDB11CF58CC84F9ABBBAFB89761F10466EE8149A291D735D981CB50

Analysis Process: rundll32.exePID: 7060, Parent PID: 180COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	98.5%
Signature Coverage:	0%
Total number of Nodes:	457
Total number of Limit Nodes:	8

Executed Functions

Function 10013A20 Relevance: 50.9, APIs: 17, Strings: 12, Instructions: 185
filesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 10013A60
swprintf.LIBCMT ref: 10013A86
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 10013A99
GetLastError.KERNEL32 ref: 10013AA5

Part of subcall function 10022BD3: _doexit.LIBCMT ref: 10022BDD

Part of subcall function 100138F0: _memset.LIBCMT ref: 10013918
Part of subcall function 100138F0: RegOpenKeyExA.ADVAPI32(80000001,101AFE40,00000000,00020006,?), ref: 10013944
Part of subcall function 100138F0: _sprintf.LIBCMT ref: 1001397C
Part of subcall function 100138F0: _strlen.LIBCMT ref: 1001398B
Part of subcall function 100138F0: RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,?), ref: 100139D7
Part of subcall function 100138F0: RegCloseKey.ADVAPI32(?), ref: 100139EA

IsUserAnAdmin.SHELL32 ref: 10013AC2
ReleaseMutex.KERNEL32(00000000), ref: 10013ADC
_memset.LIBCMT ref: 10013B1C
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 10013B32
_sprintf.LIBCMT ref: 10013B4E
DeleteFileA.KERNEL32(?), ref: 10013B5D
MoveFileA.KERNEL32(?,?), ref: 10013B71
_wprintf.LIBCMT ref: 10013CAC
_strlen.LIBCMT ref: 10013CB9

Strings

EnOperationMode Error !, xrefs: 10013CA7
%s:%hd, xrefs: 10013A75
RunService !, xrefs: 10013C68
Eaiawk mgqwgoywasgymoeeuu, xrefs: 10013C75
TMzsft xtnogaqk, xrefs: 10013C31, 10013C5F, 10013C7F
206.238.77.142, xrefs: 10013A70, 10013CF1
Yyickg caosusmk, xrefs: 10013C7A
service_is_exist !, xrefs: 10013C24
C:\Users\Public\Documents\, xrefs: 10013B3D
Windows Update, xrefs: 10013B38, 10013C04
206.238.77.142, xrefs: 10013CB4, 10013CDA
%s%s, xrefs: 10013B42

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File_memset$Mutex_sprintf_strlen$AdminCloseCreateDeleteErrorLastModuleMoveNameOpenReleaseUserValue_doexit_wprintfswprintf
String ID: %s%s$%s:%hd$206.238.77.142$206.238.77.142$C:\Users\Public\Documents\$Eaiawk mgqwgoywasgymoeeuu$EnOperationMode Error !$RunService !$TMzsft xtnogaqk$Windows Update$Yyickg caosusmk$service_is_exist !
API String ID: 2228167989-1563067711
Opcode ID: 2fc02c7820abb1e6e7b02b1e9042d30205a633eb3f33f25fe0a671c5299acd93
Instruction ID: 8ce7a2c48d05da8e1d18419a98124d55002a878a035d7289134c72219816da3c
Opcode Fuzzy Hash: 2fc02c7820abb1e6e7b02b1e9042d30205a633eb3f33f25fe0a671c5299acd93
Instruction Fuzzy Hash: CB61ECB5944314AAE721D7A08C87BE977B8EF00741F804099F6496D5D3EB78DAC4CBA2

Function 1000D890 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 142
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000), ref: 1000D8B6
GetLastError.KERNEL32 ref: 1000D8C0
CryptCreateHash.ADVAPI32(00000000,00000000,00000000,00000000,?), ref: 1000D8E1
GetLastError.KERNEL32 ref: 1000D8EB
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 1000D8FA

Strings

%02X, xrefs: 1000D9C8

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorLast$AcquireCreateHashRelease
String ID: %02X
API String ID: 4104741015-436463671
Opcode ID: 783f6aeacaf77bddf85f865987ab6f2245b3743a8a3a9c8136557c6450919572
Instruction ID: e6624ba5d8ed9705aec1f79a9e38e76f649a0541b50efeb1c6887bd17401cf19
Opcode Fuzzy Hash: 783f6aeacaf77bddf85f865987ab6f2245b3743a8a3a9c8136557c6450919572
Instruction Fuzzy Hash: AE51C5B5A00219EFEB14DFA4CC85BEEB7B4FB48300F108559FA15AB295D778A940CF61

Function 033A0A09 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 178nativememorywindowCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(-00000001,00000022,033A26FB,00000004,00000000), ref: 033A0A8A
NtSetInformationProcess.NTDLL(-00000001,00000022,?,00000004,033A09F7,0000005D), ref: 033A0AAA
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000004,033A09F7,0000005D), ref: 033A0ACC
wsprintfA.USER32(?,?,?,?), ref: 033A0B74
MessageBoxA.USER32(00000000,?,?,00000010), ref: 033A0B8C

Strings

SWVU, xrefs: 033A0A79, 033A0AD8, 033A0AEC, 033A0AF2, 033A0AF8, 033A0B15, 033A0BC8
Application error, xrefs: 033A0B88
The procedure %s could not be located in the DLL %s., xrefs: 033A0B6C

Memory Dump Source

Source File: 00000006.00000003.2149767299.00000000033A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_33a0000_rundll32.jbxd

Similarity

API ID: InformationProcess$AllocMessageQueryVirtualwsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 2902211186-4283279704
Opcode ID: de0e8ee88c8a98f7b8a38ace4394a491acda8513ba92f7ded7199e416edf0d91
Instruction ID: a1ae5263fca18ae43e41f367c8cc3594420918898d3b1a05ac0a29e9e77fd424
Opcode Fuzzy Hash: de0e8ee88c8a98f7b8a38ace4394a491acda8513ba92f7ded7199e416edf0d91
Instruction Fuzzy Hash: 9041C272641B469FEB39DF28CC94FABB3A8EF04785F044528EE459B284DB70E914CB50

Function 033A0A95 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140memorynativewindowCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL(-00000001,00000022,?,00000004,033A09F7,0000005D), ref: 033A0AAA
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000004,033A09F7,0000005D), ref: 033A0ACC
wsprintfA.USER32(?,?,?,?), ref: 033A0B74
MessageBoxA.USER32(00000000,?,?,00000010), ref: 033A0B8C
ExitProcess.KERNEL32(00000000), ref: 033A0B94
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 033A0BE7

Strings

SWVU, xrefs: 033A0AD8, 033A0AEC, 033A0AF2, 033A0AF8, 033A0B15, 033A0BC8
Application error, xrefs: 033A0B88
The procedure %s could not be located in the DLL %s., xrefs: 033A0B6C

Memory Dump Source

Source File: 00000006.00000003.2149767299.00000000033A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_33a0000_rundll32.jbxd

Similarity

API ID: ProcessVirtual$AllocExitFreeInformationMessagewsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 2788668848-4283279704
Opcode ID: f644d6bb55c65f053268db4f25cec8320b3bbf1d1d06db4825fff5ba47126e3b
Instruction ID: 5f7db994d38d22bda2af5698fa4aa1ac380e17c0a706b373c3bc0e1aa832a375
Opcode Fuzzy Hash: f644d6bb55c65f053268db4f25cec8320b3bbf1d1d06db4825fff5ba47126e3b
Instruction Fuzzy Hash: 6831D071641B869FDB39DF24CC94FEF77ACEF05785F044129EE428A284DB74A9108B20

Function 1000CFC0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 251
processpipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 1000D055
_memset.LIBCMT ref: 1000D08B
_memset.LIBCMT ref: 1000D09E
_memset.LIBCMT ref: 1000D0B1
CreatePipe.KERNELBASE(?,?,0000000C,00000000), ref: 1000D10C
GetStartupInfoA.KERNEL32(00000044), ref: 1000D12D
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,00000000), ref: 1000D17E
CloseHandle.KERNEL32(?,?), ref: 1000D39A
CloseHandle.KERNEL32(?), ref: 1000D3A7
CloseHandle.KERNEL32(?), ref: 1000D3B4
CloseHandle.KERNEL32(?), ref: 1000D3C1

Strings

D, xrefs: 1000D0CD
ProcessorId, xrefs: 1000D00B
wmic cpu get processorid, xrefs: 1000D000

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle_memset$Create$InfoPipeProcessStartup
String ID: D$ProcessorId$wmic cpu get processorid
API String ID: 1762129635-53154263
Opcode ID: 2faa9055df3024060b3a78fac8b67b6add4b8c37b23ad85aa60008f06d3c8044
Instruction ID: 29feaeb9d2e0a167578c768367cdbb99c1f13e7196a5b6bb9c176603c2bdf5a2
Opcode Fuzzy Hash: 2faa9055df3024060b3a78fac8b67b6add4b8c37b23ad85aa60008f06d3c8044
Instruction Fuzzy Hash: D1B14E75902228DFEB29DB60CC99BDEB7B4FB48340F1041DAE109A7181DB756B84CF50

Function 1000D420 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 250
processpipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 1000D4B4
_memset.LIBCMT ref: 1000D4EA
_memset.LIBCMT ref: 1000D4FD
_memset.LIBCMT ref: 1000D510
CreatePipe.KERNELBASE(?,?,0000000C,00000000), ref: 1000D56B
GetStartupInfoA.KERNEL32(00000044), ref: 1000D58C
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,00000000), ref: 1000D5DD
CloseHandle.KERNEL32(?,?), ref: 1000D7F9
CloseHandle.KERNEL32(?), ref: 1000D806
CloseHandle.KERNEL32(?), ref: 1000D813
CloseHandle.KERNEL32(?), ref: 1000D820

Strings

SerialNumber, xrefs: 1000D46A
D, xrefs: 1000D52C
wmic diskdrive get serialnumber, xrefs: 1000D460

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle_memset$Create$InfoPipeProcessStartup
String ID: D$SerialNumber$wmic diskdrive get serialnumber
API String ID: 1762129635-2526680146
Opcode ID: 284479aef56905e99ef7afbd9686248a6d4ef8a24c59542d99c3aafd4a34ee3f
Instruction ID: f7e6dc397231a2a0a1082a64f52227403f3a6002e1c9f0e787add4f7ccce3aad
Opcode Fuzzy Hash: 284479aef56905e99ef7afbd9686248a6d4ef8a24c59542d99c3aafd4a34ee3f
Instruction Fuzzy Hash: 8CB12B759162289BEB28DB64CC9DBEEB7B4FB48300F0041DAE50DAA191DB756B84CF50

Function 10026FE8 Relevance: 16.8, APIs: 11, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 10027021

Part of subcall function 100258DC: __getptd_noexit.LIBCMT ref: 100258DC

__gmtime64_s.LIBCMT ref: 100270BA
__gmtime64_s.LIBCMT ref: 100270F0
__gmtime64_s.LIBCMT ref: 1002710D
__allrem.LIBCMT ref: 10027163
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1002717F
__allrem.LIBCMT ref: 10027196
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 100271B4
__allrem.LIBCMT ref: 100271CB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 100271E9
__invoke_watson.LIBCMT ref: 1002725A

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: faf785f0e9591b3d4b811fc4296c87dcbc334db000ad1bf2518f1b08427d47ec
Instruction ID: 713491a1cde179dae1e75a0093b68b8f74a69f94e9f1ec33854f382ae24b7f6e
Opcode Fuzzy Hash: faf785f0e9591b3d4b811fc4296c87dcbc334db000ad1bf2518f1b08427d47ec
Instruction Fuzzy Hash: 6B71D476A00717EBE715DE78EC82B5AB3E8FF40364F91412AF918D6681E770ED448790

Function 6C696740 Relevance: 6.2, APIs: 4, Instructions: 243
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(0000FFFF,00000000,00001000,00000004), ref: 6C6969A4
_memset.LIBCMT ref: 6C696A4C
VirtualAlloc.KERNELBASE(0000FFFF,000000B8,00001000,00000004,?,6C698C38), ref: 6C696B0E
_memmove.LIBCMT ref: 6C696B70

Memory Dump Source

Source File: 00000006.00000002.3054985603.000000006C681000.00000040.00000001.01000000.00000003.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000006.00000002.3054920038.000000006C680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3054985603.000000006C9C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3054985603.000000006CBAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3054985603.000000006CBB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3054985603.000000006CBB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3056021665.000000006CC55000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c680000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocVirtual$_memmove_memset
String ID:
API String ID: 725130153-0
Opcode ID: af01bac3374c618721e138754d3ca3c72d74494653e4f821ac976264aae05339
Instruction ID: 395c12fc52dce5ac1d009dabf2c6e74aa10fdb6c514c0d7e02ec50b25f49a4c4
Opcode Fuzzy Hash: af01bac3374c618721e138754d3ca3c72d74494653e4f821ac976264aae05339
Instruction Fuzzy Hash: D9D16F75B0260DCFCB48CFD9E593A2DBBB1FB8A300B14821AD8A587754DB30A941CF49

Function 033A13BF Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,00001000,00000004,?,?), ref: 033A13EA
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 033A1403

Memory Dump Source

Source File: 00000006.00000003.2149767299.00000000033A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_33a0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 460e07aa1c6cfb092b5f976fa85d581fca477865be9a128e2591be7121e923ca
Instruction ID: b1d429a417b6c49ed05833987fabd77db929dafd5a81931b874044704500e5e3
Opcode Fuzzy Hash: 460e07aa1c6cfb092b5f976fa85d581fca477865be9a128e2591be7121e923ca
Instruction Fuzzy Hash: 74F08276200305AFDB19CF40C844FEA7779EB48391F104176EA42AB684C670F5148B10

Function 1002CE25 Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 1002CE3C

Part of subcall function 10027FF1: __mtinitlocknum.LIBCMT ref: 10028003
Part of subcall function 10027FF1: __amsg_exit.LIBCMT ref: 1002800F
Part of subcall function 10027FF1: EnterCriticalSection.KERNEL32(?,?,10025D6D,0000000D), ref: 1002801C

__tzset_nolock.LIBCMT ref: 1002CE4F

Part of subcall function 1002D09F: __lock.LIBCMT ref: 1002D0C1
Part of subcall function 1002D09F: ____lc_codepage_func.LIBCMT ref: 1002D108
Part of subcall function 1002D09F: __getenv_helper_nolock.LIBCMT ref: 1002D129
Part of subcall function 1002D09F: _free.LIBCMT ref: 1002D15C
Part of subcall function 1002D09F: _strlen.LIBCMT ref: 1002D163
Part of subcall function 1002D09F: __malloc_crt.LIBCMT ref: 1002D16A

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: fc85f6cf18a6252e642b57c3e1c2b749fe30e0e1031c663e82c605452884cce2
Instruction ID: a2ad06c6b65e7629715c0b93b357caa5f945d3fedfb1b9c2ad21f9bf3716e497
Opcode Fuzzy Hash: fc85f6cf18a6252e642b57c3e1c2b749fe30e0e1031c663e82c605452884cce2
Instruction Fuzzy Hash: 0BE0C238451A48D9DF10EBF0AA4275C32F0FB04B66FE20209E004041D28F7D35888923

Function 10022833 Relevance: 3.0, APIs: 2, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 10022839

Part of subcall function 10022801: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,1002283E,00000000,?,100280A4,000000FF,0000001E,101B7BE8,00000008,10028008,00000000,?), ref: 10022810
Part of subcall function 10022801: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 10022822

ExitProcess.KERNEL32 ref: 10022842

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 3bf28b7052921138b5cd44a98d3311a828cfa0a63c341592180aa8684d3b340a
Instruction ID: c8f4cf039e012b41d150cd44d72804b099170dd8f7fcc5d26d0c23f5f7bd029f
Opcode Fuzzy Hash: 3bf28b7052921138b5cd44a98d3311a828cfa0a63c341592180aa8684d3b340a
Instruction Fuzzy Hash: B5B09230001108BFDB022F51DC4A8593FA9FB002A0B508020F80809032DF73BA929A81

Function 033A082D Relevance: 2.6, APIs: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,-00000436,00001000,00000004), ref: 033A087D
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 033A08A9

Memory Dump Source

Source File: 00000006.00000003.2149767299.00000000033A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_33a0000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7e515f7c385f7f07b94d9a5cb9b23266753d833ffbaa65bc10218dcc86593253
Instruction ID: 29b3916060dcfc313f431ac2c3ce83f0c16348864b6c37a4efd373bce2f03555
Opcode Fuzzy Hash: 7e515f7c385f7f07b94d9a5cb9b23266753d833ffbaa65bc10218dcc86593253
Instruction Fuzzy Hash: 34018871A011147BE704CE99CC40FAEB7A9EBC8760F14C169F51897384D674AD10CBA0

Function 10021DFA Relevance: 1.5, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 100258DC: __getptd_noexit.LIBCMT ref: 100258DC

_asctime.LIBCMT ref: 10021E5D

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: __getptd_noexit_asctime
String ID:
API String ID: 1865661205-0
Opcode ID: dcfe908546e3f88bc8117c10939122550607e7d39558988ca205b2cb5c272348
Instruction ID: 4125543197aa1fcd6f4b2a2d68e97bfeb0adc15cba48122be1fc6d66b0878a2d
Opcode Fuzzy Hash: dcfe908546e3f88bc8117c10939122550607e7d39558988ca205b2cb5c272348
Instruction Fuzzy Hash: 53F04939A002099EDF00DBA4EC56BCE77ECEF28255FD20469EC05EB091EB74E9848725

Function 10036500 Relevance: 1.5, APIs: 1, Instructions: 22
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202), ref: 1003651E

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: d3557ac59b8f8fefe8b80b3b61d78a442e21de74061af108e84e171f57d9cb46
Instruction ID: a027679b03284c68216ebb438d11db6f7a8099bc69e3ea9b22835e59c52e58d0
Opcode Fuzzy Hash: d3557ac59b8f8fefe8b80b3b61d78a442e21de74061af108e84e171f57d9cb46
Instruction Fuzzy Hash: ABE0DF74A04208ABCB00DBB4DD0755D77F4EF49200F80016CF9098B252EB34AA148A82

Function 10022BD3 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 10022BDD

Part of subcall function 10022AA4: __lock.LIBCMT ref: 10022AB2
Part of subcall function 10022AA4: DecodePointer.KERNEL32(101B78D8,0000001C,10022A1B,00000000,00000001,00000000,?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022AF1
Part of subcall function 10022AA4: DecodePointer.KERNEL32(?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B02
Part of subcall function 10022AA4: EncodePointer.KERNEL32(00000000,?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B1B
Part of subcall function 10022AA4: DecodePointer.KERNEL32(-00000004,?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B2B
Part of subcall function 10022AA4: EncodePointer.KERNEL32(00000000,?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B31
Part of subcall function 10022AA4: DecodePointer.KERNEL32(?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B47
Part of subcall function 10022AA4: DecodePointer.KERNEL32(?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B52
Part of subcall function 10022AA4: __initterm.LIBCMT ref: 10022B7A
Part of subcall function 10022AA4: __initterm.LIBCMT ref: 10022B8B

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode__initterm$__lock_doexit
String ID:
API String ID: 3712619029-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: cfc2533f0be627bc8b7b8cac997dbfbd0b87b13c6f736a1528db1b5c4a82aaa4
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: 06B0123158030C33E9201581FC03F093B1C8F80A60F500020FF0C1C5E1A593756080CA

Non-executed Functions

Function 10012550 Relevance: 54.6, APIs: 24, Strings: 7, Instructions: 308servicefileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,1DFFD115,?,?,?,00000000,10023340,101B6C90,000000FE,?,10013C89,TMzsft xtnogaqk,Yyickg caosusmk,Eaiawk mgqwgoywasgymoeeuu), ref: 10012594
ExpandEnvironmentStringsA.KERNEL32(C:\Users\Public\Documents\,?,00000104,?,?,?,00000000,10023340,101B6C90,000000FE,?,10013C89,TMzsft xtnogaqk,Yyickg caosusmk,Eaiawk mgqwgoywasgymoeeuu), ref: 100125AB
_strlen.LIBCMT ref: 100125B8
_strncmp.LIBCMT ref: 100125CF
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 1001270E

Part of subcall function 10012300: _memset.LIBCMT ref: 10012328
Part of subcall function 10012300: _strlen.LIBCMT ref: 1001234F
Part of subcall function 10012300: _strncpy.LIBCMT ref: 10012382
Part of subcall function 10012300: CreateDirectoryA.KERNEL32(00000000,00000000), ref: 100123A9

wsprintfA.USER32 ref: 10012616
_strlen.LIBCMT ref: 10012626
_strlen.LIBCMT ref: 10012642
CopyFileA.KERNEL32(?,?,00000000), ref: 100126AE
_memset.LIBCMT ref: 100126C2
_strcat.LIBCMT ref: 100126D8
CreateServiceA.ADVAPI32(?,?,?,000F01FF,00000110,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000), ref: 10012756
LockServiceDatabase.ADVAPI32(?), ref: 10012769
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 10012799
ChangeServiceConfig2A.ADVAPI32(00000000,00000002,00015180), ref: 10012877
UnlockServiceDatabase.ADVAPI32(?), ref: 10012884
GetLastError.KERNEL32 ref: 10012893
OpenServiceA.ADVAPI32(?,?,000F01FF), ref: 100128B0

Strings

SYSTEM\CurrentControlSet\Services\, xrefs: 10012983, 10012986
%, xrefs: 100125EE
Yyickg caosusmk, xrefs: 1001277D
C:\Users\Public\Documents\, xrefs: 100125A6
Description, xrefs: 10012A05, 10012A08
Windows Update, xrefs: 10012603
s, xrefs: 100125F5

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Service$_strlen$ChangeConfig2CreateDatabaseFileOpen_memset$CopyDirectoryEnvironmentErrorExpandLastLockManagerModuleNameStringsUnlock_strcat_strncmp_strncpywsprintf
String ID: %$C:\Users\Public\Documents\$Description$SYSTEM\CurrentControlSet\Services\$Windows Update$Yyickg caosusmk$s
API String ID: 2269191997-3217403557
Opcode ID: da25e49445566c96217ba80189cd2cecd7e86491d1e1acde59f2152fe1c39007
Instruction ID: 58a78215622ab89836c283d46f1977e4f6cad2cf6e4b3b9b80a50220f8474d07
Opcode Fuzzy Hash: da25e49445566c96217ba80189cd2cecd7e86491d1e1acde59f2152fe1c39007
Instruction Fuzzy Hash: BEE17471D04298DFEB26CB94DC88BDE7BB8BB15704F0441D9E5486A2C1C7B95B88CF61

Function 1000E970 Relevance: 54.5, APIs: 26, Strings: 5, Instructions: 217stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000E9B6
_memset.LIBCMT ref: 1000E9D5
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 1000E9EB
StrCpyW.SHLWAPI(?,?), ref: 1000EA0A
PathRemoveFileSpecW.SHLWAPI(?), ref: 1000EA17
lstrlenW.KERNEL32(?), ref: 1000EA24

Strings

" > nul, xrefs: 1000EB85
/c ping -n 4 127.0.0.1 > nul, xrefs: 1000EA8F
D, xrefs: 1000EBD5
&& del ", xrefs: 1000EB63
COMSPEC, xrefs: 1000EA60

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File_memset$ModuleNamePathRemoveSpeclstrlen
String ID: && del "$ /c ping -n 4 127.0.0.1 > nul$" > nul$COMSPEC$D
API String ID: 322946884-2269649423
Opcode ID: 144a78e811b26684e0f96933bcd6fe390524fe62f1730313945f432d4c563e04
Instruction ID: 84f9132210fad28102cfca7cccb4be7a633d21108d91728e9d5e1e2c02768cad
Opcode Fuzzy Hash: 144a78e811b26684e0f96933bcd6fe390524fe62f1730313945f432d4c563e04
Instruction Fuzzy Hash: 17914F75A00219AFEB24DB64CC85BEA77B8FF48740F448599F20DAA191DF70AB84CF51

Function 1000EF10 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 213keyboardsleepstringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000EF55
_memset.LIBCMT ref: 1000EF72
_memset.LIBCMT ref: 1000EF88
Sleep.KERNEL32(00000005), ref: 1000EF92
lstrlenA.KERNEL32(00000000), ref: 1000EF9F
_memset.LIBCMT ref: 1000EFDC
GetKeyState.USER32(00000010), ref: 1000F035
GetAsyncKeyState.USER32(?), ref: 1000F05C
GetKeyState.USER32(00000014), ref: 1000F073

Strings

], xrefs: 1000F0CF
e, xrefs: 1000F026
<BackSpace>, xrefs: 1000F15E
<Enter>, xrefs: 1000F1EB

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$State$AsyncSleeplstrlen
String ID: <BackSpace>$<Enter>$]$e
API String ID: 607291201-3604511016
Opcode ID: da57c67bcd9e4523acf9165be53d619ee9f3dc396b189a0e504f25392de7e49e
Instruction ID: 971390b8b5f7826b9d9bd22f466c4ca9011c4cb2ed80f64febdb7f556ca07fc7
Opcode Fuzzy Hash: da57c67bcd9e4523acf9165be53d619ee9f3dc396b189a0e504f25392de7e49e
Instruction Fuzzy Hash: 6091F4B4900718DFEB20CFA0DC49BEA7375FB84346F1041EDE509A6186DB76AA94DF41

Function 1001DBF0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 104networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(?,00000001,00000006), ref: 1001DC4B
bind.WS2_32(00000000,00000002,0000001C), ref: 1001DC70
WSAGetLastError.WS2_32(?,?,?,?), ref: 1001DCA8
SetLastError.KERNEL32 ref: 1001DCB6
WSAGetLastError.WS2_32(?,?,?,?), ref: 1001DCD7
SetLastError.KERNEL32 ref: 1001DCE5
WSAGetLastError.WS2_32(?,?,?), ref: 1001DCF6
SetLastError.KERNEL32 ref: 1001DD04

Strings

0.0.0.0, xrefs: 1001DC17, 1001DC2D

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLast$bindsocket
String ID: 0.0.0.0
API String ID: 2672188334-3771769585
Opcode ID: 67e94f2010b34371f429a1fa7c81e8d84f1349c60049d7ca6e869d281ca33336
Instruction ID: 8216ced0d739489223f21362e87208fc090313cd3a371b7f6b63c1b20dd229cb
Opcode Fuzzy Hash: 67e94f2010b34371f429a1fa7c81e8d84f1349c60049d7ca6e869d281ca33336
Instruction Fuzzy Hash: 8231E672A002159FE720EF68DC85BAB77E8EF45350F00452EFD09CA181EAB5D885D7A0

Function 1001C580 Relevance: 7.7, APIs: 5, Instructions: 151networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32(?,?,?,?,?,?,1001C326,FFFFFFFF,?,?,?,FFFFFFFF,?), ref: 1001C5E3

Part of subcall function 100172C0: __CxxThrowException@8.LIBCMT ref: 100172D2
Part of subcall function 100172C0: EnterCriticalSection.KERNEL32(00000000,1DFFD115,00000000,00000098,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005), ref: 10017312
Part of subcall function 100172C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005,?,100168C9,00000400,00000400), ref: 1001737B

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterErrorException@8LastLeaveThrow
String ID:
API String ID: 1367629879-0
Opcode ID: 1a78252def1050f5be20003a34375eeef4699fcd1b0fa4c910ffc5e1ea9ae854
Instruction ID: 2045c5cf5837c9daf880452df431a01197e78d674d59fb6298516e1ae159bddb
Opcode Fuzzy Hash: 1a78252def1050f5be20003a34375eeef4699fcd1b0fa4c910ffc5e1ea9ae854
Instruction Fuzzy Hash: 7851BEB5900218AFDB21DFA4C841AAE77B5FF44390F100219F8599F291E770EDD0DB91

Function 100153E0 Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 249libraryloaderCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10015432
_memset.LIBCMT ref: 10015448
_memset.LIBCMT ref: 1001545E
LoadLibraryA.KERNEL32(ADVAPI32.dll), ref: 1001546B
GetProcAddress.KERNEL32(00000000,RegQueryValueExA), ref: 10015493
GetProcAddress.KERNEL32(00000000,RegOpenKeyExA), ref: 100154AB
GetProcAddress.KERNEL32(00000000,RegEnumValueA), ref: 100154C3
GetProcAddress.KERNEL32(00000000,RegEnumKeyExA), ref: 100154DB
GetProcAddress.KERNEL32(00000000,RegCloseKey), ref: 100154F3
FreeLibrary.KERNEL32(00000000), ref: 1001553C

Strings

RegEnumKeyExA, xrefs: 100154CF
RegEnumValueA, xrefs: 100154B7
RegCloseKey, xrefs: 100154E7
RegQueryValueExA, xrefs: 10015487
ADVAPI32.dll, xrefs: 10015466
RegOpenKeyExA, xrefs: 1001549F

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$_memset$Library$FreeLoad
String ID: ADVAPI32.dll$RegCloseKey$RegEnumKeyExA$RegEnumValueA$RegOpenKeyExA$RegQueryValueExA
API String ID: 2029490530-3713883646
Opcode ID: ce21794f6d49dae7673cc83d0b588799919480882acf9cc9429ea4c88414c882
Instruction ID: 42d3faf0a6d82433ca9894e8e05647cd2437e6e791ab8efedd1cac75c6c50b36
Opcode Fuzzy Hash: ce21794f6d49dae7673cc83d0b588799919480882acf9cc9429ea4c88414c882
Instruction Fuzzy Hash: 4AB17EB5904629EFDB20DF64CC89BEEB7B4FB48306F0445D8E909AA290D7759AC4CF50

Function 10007130 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 183timeCOMMON

Download Yara Rule

APIs

WinHttpOpen.WINHTTP(curl/7.83.1,00000000,00000000,00000000,00000000), ref: 10007197
WinHttpSetTimeouts.WINHTTP(00000000,000003E8,000003E8,000003E8,000003E8), ref: 100071BE
WinHttpConnect.WINHTTP(00000000,?,00000050,00000000), ref: 100071D6
WinHttpOpenRequest.WINHTTP(00000000,GET,?,00000000,00000000,00000000,00000000), ref: 100071FA
WinHttpSendRequest.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 10007219
WinHttpReceiveResponse.WINHTTP(00000000,00000000), ref: 1000722E
WinHttpQueryHeaders.WINHTTP(00000000,20000013,00000000,00000000,00000004,00000000), ref: 10007264
__CxxThrowException@8.LIBCMT ref: 10007272
WinHttpQueryDataAvailable.WINHTTP(00000000,00000000), ref: 10007293
GetLastError.KERNEL32 ref: 1000729D
__CxxThrowException@8.LIBCMT ref: 100072AF
std::ios_base::clear.LIBCPMTD ref: 100072C8
WinHttpReadData.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000), ref: 100072E4
std::ios_base::clear.LIBCPMTD ref: 100072FF
GetLastError.KERNEL32(00000000), ref: 1000730A
_wprintf.LIBCMT ref: 10007316
WinHttpCloseHandle.WINHTTP(00000000), ref: 10007328
WinHttpCloseHandle.WINHTTP(00000000), ref: 10007338
WinHttpCloseHandle.WINHTTP(00000000), ref: 10007348

Strings

GET, xrefs: 100071F1
curl/7.83.1, xrefs: 10007192
Error %d has occurred., xrefs: 10007311

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Http$CloseHandle$DataErrorException@8LastOpenQueryRequestThrowstd::ios_base::clear$AvailableConnectHeadersReadReceiveResponseSendTimeouts_wprintf
String ID: Error %d has occurred.$GET$curl/7.83.1
API String ID: 3568891788-3281102068
Opcode ID: a0faf76c0c659e3c95fc50e059929233ef8cb015fb8e25ec05d524550362fc63
Instruction ID: 96198f7158a5b0440b015918e988b78723295c7c608185cc2ea97e2543ed712c
Opcode Fuzzy Hash: a0faf76c0c659e3c95fc50e059929233ef8cb015fb8e25ec05d524550362fc63
Instruction Fuzzy Hash: CF7107B1D40248EFEB15DFA0CC99BEEBBB4FB04741F104119F51AAA2D4CB786A45DB50

Function 10012C30 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 120sleepregistrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(TMzsft xtnogaqk,10012E80), ref: 10012C4D
FreeConsole.KERNEL32 ref: 10012C68
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012CB5
Sleep.KERNEL32(000001F4), ref: 10012CCA
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012CE6
CreateMutexA.KERNEL32(00000000,00000000,TMzsft xtnogaqk), ref: 10012D08
GetLastError.KERNEL32 ref: 10012D14
WSAStartup.WS2_32(00000202,?), ref: 10012D34
GetVersionExA.KERNEL32(00000094), ref: 10012D4B
Sleep.KERNEL32(000F4240,00000000), ref: 10012D73

Strings

TMzsft xtnogaqk, xrefs: 10012C48, 10012CFF
%s Win7, xrefs: 10012DAF

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Service$SleepStatus$ConsoleCreateCtrlErrorFreeHandlerLastMutexRegisterStartupVersion
String ID: %s Win7$TMzsft xtnogaqk
API String ID: 1415809075-2726583022
Opcode ID: 3c918adf2ea9c1f546c4a298ab0c77e3fc501175bd32b3641c86ff31aace8df7
Instruction ID: 16fc8e2a50e62427ded2aaa4a0275d88474e0d3da89c2d2dd2af286da20813d4
Opcode Fuzzy Hash: 3c918adf2ea9c1f546c4a298ab0c77e3fc501175bd32b3641c86ff31aace8df7
Instruction Fuzzy Hash: 9B518EB5904224DFE729EF60CC8DB9A77B4FB04306F804298E10D6A5A1D7786AC8DF52

Function 10015EB0 Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 139libraryloaderfileCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(wininet.dll), ref: 10015F01
GetProcAddress.KERNEL32(?,InternetOpenA), ref: 10015F19
FreeLibrary.KERNEL32(00000000), ref: 10015F57
GetProcAddress.KERNEL32(?,InternetOpenUrlA), ref: 10015F70
FreeLibrary.KERNEL32(00000000), ref: 10015FB7
CreateFileA.KERNEL32(1000F526,40000000,00000000,00000000,00000002,00000000,00000000), ref: 10015FD7
_memset.LIBCMT ref: 10015FFE
GetProcAddress.KERNEL32(?,InternetReadFile), ref: 10016012
WriteFile.KERNEL32(000000FF,?,00000000,00000000,00000000), ref: 10016086
CloseHandle.KERNEL32(000000FF), ref: 100160A0
Sleep.KERNEL32(00000001), ref: 100160A8
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 100160BA
FreeLibrary.KERNEL32(00000000), ref: 100160F0

Strings

InternetCloseHandle, xrefs: 100160AE
wininet.dll, xrefs: 10015EFC
InternetOpenUrlA, xrefs: 10015F64
MSIE 6.0, xrefs: 10015F2D
InternetReadFile, xrefs: 10016006
InternetOpenA, xrefs: 10015F0D

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$Free$File$CloseCreateHandleLoadSleepWrite_memset
String ID: InternetCloseHandle$InternetOpenA$InternetOpenUrlA$InternetReadFile$MSIE 6.0$wininet.dll
API String ID: 2728150189-4269851202
Opcode ID: 91acf4dff87506ba4283441e8002569b8e5cf21a0175855ebad90579deee730e
Instruction ID: e100d08a212eeccd1dc3a45c1d5aa8af2f61e991188d98dff4208e55cab7884c
Opcode Fuzzy Hash: 91acf4dff87506ba4283441e8002569b8e5cf21a0175855ebad90579deee730e
Instruction Fuzzy Hash: DA51CCF5900228DFEB31DB64CD89BDA77B8AB48305F5081D8F709AA181C7759AC5CF68

Function 100123C0 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 117libraryloaderprocessCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(userenv.dll), ref: 100123D8
GetProcAddress.KERNEL32(?,CreateEnvironmentBlock), ref: 100123EA
_memset.LIBCMT ref: 10012417
_memset.LIBCMT ref: 10012427
GetCurrentProcess.KERNEL32 ref: 10012459
OpenProcessToken.ADVAPI32(?,000F01FF,00000000), ref: 1001246F
DuplicateTokenEx.ADVAPI32(00000000,02000000,00000000,00000001,00000001,00000000), ref: 10012488
LoadLibraryA.KERNEL32(Kernel32.dll,WTSGetActiveConsoleSessionId), ref: 10012498
GetProcAddress.KERNEL32(00000000), ref: 1001249F
SetTokenInformation.ADVAPI32(00000000,0000000C,00000000,00000004), ref: 100124C0
CreateProcessAsUserA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000430,00000000,00000000,00000044,00000000), ref: 100124F6
CloseHandle.KERNEL32(00000000), ref: 10012506
CloseHandle.KERNEL32(00000000), ref: 10012510
FreeLibrary.KERNEL32(00000000), ref: 1001252F

Strings

D, xrefs: 1001244B
WTSGetActiveConsoleSessionId, xrefs: 1001248E
CreateEnvironmentBlock, xrefs: 100123E1
userenv.dll, xrefs: 100123D3
Kernel32.dll, xrefs: 10012493

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: LibraryProcessToken$AddressCloseHandleLoadProc_memset$CreateCurrentDuplicateFreeInformationOpenUser
String ID: CreateEnvironmentBlock$D$Kernel32.dll$WTSGetActiveConsoleSessionId$userenv.dll
API String ID: 2385095549-609967149
Opcode ID: ac44d7a654e1ecf9cefedaa459ffae167c2ab3953bef6485a400e85d30f059f2
Instruction ID: fd1ae4a91e3460f93e873eecc7cbeda63378566b322c9237b013182db1ce3722
Opcode Fuzzy Hash: ac44d7a654e1ecf9cefedaa459ffae167c2ab3953bef6485a400e85d30f059f2
Instruction Fuzzy Hash: B741B6B5E00218EFEB14DFE0CC99BAEBBB4FB48705F104518E6156B281D7B59944CF90

Function 10015000 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ADVAPI32.dll), ref: 10015019
GetProcAddress.KERNEL32(?,OpenProcessToken), ref: 1001502B
GetProcAddress.KERNEL32(?,AdjustTokenPrivileges), ref: 1001503D
GetProcAddress.KERNEL32(?,LookupPrivilegeValueA), ref: 1001504F
LoadLibraryA.KERNEL32(kernel32.dll), ref: 1001505D
GetProcAddress.KERNEL32(?,GetCurrentProcess), ref: 1001506F
LoadLibraryA.KERNEL32(KERNEL32.dll), ref: 100150F0
GetProcAddress.KERNEL32(?,GetLastError), ref: 10015102
CloseHandle.KERNEL32(?), ref: 1001511A
FreeLibrary.KERNEL32(00000000), ref: 1001512A
FreeLibrary.KERNEL32(00000000), ref: 1001513A

Strings

AdjustTokenPrivileges, xrefs: 10015034
GetLastError, xrefs: 100150F9
OpenProcessToken, xrefs: 10015022
LookupPrivilegeValueA, xrefs: 10015046
KERNEL32.dll, xrefs: 100150EB
kernel32.dll, xrefs: 10015058
GetCurrentProcess, xrefs: 10015066
ADVAPI32.dll, xrefs: 10015014

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$Load$Free$CloseHandle
String ID: ADVAPI32.dll$AdjustTokenPrivileges$GetCurrentProcess$GetLastError$KERNEL32.dll$LookupPrivilegeValueA$OpenProcessToken$kernel32.dll
API String ID: 2887716753-1648388921
Opcode ID: 09c34ea0c58a1937bffb1c09e732f69496aae19d3495c3a7a974608a733c4652
Instruction ID: 2ba7eb19521ecd2e0521120e7302f927c8c69f99e1a3e1b69f5f98f9208caa0c
Opcode Fuzzy Hash: 09c34ea0c58a1937bffb1c09e732f69496aae19d3495c3a7a974608a733c4652
Instruction Fuzzy Hash: 8441F775A00218EFEB16DFE4CC88BEEBBB5FB08301F144518F905AA291D7799940CBA0

Function 10015BC0 Relevance: 30.0, APIs: 10, Strings: 7, Instructions: 232libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ADVAPI32.dll,1DFFD115), ref: 10015C0D
GetProcAddress.KERNEL32(00000000,RegCreateKeyExA), ref: 10015C2C
GetProcAddress.KERNEL32(00000000,RegSetValueExA), ref: 10015C3E
GetProcAddress.KERNEL32(00000000,RegDeleteKeyA), ref: 10015C50
GetProcAddress.KERNEL32(00000000,RegDeleteValueA), ref: 10015C62
GetProcAddress.KERNEL32(00000000,RegOpenKeyExA), ref: 10015C74
GetProcAddress.KERNEL32(00000000,RegCloseKey), ref: 10015C86
FreeLibrary.KERNEL32(00000000), ref: 10015CB7

Strings

RegSetValueExA, xrefs: 10015C35
RegCloseKey, xrefs: 10015C7D
RegCreateKeyExA, xrefs: 10015C23
RegDeleteKeyA, xrefs: 10015C47
ADVAPI32.dll, xrefs: 10015C08
RegDeleteValueA, xrefs: 10015C59
RegOpenKeyExA, xrefs: 10015C6B

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: ADVAPI32.dll$RegCloseKey$RegCreateKeyExA$RegDeleteKeyA$RegDeleteValueA$RegOpenKeyExA$RegSetValueExA
API String ID: 2449869053-3188892968
Opcode ID: a0bd9a62e12f23e275d41ab7552c4dc3de141cd94503504a1d0315d773db0a11
Instruction ID: 7e0e5bb135e0f492be458d9bdacf26a44bf840c8ddca4d957ca8ae1cdeebb231
Opcode Fuzzy Hash: a0bd9a62e12f23e275d41ab7552c4dc3de141cd94503504a1d0315d773db0a11
Instruction Fuzzy Hash: A791C575A00208EFDB14CFA4D988BEEBBB9FB48751F148519F505AB280D776E981CB60

Function 10011980 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 148libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Ole32.dll), ref: 10011995
GetProcAddress.KERNEL32(?,CoInitialize), ref: 100119A7
GetProcAddress.KERNEL32(?,CoUninitialize), ref: 100119B9
GetProcAddress.KERNEL32(?,CoCreateInstance), ref: 100119CB
LoadLibraryA.KERNEL32(Oleaut32.dll), ref: 100119D9
GetProcAddress.KERNEL32(?,SysFreeString), ref: 100119EB

Strings

Oleaut32.dll, xrefs: 100119D4
Ole32.dll, xrefs: 10011990
CoUninitialize, xrefs: 100119B0
FriendlyName, xrefs: 10011AB4
CoCreateInstance, xrefs: 100119C2
CoInitialize, xrefs: 1001199E
SysFreeString, xrefs: 100119E2

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CoCreateInstance$CoInitialize$CoUninitialize$FriendlyName$Ole32.dll$Oleaut32.dll$SysFreeString
API String ID: 2238633743-3340630095
Opcode ID: 1d44af109edd1136255a39dc8a1dfaf4e7fcfd6cc7004c71e0f7df510543376a
Instruction ID: 212faf0c9611e66aabaa8f64879106e5bf96d811b783168d703724af177fa0bf
Opcode Fuzzy Hash: 1d44af109edd1136255a39dc8a1dfaf4e7fcfd6cc7004c71e0f7df510543376a
Instruction Fuzzy Hash: 69519279E00218EFDB14DFE8D884AEEB7B5FF88701F108558E516AB290D774A985CF60

Function 10015950 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 94libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,1DFFD115,?,?,?,00000000,10023340,101B6E88,000000FE,?,100158FA,00000000), ref: 1001598B
GetProcAddress.KERNEL32(?,GetThreadDesktop), ref: 100159A3
GetProcAddress.KERNEL32(?,GetUserObjectInformationA), ref: 100159BB
GetProcAddress.KERNEL32(?,SetThreadDesktop), ref: 100159D3
GetProcAddress.KERNEL32(?,CloseDesktop), ref: 100159EB
LoadLibraryA.KERNEL32(kernel32.dll,?,?,?,00000000,10023340,101B6E88,000000FE,?,100158FA,00000000), ref: 100159FC
GetProcAddress.KERNEL32(?,GetCurrentThreadId), ref: 10015A14

Strings

GetCurrentThreadId, xrefs: 10015A08
user32.dll, xrefs: 10015986
CloseDesktop, xrefs: 100159DF
GetUserObjectInformationA, xrefs: 100159AF
kernel32.dll, xrefs: 100159F7
GetThreadDesktop, xrefs: 10015997
SetThreadDesktop, xrefs: 100159C7

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseDesktop$GetCurrentThreadId$GetThreadDesktop$GetUserObjectInformationA$SetThreadDesktop$kernel32.dll$user32.dll
API String ID: 2238633743-588083535
Opcode ID: a1b5b4eb188306deb7be5c334ff11527cf8147aa92056ec69f43df2731cc529d
Instruction ID: 0747fb5764a0f845c2061594b4b15d20bfc1687557696379681bc3d3be76b4b8
Opcode Fuzzy Hash: a1b5b4eb188306deb7be5c334ff11527cf8147aa92056ec69f43df2731cc529d
Instruction Fuzzy Hash: 1641ED76901228EFDB21CFA4CC88BEEB7B4FF49311F104599F949AA251DB759A80CF50

Function 10013360 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

SocketClient.Connect %s,%d, xrefs: 10013497

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: SocketClient.Connect %s,%d
API String ID: 0-4086773378
Opcode ID: 806049d0937e817d2a7edc25e8aa56914ceb32bd5803814fc0c8e8b9f4b12fda
Instruction ID: 63baf142f1b2acfd1537a39fce8e3a032f44fd155c7a3820f2eaebd6526bdc0f
Opcode Fuzzy Hash: 806049d0937e817d2a7edc25e8aa56914ceb32bd5803814fc0c8e8b9f4b12fda
Instruction Fuzzy Hash: 3CC13479804A69CBDB21DF64CC907DEB7B5FF49340F0082D9E409AA291EB749AE4CF50

Function 1001AB90 Relevance: 21.2, APIs: 14, Instructions: 202memorytimeCOMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(00000001,00000001,00000000), ref: 1001ABD3
InterlockedCompareExchange.KERNEL32(00000001,00000001,00000000), ref: 1001ABE7
InterlockedDecrement.KERNEL32(00000005), ref: 1001AC11
DeleteCriticalSection.KERNEL32(?), ref: 1001AC61
DeleteCriticalSection.KERNEL32(?), ref: 1001AC6B
HeapFree.KERNEL32(00000000,00000000,?), ref: 1001AC75
InterlockedCompareExchange.KERNEL32(00000001,00000001,00000000), ref: 1001ACEB
timeGetTime.WINMM ref: 1001AD11
timeGetTime.WINMM ref: 1001AD1F
InterlockedDecrement.KERNEL32(00000005), ref: 1001AD52
DeleteCriticalSection.KERNEL32(?), ref: 1001ADA2
DeleteCriticalSection.KERNEL32(?), ref: 1001ADAC
HeapFree.KERNEL32(?,00000000,?), ref: 1001ADB7
InterlockedCompareExchange.KERNEL32(00000001,00000001,00000000), ref: 1001ADC5

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Interlocked$CompareCriticalDeleteExchangeSection$DecrementFreeHeapTimetime
String ID:
API String ID: 575379910-0
Opcode ID: 4b2b9e06dbfc7a189fe832d31680b9342d4a4f911797ed680ce7ed66d266748b
Instruction ID: 5fcf9dceec55b2fe5c3f5871ba84e04da2ee91e5bcf3991c6e7a15184a02e640
Opcode Fuzzy Hash: 4b2b9e06dbfc7a189fe832d31680b9342d4a4f911797ed680ce7ed66d266748b
Instruction Fuzzy Hash: A9719D7190065AEFDB11CF68CC84B5AB7F8FF05311F004669E81A9F691D774E984CBA1

Function 10022849 Relevance: 19.6, APIs: 13, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,00000001,10023AED,101B7938,00000008,10023C24,?,00000001,?,101B7958,0000000C,10023BC3,?,00000001,?), ref: 10022851
_free.LIBCMT ref: 1002286A

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

_free.LIBCMT ref: 1002287D
_free.LIBCMT ref: 1002289B
_free.LIBCMT ref: 100228AD
_free.LIBCMT ref: 100228BE
_free.LIBCMT ref: 100228C9
_free.LIBCMT ref: 100228E3
EncodePointer.KERNEL32(00000000), ref: 100228EA
_free.LIBCMT ref: 100228FF
_free.LIBCMT ref: 10022915
InterlockedDecrement.KERNEL32 ref: 10022927
_free.LIBCMT ref: 10022941

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeDecrementEncodeErrorFreeHeapInterlockedLast
String ID:
API String ID: 4264854383-0
Opcode ID: 6e45babb980946f711f94ecee9eb40fee16fb67e0b8076907215f6ffe089f320
Instruction ID: da1824f0f3d6086db6776b7d0893ce00e841dd68cd6532bffb288ba0f97f575f
Opcode Fuzzy Hash: 6e45babb980946f711f94ecee9eb40fee16fb67e0b8076907215f6ffe089f320
Instruction Fuzzy Hash: 64218DBA805231ABC715EF74FCC040A37B5FB043647E1466AF900E7A7ADB399881CB41

Function 10005CA0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetLogicalProcessorInformation,?,00000000), ref: 10005CC3
GetProcAddress.KERNEL32(00000000), ref: 10005CCA
GetLastError.KERNEL32 ref: 10005CEC
_free.LIBCMT ref: 10005CF8

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

_malloc.LIBCMT ref: 10005D04
_free.LIBCMT ref: 10005D3E
GetSystemInfo.KERNEL32(?), ref: 10005D54
_perror.LIBCMT ref: 10005D79

Strings

zstd, xrefs: 10005D74
GetLogicalProcessorInformation, xrefs: 10005CB3
kernel32, xrefs: 10005CBA

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLast_free$AddressFreeHandleHeapInfoModuleProcSystem_malloc_perror
String ID: GetLogicalProcessorInformation$kernel32$zstd
API String ID: 346688108-2576447550
Opcode ID: ebf4960832639757ba6ddf85c4acd03ed6aa7b5749e8a4a28e034f0c5179f344
Instruction ID: 534da2e331fe06abe5cc17a8b34cc9891e156add97b29abc730671e8849a38bb
Opcode Fuzzy Hash: ebf4960832639757ba6ddf85c4acd03ed6aa7b5749e8a4a28e034f0c5179f344
Instruction Fuzzy Hash: 3C212976A003115FF721E7249C89A4F73E8FF84292F940527FC0587215E73AEA4587D2

Function 10015160 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72libraryloaderstringCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 10015178
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 10015190
GetProcAddress.KERNEL32(?,Process32First), ref: 100151A8
GetProcAddress.KERNEL32(?,Process32Next), ref: 100151C0
lstrcmpiA.KERNEL32(1000E8DC,?), ref: 10015243
CloseHandle.KERNEL32(00000000), ref: 10015262
FreeLibrary.KERNEL32(00000000), ref: 10015278

Strings

kernel32.dll, xrefs: 10015173
Process32Next, xrefs: 100151B4
Process32First, xrefs: 1001519C
CreateToolhelp32Snapshot, xrefs: 10015184

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$CloseFreeHandleLoadlstrcmpi
String ID: CreateToolhelp32Snapshot$Process32First$Process32Next$kernel32.dll
API String ID: 1314729832-4285911020
Opcode ID: 1cd6a8fbb2155a4b1985ca30da2e4b0a3f5bfe765f9448f08b89226ab9c6a634
Instruction ID: b23b302b637ae1edde1f60404815d2dee06a1769a5a7b90f0171de9587be8fa8
Opcode Fuzzy Hash: 1cd6a8fbb2155a4b1985ca30da2e4b0a3f5bfe765f9448f08b89226ab9c6a634
Instruction Fuzzy Hash: 4B31AE75911228DBDB61DBA4CD88BEDB7B4FB49301F0005D8E90EAA250DB75AAC4CF50

Function 10018790 Relevance: 18.2, APIs: 12, Instructions: 172memorytimeCOMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 100187D0
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 100187DD
InterlockedDecrement.KERNEL32(00000000), ref: 100187FC
DeleteCriticalSection.KERNEL32(?), ref: 10018819
HeapFree.KERNEL32(?,00000000,?), ref: 10018824
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 100188AF
timeGetTime.WINMM ref: 100188D1
timeGetTime.WINMM ref: 100188DC
InterlockedDecrement.KERNEL32(00000000), ref: 1001890A
DeleteCriticalSection.KERNEL32(-00000018), ref: 10018933
HeapFree.KERNEL32(?,00000000,00000000), ref: 10018940
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 1001894E

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Interlocked$CompareExchange$CriticalDecrementDeleteFreeHeapSectionTimetime
String ID:
API String ID: 2485412644-0
Opcode ID: f37f0bf1c14315c2a0328e2bdc40fd7b1b2d9f8162c99514ea29b688ea27d9bd
Instruction ID: ccbf6a195e50664b114f756a4c275c858458adfb65b41e8f4299d56aa6b79b38
Opcode Fuzzy Hash: f37f0bf1c14315c2a0328e2bdc40fd7b1b2d9f8162c99514ea29b688ea27d9bd
Instruction Fuzzy Hash: 3C51AC76A00615EFDB11CF68CC84B9AB7F8FF04710F204569F919AB291D734EA80CB91

Function 1000E190 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E1DD
_memset.LIBCMT ref: 1000E1FA
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,?,?,?,?,?,?,1DFFD115), ref: 1000E20F
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,\360se6\User Data\,00000000,?,?,?,?,?,?,1DFFD115), ref: 1000E258
Sleep.KERNEL32(000003E8,Default,?,?,?,?,?,?,1DFFD115), ref: 1000E273
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E298

Strings

\360se6\User Data\, xrefs: 1000E22E
360se6.exe, xrefs: 1000E1BB
bak, xrefs: 1000E247
Default, xrefs: 1000E25E

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: 360se6.exe$Default$\360se6\User Data\$bak
API String ID: 2742518391-1576209161
Opcode ID: cf5631d64cf3daff86f29a9e46f2c2e6785fc6ccd8703a21c0b353372ed7785e
Instruction ID: 701f933334c7848fb056ee3a11f22efabf5e93a761c2cecb354365ab54c774ad
Opcode Fuzzy Hash: cf5631d64cf3daff86f29a9e46f2c2e6785fc6ccd8703a21c0b353372ed7785e
Instruction Fuzzy Hash: B6316C75950258ABEB24DB60CC9ABDDB378EB14700F0001E9F5096A2D1EB787B84CF61

Function 1000E2F0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E33D
_memset.LIBCMT ref: 1000E35A
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001C,00000000,?,?,?,?,?,?,1DFFD115), ref: 1000E36F
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,\Google\Chrome\User Data\,00000000,?,?,?,?,?,?,1DFFD115), ref: 1000E3B8
Sleep.KERNEL32(000003E8,Default,?,?,?,?,?,?,1DFFD115), ref: 1000E3D3
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E3F8

Strings

\Google\Chrome\User Data\, xrefs: 1000E38E
bak, xrefs: 1000E3A7
chrome.exe, xrefs: 1000E31B
Default, xrefs: 1000E3BE

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: Default$\Google\Chrome\User Data\$bak$chrome.exe
API String ID: 2742518391-1166745273
Opcode ID: 40d655d6cc16712bff4f2fb1f87b01a0d4e762ec64db6e7df24cb74d5259b5f4
Instruction ID: fecff77be065e459785ac47ee9805b112d0841096ecda917c53accf8bb13844d
Opcode Fuzzy Hash: 40d655d6cc16712bff4f2fb1f87b01a0d4e762ec64db6e7df24cb74d5259b5f4
Instruction Fuzzy Hash: 20316A75950258EBEB24DB60CC9ABD9B378EB14700F0002E9F5096A2D1EB787B84CF65

Function 1000E4A0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E4ED
_memset.LIBCMT ref: 1000E50A
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001C,00000000,?,?,?,?,?,?,1DFFD115), ref: 1000E51F
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,\Tencent\QQBrowser\User Data\,00000000,?,?,?,?,?,?,1DFFD115), ref: 1000E568
Sleep.KERNEL32(000003E8,Default,?,?,?,?,?,?,1DFFD115), ref: 1000E583
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E5A8

Strings

QQBrowser.exe, xrefs: 1000E4CB
bak, xrefs: 1000E557
Default, xrefs: 1000E56E
\Tencent\QQBrowser\User Data\, xrefs: 1000E53E

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: Default$QQBrowser.exe$\Tencent\QQBrowser\User Data\$bak
API String ID: 2742518391-2429508344
Opcode ID: 0e54152de5e706dd32317b2883b6d9b22f54a27d1984d202d2b92858c0c27df3
Instruction ID: 303e9ac27bd1ca3b56e85ec31da4520ec1f556187fdca0bed45659d0685da91e
Opcode Fuzzy Hash: 0e54152de5e706dd32317b2883b6d9b22f54a27d1984d202d2b92858c0c27df3
Instruction Fuzzy Hash: 00316C75950258EFEB24DB60CC9ABD9B378EB14700F0001D9F5096A2D1EB787B84CF61

Function 1000E600 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E64D
_memset.LIBCMT ref: 1000E66A
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,?,?,?,?,?,?,1DFFD115), ref: 1000E67F
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,\Microsoft\,00000000,?,?,?,?,?,?,1DFFD115), ref: 1000E6C8
Sleep.KERNEL32(000003E8,Skype for Desktop,?,?,?,?,?,?,1DFFD115), ref: 1000E6E3
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E708

Strings

Skype.exe, xrefs: 1000E62B
Skype for Desktop, xrefs: 1000E6CE
\Microsoft\, xrefs: 1000E69E
bak, xrefs: 1000E6B7

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: Skype for Desktop$Skype.exe$\Microsoft\$bak
API String ID: 2742518391-3712293284
Opcode ID: 609e6d69384bd8dc0245cb6b53dc543715522320479eba0b398141e820af1bdb
Instruction ID: 5cbbd60c3ee543de6939a2953fd336e89185860d59f2e57474878281ef46e463
Opcode Fuzzy Hash: 609e6d69384bd8dc0245cb6b53dc543715522320479eba0b398141e820af1bdb
Instruction Fuzzy Hash: FB316A75950258ABEB24DB64CC9ABD9B378EB14700F0002E9F5096A2D1EB787B84CF61

Function 100138F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 70registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10013918
RegOpenKeyExA.ADVAPI32(80000001,101AFE40,00000000,00020006,?), ref: 10013944
_sprintf.LIBCMT ref: 1001397C
_strlen.LIBCMT ref: 1001398B
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 100139A9
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,?), ref: 100139D7
RegCloseKey.ADVAPI32(?), ref: 100139EA

Strings

C:\Users\Public\Documents\, xrefs: 1001396B
Windows Update, xrefs: 10013966
%s%s, xrefs: 10013970

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseFileModuleNameOpenValue_memset_sprintf_strlen
String ID: %s%s$C:\Users\Public\Documents\$Windows Update
API String ID: 2914755242-3221868064
Opcode ID: a37f16671de4bf3d8217d41773bbf0f470df6e6be3ad6b2328483c6e46eca91b
Instruction ID: 74569bc2ad6f0a8eef20b1f4c122fea453a43a38896f5d2099743f1305caba47
Opcode Fuzzy Hash: a37f16671de4bf3d8217d41773bbf0f470df6e6be3ad6b2328483c6e46eca91b
Instruction Fuzzy Hash: 08210C75900218AFEB64DBA0CC86BD97778EB18701F404599E649AA181DBB46AC4CF91

Function 10007580 Relevance: 16.7, APIs: 11, Instructions: 233COMMONLIBRARYCODE

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 1000765B
char_traits.LIBCPMTD ref: 1000767F
char_traits.LIBCPMTD ref: 100076B0
char_traits.LIBCPMTD ref: 100076DA
char_traits.LIBCPMTD ref: 10007711
char_traits.LIBCPMTD ref: 10007735

Part of subcall function 10007520: _memmove.LIBCMT ref: 1000753E

char_traits.LIBCPMTD ref: 1000776F
char_traits.LIBCPMTD ref: 1000779B

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: char_traits$_memmove
String ID:
API String ID: 4015421094-0
Opcode ID: 8a46f27c53daf1bb3a5c5b26083eeb91bd03bd6e6ef27442f332e57adb46b26b
Instruction ID: 392e569acab4bc7803cc6a5d1307a5f36e8b576372a140fd2397c7b8e5873d66
Opcode Fuzzy Hash: 8a46f27c53daf1bb3a5c5b26083eeb91bd03bd6e6ef27442f332e57adb46b26b
Instruction Fuzzy Hash: 53A1B47AA00008EFDB04DF98DD92D9E77B6FF58298B248154F9099725ADB30FE50CB90

Function 10029B73 Relevance: 16.7, APIs: 11, Instructions: 229COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 10029B81

Part of subcall function 10027FF1: __mtinitlocknum.LIBCMT ref: 10028003
Part of subcall function 10027FF1: __amsg_exit.LIBCMT ref: 1002800F
Part of subcall function 10027FF1: EnterCriticalSection.KERNEL32(?,?,10025D6D,0000000D), ref: 1002801C

@_EH4_CallFilterFunc@8.LIBCMT ref: 10029B9F
__calloc_crt.LIBCMT ref: 10029BB8
@_EH4_CallFilterFunc@8.LIBCMT ref: 10029BD3
GetStartupInfoW.KERNEL32(?,101B7C90,00000064), ref: 10029C28
__calloc_crt.LIBCMT ref: 10029C73
GetFileType.KERNEL32(00000001), ref: 10029CBA
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 10029CF3
GetStdHandle.KERNEL32(-000000F6), ref: 10029DAC
GetFileType.KERNEL32(00000000), ref: 10029DBE
InitializeCriticalSectionAndSpinCount.KERNEL32(-101BEA54,00000FA0), ref: 10029DF3

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CallCountFileFilterFunc@8InitializeSpinType__calloc_crt$EnterHandleInfoStartup__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 301580142-0
Opcode ID: 253e1a18d07f7ed5b743515052310a273316cb8cc387dfcc17b4352ffc5cb5ed
Instruction ID: 539e413c7bcea522b47ae7ad5c28c4f5532b66027edab54cb976d1ebee692ea2
Opcode Fuzzy Hash: 253e1a18d07f7ed5b743515052310a273316cb8cc387dfcc17b4352ffc5cb5ed
Instruction Fuzzy Hash: D3910671D043558FDB20CF68E88069DBBF4FF463A0B60426EE4AAAB3D1C7349842DB10

Function 10010380 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 112filestringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1001039F
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000004,00000080,00000000), ref: 10010406
GetFileSize.KERNEL32(?,00000000), ref: 10010425
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 1001044A
lstrlenA.KERNEL32(1000EEB8), ref: 10010454
lstrlenA.KERNEL32(1000EEB8,00000000,00000000), ref: 100104D6
WriteFile.KERNEL32(?,?,00000000), ref: 100104EB
CloseHandle.KERNEL32(?), ref: 100104F8

Strings

.key, xrefs: 100103D9

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$lstrlen$CloseCreateDirectoryHandlePointerSizeSystemWrite
String ID: .key
API String ID: 1674266968-343438762
Opcode ID: ffe63ab53faeb08c4fabfe3c25abd14c77d86f4555a55f109598a67c17bf6787
Instruction ID: 1c9aefebe2efcbaba9d66af4461c31df970b4e064e3fc872ccff81242f4e36e7
Opcode Fuzzy Hash: ffe63ab53faeb08c4fabfe3c25abd14c77d86f4555a55f109598a67c17bf6787
Instruction Fuzzy Hash: 7A410CB590022CDFDB29CB64DC86BD9B7B5BF48700F0085D9F649AA241D774AAC4CF90

Function 1000FE50 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 1000FE67
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 1000FE93

Strings

open, xrefs: 1000FE8C
D, xrefs: 1000FF6D

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ExecuteShell_strlen
String ID: D$open
API String ID: 4170776411-2491301029
Opcode ID: 45e0c28ea66c154113347479300cd7af64224d28f2b9312c10382868c233d3c8
Instruction ID: 2f325713f910cbc9df21e4a28366f17d85fbec6a5c87df3961e0dadf8c324f84
Opcode Fuzzy Hash: 45e0c28ea66c154113347479300cd7af64224d28f2b9312c10382868c233d3c8
Instruction Fuzzy Hash: E3418475900318EBEB20DF50CC46BEA77B8EF45740F00409CF608AB581DBB5AA85DF51

Function 1000E760 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E7AD
_memset.LIBCMT ref: 1000E7CA
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,?,?,?,?,?,?,1DFFD115), ref: 1000E7DF
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,101AF284,00000000,?,?,?,?,?,?,1DFFD115), ref: 1000E828
Sleep.KERNEL32(000003E8,SogouExplorer,?,?,?,?,?,?,1DFFD115), ref: 1000E843
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E868

Strings

SogouExplorer, xrefs: 1000E82E
SogouExplorer.exe, xrefs: 1000E78B
bak, xrefs: 1000E817

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: SogouExplorer$SogouExplorer.exe$bak
API String ID: 2742518391-538188596
Opcode ID: 387075a032f40cdf426803d7b8eb962ed2b699bce44bc087e450045890685a63
Instruction ID: cdfe1adb3a5306c7d49e930ca4d3ffe4328d7c09e084d7f548619efed37bff03
Opcode Fuzzy Hash: 387075a032f40cdf426803d7b8eb962ed2b699bce44bc087e450045890685a63
Instruction Fuzzy Hash: 14316C75950258ABEB24DBA0CC9ABD9B374EF14700F0001D9F5096A2D1EB787B84CB55

Function 10012C66 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 49sleepsynchronizationnetworkCOMMON

Download Yara Rule

APIs

SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012CB5
Sleep.KERNEL32(000001F4), ref: 10012CCA
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012CE6
CreateMutexA.KERNEL32(00000000,00000000,TMzsft xtnogaqk), ref: 10012D08
GetLastError.KERNEL32 ref: 10012D14

Part of subcall function 10022BD3: _doexit.LIBCMT ref: 10022BDD

WSAStartup.WS2_32(00000202,?), ref: 10012D34
GetVersionExA.KERNEL32(00000094), ref: 10012D4B
Sleep.KERNEL32(000F4240,00000000), ref: 10012D73

Strings

TMzsft xtnogaqk, xrefs: 10012CFF

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ServiceSleepStatus$CreateErrorLastMutexStartupVersion_doexit
String ID: TMzsft xtnogaqk
API String ID: 4049670039-2123815393
Opcode ID: a53748f86f27197abeafadced6f73c21d7a14410f93471b365f7083a90965c1a
Instruction ID: 51f78178352a1e6bbcd1a39a8c3a93efe3193938c267407751cb2d4182533f7a
Opcode Fuzzy Hash: a53748f86f27197abeafadced6f73c21d7a14410f93471b365f7083a90965c1a
Instruction Fuzzy Hash: E5216DB4504220DFE329AF60CC8EB5937B4F70430AF804298E1096A9A6D7BC6588CF12

Function 10011F60 Relevance: 15.1, APIs: 10, Instructions: 123COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10011F90
_memset.LIBCMT ref: 10011FAA
FindWindowA.USER32(101AF964,00000000), ref: 10011FBA

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$FindWindow
String ID:
API String ID: 3918834205-0
Opcode ID: 39f1a4b514bf7a49ce17fcebaa32398609855f0b54f364aa2f0891fbe461ef20
Instruction ID: d02908bb6393ccc6194f76cc94439ad83e97ec676181d408bc8d9695fa0a8030
Opcode Fuzzy Hash: 39f1a4b514bf7a49ce17fcebaa32398609855f0b54f364aa2f0891fbe461ef20
Instruction Fuzzy Hash: E44161B5901218EBEB64CBA4DC85F9D77B4FB48304F008699EA0D9F282D774AAD4CF54

Function 10006F00 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 156COMMON

Download Yara Rule

APIs

Part of subcall function 10007130: WinHttpOpen.WINHTTP(curl/7.83.1,00000000,00000000,00000000,00000000), ref: 10007197
Part of subcall function 10007130: WinHttpSetTimeouts.WINHTTP(00000000,000003E8,000003E8,000003E8,000003E8), ref: 100071BE
Part of subcall function 10007130: WinHttpConnect.WINHTTP(00000000,?,00000050,00000000), ref: 100071D6
Part of subcall function 10007130: WinHttpOpenRequest.WINHTTP(00000000,GET,?,00000000,00000000,00000000,00000000), ref: 100071FA
Part of subcall function 10007130: WinHttpSendRequest.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 10007219
Part of subcall function 10007130: WinHttpReceiveResponse.WINHTTP(00000000,00000000), ref: 1000722E
Part of subcall function 10007130: WinHttpQueryHeaders.WINHTTP(00000000,20000013,00000000,00000000,00000004,00000000), ref: 10007264
Part of subcall function 10007130: __CxxThrowException@8.LIBCMT ref: 10007272

Part of subcall function 10006250: operator!=.LIBCPMTD ref: 1000628B
Part of subcall function 10006250: operator!=.LIBCPMTD ref: 100062CD

_Func_class.LIBCPMTD ref: 10006F71
_Func_class.LIBCPMTD ref: 10006FDF

Strings

ip.ping0.cc, xrefs: 10007084
4.ipw.cn, xrefs: 10006F46
ifconfig.cc, xrefs: 10006FAE
ifconfig.me, xrefs: 1000701C

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Http$Func_classOpenRequestoperator!=$ConnectException@8HeadersQueryReceiveResponseSendThrowTimeouts
String ID: 4.ipw.cn$ifconfig.cc$ifconfig.me$ip.ping0.cc
API String ID: 2327121134-1054840108
Opcode ID: e5f02f596ccace418473e767889c4ca837b0525676b23f026339b6d6215960db
Instruction ID: 8fedc6d71d1ea5c4082eb8e8fcd3074e9b412fba7bcbbe1695d31a67eb8f4e53
Opcode Fuzzy Hash: e5f02f596ccace418473e767889c4ca837b0525676b23f026339b6d6215960db
Instruction Fuzzy Hash: 2E513D75D00508DBDB18DFA8CC52ADDB7B6FF4C3A0F548129E41A6B295EB306A49CF60

Function 10013E90 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 150libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 10013EBF
GetProcAddress.KERNEL32(?,IsBadReadPtr), ref: 10013ED1
LoadLibraryA.KERNEL32(?), ref: 10013F25
FreeLibrary.KERNEL32(00000000), ref: 10014063

Strings

IsBadReadPtr, xrefs: 10013EC8
kernel32.dll, xrefs: 10013EBA

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Library$Load$AddressFreeProc
String ID: IsBadReadPtr$kernel32.dll
API String ID: 2632591731-2271619998
Opcode ID: b8cf5a7d21cec9c91bc597fb19d05e0d91973cb50290725d0d54b057ef2bedf3
Instruction ID: 4d98165a6a2f5fd888ffb7798c0831731eea4b449ce7d88afba1872c43b950e1
Opcode Fuzzy Hash: b8cf5a7d21cec9c91bc597fb19d05e0d91973cb50290725d0d54b057ef2bedf3
Instruction Fuzzy Hash: 2F61B178A00209EFDB04CF95C484BAEBBB1FF48314F258599E915AB361C735AA85DF90

Function 1000F420 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 1000F44B
_malloc.LIBCMT ref: 1000F473
_memmove.LIBCMT ref: 1000F496

Strings

D, xrefs: 1000F551

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _malloc_memmove_strlen
String ID: D
API String ID: 3238260300-2746444292
Opcode ID: 6855c12a7bdc6e0bd8773f4745c8c759726946dada61b8ef62cf01ab51cda593
Instruction ID: 6d557a2bb59ac2ae05f88cec7faa246fa2e5727cbdb9c8dfb4b7bdd6368fabdf
Opcode Fuzzy Hash: 6855c12a7bdc6e0bd8773f4745c8c759726946dada61b8ef62cf01ab51cda593
Instruction Fuzzy Hash: 163173B5D00218EBDB64CF60DC45BEB7378EB58345F404598E60DAA241EBB6AAC4CF91

Function 100157F0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 101libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,1DFFD115), ref: 10015828
GetProcAddress.KERNEL32(?,OpenInputDesktop), ref: 1001587D
GetProcAddress.KERNEL32(?,OpenDesktopA), ref: 1001588F
GetProcAddress.KERNEL32(?,CloseDesktop), ref: 100158A1

Part of subcall function 10015950: LoadLibraryA.KERNEL32(user32.dll,1DFFD115,?,?,?,00000000,10023340,101B6E88,000000FE,?,100158FA,00000000), ref: 1001598B
Part of subcall function 10015950: GetProcAddress.KERNEL32(?,GetThreadDesktop), ref: 100159A3
Part of subcall function 10015950: GetProcAddress.KERNEL32(?,GetUserObjectInformationA), ref: 100159BB
Part of subcall function 10015950: GetProcAddress.KERNEL32(?,SetThreadDesktop), ref: 100159D3
Part of subcall function 10015950: GetProcAddress.KERNEL32(?,CloseDesktop), ref: 100159EB
Part of subcall function 10015950: LoadLibraryA.KERNEL32(kernel32.dll,?,?,?,00000000,10023340,101B6E88,000000FE,?,100158FA,00000000), ref: 100159FC
Part of subcall function 10015950: GetProcAddress.KERNEL32(?,GetCurrentThreadId), ref: 10015A14

Strings

user32.dll, xrefs: 10015823
CloseDesktop, xrefs: 10015898
OpenDesktopA, xrefs: 10015886
OpenInputDesktop, xrefs: 10015875, 10015878

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseDesktop$OpenDesktopA$OpenInputDesktop$user32.dll
API String ID: 2238633743-3711086354
Opcode ID: 1873b1d038e82ffe73c977c033c60f3efe240073f85bcd7195dda5366d5656d8
Instruction ID: 34810388ce7dedadcc66fe602c4080af1544b897567115cb541a18f1db2ea245
Opcode Fuzzy Hash: 1873b1d038e82ffe73c977c033c60f3efe240073f85bcd7195dda5366d5656d8
Instruction Fuzzy Hash: 16416975D08388EEEB11CBE4D888BDEBFB5EF09315F140119E405BA281CBBA5944CB65

Function 1001C3A0 Relevance: 13.6, APIs: 9, Instructions: 149memorynetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 1001B6A0: HeapAlloc.KERNEL32(?,00000000,?,?,?,?,?,?,1001D1A7,?,1001C0BB,?,?,?,?,1001EAD1), ref: 1001B6CA

EnterCriticalSection.KERNEL32(00000054,?,00000000,1DFFD115,?,00000000), ref: 1001C3F8

Part of subcall function 1001BD70: timeGetTime.WINMM ref: 1001BD78
Part of subcall function 1001BD70: _memmove.LIBCMT ref: 1001BDDC

GetLastError.KERNEL32 ref: 1001C470
CreateIoCompletionPort.KERNEL32(?,?,00000000,00000000), ref: 1001C44A

Part of subcall function 100172C0: __CxxThrowException@8.LIBCMT ref: 100172D2
Part of subcall function 100172C0: EnterCriticalSection.KERNEL32(00000000,1DFFD115,00000000,00000098,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005), ref: 10017312
Part of subcall function 100172C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005,?,100168C9,00000400,00000400), ref: 1001737B

connect.WS2_32(?,?,0000001C), ref: 1001C497
CreateIoCompletionPort.KERNEL32(?,?,00000000,00000000), ref: 1001C4CC
HeapFree.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 1001C552
LeaveCriticalSection.KERNEL32(00000054), ref: 1001C559

Part of subcall function 1001A870: ioctlsocket.WS2_32(?,8004667E,?), ref: 1001A87F

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CompletionCreateEnterHeapLeavePort$AllocErrorException@8FreeLastThrowTime_memmoveconnectioctlsockettime
String ID:
API String ID: 577898059-0
Opcode ID: fb6ef4b531d651df34b6af81ca114c1cb161ed1b6c4b7f8e2a56bc7a7bb065d0
Instruction ID: 13f5607a006f5134b6e7d624e793b95b5dada5aad690ad180316847aeaa3252a
Opcode Fuzzy Hash: fb6ef4b531d651df34b6af81ca114c1cb161ed1b6c4b7f8e2a56bc7a7bb065d0
Instruction Fuzzy Hash: CA518F75600208AFDB11DF64CC85FAA77AAFF44350F144428FD09EE2A1DB71E890DB60

Function 1001E560 Relevance: 13.6, APIs: 9, Instructions: 139COMMON

Download Yara Rule

APIs

_memmove_s.LIBCMT ref: 1001E5C0

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memmove_s
String ID:
API String ID: 800865076-0
Opcode ID: bfd165e00e761db38f2bdf525350d73678aeff4c921f7e730ca0ddaf86c9b7a3
Instruction ID: e53b5beb10ba7e09faa63e27da374d48c55a1d98f715c35b0f5f6325fba29714
Opcode Fuzzy Hash: bfd165e00e761db38f2bdf525350d73678aeff4c921f7e730ca0ddaf86c9b7a3
Instruction Fuzzy Hash: 59418D36200655AFD711DF68C888B9EF7E9FF44364F10402AF9098B291DB75EDA08BA0

Function 1000EDC0 Relevance: 13.6, APIs: 9, Instructions: 80stringtimeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000EDDF
GetForegroundWindow.USER32 ref: 1000EDE7
GetWindowTextA.USER32(00000000,101BC5F8,00000400), ref: 1000EE02
_memset.LIBCMT ref: 1000EE27
lstrlenA.KERNEL32(101BC5F8), ref: 1000EE47
GetLocalTime.KERNEL32(?), ref: 1000EE5C
wsprintfA.USER32 ref: 1000EEA3
_memset.LIBCMT ref: 1000EEC9
_memset.LIBCMT ref: 1000EEDD

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$Window$ForegroundLocalTextTimelstrlenwsprintf
String ID:
API String ID: 2818073195-0
Opcode ID: 75adef7124855e83a17f00d692abf37ea0045c21f2baa1bf399519b3b5abe7e2
Instruction ID: 03485689b72bf285f166b7c4cb3250636e2bcbf9ff048aaab2fc2e49669969a2
Opcode Fuzzy Hash: 75adef7124855e83a17f00d692abf37ea0045c21f2baa1bf399519b3b5abe7e2
Instruction Fuzzy Hash: 753168F5A0012D9BD734DB54CD85BE973B8EB44704F0041A8F7097A191EB787AC5CB69

Function 100298C9 Relevance: 13.6, APIs: 9, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

__ioinit.LIBCMT ref: 100298CC

Part of subcall function 10029B38: InitOnceExecuteOnce.KERNEL32(101BE634,10029B73,00000000,00000000,1003508B,101B7FB0,0000000C,10005D7E,zstd), ref: 10029B46

__get_osfhandle.LIBCMT ref: 100298E0
__get_osfhandle.LIBCMT ref: 1002990B
__get_osfhandle.LIBCMT ref: 10029914
__get_osfhandle.LIBCMT ref: 10029920
CloseHandle.KERNEL32(00000000,?,?,?,10029874,?,101B7C48,00000010,1002399B,00000000,?,?,?), ref: 10029927
GetLastError.KERNEL32(?,10029874,?,101B7C48,00000010,1002399B,00000000,?,?,?), ref: 10029931
__free_osfhnd.LIBCMT ref: 1002993E
__dosmaperr.LIBCMT ref: 10029960

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: __get_osfhandle$Once$CloseErrorExecuteHandleInitLast__dosmaperr__free_osfhnd__ioinit
String ID:
API String ID: 974577687-0
Opcode ID: aeb50e6623f9612fbfea4720a11a12ee66fd82b979432c8a2b3a73e6567c2db6
Instruction ID: 534cc79353f924f132b53f2d2c247f43b701ca5fdf2037831c5180732be56f73
Opcode Fuzzy Hash: aeb50e6623f9612fbfea4720a11a12ee66fd82b979432c8a2b3a73e6567c2db6
Instruction Fuzzy Hash: 491148326042A41AD261D63C798976E36CCDF42BF4FE6079DFD2EDB0D2EA24ACC18150

Function 10012E80 Relevance: 13.6, APIs: 9, Instructions: 62sleepCOMMON

Download Yara Rule

APIs

SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012EC6
Sleep.KERNEL32(000001F4), ref: 10012ED1
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012F10
Sleep.KERNEL32(000001F4), ref: 10012F1B
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012F5A
Sleep.KERNEL32(000001F4), ref: 10012F65
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012FA0
Sleep.KERNEL32(000001F4), ref: 10012FAB
SetServiceStatus.ADVAPI32(?,101BD9EC), ref: 10012FD1

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ServiceStatus$Sleep
String ID:
API String ID: 4108286180-0
Opcode ID: 3093577f81a1bfef1be0275f51949fcebcef33dae7894a088e6bc179c9b4736d
Instruction ID: 2eb2aa5b39fb85c5a3343167d6ecbcddaa6ef8ab947596cac2bc6c57621dfea1
Opcode Fuzzy Hash: 3093577f81a1bfef1be0275f51949fcebcef33dae7894a088e6bc179c9b4736d
Instruction Fuzzy Hash: 1C31F7B4104221DFE31DFF60CC98B957BB8F708308F804368E5095BAA5E7BD6598DB56

Function 10011580 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100115CC
GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 100115E0
CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 10011647
GetFileSize.KERNEL32(000000FF,00000000), ref: 10011669

Part of subcall function 1001EF9C: _malloc.LIBCMT ref: 1001EFB4

ReadFile.KERNEL32(000000FF,?,00000000,00000000,00000000), ref: 100116B4
CloseHandle.KERNEL32(000000FF), ref: 10011771

Strings

.key, xrefs: 1001161A

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateDirectoryHandleReadSizeSystem_malloc_memset
String ID: .key
API String ID: 1189190961-343438762
Opcode ID: e3cca6749972bda63ac77e56a70e5a53b244fe33762708ed0120600f45f4504f
Instruction ID: 3d4300d2710fecc02f3fab15f3df85ad30c21ba86dc6f63d814e5d622af92f7c
Opcode Fuzzy Hash: e3cca6749972bda63ac77e56a70e5a53b244fe33762708ed0120600f45f4504f
Instruction Fuzzy Hash: 2551EAB5D0022C9BDB69CB64DC82BD9B7B4AB58300F0045D8E64DAB281DB74AFC4CF91

Function 10011E10 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 59stringnetworkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10011E5F
_memset.LIBCMT ref: 10011E71

Part of subcall function 100153E0: _memset.LIBCMT ref: 10015432
Part of subcall function 100153E0: _memset.LIBCMT ref: 10015448
Part of subcall function 100153E0: _memset.LIBCMT ref: 1001545E
Part of subcall function 100153E0: LoadLibraryA.KERNEL32(ADVAPI32.dll), ref: 1001546B

lstrlenA.KERNEL32(?), ref: 10011EA4
gethostname.WS2_32(?,10012B7F), ref: 10011EB6
lstrlenA.KERNEL32(?), ref: 10011EC0

Strings

SYSTEM\Setup, xrefs: 10011E23
HostName, xrefs: 10011E87

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$lstrlen$LibraryLoadgethostname
String ID: HostName$SYSTEM\Setup
API String ID: 3877737349-3163474852
Opcode ID: 3c57c7ea14b851b5edd5a4aedf8599d14a790c5ab8a68f19adf55a60d148b559
Instruction ID: 6f4c2ddfbcec68ea414a63b34556a325c0cca03fb215b7fd9fe6e58d22cc8f59
Opcode Fuzzy Hash: 3c57c7ea14b851b5edd5a4aedf8599d14a790c5ab8a68f19adf55a60d148b559
Instruction Fuzzy Hash: B41133B9A40218EBD714DF94DC81FAA77B8EB88600F00815CFA0D5B281D635EB41CB94

Function 1001E990 Relevance: 12.2, APIs: 8, Instructions: 179threadnetworkCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000040,?,00000001,000000FF), ref: 1001EA1C
CloseHandle.KERNEL32(?,?,00000001,000000FF), ref: 1001EA33

Part of subcall function 1001A570: PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,1001E9C8,?), ref: 1001A57C

GetCurrentThreadId.KERNEL32 ref: 1001EA8E
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 1001EAB3
GetLastError.KERNEL32(?,?,?), ref: 1001EAEF
WSAGetOverlappedResult.WS2_32(00000000,?,?,00000000,?), ref: 1001EB11
WSAGetLastError.WS2_32 ref: 1001EB1B
GetCurrentThreadId.KERNEL32 ref: 1001EB41

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CompletionCurrentErrorLastQueuedStatusThread$CloseHandleMultipleObjectsOverlappedPostResultWait
String ID:
API String ID: 1776276126-0
Opcode ID: b262b485ae6c8d05e2cc6277a80d9fb5ca37b47e31c1310d56df349767435e47
Instruction ID: 66b5417a272267f179c33290e45a533a74909bc530ce5bb48fcf6268d69e9a86
Opcode Fuzzy Hash: b262b485ae6c8d05e2cc6277a80d9fb5ca37b47e31c1310d56df349767435e47
Instruction Fuzzy Hash: A8519275900219AFDB11DFA8C8C5AAEBBB9FF48350F504569FA169B211DB30FE40CB91

Function 10019E20 Relevance: 12.1, APIs: 8, Instructions: 133networkCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 10019EDE
getaddrinfo.WS2_32(?,00000000,00000C00,00000000), ref: 10019F03
_free.LIBCMT ref: 10019F1C
WSASetLastError.WS2_32(00000000,?,?,?,?,?,?,?,?), ref: 10019F29
_memmove.LIBCMT ref: 10019F6D
freeaddrinfo.WS2_32(00000000,?,?,?,?,?,?,?,?), ref: 10019F7B
htons.WS2_32(?), ref: 10019F88
WSASetLastError.WS2_32(00002AF9,?,?,?,?,?,?,?,?), ref: 10019FAA

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free_memcpy_s_memmovefreeaddrinfogetaddrinfohtons
String ID:
API String ID: 1080299913-0
Opcode ID: 38c9a16045676048a6fe288dd4f45fcc865443c53d635113eaf2434cff52915d
Instruction ID: 09d37e572ec1318aebb19466cc5ed3869c43ff4f8d51cd655d2081561f1130ca
Opcode Fuzzy Hash: 38c9a16045676048a6fe288dd4f45fcc865443c53d635113eaf2434cff52915d
Instruction Fuzzy Hash: FF416171A00229ABDB20CF64CC85BAAB7B4FF55240F4181A9F94DDB111EB719EC9CB90

Function 1000F2B0 Relevance: 12.1, APIs: 8, Instructions: 62processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 1000F2C3
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1000F2DD
Process32First.KERNEL32(000000FF,00000128), ref: 1000F30E
OpenProcess.KERNEL32(00000001,00000000,00000000,000000FF,00000128,00000002,00000000), ref: 1000F347
TerminateProcess.KERNEL32(00000000,00000000), ref: 1000F367
CloseHandle.KERNEL32(00000000), ref: 1000F374
Process32Next.KERNEL32(000000FF,00000128), ref: 1000F388
CloseHandle.KERNEL32(000000FF,000000FF,00000128,00000002,00000000), ref: 1000F39C

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleProcess32$CreateCurrentFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 477742948-0
Opcode ID: 0e5e03193292138b7c311efabc93a15d5f194d092c39daaf66340cd660e8982b
Instruction ID: d41c4376eefb6253570006433f593cac2f32630ea850329660a4d75d5b4afe3c
Opcode Fuzzy Hash: 0e5e03193292138b7c311efabc93a15d5f194d092c39daaf66340cd660e8982b
Instruction Fuzzy Hash: 4921C370900228DFDB25EB60CD89BEDB7B4FB48750F1045D9E609AB290D774AB80DF50

Function 10002740 Relevance: 12.1, APIs: 8, Instructions: 56COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10002756

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

DeleteCriticalSection.KERNEL32(?), ref: 10002778
_free.LIBCMT ref: 1000277F
DeleteCriticalSection.KERNEL32(?,00000000), ref: 100027B2
_free.LIBCMT ref: 100027B9
_free.LIBCMT ref: 100027C2
_free.LIBCMT ref: 100027D1
_free.LIBCMT ref: 100027D7

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$CriticalDeleteSection$ErrorFreeHeapLast
String ID:
API String ID: 229044151-0
Opcode ID: 829fe4cc710feb83a16dcdc532ce873229ccf800336d69de1fb585340b12b445
Instruction ID: 16a73a784ab602da626493d70980f9eae99143d6bc0915a138f34a67110a4392
Opcode Fuzzy Hash: 829fe4cc710feb83a16dcdc532ce873229ccf800336d69de1fb585340b12b445
Instruction Fuzzy Hash: 560108B66007105BE612EF209C82A6B73AAEF80580F54442CF94A47207DB35F985C7E2

Function 10018DD0 Relevance: 10.7, APIs: 7, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,?,?,00000000,1DFFD115), ref: 10018E77
HeapFree.KERNEL32(?,00000000,?), ref: 10018E84
_free.LIBCMT ref: 10018F18
HeapDestroy.KERNEL32(?), ref: 10018F8E
HeapCreate.KERNEL32(?,?,?), ref: 10018F9F
HeapDestroy.KERNEL32(00000000), ref: 10018FAC
HeapCreate.KERNEL32(?,?,?), ref: 10018FB7

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Heap$CreateDestroy$CriticalDeleteFreeSection_free
String ID:
API String ID: 1764084169-0
Opcode ID: c3f88b120b0d50cfdc866e451160b25d59f4e1943c12536e881b99dc529dd748
Instruction ID: 8cea0ffc507937525084062c29ae185d00e44530d60b22a0429b01e019052092
Opcode Fuzzy Hash: c3f88b120b0d50cfdc866e451160b25d59f4e1943c12536e881b99dc529dd748
Instruction Fuzzy Hash: 2B5148B1A00606EFDB05CFA4C881B9ABBF5FF08304F044569E909AF651DB35EA55CBA0

Function 100145C0 Relevance: 10.7, APIs: 7, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd34e201d1059666f78fc474e3004731cd6cb8f970c98b5a1a8be2d127c39e0
Instruction ID: df39f66d2745d17a7fe87e744aa0e03a21574858425a6f03c3f21479afaab56c
Opcode Fuzzy Hash: bfd34e201d1059666f78fc474e3004731cd6cb8f970c98b5a1a8be2d127c39e0
Instruction Fuzzy Hash: 536109B9E00209EFDB44CF94C884B9EB7B5FF48304F218598E905AB395D775EA81DB90

Function 10002070 Relevance: 10.6, APIs: 7, Instructions: 114COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 1000208B
WakeAllConditionVariable.KERNEL32(?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 100020AD
LeaveCriticalSection.KERNEL32(?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 100020B4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 100020EC
SleepConditionVariableCS.KERNEL32(?,?,000000FF,?,?,?,100025EE,?,?,?,10002B57,?), ref: 1000210D
LeaveCriticalSection.KERNEL32(?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 10002116
_free.LIBCMT ref: 1000213E

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveVariable$SleepWake_free
String ID:
API String ID: 1710734047-0
Opcode ID: e61bd854db23e898daa16de29f131cc90b3ab22f0d1ab1bd32c91fa0d06ec401
Instruction ID: 05dc04eb116ff6e28942813317816f3c30ed5ba661128168b5cad8891ce245dc
Opcode Fuzzy Hash: e61bd854db23e898daa16de29f131cc90b3ab22f0d1ab1bd32c91fa0d06ec401
Instruction Fuzzy Hash: 8D4190B1601B069FE724CF64C884796B7F4FF14390F51462AE91ACB695D730F894CBA1

Function 1001A6F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,?), ref: 1001A70C
GetProcAddress.KERNEL32(00000000,CreateFileTransactedA), ref: 1001A721
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?), ref: 1001A76A
GetFileSize.KERNEL32(?,?), ref: 1001A78C

Strings

CreateFileTransactedA, xrefs: 1001A71B
kernel32.dll, xrefs: 1001A707

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$AddressCreateHandleModuleProcSize
String ID: CreateFileTransactedA$kernel32.dll
API String ID: 381258031-3827029016
Opcode ID: 2b602c5be5b8ceff7d4341a465a72c2674a25abf06f1222532ee79990a52c5db
Instruction ID: 3fd96c11bbd7488a8a418e2e25c194671cc8f240b4c6ee697fb62349ff201565
Opcode Fuzzy Hash: 2b602c5be5b8ceff7d4341a465a72c2674a25abf06f1222532ee79990a52c5db
Instruction Fuzzy Hash: 0431AD34744205BBEB31CA649C45B9977F8EF02B61F20425AFE18EE1D0D7B1EAD0D654

Function 1001A8B0 Relevance: 10.6, APIs: 7, Instructions: 96COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000001,0000FFFF,000000FB,00000001,00000004), ref: 1001A8E5
setsockopt.WS2_32(00000001,0000FFFF,00000004,00000000,00000004), ref: 1001A8F7
setsockopt.WS2_32(00000001,0000FFFF,000000FB,00000000,00000004), ref: 1001A91E
setsockopt.WS2_32(00000001,0000FFFF,00000004,00000000,00000004), ref: 1001A930

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 7b82cd8a322e7eafe5a33a62bfc76d56978321d665ea09961d1f1c17fe74bef7
Instruction ID: 2534b507c7e92884fcc3b13e06d001a7cc937f1284d80b897d24f64fcb9b5863
Opcode Fuzzy Hash: 7b82cd8a322e7eafe5a33a62bfc76d56978321d665ea09961d1f1c17fe74bef7
Instruction Fuzzy Hash: 2521FBB674421E7AEB10C6959C81FA9775CDF45771F200272FF18DB2C1D971994887A0

Function 1001E880 Relevance: 10.6, APIs: 7, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000,1DFFD115,?,00000000,?,?,00000000,10035FA8,000000FF,?,1001DB19,00000000,?,?,1001D937,?), ref: 1001E8BC
EnterCriticalSection.KERNEL32(00000000,1DFFD115,?,00000000,?,?,00000000,10035FA8,000000FF,?,1001DB19,00000000,?,?,1001D937,?), ref: 1001E8F8
SetLastError.KERNEL32(00000000,?,1001DB19,00000000,?,?,1001D937,?,00000000,?,?,?,?,1001EB3A,?,?), ref: 1001E90D
LeaveCriticalSection.KERNEL32(?,?,1001DB19,00000000,?,?,1001D937,?,00000000,?,?,?,?,1001EB3A,?,?), ref: 1001E92C
InterlockedDecrement.KERNEL32(00000028), ref: 1001E948
HeapFree.KERNEL32(?,00000000,00000000,00000000,?,1001DB19,00000000,?,?,1001D937,?,00000000,?,?,?), ref: 1001E969

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalErrorLastSection$DecrementEnterFreeHeapInterlockedLeave
String ID:
API String ID: 2534375417-0
Opcode ID: 8a373b9e699bbe36eec3ad261a269d3c2d471c0edf0be97ca4a8e9b207caec58
Instruction ID: c19bc2cfbfcf6eb32c943866d2ea1f3cbf7c2381cbd68fa049da8d29006db6f8
Opcode Fuzzy Hash: 8a373b9e699bbe36eec3ad261a269d3c2d471c0edf0be97ca4a8e9b207caec58
Instruction Fuzzy Hash: 46315A32600645AFDB61CF64CC88B9ABBF9FF48361F04452AF91ADB660DB31E854CB50

Function 100137C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100137E8
_strcat.LIBCMT ref: 10013887
RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,000F003F,?), ref: 100138BD
RegCloseKey.ADVAPI32(?), ref: 100138CE

Strings

SYSTEM\CurrentControlSet\Services\, xrefs: 1001387C, 1001387F
TMzsft xtnogaqk, xrefs: 1001388F

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseOpen_memset_strcat
String ID: SYSTEM\CurrentControlSet\Services\$TMzsft xtnogaqk
API String ID: 3167732647-1014003165
Opcode ID: 2662b6faaf2599209bb8ca6bb403307948ab9ad392b1d5476d8a6161b5a9aa7b
Instruction ID: 22143534158840905b67e581eba63ca17ab0457cd731155eff119560de7604f3
Opcode Fuzzy Hash: 2662b6faaf2599209bb8ca6bb403307948ab9ad392b1d5476d8a6161b5a9aa7b
Instruction Fuzzy Hash: AD41D020D0C2C9D9EB02C7A888097DEBFB55B26749F0840D8D5887A282D7FE5758C7B6

Function 10003320 Relevance: 10.6, APIs: 7, Instructions: 80COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 10003330

Part of subcall function 10024166: __calloc_impl.LIBCMT ref: 10024179

InitializeCriticalSection.KERNEL32(00000018,00000000), ref: 1000335C
InitializeConditionVariable.KERNEL32(00000030), ref: 1000336C
InitializeConditionVariable.KERNEL32(00000034), ref: 10003372
__beginthreadex.LIBCMT ref: 100033A8

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Initialize$ConditionVariable$CriticalSection__beginthreadex__calloc_impl_calloc
String ID:
API String ID: 4275094566-0
Opcode ID: 1c90a2da0a09f1423271f63d7b8369d043ae484d91931262826aadb9d33fa527
Instruction ID: d63cbc47a989e61f8d5764840e3dc6a2f22de4f4aba891b4dc0ad6eac0f10f79
Opcode Fuzzy Hash: 1c90a2da0a09f1423271f63d7b8369d043ae484d91931262826aadb9d33fa527
Instruction Fuzzy Hash: 582192B660071AAFE711DF95EC84B97B7ECFB40350F504029EA08C7541EBB5B6598BA0

Function 100105B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 100105D3
_memset.LIBCMT ref: 100105FB
GetTempPathA.KERNEL32(00000104,?), ref: 1001060F

Strings

D, xrefs: 1001067A

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: PathTemp_memset_strrchr
String ID: D
API String ID: 3269299267-2746444292
Opcode ID: 65dff33f197481420d75febd2944a67fcb56e30f99d0bf04b3eaf0f89ed5e44e
Instruction ID: 94703a5b4a1e95a47fdd501beecf67a154b79f006fe411b9632ef845b5e6f6b1
Opcode Fuzzy Hash: 65dff33f197481420d75febd2944a67fcb56e30f99d0bf04b3eaf0f89ed5e44e
Instruction Fuzzy Hash: 2F218BB9D00218EBDB24DB50DC45BDA7378EB58305F444498F54D9E281EBB5ABC4CFA0

Function 10011FE0 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 10012026
_memset.LIBCMT ref: 10012042
GetWindowTextA.USER32(00000000,00000000,00000040), ref: 10012061
_strncpy.LIBCMT ref: 100120B5
_strncat.LIBCMT ref: 100120CA
GetWindow.USER32(00000000,00000002), ref: 100120EA
GetClassNameA.USER32(00000000,00000000,00000080), ref: 10012109

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Window$ClassNameText_memset_strncat_strncmp_strncpy
String ID:
API String ID: 3228922498-0
Opcode ID: 9b23a114edeb7ee68d8fe2a349bbd8718838ecac6987a0b2f96da892dcbfe533
Instruction ID: 88a1f005e2bcef45723d5467eb62586ba9483bdea00c3cbe37d0c3424b11e526
Opcode Fuzzy Hash: 9b23a114edeb7ee68d8fe2a349bbd8718838ecac6987a0b2f96da892dcbfe533
Instruction Fuzzy Hash: FF215CB5901219DBEB60CBA4CC85F9D77B4FB48304F108698EA0DAB182D774AAC4CF64

Function 10011B40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 10011B57
_memset.LIBCMT ref: 10011B99
Process32First.KERNEL32(000000FF,00000128), ref: 10011BB9
Process32Next.KERNEL32(000000FF,00000128), ref: 10011BF4
CloseHandle.KERNEL32(000000FF,000000FF,00000128,?,00000002,00000000), ref: 10011C04

Strings

WeChat.exe, xrefs: 10011BC2

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
String ID: WeChat.exe
API String ID: 2526126748-2865290047
Opcode ID: 39a29232ca075c726fda8ef9c875e25e6892fe3647a628bb6ce209c239f2d104
Instruction ID: de72c953fd82724fd2484dccbf463224b55a824a9cf3277821e8854a41679b26
Opcode Fuzzy Hash: 39a29232ca075c726fda8ef9c875e25e6892fe3647a628bb6ce209c239f2d104
Instruction Fuzzy Hash: 49212E759002199BDB64DBA0CD85BEDB3B4EF48301F1001E8E50DAB291EB74AE85CF90

Function 10001220 Relevance: 10.6, APIs: 7, Instructions: 58COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10001236

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

_free.LIBCMT ref: 10001275
_free.LIBCMT ref: 1000128D
_free.LIBCMT ref: 100012A8
DeleteCriticalSection.KERNEL32(8415FF68,?), ref: 100012C6
_free.LIBCMT ref: 100012CD
_free.LIBCMT ref: 100012D6

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$CriticalDeleteErrorFreeHeapLastSection
String ID:
API String ID: 2933665753-0
Opcode ID: 2361ccc68d43a71e868931a2596d9ac44d138912533a7e2e7945e83494bb7265
Instruction ID: aaf221896ecc1e09f6eeffe9c750e8d10df9c6965350f993c9d4ceeb60f37a7f
Opcode Fuzzy Hash: 2361ccc68d43a71e868931a2596d9ac44d138912533a7e2e7945e83494bb7265
Instruction Fuzzy Hash: F81104B1800B455BE721EB61F8817A773E1FF00250F948439E55B4220AD731B9E8CBA2

Function 1000F630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54processsynchronizationCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000F648
CreateProcessA.KERNEL32(00000000,1000F402,00000000,00000000,00000001,08000020,00000000,00000000,00000044,00000000), ref: 1000F686
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1000F696
CloseHandle.KERNEL32(00000000), ref: 1000F6A0
CloseHandle.KERNEL32(?), ref: 1000F6AA

Strings

D, xrefs: 1000F650

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateObjectProcessSingleWait_memset
String ID: D
API String ID: 3422168109-2746444292
Opcode ID: 6aa504984eda8c7b5acce5dc33e2805d2fb05eccdb010cb75b9960ebb1134bfa
Instruction ID: cb5451c512472725f5a4df07bad1c41973f3ae078433712cb33367d9263f6d2b
Opcode Fuzzy Hash: 6aa504984eda8c7b5acce5dc33e2805d2fb05eccdb010cb75b9960ebb1134bfa
Instruction Fuzzy Hash: CA113071A00248EFEB24DFE4DC46BAD7BB8EF48700F10421DF619AE2D4DBB5A9448B54

Function 10025DD7 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 10025DD7

Part of subcall function 10022A20: EncodePointer.KERNEL32(00000000,00000001,10025DDC,10023A64,101B7938,00000008,10023C24,?,00000001,?,101B7958,0000000C,10023BC3,?,00000001,?), ref: 10022A23
Part of subcall function 10022A20: __initp_misc_winsig.LIBCMT ref: 10022A44

__mtinitlocks.LIBCMT ref: 10025DDC

Part of subcall function 10028120: InitializeCriticalSectionAndSpinCount.KERNEL32(101BB940,00000FA0,?,00000001,10025DE1,10023A64,101B7938,00000008,10023C24,?,00000001,?,101B7958,0000000C,10023BC3,?), ref: 1002813E

__mtterm.LIBCMT ref: 10025DE5

Part of subcall function 10025E4D: DeleteCriticalSection.KERNEL32(?,?,?,?,10023B29,10023B0F,101B7938,00000008,10023C24,?,00000001,?,101B7958,0000000C,10023BC3,?), ref: 1002803C
Part of subcall function 10025E4D: _free.LIBCMT ref: 10028043
Part of subcall function 10025E4D: DeleteCriticalSection.KERNEL32(101BB940,?,?,10023B29,10023B0F,101B7938,00000008,10023C24,?,00000001,?,101B7958,0000000C,10023BC3,?,00000001), ref: 10028065

__calloc_crt.LIBCMT ref: 10025E0A
__initptd.LIBCMT ref: 10025E2C
GetCurrentThreadId.KERNEL32 ref: 10025E33

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Delete$CountCurrentEncodeInitializePointerSpinThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 757573777-0
Opcode ID: 5305d30ccda45478ab966d2ea542fe534dde36908a179f48a9bcc1fc7b76229d
Instruction ID: 58ec3693b2f49863f7a8b2837ed69b9cb9c38201cd79a3fee43b5d8399986583
Opcode Fuzzy Hash: 5305d30ccda45478ab966d2ea542fe534dde36908a179f48a9bcc1fc7b76229d
Instruction Fuzzy Hash: 31F0243A1093225AE779E7383C0724B37C8DF02272BA2461DF5A6C84D5FF72A9424658

Function 10023833 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,100238FC,?), ref: 1002384D
GetProcAddress.KERNEL32(00000000), ref: 10023854
EncodePointer.KERNEL32(00000000), ref: 10023860
DecodePointer.KERNEL32(00000001,100238FC,?), ref: 1002387D

Strings

combase.dll, xrefs: 10023848
RoInitialize, xrefs: 1002383C

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 8a1acb73c590863b49b739fc2dd12772df6c41613cc91e6a01cbeba2b542fb8d
Instruction ID: 1191a88cc48d34fd9790489e5a8225d39aecb065cdaa85872b62c02564ac10b9
Opcode Fuzzy Hash: 8a1acb73c590863b49b739fc2dd12772df6c41613cc91e6a01cbeba2b542fb8d
Instruction Fuzzy Hash: 05E09A70240322AFEB247F30CDCEB4536B5F708702F908120F002DD0A0EBB88440CA52

Function 10023908 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,10023822), ref: 10023922
GetProcAddress.KERNEL32(00000000), ref: 10023929
EncodePointer.KERNEL32(00000000), ref: 10023934
DecodePointer.KERNEL32(10023822), ref: 1002394F

Strings

combase.dll, xrefs: 1002391D
RoUninitialize, xrefs: 10023911

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 4920fa68460fbff39facb883f69098808d4252d96aa017c2b93aa0396bf9b739
Instruction ID: 1f88319e3d8987e8e0ffa380cb3ac5eb2f489078ab51b11df1e274af2f38050d
Opcode Fuzzy Hash: 4920fa68460fbff39facb883f69098808d4252d96aa017c2b93aa0396bf9b739
Instruction Fuzzy Hash: 06E04678600221AFEBA56F20CC8DB463BB5F715301F918620F105D80A5EBFA9580CF92

Function 10016140 Relevance: 9.2, APIs: 6, Instructions: 151COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 100161B4

Part of subcall function 10020474: __FF_MSGBANNER.LIBCMT ref: 1002048B
Part of subcall function 10020474: __NMSG_WRITE.LIBCMT ref: 10020492
Part of subcall function 10020474: HeapAlloc.KERNEL32(033C0000,00000000,00000001,?,?,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 100204B7

_free.LIBCMT ref: 10016270
std::exception::exception.LIBCMT ref: 100162BC
__CxxThrowException@8.LIBCMT ref: 100162D1
SetLastError.KERNEL32(00000018,?,101B722C,?,1001640E,80004005,?,100168C9,00000400,00000400), ref: 100162DC
_free.LIBCMT ref: 100162E7

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$AllocErrorException@8HeapLastThrow_mallocstd::exception::exception
String ID:
API String ID: 3049299895-0
Opcode ID: c4e75bb467dcd632cc6794f0c5e8569d33c960b951e8937276adff62c409ee6a
Instruction ID: ed2824db1dae17bfd308ba5dcb0e615037e45c0d1587b7e3fee2415e99e90dce
Opcode Fuzzy Hash: c4e75bb467dcd632cc6794f0c5e8569d33c960b951e8937276adff62c409ee6a
Instruction Fuzzy Hash: A0519AB6A006199FCB01CF98DC80B9EBBF4EB49710F554169E914AB341D775ED80CB90

Function 100285A2 Relevance: 9.1, APIs: 6, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

__ioinit.LIBCMT ref: 100285A6

Part of subcall function 10029B38: InitOnceExecuteOnce.KERNEL32(101BE634,10029B73,00000000,00000000,1003508B,101B7FB0,0000000C,10005D7E,zstd), ref: 10029B46

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Once$ExecuteInit__ioinit
String ID:
API String ID: 129814473-0
Opcode ID: 5f84c9e2474b48f1b5df84408ea3fed00915e9808a8aa5c3ede1912be93b9b93
Instruction ID: eb12839c2236a0a66080d8b7707541b2b015dfdafb5b4036e193e8b83220f103
Opcode Fuzzy Hash: 5f84c9e2474b48f1b5df84408ea3fed00915e9808a8aa5c3ede1912be93b9b93
Instruction Fuzzy Hash: 7A415679902B058FD320CB78E885A6E77E4EF413B0B90871DF8AB876D1D774EA408B10

Function 1001E0D0 Relevance: 9.1, APIs: 6, Instructions: 127memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000094,00000000,?,00000000,00000000), ref: 1001E132
_memmove.LIBCMT ref: 1001E18D
InterlockedExchangeAdd.KERNEL32(-00000040,?), ref: 1001E19D
InterlockedDecrement.KERNEL32(00000028), ref: 1001E1B6
HeapFree.KERNEL32(?,00000000,00000000,00000000), ref: 1001E1E0
InterlockedExchangeAdd.KERNEL32(-00000040,?), ref: 1001E1F7

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Interlocked$ExchangeHeap$AllocDecrementFree_memmove
String ID:
API String ID: 3475820249-0
Opcode ID: 8410d57850f0f56a72160be52005f4586bc43fc5666634ebf8d9ae9adf307239
Instruction ID: 7998932e740281b790ced908d299ef40af193b578d293305540e12fdeb0e7596
Opcode Fuzzy Hash: 8410d57850f0f56a72160be52005f4586bc43fc5666634ebf8d9ae9adf307239
Instruction Fuzzy Hash: F5410D72900259AFDB11CF99C884A9EBBF8FF49314F1145AAEC199F211D770ED54CB90

Function 10012A90 Relevance: 9.1, APIs: 6, Instructions: 115networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10012AB1

Part of subcall function 100122A0: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 100122C1
Part of subcall function 100122A0: GetProcAddress.KERNEL32(00000000), ref: 100122C8
Part of subcall function 100122A0: GetCurrentProcess.KERNEL32(00000000), ref: 100122DB

GetVersionExA.KERNEL32(0000009C), ref: 10012AED

Part of subcall function 10011EE0: LoadLibraryA.KERNEL32(ntdll.dll), ref: 10011EF9
Part of subcall function 10011EE0: GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 10011F11
Part of subcall function 10011EE0: FreeLibrary.KERNEL32(00000000), ref: 10011F4A

Part of subcall function 10011980: LoadLibraryA.KERNEL32(Ole32.dll), ref: 10011995
Part of subcall function 10011980: GetProcAddress.KERNEL32(?,CoInitialize), ref: 100119A7
Part of subcall function 10011980: GetProcAddress.KERNEL32(?,CoUninitialize), ref: 100119B9
Part of subcall function 10011980: GetProcAddress.KERNEL32(?,CoCreateInstance), ref: 100119CB
Part of subcall function 10011980: LoadLibraryA.KERNEL32(Oleaut32.dll), ref: 100119D9
Part of subcall function 10011980: GetProcAddress.KERNEL32(?,SysFreeString), ref: 100119EB

Part of subcall function 10011C40: _strncpy.LIBCMT ref: 10011D43

Part of subcall function 100121A0: _memset.LIBCMT ref: 100121D2

Part of subcall function 10011D80: GetSystemInfo.KERNEL32(?), ref: 10011DCD
Part of subcall function 10011D80: __snprintf.LIBCMT ref: 10011DE8

Part of subcall function 10012130: _memset.LIBCMT ref: 1001214F
Part of subcall function 10012130: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 10012162

Part of subcall function 10011E10: _memset.LIBCMT ref: 10011E5F
Part of subcall function 10011E10: _memset.LIBCMT ref: 10011E71
Part of subcall function 10011E10: lstrlenA.KERNEL32(?), ref: 10011EA4
Part of subcall function 10011E10: gethostname.WS2_32(?,10012B7F), ref: 10011EB6
Part of subcall function 10011E10: lstrlenA.KERNEL32(?), ref: 10011EC0

Part of subcall function 10013280: GetLastInputInfo.USER32(00000008), ref: 1001329B

_memmove.LIBCMT ref: 10012B9C
InternetGetConnectedState.WININET(?,00000000), ref: 10012BAD
_strlen.LIBCMT ref: 10012BB7

Part of subcall function 10006F00: _Func_class.LIBCPMTD ref: 10006F71

_Func_class.LIBCPMTD ref: 10012BD2

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$_memset$Library$Load$Func_classInfolstrlen$ConnectedCurrentFreeGlobalHandleInputInternetLastMemoryModuleProcessStateStatusSystemVersion__snprintf_memmove_strlen_strncpygethostname
String ID:
API String ID: 1392860501-0
Opcode ID: 43b44d29e576c7a7eab6005ce55aa7196c291a1fb8a4cd9e799f16c790759da6
Instruction ID: 6fcb611156f6b3c8081496a382b787b04c25c68574042c94e1e96bd79d1c608f
Opcode Fuzzy Hash: 43b44d29e576c7a7eab6005ce55aa7196c291a1fb8a4cd9e799f16c790759da6
Instruction Fuzzy Hash: 514186B9D4021A6BDB14DBA0DC46FEE7378EF14344F4045A8F51D6A182EE34B7888B91

Function 1001D950 Relevance: 9.1, APIs: 6, Instructions: 107memorytimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(1DFFD115,?,?,00000000,?,?,10035FD8,000000FF,?,1001D925,?,00000000,?,?,?), ref: 1001D984
EnterCriticalSection.KERNEL32(00000054,1DFFD115,?,?,00000000,?,?,10035FD8,000000FF,?,1001D925,?,00000000,?,?,?), ref: 1001D9A8
SetLastError.KERNEL32(00000000,?,1001D925,?,00000000,?,?,?,?,1001EB3A,?,?), ref: 1001D9BD
LeaveCriticalSection.KERNEL32(00000054,?,1001D925,?,00000000,?,?,?,?,1001EB3A,?,?), ref: 1001D9E0
GetLastError.KERNEL32(?,00000000), ref: 1001DA42
HeapFree.KERNEL32(?,00000000,?,?,?,00000000), ref: 1001DA77

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalErrorLastSection$EnterFreeHeapLeaveTimetime
String ID:
API String ID: 340097737-0
Opcode ID: 63cb6f8e7694ae6483c047f050ef8b7d6c6ce7c6f04acb454207dabb1f28742f
Instruction ID: 651f3edefb78460789619dc2c76435f0b6e471a6de73fc66fbbe7bd7a0e23f04
Opcode Fuzzy Hash: 63cb6f8e7694ae6483c047f050ef8b7d6c6ce7c6f04acb454207dabb1f28742f
Instruction Fuzzy Hash: 5641AEB1600619AFDB11EF54CC85BAAB7F8FF08320F40452AF915CB691D774E940CBA1

Function 1000C230 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 1000C28F
std::error_category::default_error_condition.LIBCPMTD ref: 1000C2B0
std::error_category::default_error_condition.LIBCPMTD ref: 1000C2CA
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 1000C2D6
_Copy_impl.LIBCPMTD ref: 1000C2F1
std::error_category::default_error_condition.LIBCPMTD ref: 1000C323

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: std::error_category::default_error_condition$Affinity::operator!=Concurrency::details::Hardware$Copy_impl
String ID:
API String ID: 1600619793-0
Opcode ID: b1d60bd1d2c90ce81873208b493584433b2c3e2ab3f7430867161bbb174af34e
Instruction ID: d7a5fca912ec06086403f1c670a1a813a5f108e565bd240dc1cb7e9a7b1914b0
Opcode Fuzzy Hash: b1d60bd1d2c90ce81873208b493584433b2c3e2ab3f7430867161bbb174af34e
Instruction Fuzzy Hash: ED310079910119ABDB08DF95CC91DFFB3B9FF88240B50852DB515A7296DF30BA05CB90

Function 10009900 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 1000995F
std::error_category::default_error_condition.LIBCPMTD ref: 10009980
std::error_category::default_error_condition.LIBCPMTD ref: 1000999A
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 100099A6
_Copy_impl.LIBCPMTD ref: 100099C1
std::error_category::default_error_condition.LIBCPMTD ref: 100099F3

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: std::error_category::default_error_condition$Affinity::operator!=Concurrency::details::Hardware$Copy_impl
String ID:
API String ID: 1600619793-0
Opcode ID: 2ed96429231faa1b98a0dfe9f2b9f2661ec804e65a12f5b07c9e7ace5e47c8cf
Instruction ID: fd5af44e1f88a068f71331fad6f74fd73f7a6a584799292872335351018ebe79
Opcode Fuzzy Hash: 2ed96429231faa1b98a0dfe9f2b9f2661ec804e65a12f5b07c9e7ace5e47c8cf
Instruction Fuzzy Hash: AD31FE79900519ABDB08DF95CC91DFFB3B9FF88240B50852DB515AB296DF30BA05CB90

Function 1001A9D0 Relevance: 9.1, APIs: 6, Instructions: 86networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 1001A9E7
WSAAddressToStringA.WS2_32(?,0000001C,00000000,?,?), ref: 1001AA10
htons.WS2_32(?), ref: 1001AA2D
StrPBrkA.SHLWAPI(?,101B05A8,?,?,?,?,1001A154,?,?,?), ref: 1001AA53
StrChrA.SHLWAPI(?,00000025,?,?,?,?,1001A154,?,?,?), ref: 1001AA5E
_memmove.LIBCMT ref: 1001AA80

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: htons$AddressString_memmove
String ID:
API String ID: 2092185379-0
Opcode ID: 1da62bb18fa6672f18f6b109637b5a37ed39d3a7a0056215d56cfa2b173f808e
Instruction ID: 0d8a7e0632666a9e584c7e0b1c50e51ce1a1bb8526f63a46b25b18e10d486f15
Opcode Fuzzy Hash: 1da62bb18fa6672f18f6b109637b5a37ed39d3a7a0056215d56cfa2b173f808e
Instruction Fuzzy Hash: 2F218E36200326ABEB119FA4DD84BAA37ECEF49355F418025FD098A151D3B4D9C4D761

Function 10017B90 Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10017BAA

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

_free.LIBCMT ref: 10017BB2
_malloc.LIBCMT ref: 10017C09
_malloc.LIBCMT ref: 10017C16
_memset.LIBCMT ref: 10017C22
_memset.LIBCMT ref: 10017C2E

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free_malloc_memset$ErrorFreeHeapLast
String ID:
API String ID: 3649356292-0
Opcode ID: e2ce2a3dfe1de264b51823140416de6bf36e0b396c0ae9a07080b5863090727e
Instruction ID: 4c7394fda08d7e2547570c27631cca39768b6331ab3c3b2927f712e97e116122
Opcode Fuzzy Hash: e2ce2a3dfe1de264b51823140416de6bf36e0b396c0ae9a07080b5863090727e
Instruction Fuzzy Hash: 91111BB55012009BDB10DF15DD85B867FA5FF51304F4880B8FA089E29BD776E554CBA4

Function 10014850 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100148E9
_sprintf.LIBCMT ref: 1001491C
DeleteFileA.KERNEL32(00000000), ref: 1001492B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 1001494A

Strings

%s%u, xrefs: 10014910

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: DeleteFileFreeVirtual_memset_sprintf
String ID: %s%u
API String ID: 510910084-679674701
Opcode ID: adc25b0c065f21cbd1dfded628025ccd8d207bb86f6a67400b9d615e7817787c
Instruction ID: e4550e76bca269e0cd4f0d0c42d540de692b114aa9dc25b4e6c159d00a62e7eb
Opcode Fuzzy Hash: adc25b0c065f21cbd1dfded628025ccd8d207bb86f6a67400b9d615e7817787c
Instruction Fuzzy Hash: 3D31D4B59042689FC725CF14CC41BEEBBB4EB45315F108199FA585B3D1CB34AA81CF90

Function 1000B5A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 1000B5E8
inet_addr.WS2_32(?), ref: 1000B5F9
_wprintf.LIBCMT ref: 1000B613

Strings

OnConnect: %s,%d, xrefs: 1000B60E
2, xrefs: 1000B5B3

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _wprintfhtonsinet_addr
String ID: 2$OnConnect: %s,%d
API String ID: 3872430831-1911175251
Opcode ID: c5e6b32b25000850bdcfd3e7752fad518d315f21ca028ddb3caaaf99291d32ff
Instruction ID: b422dd61b17a844059851ccc93c32e4f95b7dbd58dc7ab89f53cd95de4c22344
Opcode Fuzzy Hash: c5e6b32b25000850bdcfd3e7752fad518d315f21ca028ddb3caaaf99291d32ff
Instruction Fuzzy Hash: B111D6B5A00208AFCB14DFA4D9809AEB7B9FF88200F108159F9099B251EB35AA45CB50

Function 100106D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100106F8
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 1001070E
_memset.LIBCMT ref: 10010729
ShellExecuteExA.SHELL32(0000003C), ref: 10010761

Part of subcall function 10022BD3: _doexit.LIBCMT ref: 10022BDD

Strings

<, xrefs: 10010714

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$ExecuteFileModuleNameShell_doexit
String ID: <
API String ID: 862106238-4251816714
Opcode ID: 20cf96c7f9d228022f40f64b64e5aa891d9eb85aec194889f2121776d6cbdfe6
Instruction ID: ed08ded1bf864bf3e223a1e7aee1529ee6b636ef57dacc8919679b4bfa0f8810
Opcode Fuzzy Hash: 20cf96c7f9d228022f40f64b64e5aa891d9eb85aec194889f2121776d6cbdfe6
Instruction Fuzzy Hash: F5112174A443189BDB60DF60DC86BD977B8EB58701F4040D8E54CAA2D1DBB46BC8CF51

Function 10011D80 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 100153E0: _memset.LIBCMT ref: 10015432
Part of subcall function 100153E0: _memset.LIBCMT ref: 10015448
Part of subcall function 100153E0: _memset.LIBCMT ref: 1001545E
Part of subcall function 100153E0: LoadLibraryA.KERNEL32(ADVAPI32.dll), ref: 1001546B

GetSystemInfo.KERNEL32(?), ref: 10011DCD
__snprintf.LIBCMT ref: 10011DE8

Strings

~MHz, xrefs: 10011DB2
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 10011DB7
%d*%sMHz, xrefs: 10011DDB

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$InfoLibraryLoadSystem__snprintf
String ID: %d*%sMHz$HARDWARE\DESCRIPTION\System\CentralProcessor\0$~MHz
API String ID: 4072208565-2169120903
Opcode ID: 8cfe9623471b1fdf1c554914f6860f425b5aeaa8db3a3f010a36363e40d3c6a7
Instruction ID: d45dab53a83cfac9e0a1e2a4c9fe7e981714f2b5fce01b97ec9512f60cfb67df
Opcode Fuzzy Hash: 8cfe9623471b1fdf1c554914f6860f425b5aeaa8db3a3f010a36363e40d3c6a7
Instruction Fuzzy Hash: F6010075A10248EFDB00DBE8CD46BAEB7B4EF48604F50415DBA08EB281E6756A44C761

Function 100118D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100118F8
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 1001190E
_memset.LIBCMT ref: 10011929
ShellExecuteExA.SHELL32(0000003C), ref: 10011961

Part of subcall function 10022BD3: _doexit.LIBCMT ref: 10022BDD

Strings

<, xrefs: 10011914

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$ExecuteFileModuleNameShell_doexit
String ID: <
API String ID: 862106238-4251816714
Opcode ID: 3b53686e11ed67b0b73857ac907e37981459c7ca599cd7ab1f7b00ff7bdf5b39
Instruction ID: 184780f53a04bf753c675ecee7cc99bb54cbc30637577b5367bcbf7d21cbf3cf
Opcode Fuzzy Hash: 3b53686e11ed67b0b73857ac907e37981459c7ca599cd7ab1f7b00ff7bdf5b39
Instruction Fuzzy Hash: 6A112D789043189BDB64DF60DC86BD977B8AF58700F4040D8E54CAA2D1DBB46BC8CF51

Function 10011EE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll), ref: 10011EF9
GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 10011F11
FreeLibrary.KERNEL32(00000000), ref: 10011F4A

Strings

RtlGetNtVersionNumbers, xrefs: 10011F08
ntdll.dll, xrefs: 10011EF4

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlGetNtVersionNumbers$ntdll.dll
API String ID: 145871493-1263206204
Opcode ID: cf38a511d7e8b4ae8d17f5c5b92b7a0423aa2ce6899e0fe5ee67ae0bceb075ab
Instruction ID: fc6e9e5f567ed89b3598dd89ccb3c317c7ae0145ebb98ab299a18f454954bdf5
Opcode Fuzzy Hash: cf38a511d7e8b4ae8d17f5c5b92b7a0423aa2ce6899e0fe5ee67ae0bceb075ab
Instruction Fuzzy Hash: EF01A579901208EFDB14DF94C988B9EBBB5FF48305F108598F8059B290D7759A45DF50

Function 1000F017 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34keyboardsleepstringCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000005), ref: 1000EF92
lstrlenA.KERNEL32(00000000), ref: 1000EF9F
_memset.LIBCMT ref: 1000EFDC
GetKeyState.USER32(00000010), ref: 1000F035
GetAsyncKeyState.USER32(?), ref: 1000F05C
GetKeyState.USER32(00000014), ref: 1000F073

Strings

], xrefs: 1000F092
e, xrefs: 1000F026

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: State$AsyncSleep_memsetlstrlen
String ID: ]$e
API String ID: 1122937223-1460998272
Opcode ID: eed0b91c2744c895165e97b4f44415f78997a58abc4c3c7c85806ef0c703c4ee
Instruction ID: 764bce47da2be80fe97f0ee0a60544cb6e7be49dbe84d1d57fcac03222c10f19
Opcode Fuzzy Hash: eed0b91c2744c895165e97b4f44415f78997a58abc4c3c7c85806ef0c703c4ee
Instruction Fuzzy Hash: 35011A34901728CFFB64CF15CC85BA977B2FB80391F1082A9C4095695ACB779EA1EE01

Function 100122A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 100122C1
GetProcAddress.KERNEL32(00000000), ref: 100122C8
GetCurrentProcess.KERNEL32(00000000), ref: 100122DB

Strings

IsWow64Process, xrefs: 100122B7
kernel32, xrefs: 100122BC

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32
API String ID: 4190356694-3789238822
Opcode ID: 4dbbbb52112192865a612101614944367de734d12e029e91dbf73928284f9556
Instruction ID: d8b697d57578edb345ad90496a9b557fc7605fd1813d4f5a4f7f5f71a7bdeb36
Opcode Fuzzy Hash: 4dbbbb52112192865a612101614944367de734d12e029e91dbf73928284f9556
Instruction Fuzzy Hash: 74F0FE75D00208FFDB10EFE4C94879DBBB8EF08205F404099E80997251DB389648DB50

Function 10016750 Relevance: 7.7, APIs: 5, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 100184E0: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,100167AB,1DFFD115,00000000,?,?,?,1001849E), ref: 100184FB
Part of subcall function 100184E0: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,100167AB,1DFFD115,00000000,?,?,?,1001849E), ref: 10018516

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,1DFFD115,00000000,?,?,?,1001849E), ref: 100167F5
HeapCreate.KERNEL32(00000004,00000000,00000000,?,?,?,1001849E), ref: 10016889
_free.LIBCMT ref: 1001693E
_free.LIBCMT ref: 10016946
_free.LIBCMT ref: 100169A9

Part of subcall function 100172C0: __CxxThrowException@8.LIBCMT ref: 100172D2
Part of subcall function 100172C0: EnterCriticalSection.KERNEL32(00000000,1DFFD115,00000000,00000098,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005), ref: 10017312
Part of subcall function 100172C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005,?,100168C9,00000400,00000400), ref: 1001737B

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$CreateCriticalInfoNativeSectionSystem$EnterEventException@8HeapLeaveThrow
String ID:
API String ID: 471852966-0
Opcode ID: 62dcc8071ba77636672d3d9cd1e185c692ae9957d13345a13a02519507dda5e3
Instruction ID: d7e5b155edf1d74aaead93eb83c8ab603744e77deffcff0117244fe85bcfb593
Opcode Fuzzy Hash: 62dcc8071ba77636672d3d9cd1e185c692ae9957d13345a13a02519507dda5e3
Instruction Fuzzy Hash: C37118B0501B419FE761CF64C958787BBF4FF04308F108A1DE6AA9B691DBB9B148CB90

Function 1001CCD0 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

getsockopt.WS2_32(?,0000FFFF,00001001,?,?), ref: 1001CD1D
InterlockedCompareExchange.KERNEL32(00000004,00000000,00000001), ref: 1001CD64
EnterCriticalSection.KERNEL32(?), ref: 1001CD7A
LeaveCriticalSection.KERNEL32(?), ref: 1001CD89
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,10035AC4), ref: 1001CDCC

Part of subcall function 1001E2B0: InterlockedExchangeAdd.KERNEL32(00000044,?), ref: 1001E328
Part of subcall function 1001E2B0: InterlockedDecrement.KERNEL32(?), ref: 1001E33E
Part of subcall function 1001E2B0: HeapFree.KERNEL32(?,00000000,?,?), ref: 1001E36E

Part of subcall function 1001BE40: timeGetTime.WINMM(00000007,00000000,00000000,00000000,?,00000001,?,?,00000001,00000000), ref: 1001BE7F

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalInterlockedSection$ExchangeLeave$CompareDecrementEnterFreeHeapTimegetsockopttime
String ID:
API String ID: 1051621181-0
Opcode ID: 47ef961c13baaeb1f1c3f54f41a175c5428382baf7d5d31f1b2d3631bcd46669
Instruction ID: aa49a767c170bc5356aa645f39eb09f20ade229693a97dd4efdc251de6f66d51
Opcode Fuzzy Hash: 47ef961c13baaeb1f1c3f54f41a175c5428382baf7d5d31f1b2d3631bcd46669
Instruction Fuzzy Hash: ED41D072A00619AFD711CF94DC81F9EBBF8FB04351F10423AEA059B690D775E9A0CB90

Function 100143E0 Relevance: 7.6, APIs: 5, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 1001446A
_free.LIBCMT ref: 10014479
VirtualFree.KERNEL32(?,00000000,00008000,?,1001478E), ref: 10014498
GetProcessHeap.KERNEL32(00000000,00000000,?,1001478E), ref: 100144A4
HeapFree.KERNEL32(00000000,?,1001478E), ref: 100144AB

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Free$Heap$LibraryProcessVirtual_free
String ID:
API String ID: 3953351234-0
Opcode ID: d9d32f6ed72f362beb0b78fbb99d4c82a6959af6a865298871246b0d9bcbc94d
Instruction ID: e984664baf45058b12496fb5a6c08b784cfcca4bbda2656e475c534f62021b4f
Opcode Fuzzy Hash: d9d32f6ed72f362beb0b78fbb99d4c82a6959af6a865298871246b0d9bcbc94d
Instruction Fuzzy Hash: 6131B674A00208EFDB14CF94C598B9DB7B6FB49315F258288E9056B391C775EE86DF80

Function 1003285D Relevance: 7.6, APIs: 5, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

__malloc_crt.LIBCMT ref: 10032879
std::exception::exception.LIBCMT ref: 10032893
__CxxThrowException@8.LIBCMT ref: 100328C9

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw__malloc_crtstd::exception::exception
String ID:
API String ID: 3183362523-0
Opcode ID: 12067b7f50e60089eb0c5929b79bbc81da0302d8a13d9fc531a0150228292b0c
Instruction ID: 3afcd033efa841a0b0f27a91848f479c7de1b815caadbdc1d716f9ba00caeb03
Opcode Fuzzy Hash: 12067b7f50e60089eb0c5929b79bbc81da0302d8a13d9fc531a0150228292b0c
Instruction Fuzzy Hash: B021FC3950420DAECB02EF64DC426CEB7B8EF00241F40C565FD45AE250EB34E680CB93

Function 1002354C Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 10023558

Part of subcall function 10020474: __FF_MSGBANNER.LIBCMT ref: 1002048B
Part of subcall function 10020474: __NMSG_WRITE.LIBCMT ref: 10020492
Part of subcall function 10020474: HeapAlloc.KERNEL32(033C0000,00000000,00000001,?,?,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 100204B7

_free.LIBCMT ref: 1002356B

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: bad27d9961e6c256fd05d00a16dcfa7813a2fc78cb849604c55e28e4d427328b
Instruction ID: 8f73b662920d403f089da30250cd819716aaae5841175fa17ded837e2a866512
Opcode Fuzzy Hash: bad27d9961e6c256fd05d00a16dcfa7813a2fc78cb849604c55e28e4d427328b
Instruction Fuzzy Hash: 28112731900A366FCB21DB70BC4564E37E4EF003A0FE18525F90D9A1A1DF349940D794

Function 1001DFB0 Relevance: 7.6, APIs: 5, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 1001DFDE

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

_free.LIBCMT ref: 1001DFE9
HeapDestroy.KERNEL32(?,?,80004005,?,1001E736), ref: 1001E03E
HeapCreate.KERNEL32(?,?,?,?,80004005,?,1001E736), ref: 1001E056
SetEvent.KERNEL32(?,?,80004005,?,1001E736), ref: 1001E093

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Heap$_free$CreateDestroyErrorEventFreeLast
String ID:
API String ID: 840158118-0
Opcode ID: 0e583d642f774632f9c27456ec0f16af5b2d05b50993fe6db7455c841bf81a0b
Instruction ID: 1bce1808b3a2e791fe6ccda0018e989c211068b54a4ee0f2cf5caece12fc7c46
Opcode Fuzzy Hash: 0e583d642f774632f9c27456ec0f16af5b2d05b50993fe6db7455c841bf81a0b
Instruction Fuzzy Hash: 3221D071401B428BE7229F35D908787BAE1BF49304F50891DE5AA96651DBBAB884CF40

Function 1001B630 Relevance: 7.5, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B651
EnterCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B657
LeaveCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B675
LeaveCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B678
LeaveCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B68A
LeaveCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B68D

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: c76d05b3fccb81bbde97bbe8f299796e80221eabea18b0df9aee05efc5887d01
Instruction ID: 15876e7cb504465c55ff25fd79a18e235aef5e7f8048034f6523b5cd64803c08
Opcode Fuzzy Hash: c76d05b3fccb81bbde97bbe8f299796e80221eabea18b0df9aee05efc5887d01
Instruction Fuzzy Hash: 43F044722016146FD711AB6EDCC0A9BB7ECFFC9224B520136E908DB611C779E8458AB0

Function 100278EA Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 10025CA4: __getptd_noexit.LIBCMT ref: 10025CA5
Part of subcall function 10025CA4: __amsg_exit.LIBCMT ref: 10025CB2

__amsg_exit.LIBCMT ref: 10027917
__lock.LIBCMT ref: 10027927
InterlockedDecrement.KERNEL32(?), ref: 10027944
_free.LIBCMT ref: 10027957
InterlockedIncrement.KERNEL32(033DF960), ref: 1002796F

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 1231874560-0
Opcode ID: 5b52af1cc653b6a68240cb3c15142706c47bbd1bbb99473af2bdf0793a479e8c
Instruction ID: e038a616fc268b6b30c8c800e06b11c4754edae7854568c1c2ca9af5bccd002d
Opcode Fuzzy Hash: 5b52af1cc653b6a68240cb3c15142706c47bbd1bbb99473af2bdf0793a479e8c
Instruction Fuzzy Hash: 0701C036A01732ABDB21DB69BA8174D77B0FF01650FD10145E8086BA92CB386981CFC1

Function 10003400 Relevance: 7.5, APIs: 5, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000018,00000000,0000003C,00000000,?,?,100033DA), ref: 1000340C
WakeAllConditionVariable.KERNEL32 ref: 1000341D
LeaveCriticalSection.KERNEL32(00000018), ref: 10003424
WaitForSingleObject.KERNEL32(?,000000FF,?), ref: 1000345C
GetLastError.KERNEL32 ref: 1000346D

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterErrorLastLeaveObjectSingleVariableWaitWake
String ID:
API String ID: 2002041392-0
Opcode ID: e75bfb5a0ad93df77c66187c49ea81158b5d7819f7b5d557b30da283341fa316
Instruction ID: 32492cade0fa7766ae1656b716e42035eae87337b4a1db3a89480abb877ebfd1
Opcode Fuzzy Hash: e75bfb5a0ad93df77c66187c49ea81158b5d7819f7b5d557b30da283341fa316
Instruction Fuzzy Hash: 8301B1325002169FEB52EF58DCC469773ECFF45391B018525EA589B119D730E989CBA2

Function 1001D760 Relevance: 6.3, APIs: 5, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1001A990: setsockopt.WS2_32(?,0000FFFF,00007010,00000000,00000004), ref: 1001A9A6

EnterCriticalSection.KERNEL32 ref: 1001D7AC
LeaveCriticalSection.KERNEL32(00000054), ref: 1001D7C7

Part of subcall function 1001BE40: timeGetTime.WINMM(00000007,00000000,00000000,00000000,?,00000001,?,?,00000001,00000000), ref: 1001BE7F

SetLastError.KERNEL32(00000000), ref: 1001D7D1
LeaveCriticalSection.KERNEL32(00000054), ref: 1001D7EC
HeapFree.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 1001D842

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterErrorFreeHeapLastTimesetsockopttime
String ID:
API String ID: 4191520005-0
Opcode ID: d82dbdcae07a67b72c96c9c25426668b2813c80c10765768011baf3510c592d9
Instruction ID: 8b7f9298d96b99960fdb9572d67dbc8946c541a3fe55414fa74220fd8c56f37f
Opcode Fuzzy Hash: d82dbdcae07a67b72c96c9c25426668b2813c80c10765768011baf3510c592d9
Instruction Fuzzy Hash: E131C372600214EFD711DF48CC85B9EB7B8FF49721F10422AF9299B291DB75A840CB60

Function 100268E6 Relevance: 6.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 1002696A
_memmove.LIBCMT ref: 100269B1
___AdjustPointer.LIBCMT ref: 100269FF
_memmove.LIBCMT ref: 10026A08

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AdjustPointer_memmove
String ID:
API String ID: 1721217611-0
Opcode ID: b405e0998ef0b9efc1edcd27beb66ba5646d659d8eec6f86d97dda6a22f7c017
Instruction ID: 0e35a04b9f418c62776a7450ae1d75bb5788a7e2c58344f017f8f72862e36527
Opcode Fuzzy Hash: b405e0998ef0b9efc1edcd27beb66ba5646d659d8eec6f86d97dda6a22f7c017
Instruction Fuzzy Hash: DC4192766043469AEB25CF50FC42F6A37F4DF097A0FA1401DF849AA5D1DF71E880DA62

Function 1002F1F7 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 1002F22B
__isleadbyte_l.LIBCMT ref: 1002F259
MultiByteToWideChar.KERNEL32(00000000,00000009,0000000C,00000000,00000000,00000000), ref: 1002F287
MultiByteToWideChar.KERNEL32(00000000,00000009,0000000C,00000001,00000000,00000000), ref: 1002F2BD

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2b3d1593b62abf2a8beba7a4b33d3e542d277218e77fbf3ac6909a8a0f39df84
Instruction ID: 88f6cfa15c5d6d04ed07b041f1d82007708ea3ed43a2cafbe05b56c4a286dddd
Opcode Fuzzy Hash: 2b3d1593b62abf2a8beba7a4b33d3e542d277218e77fbf3ac6909a8a0f39df84
Instruction Fuzzy Hash: 1D31BC3560029AEFDB11CE64E845BBA3BE5FF422A0F52443DE8249B1A1D770E844DB50

Function 1001E3A0 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(?), ref: 1001E41B
UnmapViewOfFile.KERNEL32(00000000), ref: 1001E441
CloseHandle.KERNEL32(00000000), ref: 1001E461
CloseHandle.KERNEL32(00000000), ref: 1001E483

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle$ErrorFileLastUnmapView
String ID:
API String ID: 4017539725-0
Opcode ID: 496f3fa893c77ec6c9c64e1aa7dc66e4b9ed660e755f62b2c78ec002215d3852
Instruction ID: cba275ec36c653788e4822474d84c3c335d5b1142b70863171b6aa198203d996
Opcode Fuzzy Hash: 496f3fa893c77ec6c9c64e1aa7dc66e4b9ed660e755f62b2c78ec002215d3852
Instruction Fuzzy Hash: 1E3118B5A002599BDB11CFA4CC48BAFBBF8FF48754F004219F805EB241EB75E9448BA0

Function 1001B710 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(00000000,?,00000000), ref: 1001B765
InterlockedCompareExchange.KERNEL32(?,?,?), ref: 1001B777

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CompareExchangeInterlocked
String ID:
API String ID: 3335655927-0
Opcode ID: 9484bcffa374807802c2175ff6f6c2d2e59b0392790023a2fe2f7dd29207cd47
Instruction ID: a411b3ee14b548daa5b868b1c8f2e50aeeae3c08791ef6b703bc2ef0cd82c7fc
Opcode Fuzzy Hash: 9484bcffa374807802c2175ff6f6c2d2e59b0392790023a2fe2f7dd29207cd47
Instruction Fuzzy Hash: 6E219F36304A09ABD720DF6DDD80E96F3EDFBC8311F00456AEA89C7240DB31E9548BA0

Function 10014070 Relevance: 6.1, APIs: 4, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00000000,00001000,00000004), ref: 100140EE
_memset.LIBCMT ref: 1001410A
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,100146FE), ref: 1001412C
_memmove.LIBCMT ref: 1001414A

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocVirtual$_memmove_memset
String ID:
API String ID: 725130153-0
Opcode ID: f53fd65b4befc706c090b7c927cf75363b07fbc3177beadfb71f7d900ef2fefc
Instruction ID: 93ed00f0eb9094769ecb9556d8f7921b1dd27d8a6f78ffda3dd0833cdc577a5f
Opcode Fuzzy Hash: f53fd65b4befc706c090b7c927cf75363b07fbc3177beadfb71f7d900ef2fefc
Instruction Fuzzy Hash: F631EA74A00209EFCB08CF94C995EAEB7B1FF48704F218598E915AB351D770EE81DB50

Function 1001A3A0 Relevance: 6.1, APIs: 4, Instructions: 84fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(00000002,00000004,?,?,?,00000002,00000004), ref: 1001A3B3
CreateFileMappingA.KERNEL32(00000002,00000000,00000004,00000004,00000000,00000000), ref: 1001A3E0
MapViewOfFileEx.KERNEL32(00000000,?,?,?,?,00000000,?,00000002,00000004), ref: 1001A429
CloseHandle.KERNEL32(?,?,00000002,00000004), ref: 1001A43F

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleMappingSizeView
String ID:
API String ID: 1374251026-0
Opcode ID: 4b8af0a805cdf8347236f9c71f45033270cfc3b78af84c4974c8e4d52b637325
Instruction ID: 8fce67c6ff09011a8acf264d9e13d81355b447303082185ad91e7b9cb9a6a423
Opcode Fuzzy Hash: 4b8af0a805cdf8347236f9c71f45033270cfc3b78af84c4974c8e4d52b637325
Instruction Fuzzy Hash: 272167B5A0061AAFD714DF69DC45A5AF7F8FB49350F10812AFD19D7200D770E9A09BD0

Function 1001B090 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 1001B152

Part of subcall function 1001B190: HeapFree.KERNEL32(?,00000000,?), ref: 1001B1E5

DeleteCriticalSection.KERNEL32(?,1DFFD115), ref: 1001B113
DeleteCriticalSection.KERNEL32(?), ref: 1001B124
HeapFree.KERNEL32(?,00000000), ref: 1001B132

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalDeleteFreeHeapSection$_free
String ID:
API String ID: 210024702-0
Opcode ID: 2457e78313824737e41231bfbb3820b753e3b2e9e7e39901a1bfba69df0cf740
Instruction ID: 33c100260f324d21ff77bf2896aba4d0bbdecf1759cfcc0eaa01cd95da98a8db
Opcode Fuzzy Hash: 2457e78313824737e41231bfbb3820b753e3b2e9e7e39901a1bfba69df0cf740
Instruction Fuzzy Hash: 63319E71A00616EFDB11DFA8C884B5AFBF8FF05315F118269E9199F291D731E944CBA0

Function 100152A0 Relevance: 6.1, APIs: 4, Instructions: 62processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,10011CAA), ref: 100152B1

Part of subcall function 1001EF9C: _malloc.LIBCMT ref: 1001EFB4

Process32First.KERNEL32(10011CAA,1DFFD115), ref: 100152E0
Process32Next.KERNEL32(10011CAA,1DFFD115), ref: 10015316
lstrcmpiA.KERNEL32(1DFFD0F1,00000000), ref: 1001532A

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32_malloclstrcmpi
String ID:
API String ID: 242301054-0
Opcode ID: 335c3f3c8a0e05f5839a3b8562ab9f751be2bf2361413e739464e8ead2f72be9
Instruction ID: 03fd10ac50de1202267bfae5930d06ed0f63b87ea6e01dd6c59341b656d33967
Opcode Fuzzy Hash: 335c3f3c8a0e05f5839a3b8562ab9f751be2bf2361413e739464e8ead2f72be9
Instruction Fuzzy Hash: 8321BAB4A04208EBDB14CB98C981A9EB7F5EF48745F2480A8E818AF341D771EF81DB54

Function 10003480 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,10001499,?,?,00000000,?,?,?), ref: 100034A7
SleepConditionVariableCS.KERNEL32(00000000,?,00000000), ref: 100034CB
LeaveCriticalSection.KERNEL32(?), ref: 100034D2
SleepConditionVariableCS.KERNEL32(00000000,?,000000FF), ref: 1000350E

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ConditionCriticalSectionSleepVariable$EnterLeave
String ID:
API String ID: 3020340620-0
Opcode ID: 05074beb6edb66eb96e78de5814604b12c6efd175baefdef2757970339633dab
Instruction ID: f135a66ef4c3fa2a34bb39291fcdf00077fd575a97a3f57769656b34936bebed
Opcode Fuzzy Hash: 05074beb6edb66eb96e78de5814604b12c6efd175baefdef2757970339633dab
Instruction Fuzzy Hash: 42110471500B558FE772CA58D9C4B5773E8FB007A6F51DE1DE4938A899C374F8888B21

Function 1000ECF0 Relevance: 6.1, APIs: 4, Instructions: 60windowstringCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 1000ED07
_memset.LIBCMT ref: 1000ED30
SendMessageA.USER32(?,0000000D,00000400,00000000), ref: 1000ED4A
lstrlenA.KERNEL32(00000000), ref: 1000ED57

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: MessageSendVisibleWindow_memsetlstrlen
String ID:
API String ID: 1293396957-0
Opcode ID: c0acd891ebef83d26f17d4d1390c8d3953d1a4ad271df1068977982f2c5964a8
Instruction ID: 5b252e65773c6f6e6056f087db140e16ac5e3367f8d3fdb97bb4e1eeb390b3d9
Opcode Fuzzy Hash: c0acd891ebef83d26f17d4d1390c8d3953d1a4ad271df1068977982f2c5964a8
Instruction Fuzzy Hash: 7311B6F5A00205EBEB14DF60CD45BDA7368DF54340F0044A9FB09FB285EA75EA858B95

Function 10003280 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 10003292
SleepConditionVariableCS.KERNEL32(?,?,000000FF), ref: 100032BD
EnterCriticalSection.KERNEL32(?), ref: 100032ED
WakeConditionVariable.KERNEL32(?), ref: 100032FA

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ConditionCriticalEnterSectionVariable$SleepWake
String ID:
API String ID: 1272541424-0
Opcode ID: d2ef4d3d3bece3ecb2957c56201156f867af3ba4ab4f7a9e8506c951494b066a
Instruction ID: d287fa8a1d97e4fb1d990ba0663406a79fc7a6a744e69c2c1aa7d7a44e5ccb06
Opcode Fuzzy Hash: d2ef4d3d3bece3ecb2957c56201156f867af3ba4ab4f7a9e8506c951494b066a
Instruction Fuzzy Hash: 2C115572100B159FE336DF68DCC485BB3F9FB44360B418E19E4A683A45CB30F8498B60

Function 1001EB80 Relevance: 6.1, APIs: 4, Instructions: 57windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(1001C8E6,00000000,00000000,00000000,00000001), ref: 1001EB99
TranslateMessage.USER32(?), ref: 1001EBBE
DispatchMessageA.USER32(?), ref: 1001EBC4
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 1001EBD6

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 5f19f8642b326884221ac1f2436e0d1f5125d6a111024dfe36bdec5d200537f7
Instruction ID: 4683bdf92f3b324d92ef008ada9b145ce160014bd2fbc826a850825f78051344
Opcode Fuzzy Hash: 5f19f8642b326884221ac1f2436e0d1f5125d6a111024dfe36bdec5d200537f7
Instruction Fuzzy Hash: 0D018833A4421D67EB20DAD99CC1FEEF3ACEB44750F5005A2FE08EB1C0D6A5E94146A0

Function 10012300 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10012328
_strlen.LIBCMT ref: 1001234F
_strncpy.LIBCMT ref: 10012382
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 100123A9

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateDirectory_memset_strlen_strncpy
String ID:
API String ID: 3994138041-0
Opcode ID: 5146f0f5f6924dacce34261d64f74e5090e561bcbd4e5be505613ef66d126bf7
Instruction ID: 101a95c8069f775dae9c248aff8c456d68721b5b320a68391b460c7f447a75fb
Opcode Fuzzy Hash: 5146f0f5f6924dacce34261d64f74e5090e561bcbd4e5be505613ef66d126bf7
Instruction Fuzzy Hash: CB1194B9D041189BCB10DB64DC81BDD77B8EF65304F0082E9E59D9B281DAB4EBD48F91

Function 10016B30 Relevance: 6.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10017520: _free.LIBCMT ref: 1001755A

HeapDestroy.KERNEL32(00000000,1DFFD115,?,?,?,?,100359E3,000000FF), ref: 10016B70
HeapCreate.KERNEL32(00000001,?,?,1DFFD115,?,?,?,?,100359E3,000000FF), ref: 10016B7F
_free.LIBCMT ref: 10016B8F
HeapDestroy.KERNEL32(?,?,?,?,?,100359E3,000000FF), ref: 10016BBD

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Heap$Destroy_free$Create
String ID:
API String ID: 3093871995-0
Opcode ID: 16e0c79affba40acb3f9a94d92ca98c28378774c059c7bd50a370be0c89aea4a
Instruction ID: d00498a318c3039bf53502062df662130d8b902564dd33ec98044163ccf8f0fc
Opcode Fuzzy Hash: 16e0c79affba40acb3f9a94d92ca98c28378774c059c7bd50a370be0c89aea4a
Instruction Fuzzy Hash: F71136B6904B149FD720CF69DC44B56BBF8FB08750F004A2DE89AC7651E775E944CB90

Function 10026230 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 10026247

Part of subcall function 10026858: ___AdjustPointer.LIBCMT ref: 100268A1

_UnwindNestedFrames.LIBCMT ref: 1002625E
___FrameUnwindToState.LIBCMT ref: 10026270
CallCatchBlock.LIBCMT ref: 10026294

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 6092b50bab1218cd8aabaab9e12c658e2e0f1782f2186364ed2301dcdcc7d9c1
Instruction ID: 780a5d68346db81fedf9f8d85dc8351bab79c3fb61c7619bb358afdc1328406f
Opcode Fuzzy Hash: 6092b50bab1218cd8aabaab9e12c658e2e0f1782f2186364ed2301dcdcc7d9c1
Instruction Fuzzy Hash: 88011732000109FBCF12CF95EC05EDA3BBAFF8C754F518115FA1865121C776E865ABA0

Function 10028BC3 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 10028BE7

Part of subcall function 100292C6: __fltout2.LIBCMT ref: 100292EF

__cftog_l.LIBCMT ref: 10028C0D
__cftoe_l.LIBCMT ref: 10028C3F

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: c2eb68e8ade19565e9c0612c28aff17bdb070db1da49cc9352462dfe7f7478ea
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: 1201407A40214EBBCF529E84EC51CDD3F72FB18294BA58415FE1858031C336DAB1AB91

Function 10015350 Relevance: 6.0, APIs: 4, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 10015381
__beginthreadex.LIBCMT ref: 100153A3
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 100153B4
CloseHandle.KERNEL32(00000000), ref: 100153BE

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseCreateEventHandleObjectSingleWait__beginthreadex
String ID:
API String ID: 2993629242-0
Opcode ID: d7dcd88de3af4c7a17b78a3c7ea8846737ab5e00941b9493fb9a3973c1d0ec84
Instruction ID: 28439952cb9d60efeb8680ab5036a31f0774e1b625031860cf64c459a7230e8b
Opcode Fuzzy Hash: d7dcd88de3af4c7a17b78a3c7ea8846737ab5e00941b9493fb9a3973c1d0ec84
Instruction Fuzzy Hash: 9A111EB5A04249AFDB14DFA8CC81BEE7BB4EF49310F504249F919AB381D730AA40CB90

Function 100327EB Relevance: 6.0, APIs: 4, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

__malloc_crt.LIBCMT ref: 10032807
std::exception::exception.LIBCMT ref: 10032821
__CxxThrowException@8.LIBCMT ref: 10032857

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw__malloc_crtstd::exception::exception
String ID:
API String ID: 3183362523-0
Opcode ID: c060a18d73b796a30dd2a53eb01a138e769d2f3d535d15112ec57b6c053b814d
Instruction ID: 61d3b0669a0cbb4b249a077222c69809c774bd9a0b89fdd2f935691ba84154ea
Opcode Fuzzy Hash: c060a18d73b796a30dd2a53eb01a138e769d2f3d535d15112ec57b6c053b814d
Instruction Fuzzy Hash: AEF04F799002097ACB05DFA4D9859CDB7FCEA10284F80C056FD15AB141DB78E384CA91

Function 10016AC0 Relevance: 6.0, APIs: 4, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 100174B0: HeapFree.KERNEL32(10016ACC,00000000,?,?,?,?,10016ACC,?,?,10016FF0), ref: 100174D5
Part of subcall function 100174B0: _free.LIBCMT ref: 100174EF

HeapDestroy.KERNEL32(00000000,?,?,10016FF0), ref: 10016AD3
HeapCreate.KERNEL32(?,?,?,?,?,10016FF0), ref: 10016AE2
_free.LIBCMT ref: 10016AF2
HeapDestroy.KERNEL32(?,10016FF0), ref: 10016B22

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Heap$Destroy_free$CreateFree
String ID:
API String ID: 4097506873-0
Opcode ID: 5821550070371558d6326ac293e511f2d9706211c5074b01848d33611e582a02
Instruction ID: 26b69236e6c287892c4b939c4df5092f0c49b63a1c7adf96395978ecd4ddac7a
Opcode Fuzzy Hash: 5821550070371558d6326ac293e511f2d9706211c5074b01848d33611e582a02
Instruction Fuzzy Hash: 07F01DB5200602AFEB05DF75DC48B46BBB8FF08345F404218E409CBA51DB35E4A5CBD0

Function 1001BB70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 1001BB2C
Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 1001BB66

Part of subcall function 1001ED68: std::exception::exception.LIBCMT ref: 1001ED7E
Part of subcall function 1001ED68: __CxxThrowException@8.LIBCMT ref: 1001ED93

Strings

vector<T> too long, xrefs: 1001BBD8

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Exception@8Internal_throw_exceptionThrow_memmovestd::exception::exception
String ID: vector<T> too long
API String ID: 3224774664-3788999226
Opcode ID: 6098c6dfe018a0d1be71fac0227d1825c4ecc01241087ebe161bd52a6db14e3a
Instruction ID: eae54de508585d01ba0ea4a69c7d47a938ab1ba8a2878b9bbe041104eb365bc3
Opcode Fuzzy Hash: 6098c6dfe018a0d1be71fac0227d1825c4ecc01241087ebe161bd52a6db14e3a
Instruction Fuzzy Hash: 3C312876700A295BC714CEADDCC189ABB99EB88370724823AF918CB644D771F991C7D0

Function 100065C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 10006720
construct.LIBCPMTD ref: 1000674A

Strings

wmic cpu get processorid, xrefs: 100065E0

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: char_traitsconstruct
String ID: wmic cpu get processorid
API String ID: 489808500-2204115948
Opcode ID: 1010ae759fa7e10457475eff9b78d9461d1f2c37ab24339ddda26cbfa1624876
Instruction ID: dd645ee37d0e35d6a0c4dc76963d6f74060cdeeedd1d1d5c8c6965c7acc1db0f
Opcode Fuzzy Hash: 1010ae759fa7e10457475eff9b78d9461d1f2c37ab24339ddda26cbfa1624876
Instruction Fuzzy Hash: 01410F75E00209DFDB08CF98D891AEEB7B6FF4C750F208129E915A7385DB35A941CBA4

Function 100113C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81fileCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 10011461
DeleteFileA.KERNEL32(?), ref: 100114B6

Part of subcall function 10011580: _memset.LIBCMT ref: 100115CC
Part of subcall function 10011580: GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 100115E0
Part of subcall function 10011580: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 10011647
Part of subcall function 10011580: GetFileSize.KERNEL32(000000FF,00000000), ref: 10011669
Part of subcall function 10011580: ReadFile.KERNEL32(000000FF,?,00000000,00000000,00000000), ref: 100116B4

Strings

.key, xrefs: 1001149B

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$DirectorySystem$CreateDeleteReadSize_memset
String ID: .key
API String ID: 3518743009-343438762
Opcode ID: eb43b5ddff7011dff6964891f9a77986a6cb4ad83d3904fe4c7462824836723d
Instruction ID: c5e3bf08ea98db34f13579d809896ca9d031d76340f358e502fc38b765e240d6
Opcode Fuzzy Hash: eb43b5ddff7011dff6964891f9a77986a6cb4ad83d3904fe4c7462824836723d
Instruction Fuzzy Hash: 9F31E675A0025C9BDB28CF64DC42BEEB7B9EB45310F5081A9F9059B281DB35AE85CB90

Function 10019CC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

StrChrA.SHLWAPI(?,0000003A,?), ref: 10019CE4
_swscanf.LIBCMT ref: 10019D1E

Strings

%d.%d.%d.%d%c, xrefs: 10019D18

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _swscanf
String ID: %d.%d.%d.%d%c
API String ID: 2748852333-2398565245
Opcode ID: 18e54956b6ff5e5e5f09465d7c17339f29108a54fe6fde34eeeaabc51fafe8c6
Instruction ID: ed2d36106069c91f8a44cef8226e493977f524409a11eb0d6646e4ffefc909ba
Opcode Fuzzy Hash: 18e54956b6ff5e5e5f09465d7c17339f29108a54fe6fde34eeeaabc51fafe8c6
Instruction Fuzzy Hash: 37118232A001189BEB15DFA4D841AFE73BCEF19201F4101AEE90ADB151DB71EA848792

Function 1000F5B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40windowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 1000F5EB
MessageBoxA.USER32(00000000), ref: 1000F5F2

Strings

Shell_TrayWnd, xrefs: 1000F5E6

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: FindMessageWindow
String ID: Shell_TrayWnd
API String ID: 2823233367-2988720461
Opcode ID: fa6ae15565b281fa731f87bbf66bd491b581fbd42e31be7702e6434cd4fda3cb
Instruction ID: 8a2575e9232a4e6788a4e3303b54ed8dbf7533174b6017679d5c7ff6e03b4625
Opcode Fuzzy Hash: fa6ae15565b281fa731f87bbf66bd491b581fbd42e31be7702e6434cd4fda3cb
Instruction Fuzzy Hash: 240116B4D00208EFEB10CFA4D949B9EB7F4FB48341F2084A9E905A7394D675AF40AB54

Function 10012130 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1001214F
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 10012162

Strings

@, xrefs: 10012157

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus_memset
String ID: @
API String ID: 587104284-2766056989
Opcode ID: d7d7f9b0b0953cb5caef1f62c0310114e2340016ed59b2748a12603957ba9fb6
Instruction ID: 3d7f5f32418326eb2dbc6e30da0d634f8bec6cfce8173ea13a502be2592b4bca
Opcode Fuzzy Hash: d7d7f9b0b0953cb5caef1f62c0310114e2340016ed59b2748a12603957ba9fb6
Instruction Fuzzy Hash: 20F06DB0A10208ABDB14DFA4C941B9DBBF8EF18300F50412CE909EB381DB34EA45CB80

Function 1000F3B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000F3D5
wsprintfA.USER32 ref: 1000F3ED

Part of subcall function 1000F630: _memset.LIBCMT ref: 1000F648
Part of subcall function 1000F630: CreateProcessA.KERNEL32(00000000,1000F402,00000000,00000000,00000001,08000020,00000000,00000000,00000044,00000000), ref: 1000F686
Part of subcall function 1000F630: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1000F696
Part of subcall function 1000F630: CloseHandle.KERNEL32(00000000), ref: 1000F6A0
Part of subcall function 1000F630: CloseHandle.KERNEL32(?), ref: 1000F6AA

Strings

taskkill /f /t /im %s, xrefs: 1000F3E1

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle_memset$CreateObjectProcessSingleWaitwsprintf
String ID: taskkill /f /t /im %s
API String ID: 1221303216-1431264914
Opcode ID: e147f47295d6159a0972dd24f2dc00c959dda93d6aa0ae33a39929a26f1210c1
Instruction ID: 7a26d32dd3a77ef8c91e8ca8fb8e6281576ca4a882f0339c21baba38ccc25a09
Opcode Fuzzy Hash: e147f47295d6159a0972dd24f2dc00c959dda93d6aa0ae33a39929a26f1210c1
Instruction Fuzzy Hash: 33F05475E00108ABDF10DBA4DD46BA973B8EF54204F4040A8F94DDB182EE75BB58CB91

Function 1001BBF0 Relevance: 5.1, APIs: 4, Instructions: 133memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000054,?,00000000), ref: 1001BC70
SetLastError.KERNEL32(00000000), ref: 1001BC7F
LeaveCriticalSection.KERNEL32(00000054), ref: 1001BCA7
HeapFree.KERNEL32(?,00000000,?,?), ref: 1001BD36

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterErrorFreeHeapLastLeave
String ID:
API String ID: 132244544-0
Opcode ID: 5ee7b2dd0110e595599aec328bd6a18fa6e2e8a676dff69a3f1635a7451a1511
Instruction ID: 85bd10d27e0b442e1dab5c9d78a6aaa91c45580178b632b1c4d7f06aa4383219
Opcode Fuzzy Hash: 5ee7b2dd0110e595599aec328bd6a18fa6e2e8a676dff69a3f1635a7451a1511
Instruction Fuzzy Hash: 90418E75A00649AFDB14CFA8D884BAEB7F8FF48350F10052AED05DB351DB35E9808B91

Function 1001CEA0 Relevance: 5.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,1DFFD115,?,?,?,?,0000000F,10035F78,000000FF,?,1001CE86), ref: 1001CED9
EnterCriticalSection.KERNEL32(?,1DFFD115,?,?,?,?,0000000F,10035F78,000000FF,?,1001CE86), ref: 1001CF09
LeaveCriticalSection.KERNEL32(?,?,?,?,0000000F,10035F78,000000FF,?,1001CE86), ref: 1001CF3A
SetLastError.KERNEL32(00000057,1DFFD115,?,?,?,?,0000000F,10035F78,000000FF,?,1001CE86), ref: 1001CF6A

Memory Dump Source

Source File: 00000006.00000002.3054387752.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3054340307.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054474547.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3054812215.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: 5a7bbe1e01743a2055287aad97c0971164d7a590c1f1937ca8fb7b3f6b1a058c
Instruction ID: 7325f94427708edb1f6ad39a4a2f2957c0187faf522ed9944e05cc5fe4afe9c1
Opcode Fuzzy Hash: 5a7bbe1e01743a2055287aad97c0971164d7a590c1f1937ca8fb7b3f6b1a058c
Instruction Fuzzy Hash: B0218932A04248EFDB11CF58CC84F9ABBBAFB89761F10466EE8149A291D735D981CB50

Analysis Process: rundll32.exePID: 1784, Parent PID: 180COMMON

Executed Functions

Function 00530A09 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 178nativememorywindowCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(-00000001,00000022,005326FB,00000004,00000000), ref: 00530A8A
NtSetInformationProcess.NTDLL(-00000001,00000022,?,00000004,005309F7,0000005D), ref: 00530AAA
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,00000004,005309F7,0000005D), ref: 00530ACC
wsprintfA.USER32(?,?,?,?), ref: 00530B74
MessageBoxA.USER32(00000000,?,?,00000010), ref: 00530B8C

Strings

Application error, xrefs: 00530B88
SWVU, xrefs: 00530A79, 00530AD8, 00530AEC, 00530AF2, 00530AF8, 00530B15, 00530BC8
The procedure %s could not be located in the DLL %s., xrefs: 00530B6C

Memory Dump Source

Source File: 00000007.00000003.2168929398.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_530000_rundll32.jbxd

Similarity

API ID: InformationProcess$AllocMessageQueryVirtualwsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 2902211186-4283279704
Opcode ID: de0e8ee88c8a98f7b8a38ace4394a491acda8513ba92f7ded7199e416edf0d91
Instruction ID: ba88ecb875cf2e488da5f5642fade325ba9b21567fa9d8ee2f486c84f9552662
Opcode Fuzzy Hash: de0e8ee88c8a98f7b8a38ace4394a491acda8513ba92f7ded7199e416edf0d91
Instruction Fuzzy Hash: DB41B0726017469FEB359F24CC69BABBBA8FF44781F004528EE4697284DB70AD10CB54

Function 00530A95 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140memorynativewindowCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL(-00000001,00000022,?,00000004,005309F7,0000005D), ref: 00530AAA
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,00000004,005309F7,0000005D), ref: 00530ACC
wsprintfA.USER32(?,?,?,?), ref: 00530B74
MessageBoxA.USER32(00000000,?,?,00000010), ref: 00530B8C
ExitProcess.KERNEL32(00000000), ref: 00530B94
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 00530BE7

Strings

Application error, xrefs: 00530B88
SWVU, xrefs: 00530AD8, 00530AEC, 00530AF2, 00530AF8, 00530B15, 00530BC8
The procedure %s could not be located in the DLL %s., xrefs: 00530B6C

Memory Dump Source

Source File: 00000007.00000003.2168929398.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_530000_rundll32.jbxd

Similarity

API ID: ProcessVirtual$AllocExitFreeInformationMessagewsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 2788668848-4283279704
Opcode ID: f644d6bb55c65f053268db4f25cec8320b3bbf1d1d06db4825fff5ba47126e3b
Instruction ID: 8391ea42fdc1797dd4320df7ee6e380f40504d26fb42a9789caf3b16a512e9d1
Opcode Fuzzy Hash: f644d6bb55c65f053268db4f25cec8320b3bbf1d1d06db4825fff5ba47126e3b
Instruction Fuzzy Hash: 43319D7124138A9BDB399F20CC69FEF7BACEF45781F004529FE46862C5DA74A9108A64

Function 005313BF Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00001000,00000004,?,?), ref: 005313EA
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 00531403

Memory Dump Source

Source File: 00000007.00000003.2168929398.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_530000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 460e07aa1c6cfb092b5f976fa85d581fca477865be9a128e2591be7121e923ca
Instruction ID: b1d429a417b6c49ed05833987fabd77db929dafd5a81931b874044704500e5e3
Opcode Fuzzy Hash: 460e07aa1c6cfb092b5f976fa85d581fca477865be9a128e2591be7121e923ca
Instruction Fuzzy Hash: 74F08276200305AFDB19CF40C844FEA7779EB48391F104176EA42AB684C670F5148B10

Function 0053082D Relevance: 2.6, APIs: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,-00000436,00001000,00000004), ref: 0053087D
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 005308A9

Memory Dump Source

Source File: 00000007.00000003.2168929398.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_530000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7e515f7c385f7f07b94d9a5cb9b23266753d833ffbaa65bc10218dcc86593253
Instruction ID: 4426bb100af0c1772b8f7cacb043132421f1b2e67447461f6e8d2d46386c02ed
Opcode Fuzzy Hash: 7e515f7c385f7f07b94d9a5cb9b23266753d833ffbaa65bc10218dcc86593253
Instruction Fuzzy Hash: 2D018471A01214BBEB04CE99CC41FAFB7A9EBC8760F14C16AF61897385D674AD10CBA0

Analysis Process: rundll32.exePID: 5688, Parent PID: 180COMMON

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	98.5%
Signature Coverage:	0%
Total number of Nodes:	457
Total number of Limit Nodes:	8

Executed Functions

Function 10013A20 Relevance: 50.9, APIs: 17, Strings: 12, Instructions: 185
filesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 10013A60
swprintf.LIBCMT ref: 10013A86
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 10013A99
GetLastError.KERNEL32 ref: 10013AA5

Part of subcall function 10022BD3: _doexit.LIBCMT ref: 10022BDD

Part of subcall function 100138F0: _memset.LIBCMT ref: 10013918
Part of subcall function 100138F0: RegOpenKeyExA.ADVAPI32(80000001,101AFE40,00000000,00020006,?), ref: 10013944
Part of subcall function 100138F0: _sprintf.LIBCMT ref: 1001397C
Part of subcall function 100138F0: _strlen.LIBCMT ref: 1001398B
Part of subcall function 100138F0: RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,?), ref: 100139D7
Part of subcall function 100138F0: RegCloseKey.ADVAPI32(?), ref: 100139EA

IsUserAnAdmin.SHELL32 ref: 10013AC2
ReleaseMutex.KERNEL32(00000000), ref: 10013ADC
_memset.LIBCMT ref: 10013B1C
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 10013B32
_sprintf.LIBCMT ref: 10013B4E
DeleteFileA.KERNEL32(?), ref: 10013B5D
MoveFileA.KERNEL32(?,?), ref: 10013B71
_wprintf.LIBCMT ref: 10013CAC
_strlen.LIBCMT ref: 10013CB9

Strings

%s%s, xrefs: 10013B42
RunService !, xrefs: 10013C68
Yyickg caosusmk, xrefs: 10013C7A
Eaiawk mgqwgoywasgymoeeuu, xrefs: 10013C75
TMzsft xtnogaqk, xrefs: 10013C31, 10013C5F, 10013C7F
206.238.77.142, xrefs: 10013A70, 10013CF1
service_is_exist !, xrefs: 10013C24
EnOperationMode Error !, xrefs: 10013CA7
206.238.77.142, xrefs: 10013CB4, 10013CDA
%s:%hd, xrefs: 10013A75
Windows Update, xrefs: 10013B38, 10013C04
C:\Users\Public\Documents\, xrefs: 10013B3D

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File_memset$Mutex_sprintf_strlen$AdminCloseCreateDeleteErrorLastModuleMoveNameOpenReleaseUserValue_doexit_wprintfswprintf
String ID: %s%s$%s:%hd$206.238.77.142$206.238.77.142$C:\Users\Public\Documents\$Eaiawk mgqwgoywasgymoeeuu$EnOperationMode Error !$RunService !$TMzsft xtnogaqk$Windows Update$Yyickg caosusmk$service_is_exist !
API String ID: 2228167989-1563067711
Opcode ID: 2fc02c7820abb1e6e7b02b1e9042d30205a633eb3f33f25fe0a671c5299acd93
Instruction ID: 8ce7a2c48d05da8e1d18419a98124d55002a878a035d7289134c72219816da3c
Opcode Fuzzy Hash: 2fc02c7820abb1e6e7b02b1e9042d30205a633eb3f33f25fe0a671c5299acd93
Instruction Fuzzy Hash: CB61ECB5944314AAE721D7A08C87BE977B8EF00741F804099F6496D5D3EB78DAC4CBA2

Function 1000D890 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 142
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000), ref: 1000D8B6
GetLastError.KERNEL32 ref: 1000D8C0
CryptCreateHash.ADVAPI32(00000000,00000000,00000000,00000000,?), ref: 1000D8E1
GetLastError.KERNEL32 ref: 1000D8EB
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 1000D8FA

Strings

%02X, xrefs: 1000D9C8

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorLast$AcquireCreateHashRelease
String ID: %02X
API String ID: 4104741015-436463671
Opcode ID: 783f6aeacaf77bddf85f865987ab6f2245b3743a8a3a9c8136557c6450919572
Instruction ID: e6624ba5d8ed9705aec1f79a9e38e76f649a0541b50efeb1c6887bd17401cf19
Opcode Fuzzy Hash: 783f6aeacaf77bddf85f865987ab6f2245b3743a8a3a9c8136557c6450919572
Instruction Fuzzy Hash: AE51C5B5A00219EFEB14DFA4CC85BEEB7B4FB48300F108559FA15AB295D778A940CF61

Function 00B10A09 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 178nativememorywindowCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(-00000001,00000022,00B126FB,00000004,00000000), ref: 00B10A8A
NtSetInformationProcess.NTDLL(-00000001,00000022,?,00000004,00B109F7,0000005D), ref: 00B10AAA
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000004,00B109F7,0000005D), ref: 00B10ACC
wsprintfA.USER32(?,?,?,?), ref: 00B10B74
MessageBoxA.USER32(00000000,?,?,00000010), ref: 00B10B8C

Strings

Application error, xrefs: 00B10B88
The procedure %s could not be located in the DLL %s., xrefs: 00B10B6C
SWVU, xrefs: 00B10A79, 00B10AD8, 00B10AEC, 00B10AF2, 00B10AF8, 00B10B15, 00B10BC8

Memory Dump Source

Source File: 0000000E.00000003.2279305836.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_b10000_rundll32.jbxd

Similarity

API ID: InformationProcess$AllocMessageQueryVirtualwsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 2902211186-4283279704
Opcode ID: de0e8ee88c8a98f7b8a38ace4394a491acda8513ba92f7ded7199e416edf0d91
Instruction ID: 2d108d7b0d255283aec6670e0109959256a125daad4d79a2d08688890311dace
Opcode Fuzzy Hash: de0e8ee88c8a98f7b8a38ace4394a491acda8513ba92f7ded7199e416edf0d91
Instruction Fuzzy Hash: 5441D072611746AFEB35AF24CC55FEB73A8EF04781F404568EE0597288DBB0AD90CB94

Function 00B10A95 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140memorynativewindowCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL(-00000001,00000022,?,00000004,00B109F7,0000005D), ref: 00B10AAA
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000004,00B109F7,0000005D), ref: 00B10ACC
wsprintfA.USER32(?,?,?,?), ref: 00B10B74
MessageBoxA.USER32(00000000,?,?,00000010), ref: 00B10B8C
ExitProcess.KERNEL32(00000000), ref: 00B10B94
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 00B10BE7

Strings

Application error, xrefs: 00B10B88
The procedure %s could not be located in the DLL %s., xrefs: 00B10B6C
SWVU, xrefs: 00B10AD8, 00B10AEC, 00B10AF2, 00B10AF8, 00B10B15, 00B10BC8

Memory Dump Source

Source File: 0000000E.00000003.2279305836.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_b10000_rundll32.jbxd

Similarity

API ID: ProcessVirtual$AllocExitFreeInformationMessagewsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 2788668848-4283279704
Opcode ID: f644d6bb55c65f053268db4f25cec8320b3bbf1d1d06db4825fff5ba47126e3b
Instruction ID: eccc78b599f17ae4db4a13088ee46b2a5036d8dc4fb74ceb0749e951a28fe42b
Opcode Fuzzy Hash: f644d6bb55c65f053268db4f25cec8320b3bbf1d1d06db4825fff5ba47126e3b
Instruction Fuzzy Hash: 9731E071251386ABDB39AF20CC55FEF37ACEF05781F004169FE4286285DEB0A9908B10

Function 1000CFC0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 251
processpipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 1000D055
_memset.LIBCMT ref: 1000D08B
_memset.LIBCMT ref: 1000D09E
_memset.LIBCMT ref: 1000D0B1
CreatePipe.KERNELBASE(?,?,0000000C,00000000), ref: 1000D10C
GetStartupInfoA.KERNEL32(00000044), ref: 1000D12D
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,00000000), ref: 1000D17E
CloseHandle.KERNEL32(?,?), ref: 1000D39A
CloseHandle.KERNEL32(?), ref: 1000D3A7
CloseHandle.KERNEL32(?), ref: 1000D3B4
CloseHandle.KERNEL32(?), ref: 1000D3C1

Strings

wmic cpu get processorid, xrefs: 1000D000
ProcessorId, xrefs: 1000D00B
D, xrefs: 1000D0CD

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle_memset$Create$InfoPipeProcessStartup
String ID: D$ProcessorId$wmic cpu get processorid
API String ID: 1762129635-53154263
Opcode ID: 2faa9055df3024060b3a78fac8b67b6add4b8c37b23ad85aa60008f06d3c8044
Instruction ID: 29feaeb9d2e0a167578c768367cdbb99c1f13e7196a5b6bb9c176603c2bdf5a2
Opcode Fuzzy Hash: 2faa9055df3024060b3a78fac8b67b6add4b8c37b23ad85aa60008f06d3c8044
Instruction Fuzzy Hash: D1B14E75902228DFEB29DB60CC99BDEB7B4FB48340F1041DAE109A7181DB756B84CF50

Function 1000D420 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 250
processpipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 1000D4B4
_memset.LIBCMT ref: 1000D4EA
_memset.LIBCMT ref: 1000D4FD
_memset.LIBCMT ref: 1000D510
CreatePipe.KERNELBASE(?,?,0000000C,00000000), ref: 1000D56B
GetStartupInfoA.KERNEL32(00000044), ref: 1000D58C
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,00000000), ref: 1000D5DD
CloseHandle.KERNEL32(?,?), ref: 1000D7F9
CloseHandle.KERNEL32(?), ref: 1000D806
CloseHandle.KERNEL32(?), ref: 1000D813
CloseHandle.KERNEL32(?), ref: 1000D820

Strings

SerialNumber, xrefs: 1000D46A
wmic diskdrive get serialnumber, xrefs: 1000D460
D, xrefs: 1000D52C

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle_memset$Create$InfoPipeProcessStartup
String ID: D$SerialNumber$wmic diskdrive get serialnumber
API String ID: 1762129635-2526680146
Opcode ID: 284479aef56905e99ef7afbd9686248a6d4ef8a24c59542d99c3aafd4a34ee3f
Instruction ID: f7e6dc397231a2a0a1082a64f52227403f3a6002e1c9f0e787add4f7ccce3aad
Opcode Fuzzy Hash: 284479aef56905e99ef7afbd9686248a6d4ef8a24c59542d99c3aafd4a34ee3f
Instruction Fuzzy Hash: 8CB12B759162289BEB28DB64CC9DBEEB7B4FB48300F0041DAE50DAA191DB756B84CF50

Function 10026FE8 Relevance: 16.8, APIs: 11, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 10027021

Part of subcall function 100258DC: __getptd_noexit.LIBCMT ref: 100258DC

__gmtime64_s.LIBCMT ref: 100270BA
__gmtime64_s.LIBCMT ref: 100270F0
__gmtime64_s.LIBCMT ref: 1002710D
__allrem.LIBCMT ref: 10027163
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1002717F
__allrem.LIBCMT ref: 10027196
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 100271B4
__allrem.LIBCMT ref: 100271CB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 100271E9
__invoke_watson.LIBCMT ref: 1002725A

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: faf785f0e9591b3d4b811fc4296c87dcbc334db000ad1bf2518f1b08427d47ec
Instruction ID: 713491a1cde179dae1e75a0093b68b8f74a69f94e9f1ec33854f382ae24b7f6e
Opcode Fuzzy Hash: faf785f0e9591b3d4b811fc4296c87dcbc334db000ad1bf2518f1b08427d47ec
Instruction Fuzzy Hash: 6B71D476A00717EBE715DE78EC82B5AB3E8FF40364F91412AF918D6681E770ED448790

Function 6C696740 Relevance: 6.2, APIs: 4, Instructions: 243
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(0000FFFF,00000000,00001000,00000004), ref: 6C6969A4
_memset.LIBCMT ref: 6C696A4C
VirtualAlloc.KERNELBASE(0000FFFF,000000B8,00001000,00000004,?,6C698C38), ref: 6C696B0E
_memmove.LIBCMT ref: 6C696B70

Memory Dump Source

Source File: 0000000E.00000002.3013317433.000000006C681000.00000040.00000001.01000000.00000003.sdmp, Offset: 6C680000, based on PE: true

Associated: 0000000E.00000002.3013239239.000000006C680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000E.00000002.3013317433.000000006C9C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000E.00000002.3013317433.000000006CBAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000E.00000002.3013317433.000000006CBB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000E.00000002.3013317433.000000006CBB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000E.00000002.3015754617.000000006CC55000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c680000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocVirtual$_memmove_memset
String ID:
API String ID: 725130153-0
Opcode ID: af01bac3374c618721e138754d3ca3c72d74494653e4f821ac976264aae05339
Instruction ID: 395c12fc52dce5ac1d009dabf2c6e74aa10fdb6c514c0d7e02ec50b25f49a4c4
Opcode Fuzzy Hash: af01bac3374c618721e138754d3ca3c72d74494653e4f821ac976264aae05339
Instruction Fuzzy Hash: D9D16F75B0260DCFCB48CFD9E593A2DBBB1FB8A300B14821AD8A587754DB30A941CF49

Function 00B113BF Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,00001000,00000004,?,?), ref: 00B113EA
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 00B11403

Memory Dump Source

Source File: 0000000E.00000003.2279305836.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_b10000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 460e07aa1c6cfb092b5f976fa85d581fca477865be9a128e2591be7121e923ca
Instruction ID: b1d429a417b6c49ed05833987fabd77db929dafd5a81931b874044704500e5e3
Opcode Fuzzy Hash: 460e07aa1c6cfb092b5f976fa85d581fca477865be9a128e2591be7121e923ca
Instruction Fuzzy Hash: 74F08276200305AFDB19CF40C844FEA7779EB48391F104176EA42AB684C670F5148B10

Function 1002CE25 Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 1002CE3C

Part of subcall function 10027FF1: __mtinitlocknum.LIBCMT ref: 10028003
Part of subcall function 10027FF1: __amsg_exit.LIBCMT ref: 1002800F
Part of subcall function 10027FF1: EnterCriticalSection.KERNEL32(?,?,10025D6D,0000000D), ref: 1002801C

__tzset_nolock.LIBCMT ref: 1002CE4F

Part of subcall function 1002D09F: __lock.LIBCMT ref: 1002D0C1
Part of subcall function 1002D09F: ____lc_codepage_func.LIBCMT ref: 1002D108
Part of subcall function 1002D09F: __getenv_helper_nolock.LIBCMT ref: 1002D129
Part of subcall function 1002D09F: _free.LIBCMT ref: 1002D15C
Part of subcall function 1002D09F: _strlen.LIBCMT ref: 1002D163
Part of subcall function 1002D09F: __malloc_crt.LIBCMT ref: 1002D16A

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: fc85f6cf18a6252e642b57c3e1c2b749fe30e0e1031c663e82c605452884cce2
Instruction ID: a2ad06c6b65e7629715c0b93b357caa5f945d3fedfb1b9c2ad21f9bf3716e497
Opcode Fuzzy Hash: fc85f6cf18a6252e642b57c3e1c2b749fe30e0e1031c663e82c605452884cce2
Instruction Fuzzy Hash: 0BE0C238451A48D9DF10EBF0AA4275C32F0FB04B66FE20209E004041D28F7D35888923

Function 10022833 Relevance: 3.0, APIs: 2, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 10022839

Part of subcall function 10022801: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,1002283E,00000000,?,100280A4,000000FF,0000001E,101B7BE8,00000008,10028008,00000000,?), ref: 10022810
Part of subcall function 10022801: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 10022822

ExitProcess.KERNEL32 ref: 10022842

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 3bf28b7052921138b5cd44a98d3311a828cfa0a63c341592180aa8684d3b340a
Instruction ID: c8f4cf039e012b41d150cd44d72804b099170dd8f7fcc5d26d0c23f5f7bd029f
Opcode Fuzzy Hash: 3bf28b7052921138b5cd44a98d3311a828cfa0a63c341592180aa8684d3b340a
Instruction Fuzzy Hash: B5B09230001108BFDB022F51DC4A8593FA9FB002A0B508020F80809032DF73BA929A81

Function 00B1082D Relevance: 2.6, APIs: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,-00000436,00001000,00000004), ref: 00B1087D
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00B108A9

Memory Dump Source

Source File: 0000000E.00000003.2279305836.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_b10000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7e515f7c385f7f07b94d9a5cb9b23266753d833ffbaa65bc10218dcc86593253
Instruction ID: 7c2231c22552269cc660295264dc84100b832581a91abcc5b612a6dcbc40c4bd
Opcode Fuzzy Hash: 7e515f7c385f7f07b94d9a5cb9b23266753d833ffbaa65bc10218dcc86593253
Instruction Fuzzy Hash: B6018871A011147BE704DE99CC41FAEB7E9EBC8760F14C169F51897385D674AD10CBA0

Function 10021DFA Relevance: 1.5, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 100258DC: __getptd_noexit.LIBCMT ref: 100258DC

_asctime.LIBCMT ref: 10021E5D

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: __getptd_noexit_asctime
String ID:
API String ID: 1865661205-0
Opcode ID: dcfe908546e3f88bc8117c10939122550607e7d39558988ca205b2cb5c272348
Instruction ID: 4125543197aa1fcd6f4b2a2d68e97bfeb0adc15cba48122be1fc6d66b0878a2d
Opcode Fuzzy Hash: dcfe908546e3f88bc8117c10939122550607e7d39558988ca205b2cb5c272348
Instruction Fuzzy Hash: 53F04939A002099EDF00DBA4EC56BCE77ECEF28255FD20469EC05EB091EB74E9848725

Function 10036500 Relevance: 1.5, APIs: 1, Instructions: 22
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202), ref: 1003651E

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: d3557ac59b8f8fefe8b80b3b61d78a442e21de74061af108e84e171f57d9cb46
Instruction ID: a027679b03284c68216ebb438d11db6f7a8099bc69e3ea9b22835e59c52e58d0
Opcode Fuzzy Hash: d3557ac59b8f8fefe8b80b3b61d78a442e21de74061af108e84e171f57d9cb46
Instruction Fuzzy Hash: ABE0DF74A04208ABCB00DBB4DD0755D77F4EF49200F80016CF9098B252EB34AA148A82

Function 10022BD3 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 10022BDD

Part of subcall function 10022AA4: __lock.LIBCMT ref: 10022AB2
Part of subcall function 10022AA4: DecodePointer.KERNEL32(101B78D8,0000001C,10022A1B,00000000,00000001,00000000,?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022AF1
Part of subcall function 10022AA4: DecodePointer.KERNEL32(?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B02
Part of subcall function 10022AA4: EncodePointer.KERNEL32(00000000,?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B1B
Part of subcall function 10022AA4: DecodePointer.KERNEL32(-00000004,?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B2B
Part of subcall function 10022AA4: EncodePointer.KERNEL32(00000000,?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B31
Part of subcall function 10022AA4: DecodePointer.KERNEL32(?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B47
Part of subcall function 10022AA4: DecodePointer.KERNEL32(?,1002296B,000000FF,?,10028014,00000011,?,?,10025D6D,0000000D), ref: 10022B52
Part of subcall function 10022AA4: __initterm.LIBCMT ref: 10022B7A
Part of subcall function 10022AA4: __initterm.LIBCMT ref: 10022B8B

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode__initterm$__lock_doexit
String ID:
API String ID: 3712619029-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: cfc2533f0be627bc8b7b8cac997dbfbd0b87b13c6f736a1528db1b5c4a82aaa4
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: 06B0123158030C33E9201581FC03F093B1C8F80A60F500020FF0C1C5E1A593756080CA

Non-executed Functions

Function 10012550 Relevance: 54.6, APIs: 24, Strings: 7, Instructions: 308servicefileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,0F3104C0,?,?,?,00000000,10023340,101B6C90,000000FE,?,10013C89,TMzsft xtnogaqk,Yyickg caosusmk,Eaiawk mgqwgoywasgymoeeuu), ref: 10012594
ExpandEnvironmentStringsA.KERNEL32(C:\Users\Public\Documents\,?,00000104,?,?,?,00000000,10023340,101B6C90,000000FE,?,10013C89,TMzsft xtnogaqk,Yyickg caosusmk,Eaiawk mgqwgoywasgymoeeuu), ref: 100125AB
_strlen.LIBCMT ref: 100125B8
_strncmp.LIBCMT ref: 100125CF
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 1001270E

Part of subcall function 10012300: _memset.LIBCMT ref: 10012328
Part of subcall function 10012300: _strlen.LIBCMT ref: 1001234F
Part of subcall function 10012300: _strncpy.LIBCMT ref: 10012382
Part of subcall function 10012300: CreateDirectoryA.KERNEL32(00000000,00000000), ref: 100123A9

wsprintfA.USER32 ref: 10012616
_strlen.LIBCMT ref: 10012626
_strlen.LIBCMT ref: 10012642
CopyFileA.KERNEL32(?,?,00000000), ref: 100126AE
_memset.LIBCMT ref: 100126C2
_strcat.LIBCMT ref: 100126D8
CreateServiceA.ADVAPI32(?,?,?,000F01FF,00000110,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000), ref: 10012756
LockServiceDatabase.ADVAPI32(?), ref: 10012769
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 10012799
ChangeServiceConfig2A.ADVAPI32(00000000,00000002,00015180), ref: 10012877
UnlockServiceDatabase.ADVAPI32(?), ref: 10012884
GetLastError.KERNEL32 ref: 10012893
OpenServiceA.ADVAPI32(?,?,000F01FF), ref: 100128B0

Strings

SYSTEM\CurrentControlSet\Services\, xrefs: 10012983, 10012986
Yyickg caosusmk, xrefs: 1001277D
s, xrefs: 100125F5
Description, xrefs: 10012A05, 10012A08
%, xrefs: 100125EE
Windows Update, xrefs: 10012603
C:\Users\Public\Documents\, xrefs: 100125A6

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Service$_strlen$ChangeConfig2CreateDatabaseFileOpen_memset$CopyDirectoryEnvironmentErrorExpandLastLockManagerModuleNameStringsUnlock_strcat_strncmp_strncpywsprintf
String ID: %$C:\Users\Public\Documents\$Description$SYSTEM\CurrentControlSet\Services\$Windows Update$Yyickg caosusmk$s
API String ID: 2269191997-3217403557
Opcode ID: da25e49445566c96217ba80189cd2cecd7e86491d1e1acde59f2152fe1c39007
Instruction ID: 58a78215622ab89836c283d46f1977e4f6cad2cf6e4b3b9b80a50220f8474d07
Opcode Fuzzy Hash: da25e49445566c96217ba80189cd2cecd7e86491d1e1acde59f2152fe1c39007
Instruction Fuzzy Hash: BEE17471D04298DFEB26CB94DC88BDE7BB8BB15704F0441D9E5486A2C1C7B95B88CF61

Function 1001C580 Relevance: 7.7, APIs: 5, Instructions: 151networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32(?,?,?,?,?,?,1001C326,FFFFFFFF,?,?,?,FFFFFFFF,?), ref: 1001C5E3

Part of subcall function 100172C0: __CxxThrowException@8.LIBCMT ref: 100172D2
Part of subcall function 100172C0: EnterCriticalSection.KERNEL32(00000000,0F3104C0,00000000,00000098,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005), ref: 10017312
Part of subcall function 100172C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005,?,100168C9,00000400,00000400), ref: 1001737B

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterErrorException@8LastLeaveThrow
String ID:
API String ID: 1367629879-0
Opcode ID: 1a78252def1050f5be20003a34375eeef4699fcd1b0fa4c910ffc5e1ea9ae854
Instruction ID: 2045c5cf5837c9daf880452df431a01197e78d674d59fb6298516e1ae159bddb
Opcode Fuzzy Hash: 1a78252def1050f5be20003a34375eeef4699fcd1b0fa4c910ffc5e1ea9ae854
Instruction Fuzzy Hash: 7851BEB5900218AFDB21DFA4C841AAE77B5FF44390F100219F8599F291E770EDD0DB91

Function 100153E0 Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 249libraryloaderCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10015432
_memset.LIBCMT ref: 10015448
_memset.LIBCMT ref: 1001545E
LoadLibraryA.KERNEL32(ADVAPI32.dll), ref: 1001546B
GetProcAddress.KERNEL32(00000000,RegQueryValueExA), ref: 10015493
GetProcAddress.KERNEL32(00000000,RegOpenKeyExA), ref: 100154AB
GetProcAddress.KERNEL32(00000000,RegEnumValueA), ref: 100154C3
GetProcAddress.KERNEL32(00000000,RegEnumKeyExA), ref: 100154DB
GetProcAddress.KERNEL32(00000000,RegCloseKey), ref: 100154F3
FreeLibrary.KERNEL32(00000000), ref: 1001553C

Strings

RegQueryValueExA, xrefs: 10015487
RegOpenKeyExA, xrefs: 1001549F
ADVAPI32.dll, xrefs: 10015466
RegEnumKeyExA, xrefs: 100154CF
RegEnumValueA, xrefs: 100154B7
RegCloseKey, xrefs: 100154E7

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$_memset$Library$FreeLoad
String ID: ADVAPI32.dll$RegCloseKey$RegEnumKeyExA$RegEnumValueA$RegOpenKeyExA$RegQueryValueExA
API String ID: 2029490530-3713883646
Opcode ID: ce21794f6d49dae7673cc83d0b588799919480882acf9cc9429ea4c88414c882
Instruction ID: 42d3faf0a6d82433ca9894e8e05647cd2437e6e791ab8efedd1cac75c6c50b36
Opcode Fuzzy Hash: ce21794f6d49dae7673cc83d0b588799919480882acf9cc9429ea4c88414c882
Instruction Fuzzy Hash: 4AB17EB5904629EFDB20DF64CC89BEEB7B4FB48306F0445D8E909AA290D7759AC4CF50

Function 10007130 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 183timeCOMMON

Download Yara Rule

APIs

WinHttpOpen.WINHTTP(curl/7.83.1,00000000,00000000,00000000,00000000), ref: 10007197
WinHttpSetTimeouts.WINHTTP(00000000,000003E8,000003E8,000003E8,000003E8), ref: 100071BE
WinHttpConnect.WINHTTP(00000000,?,00000050,00000000), ref: 100071D6
WinHttpOpenRequest.WINHTTP(00000000,GET,?,00000000,00000000,00000000,00000000), ref: 100071FA
WinHttpSendRequest.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 10007219
WinHttpReceiveResponse.WINHTTP(00000000,00000000), ref: 1000722E
WinHttpQueryHeaders.WINHTTP(00000000,20000013,00000000,00000000,00000004,00000000), ref: 10007264
__CxxThrowException@8.LIBCMT ref: 10007272
WinHttpQueryDataAvailable.WINHTTP(00000000,00000000), ref: 10007293
GetLastError.KERNEL32 ref: 1000729D
__CxxThrowException@8.LIBCMT ref: 100072AF
std::ios_base::clear.LIBCPMTD ref: 100072C8
WinHttpReadData.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000), ref: 100072E4
std::ios_base::clear.LIBCPMTD ref: 100072FF
GetLastError.KERNEL32(00000000), ref: 1000730A
_wprintf.LIBCMT ref: 10007316
WinHttpCloseHandle.WINHTTP(00000000), ref: 10007328
WinHttpCloseHandle.WINHTTP(00000000), ref: 10007338
WinHttpCloseHandle.WINHTTP(00000000), ref: 10007348

Strings

GET, xrefs: 100071F1
Error %d has occurred., xrefs: 10007311
curl/7.83.1, xrefs: 10007192

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Http$CloseHandle$DataErrorException@8LastOpenQueryRequestThrowstd::ios_base::clear$AvailableConnectHeadersReadReceiveResponseSendTimeouts_wprintf
String ID: Error %d has occurred.$GET$curl/7.83.1
API String ID: 3568891788-3281102068
Opcode ID: a0faf76c0c659e3c95fc50e059929233ef8cb015fb8e25ec05d524550362fc63
Instruction ID: 96198f7158a5b0440b015918e988b78723295c7c608185cc2ea97e2543ed712c
Opcode Fuzzy Hash: a0faf76c0c659e3c95fc50e059929233ef8cb015fb8e25ec05d524550362fc63
Instruction Fuzzy Hash: CF7107B1D40248EFEB15DFA0CC99BEEBBB4FB04741F104119F51AAA2D4CB786A45DB50

Function 100123C0 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 117libraryloaderprocessCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(userenv.dll), ref: 100123D8
GetProcAddress.KERNEL32(?,CreateEnvironmentBlock), ref: 100123EA
_memset.LIBCMT ref: 10012417
_memset.LIBCMT ref: 10012427
GetCurrentProcess.KERNEL32 ref: 10012459
OpenProcessToken.ADVAPI32(?,000F01FF,00000000), ref: 1001246F
DuplicateTokenEx.ADVAPI32(00000000,02000000,00000000,00000001,00000001,00000000), ref: 10012488
LoadLibraryA.KERNEL32(Kernel32.dll,WTSGetActiveConsoleSessionId), ref: 10012498
GetProcAddress.KERNEL32(00000000), ref: 1001249F
SetTokenInformation.ADVAPI32(00000000,0000000C,00000000,00000004), ref: 100124C0
CreateProcessAsUserA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000430,00000000,00000000,00000044,00000000), ref: 100124F6
CloseHandle.KERNEL32(00000000), ref: 10012506
CloseHandle.KERNEL32(00000000), ref: 10012510
FreeLibrary.KERNEL32(00000000), ref: 1001252F

Strings

CreateEnvironmentBlock, xrefs: 100123E1
Kernel32.dll, xrefs: 10012493
WTSGetActiveConsoleSessionId, xrefs: 1001248E
D, xrefs: 1001244B
userenv.dll, xrefs: 100123D3

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: LibraryProcessToken$AddressCloseHandleLoadProc_memset$CreateCurrentDuplicateFreeInformationOpenUser
String ID: CreateEnvironmentBlock$D$Kernel32.dll$WTSGetActiveConsoleSessionId$userenv.dll
API String ID: 2385095549-609967149
Opcode ID: ac44d7a654e1ecf9cefedaa459ffae167c2ab3953bef6485a400e85d30f059f2
Instruction ID: fd1ae4a91e3460f93e873eecc7cbeda63378566b322c9237b013182db1ce3722
Opcode Fuzzy Hash: ac44d7a654e1ecf9cefedaa459ffae167c2ab3953bef6485a400e85d30f059f2
Instruction Fuzzy Hash: B741B6B5E00218EFEB14DFE0CC99BAEBBB4FB48705F104518E6156B281D7B59944CF90

Function 10015000 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ADVAPI32.dll), ref: 10015019
GetProcAddress.KERNEL32(?,OpenProcessToken), ref: 1001502B
GetProcAddress.KERNEL32(?,AdjustTokenPrivileges), ref: 1001503D
GetProcAddress.KERNEL32(?,LookupPrivilegeValueA), ref: 1001504F
LoadLibraryA.KERNEL32(kernel32.dll), ref: 1001505D
GetProcAddress.KERNEL32(?,GetCurrentProcess), ref: 1001506F
LoadLibraryA.KERNEL32(KERNEL32.dll), ref: 100150F0
GetProcAddress.KERNEL32(?,GetLastError), ref: 10015102
CloseHandle.KERNEL32(?), ref: 1001511A
FreeLibrary.KERNEL32(00000000), ref: 1001512A
FreeLibrary.KERNEL32(00000000), ref: 1001513A

Strings

OpenProcessToken, xrefs: 10015022
GetLastError, xrefs: 100150F9
AdjustTokenPrivileges, xrefs: 10015034
LookupPrivilegeValueA, xrefs: 10015046
GetCurrentProcess, xrefs: 10015066
kernel32.dll, xrefs: 10015058
KERNEL32.dll, xrefs: 100150EB
ADVAPI32.dll, xrefs: 10015014

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$Load$Free$CloseHandle
String ID: ADVAPI32.dll$AdjustTokenPrivileges$GetCurrentProcess$GetLastError$KERNEL32.dll$LookupPrivilegeValueA$OpenProcessToken$kernel32.dll
API String ID: 2887716753-1648388921
Opcode ID: 09c34ea0c58a1937bffb1c09e732f69496aae19d3495c3a7a974608a733c4652
Instruction ID: 2ba7eb19521ecd2e0521120e7302f927c8c69f99e1a3e1b69f5f98f9208caa0c
Opcode Fuzzy Hash: 09c34ea0c58a1937bffb1c09e732f69496aae19d3495c3a7a974608a733c4652
Instruction Fuzzy Hash: 8441F775A00218EFEB16DFE4CC88BEEBBB5FB08301F144518F905AA291D7799940CBA0

Function 10013360 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

SocketClient.Connect %s,%d, xrefs: 10013497

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: SocketClient.Connect %s,%d
API String ID: 0-4086773378
Opcode ID: 806049d0937e817d2a7edc25e8aa56914ceb32bd5803814fc0c8e8b9f4b12fda
Instruction ID: 63baf142f1b2acfd1537a39fce8e3a032f44fd155c7a3820f2eaebd6526bdc0f
Opcode Fuzzy Hash: 806049d0937e817d2a7edc25e8aa56914ceb32bd5803814fc0c8e8b9f4b12fda
Instruction Fuzzy Hash: 3CC13479804A69CBDB21DF64CC907DEB7B5FF49340F0082D9E409AA291EB749AE4CF50

Function 10015160 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72libraryloaderstringCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 10015178
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 10015190
GetProcAddress.KERNEL32(?,Process32First), ref: 100151A8
GetProcAddress.KERNEL32(?,Process32Next), ref: 100151C0
lstrcmpiA.KERNEL32(1000E8DC,?), ref: 10015243
CloseHandle.KERNEL32(00000000), ref: 10015262
FreeLibrary.KERNEL32(00000000), ref: 10015278

Strings

CreateToolhelp32Snapshot, xrefs: 10015184
kernel32.dll, xrefs: 10015173
Process32First, xrefs: 1001519C
Process32Next, xrefs: 100151B4

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$CloseFreeHandleLoadlstrcmpi
String ID: CreateToolhelp32Snapshot$Process32First$Process32Next$kernel32.dll
API String ID: 1314729832-4285911020
Opcode ID: 1cd6a8fbb2155a4b1985ca30da2e4b0a3f5bfe765f9448f08b89226ab9c6a634
Instruction ID: b23b302b637ae1edde1f60404815d2dee06a1769a5a7b90f0171de9587be8fa8
Opcode Fuzzy Hash: 1cd6a8fbb2155a4b1985ca30da2e4b0a3f5bfe765f9448f08b89226ab9c6a634
Instruction Fuzzy Hash: 4B31AE75911228DBDB61DBA4CD88BEDB7B4FB49301F0005D8E90EAA250DB75AAC4CF50

Function 10018790 Relevance: 18.2, APIs: 12, Instructions: 172memorytimeCOMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 100187D0
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 100187DD
InterlockedDecrement.KERNEL32(00000000), ref: 100187FC
DeleteCriticalSection.KERNEL32(?), ref: 10018819
HeapFree.KERNEL32(?,00000000,?), ref: 10018824
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 100188AF
timeGetTime.WINMM ref: 100188D1
timeGetTime.WINMM ref: 100188DC
InterlockedDecrement.KERNEL32(00000000), ref: 1001890A
DeleteCriticalSection.KERNEL32(-00000018), ref: 10018933
HeapFree.KERNEL32(?,00000000,00000000), ref: 10018940
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 1001894E

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Interlocked$CompareExchange$CriticalDecrementDeleteFreeHeapSectionTimetime
String ID:
API String ID: 2485412644-0
Opcode ID: f37f0bf1c14315c2a0328e2bdc40fd7b1b2d9f8162c99514ea29b688ea27d9bd
Instruction ID: ccbf6a195e50664b114f756a4c275c858458adfb65b41e8f4299d56aa6b79b38
Opcode Fuzzy Hash: f37f0bf1c14315c2a0328e2bdc40fd7b1b2d9f8162c99514ea29b688ea27d9bd
Instruction Fuzzy Hash: 3C51AC76A00615EFDB11CF68CC84B9AB7F8FF04710F204569F919AB291D734EA80CB91

Function 1000E190 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E1DD
_memset.LIBCMT ref: 1000E1FA
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,?,?,?,?,?,?,0F3104C0), ref: 1000E20F
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,\360se6\User Data\,00000000,?,?,?,?,?,?,0F3104C0), ref: 1000E258
Sleep.KERNEL32(000003E8,Default,?,?,?,?,?,?,0F3104C0), ref: 1000E273
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E298

Strings

\360se6\User Data\, xrefs: 1000E22E
360se6.exe, xrefs: 1000E1BB
Default, xrefs: 1000E25E
bak, xrefs: 1000E247

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: 360se6.exe$Default$\360se6\User Data\$bak
API String ID: 2742518391-1576209161
Opcode ID: cf5631d64cf3daff86f29a9e46f2c2e6785fc6ccd8703a21c0b353372ed7785e
Instruction ID: 701f933334c7848fb056ee3a11f22efabf5e93a761c2cecb354365ab54c774ad
Opcode Fuzzy Hash: cf5631d64cf3daff86f29a9e46f2c2e6785fc6ccd8703a21c0b353372ed7785e
Instruction Fuzzy Hash: B6316C75950258ABEB24DB60CC9ABDDB378EB14700F0001E9F5096A2D1EB787B84CF61

Function 1000E2F0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E33D
_memset.LIBCMT ref: 1000E35A
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001C,00000000,?,?,?,?,?,?,0F3104C0), ref: 1000E36F
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,\Google\Chrome\User Data\,00000000,?,?,?,?,?,?,0F3104C0), ref: 1000E3B8
Sleep.KERNEL32(000003E8,Default,?,?,?,?,?,?,0F3104C0), ref: 1000E3D3
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E3F8

Strings

\Google\Chrome\User Data\, xrefs: 1000E38E
chrome.exe, xrefs: 1000E31B
Default, xrefs: 1000E3BE
bak, xrefs: 1000E3A7

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: Default$\Google\Chrome\User Data\$bak$chrome.exe
API String ID: 2742518391-1166745273
Opcode ID: 40d655d6cc16712bff4f2fb1f87b01a0d4e762ec64db6e7df24cb74d5259b5f4
Instruction ID: fecff77be065e459785ac47ee9805b112d0841096ecda917c53accf8bb13844d
Opcode Fuzzy Hash: 40d655d6cc16712bff4f2fb1f87b01a0d4e762ec64db6e7df24cb74d5259b5f4
Instruction Fuzzy Hash: 20316A75950258EBEB24DB60CC9ABD9B378EB14700F0002E9F5096A2D1EB787B84CF65

Function 1000E4A0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E4ED
_memset.LIBCMT ref: 1000E50A
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001C,00000000,?,?,?,?,?,?,0F3104C0), ref: 1000E51F
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,\Tencent\QQBrowser\User Data\,00000000,?,?,?,?,?,?,0F3104C0), ref: 1000E568
Sleep.KERNEL32(000003E8,Default,?,?,?,?,?,?,0F3104C0), ref: 1000E583
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E5A8

Strings

QQBrowser.exe, xrefs: 1000E4CB
\Tencent\QQBrowser\User Data\, xrefs: 1000E53E
Default, xrefs: 1000E56E
bak, xrefs: 1000E557

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: Default$QQBrowser.exe$\Tencent\QQBrowser\User Data\$bak
API String ID: 2742518391-2429508344
Opcode ID: 0e54152de5e706dd32317b2883b6d9b22f54a27d1984d202d2b92858c0c27df3
Instruction ID: 303e9ac27bd1ca3b56e85ec31da4520ec1f556187fdca0bed45659d0685da91e
Opcode Fuzzy Hash: 0e54152de5e706dd32317b2883b6d9b22f54a27d1984d202d2b92858c0c27df3
Instruction Fuzzy Hash: 00316C75950258EFEB24DB60CC9ABD9B378EB14700F0001D9F5096A2D1EB787B84CF61

Function 1000E600 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E64D
_memset.LIBCMT ref: 1000E66A
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,?,?,?,?,?,?,0F3104C0), ref: 1000E67F
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,\Microsoft\,00000000,?,?,?,?,?,?,0F3104C0), ref: 1000E6C8
Sleep.KERNEL32(000003E8,Skype for Desktop,?,?,?,?,?,?,0F3104C0), ref: 1000E6E3
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E708

Strings

Skype for Desktop, xrefs: 1000E6CE
\Microsoft\, xrefs: 1000E69E
Skype.exe, xrefs: 1000E62B
bak, xrefs: 1000E6B7

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: Skype for Desktop$Skype.exe$\Microsoft\$bak
API String ID: 2742518391-3712293284
Opcode ID: 609e6d69384bd8dc0245cb6b53dc543715522320479eba0b398141e820af1bdb
Instruction ID: 5cbbd60c3ee543de6939a2953fd336e89185860d59f2e57474878281ef46e463
Opcode Fuzzy Hash: 609e6d69384bd8dc0245cb6b53dc543715522320479eba0b398141e820af1bdb
Instruction Fuzzy Hash: FB316A75950258ABEB24DB64CC9ABD9B378EB14700F0002E9F5096A2D1EB787B84CF61

Function 10007580 Relevance: 16.7, APIs: 11, Instructions: 233COMMONLIBRARYCODE

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 1000765B
char_traits.LIBCPMTD ref: 1000767F
char_traits.LIBCPMTD ref: 100076B0
char_traits.LIBCPMTD ref: 100076DA
char_traits.LIBCPMTD ref: 10007711
char_traits.LIBCPMTD ref: 10007735

Part of subcall function 10007520: _memmove.LIBCMT ref: 1000753E

char_traits.LIBCPMTD ref: 1000776F
char_traits.LIBCPMTD ref: 1000779B

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: char_traits$_memmove
String ID:
API String ID: 4015421094-0
Opcode ID: 8a46f27c53daf1bb3a5c5b26083eeb91bd03bd6e6ef27442f332e57adb46b26b
Instruction ID: 392e569acab4bc7803cc6a5d1307a5f36e8b576372a140fd2397c7b8e5873d66
Opcode Fuzzy Hash: 8a46f27c53daf1bb3a5c5b26083eeb91bd03bd6e6ef27442f332e57adb46b26b
Instruction Fuzzy Hash: 53A1B47AA00008EFDB04DF98DD92D9E77B6FF58298B248154F9099725ADB30FE50CB90

Function 10010380 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 112filestringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1001039F
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000004,00000080,00000000), ref: 10010406
GetFileSize.KERNEL32(?,00000000), ref: 10010425
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 1001044A
lstrlenA.KERNEL32(1000EEB8), ref: 10010454
lstrlenA.KERNEL32(1000EEB8,00000000,00000000), ref: 100104D6
WriteFile.KERNEL32(?,?,00000000), ref: 100104EB
CloseHandle.KERNEL32(?), ref: 100104F8

Strings

.key, xrefs: 100103D9

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$lstrlen$CloseCreateDirectoryHandlePointerSizeSystemWrite
String ID: .key
API String ID: 1674266968-343438762
Opcode ID: ffe63ab53faeb08c4fabfe3c25abd14c77d86f4555a55f109598a67c17bf6787
Instruction ID: 1c9aefebe2efcbaba9d66af4461c31df970b4e064e3fc872ccff81242f4e36e7
Opcode Fuzzy Hash: ffe63ab53faeb08c4fabfe3c25abd14c77d86f4555a55f109598a67c17bf6787
Instruction Fuzzy Hash: 7A410CB590022CDFDB29CB64DC86BD9B7B5BF48700F0085D9F649AA241D774AAC4CF90

Function 1000E760 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000F3B0: _memset.LIBCMT ref: 1000F3D5
Part of subcall function 1000F3B0: wsprintfA.USER32 ref: 1000F3ED

_memset.LIBCMT ref: 1000E7AD
_memset.LIBCMT ref: 1000E7CA
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,?,?,?,?,?,?,0F3104C0), ref: 1000E7DF
GetTempFileNameA.KERNEL32(00000000,bak,00000000,00000000,101AF284,00000000,?,?,?,?,?,?,0F3104C0), ref: 1000E828
Sleep.KERNEL32(000003E8,SogouExplorer,?,?,?,?,?,?,0F3104C0), ref: 1000E843
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 1000E868

Strings

SogouExplorer.exe, xrefs: 1000E78B
SogouExplorer, xrefs: 1000E82E
bak, xrefs: 1000E817

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$File$FolderMoveNamePathSleepSpecialTempwsprintf
String ID: SogouExplorer$SogouExplorer.exe$bak
API String ID: 2742518391-538188596
Opcode ID: 387075a032f40cdf426803d7b8eb962ed2b699bce44bc087e450045890685a63
Instruction ID: cdfe1adb3a5306c7d49e930ca4d3ffe4328d7c09e084d7f548619efed37bff03
Opcode Fuzzy Hash: 387075a032f40cdf426803d7b8eb962ed2b699bce44bc087e450045890685a63
Instruction Fuzzy Hash: 14316C75950258ABEB24DBA0CC9ABD9B374EF14700F0001D9F5096A2D1EB787B84CB55

Function 1000F420 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 1000F44B
_malloc.LIBCMT ref: 1000F473
_memmove.LIBCMT ref: 1000F496

Strings

D, xrefs: 1000F551

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _malloc_memmove_strlen
String ID: D
API String ID: 3238260300-2746444292
Opcode ID: 6855c12a7bdc6e0bd8773f4745c8c759726946dada61b8ef62cf01ab51cda593
Instruction ID: 6d557a2bb59ac2ae05f88cec7faa246fa2e5727cbdb9c8dfb4b7bdd6368fabdf
Opcode Fuzzy Hash: 6855c12a7bdc6e0bd8773f4745c8c759726946dada61b8ef62cf01ab51cda593
Instruction Fuzzy Hash: 163173B5D00218EBDB64CF60DC45BEB7378EB58345F404598E60DAA241EBB6AAC4CF91

Function 1001C3A0 Relevance: 13.6, APIs: 9, Instructions: 149memorynetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 1001B6A0: HeapAlloc.KERNEL32(?,00000000,?,?,?,?,?,?,1001D1A7,?,1001C0BB,?,?,?,?,1001EAD1), ref: 1001B6CA

EnterCriticalSection.KERNEL32(00000054,?,00000000,0F3104C0,?,00000000), ref: 1001C3F8

Part of subcall function 1001BD70: timeGetTime.WINMM ref: 1001BD78
Part of subcall function 1001BD70: _memmove.LIBCMT ref: 1001BDDC

GetLastError.KERNEL32 ref: 1001C470
CreateIoCompletionPort.KERNEL32(?,?,00000000,00000000), ref: 1001C44A

Part of subcall function 100172C0: __CxxThrowException@8.LIBCMT ref: 100172D2
Part of subcall function 100172C0: EnterCriticalSection.KERNEL32(00000000,0F3104C0,00000000,00000098,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005), ref: 10017312
Part of subcall function 100172C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005,?,100168C9,00000400,00000400), ref: 1001737B

connect.WS2_32(?,?,0000001C), ref: 1001C497
CreateIoCompletionPort.KERNEL32(?,?,00000000,00000000), ref: 1001C4CC
HeapFree.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 1001C552
LeaveCriticalSection.KERNEL32(00000054), ref: 1001C559

Part of subcall function 1001A870: ioctlsocket.WS2_32(?,8004667E,?), ref: 1001A87F

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CompletionCreateEnterHeapLeavePort$AllocErrorException@8FreeLastThrowTime_memmoveconnectioctlsockettime
String ID:
API String ID: 577898059-0
Opcode ID: fb6ef4b531d651df34b6af81ca114c1cb161ed1b6c4b7f8e2a56bc7a7bb065d0
Instruction ID: 13f5607a006f5134b6e7d624e793b95b5dada5aad690ad180316847aeaa3252a
Opcode Fuzzy Hash: fb6ef4b531d651df34b6af81ca114c1cb161ed1b6c4b7f8e2a56bc7a7bb065d0
Instruction Fuzzy Hash: CA518F75600208AFDB11DF64CC85FAA77AAFF44350F144428FD09EE2A1DB71E890DB60

Function 1001E560 Relevance: 13.6, APIs: 9, Instructions: 139COMMON

Download Yara Rule

APIs

_memmove_s.LIBCMT ref: 1001E5C0

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memmove_s
String ID:
API String ID: 800865076-0
Opcode ID: bfd165e00e761db38f2bdf525350d73678aeff4c921f7e730ca0ddaf86c9b7a3
Instruction ID: e53b5beb10ba7e09faa63e27da374d48c55a1d98f715c35b0f5f6325fba29714
Opcode Fuzzy Hash: bfd165e00e761db38f2bdf525350d73678aeff4c921f7e730ca0ddaf86c9b7a3
Instruction Fuzzy Hash: 59418D36200655AFD711DF68C888B9EF7E9FF44364F10402AF9098B291DB75EDA08BA0

Function 10011580 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100115CC
GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 100115E0
CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 10011647
GetFileSize.KERNEL32(000000FF,00000000), ref: 10011669

Part of subcall function 1001EF9C: _malloc.LIBCMT ref: 1001EFB4

ReadFile.KERNEL32(000000FF,?,00000000,00000000,00000000), ref: 100116B4
CloseHandle.KERNEL32(000000FF), ref: 10011771

Strings

.key, xrefs: 1001161A

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateDirectoryHandleReadSizeSystem_malloc_memset
String ID: .key
API String ID: 1189190961-343438762
Opcode ID: e3cca6749972bda63ac77e56a70e5a53b244fe33762708ed0120600f45f4504f
Instruction ID: 3d4300d2710fecc02f3fab15f3df85ad30c21ba86dc6f63d814e5d622af92f7c
Opcode Fuzzy Hash: e3cca6749972bda63ac77e56a70e5a53b244fe33762708ed0120600f45f4504f
Instruction Fuzzy Hash: 2551EAB5D0022C9BDB69CB64DC82BD9B7B4AB58300F0045D8E64DAB281DB74AFC4CF91

Function 1000F2B0 Relevance: 12.1, APIs: 8, Instructions: 62processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 1000F2C3
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1000F2DD
Process32First.KERNEL32(000000FF,00000128), ref: 1000F30E
OpenProcess.KERNEL32(00000001,00000000,00000000,000000FF,00000128,00000002,00000000), ref: 1000F347
TerminateProcess.KERNEL32(00000000,00000000), ref: 1000F367
CloseHandle.KERNEL32(00000000), ref: 1000F374
Process32Next.KERNEL32(000000FF,00000128), ref: 1000F388
CloseHandle.KERNEL32(000000FF,000000FF,00000128,00000002,00000000), ref: 1000F39C

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleProcess32$CreateCurrentFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 477742948-0
Opcode ID: 0e5e03193292138b7c311efabc93a15d5f194d092c39daaf66340cd660e8982b
Instruction ID: d41c4376eefb6253570006433f593cac2f32630ea850329660a4d75d5b4afe3c
Opcode Fuzzy Hash: 0e5e03193292138b7c311efabc93a15d5f194d092c39daaf66340cd660e8982b
Instruction Fuzzy Hash: 4921C370900228DFDB25EB60CD89BEDB7B4FB48750F1045D9E609AB290D774AB80DF50

Function 10002740 Relevance: 12.1, APIs: 8, Instructions: 56COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10002756

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

DeleteCriticalSection.KERNEL32(?), ref: 10002778
_free.LIBCMT ref: 1000277F
DeleteCriticalSection.KERNEL32(?,00000000), ref: 100027B2
_free.LIBCMT ref: 100027B9
_free.LIBCMT ref: 100027C2
_free.LIBCMT ref: 100027D1
_free.LIBCMT ref: 100027D7

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$CriticalDeleteSection$ErrorFreeHeapLast
String ID:
API String ID: 229044151-0
Opcode ID: 829fe4cc710feb83a16dcdc532ce873229ccf800336d69de1fb585340b12b445
Instruction ID: 16a73a784ab602da626493d70980f9eae99143d6bc0915a138f34a67110a4392
Opcode Fuzzy Hash: 829fe4cc710feb83a16dcdc532ce873229ccf800336d69de1fb585340b12b445
Instruction Fuzzy Hash: 560108B66007105BE612EF209C82A6B73AAEF80580F54442CF94A47207DB35F985C7E2

Function 100145C0 Relevance: 10.7, APIs: 7, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd34e201d1059666f78fc474e3004731cd6cb8f970c98b5a1a8be2d127c39e0
Instruction ID: df39f66d2745d17a7fe87e744aa0e03a21574858425a6f03c3f21479afaab56c
Opcode Fuzzy Hash: bfd34e201d1059666f78fc474e3004731cd6cb8f970c98b5a1a8be2d127c39e0
Instruction Fuzzy Hash: 536109B9E00209EFDB44CF94C884B9EB7B5FF48304F218598E905AB395D775EA81DB90

Function 10002070 Relevance: 10.6, APIs: 7, Instructions: 114COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 1000208B
WakeAllConditionVariable.KERNEL32(?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 100020AD
LeaveCriticalSection.KERNEL32(?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 100020B4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 100020EC
SleepConditionVariableCS.KERNEL32(?,?,000000FF,?,?,?,100025EE,?,?,?,10002B57,?), ref: 1000210D
LeaveCriticalSection.KERNEL32(?,?,?,?,100025EE,?,?,?,10002B57,?), ref: 10002116
_free.LIBCMT ref: 1000213E

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveVariable$SleepWake_free
String ID:
API String ID: 1710734047-0
Opcode ID: e61bd854db23e898daa16de29f131cc90b3ab22f0d1ab1bd32c91fa0d06ec401
Instruction ID: 05dc04eb116ff6e28942813317816f3c30ed5ba661128168b5cad8891ce245dc
Opcode Fuzzy Hash: e61bd854db23e898daa16de29f131cc90b3ab22f0d1ab1bd32c91fa0d06ec401
Instruction Fuzzy Hash: 8D4190B1601B069FE724CF64C884796B7F4FF14390F51462AE91ACB695D730F894CBA1

Function 1001A6F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,?), ref: 1001A70C
GetProcAddress.KERNEL32(00000000,CreateFileTransactedA), ref: 1001A721
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?), ref: 1001A76A
GetFileSize.KERNEL32(?,?), ref: 1001A78C

Strings

CreateFileTransactedA, xrefs: 1001A71B
kernel32.dll, xrefs: 1001A707

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$AddressCreateHandleModuleProcSize
String ID: CreateFileTransactedA$kernel32.dll
API String ID: 381258031-3827029016
Opcode ID: 2b602c5be5b8ceff7d4341a465a72c2674a25abf06f1222532ee79990a52c5db
Instruction ID: 3fd96c11bbd7488a8a418e2e25c194671cc8f240b4c6ee697fb62349ff201565
Opcode Fuzzy Hash: 2b602c5be5b8ceff7d4341a465a72c2674a25abf06f1222532ee79990a52c5db
Instruction Fuzzy Hash: 0431AD34744205BBEB31CA649C45B9977F8EF02B61F20425AFE18EE1D0D7B1EAD0D654

Function 10003320 Relevance: 10.6, APIs: 7, Instructions: 80COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 10003330

Part of subcall function 10024166: __calloc_impl.LIBCMT ref: 10024179

InitializeCriticalSection.KERNEL32(00000018,00000000), ref: 1000335C
InitializeConditionVariable.KERNEL32(00000030), ref: 1000336C
InitializeConditionVariable.KERNEL32(00000034), ref: 10003372
__beginthreadex.LIBCMT ref: 100033A8

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Initialize$ConditionVariable$CriticalSection__beginthreadex__calloc_impl_calloc
String ID:
API String ID: 4275094566-0
Opcode ID: 1c90a2da0a09f1423271f63d7b8369d043ae484d91931262826aadb9d33fa527
Instruction ID: d63cbc47a989e61f8d5764840e3dc6a2f22de4f4aba891b4dc0ad6eac0f10f79
Opcode Fuzzy Hash: 1c90a2da0a09f1423271f63d7b8369d043ae484d91931262826aadb9d33fa527
Instruction Fuzzy Hash: 582192B660071AAFE711DF95EC84B97B7ECFB40350F504029EA08C7541EBB5B6598BA0

Function 100105B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 100105D3
_memset.LIBCMT ref: 100105FB
GetTempPathA.KERNEL32(00000104,?), ref: 1001060F

Strings

D, xrefs: 1001067A

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: PathTemp_memset_strrchr
String ID: D
API String ID: 3269299267-2746444292
Opcode ID: 65dff33f197481420d75febd2944a67fcb56e30f99d0bf04b3eaf0f89ed5e44e
Instruction ID: 94703a5b4a1e95a47fdd501beecf67a154b79f006fe411b9632ef845b5e6f6b1
Opcode Fuzzy Hash: 65dff33f197481420d75febd2944a67fcb56e30f99d0bf04b3eaf0f89ed5e44e
Instruction Fuzzy Hash: 2F218BB9D00218EBDB24DB50DC45BDA7378EB58305F444498F54D9E281EBB5ABC4CFA0

Function 10001220 Relevance: 10.6, APIs: 7, Instructions: 58COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10001236

Part of subcall function 1002043C: HeapFree.KERNEL32(00000000,00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020450
Part of subcall function 1002043C: GetLastError.KERNEL32(00000000,?,10025D1C,00000000,100258E1,100204FB,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 10020462

_free.LIBCMT ref: 10001275
_free.LIBCMT ref: 1000128D
_free.LIBCMT ref: 100012A8
DeleteCriticalSection.KERNEL32(8415FF68,?), ref: 100012C6
_free.LIBCMT ref: 100012CD
_free.LIBCMT ref: 100012D6

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$CriticalDeleteErrorFreeHeapLastSection
String ID:
API String ID: 2933665753-0
Opcode ID: 2361ccc68d43a71e868931a2596d9ac44d138912533a7e2e7945e83494bb7265
Instruction ID: aaf221896ecc1e09f6eeffe9c750e8d10df9c6965350f993c9d4ceeb60f37a7f
Opcode Fuzzy Hash: 2361ccc68d43a71e868931a2596d9ac44d138912533a7e2e7945e83494bb7265
Instruction Fuzzy Hash: F81104B1800B455BE721EB61F8817A773E1FF00250F948439E55B4220AD731B9E8CBA2

Function 1000F630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54processsynchronizationCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000F648
CreateProcessA.KERNEL32(00000000,1000F402,00000000,00000000,00000001,08000020,00000000,00000000,00000044,00000000), ref: 1000F686
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1000F696
CloseHandle.KERNEL32(00000000), ref: 1000F6A0
CloseHandle.KERNEL32(?), ref: 1000F6AA

Strings

D, xrefs: 1000F650

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateObjectProcessSingleWait_memset
String ID: D
API String ID: 3422168109-2746444292
Opcode ID: 6aa504984eda8c7b5acce5dc33e2805d2fb05eccdb010cb75b9960ebb1134bfa
Instruction ID: cb5451c512472725f5a4df07bad1c41973f3ae078433712cb33367d9263f6d2b
Opcode Fuzzy Hash: 6aa504984eda8c7b5acce5dc33e2805d2fb05eccdb010cb75b9960ebb1134bfa
Instruction Fuzzy Hash: CA113071A00248EFEB24DFE4DC46BAD7BB8EF48700F10421DF619AE2D4DBB5A9448B54

Function 10016140 Relevance: 9.2, APIs: 6, Instructions: 151COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 100161B4

Part of subcall function 10020474: __FF_MSGBANNER.LIBCMT ref: 1002048B
Part of subcall function 10020474: __NMSG_WRITE.LIBCMT ref: 10020492
Part of subcall function 10020474: HeapAlloc.KERNEL32(00670000,00000000,00000001,?,?,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 100204B7

_free.LIBCMT ref: 10016270
std::exception::exception.LIBCMT ref: 100162BC
__CxxThrowException@8.LIBCMT ref: 100162D1
SetLastError.KERNEL32(00000018,?,101B722C,?,1001640E,80004005,?,100168C9,00000400,00000400), ref: 100162DC
_free.LIBCMT ref: 100162E7

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$AllocErrorException@8HeapLastThrow_mallocstd::exception::exception
String ID:
API String ID: 3049299895-0
Opcode ID: c4e75bb467dcd632cc6794f0c5e8569d33c960b951e8937276adff62c409ee6a
Instruction ID: ed2824db1dae17bfd308ba5dcb0e615037e45c0d1587b7e3fee2415e99e90dce
Opcode Fuzzy Hash: c4e75bb467dcd632cc6794f0c5e8569d33c960b951e8937276adff62c409ee6a
Instruction Fuzzy Hash: A0519AB6A006199FCB01CF98DC80B9EBBF4EB49710F554169E914AB341D775ED80CB90

Function 100285A2 Relevance: 9.1, APIs: 6, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

__ioinit.LIBCMT ref: 100285A6

Part of subcall function 10029B38: InitOnceExecuteOnce.KERNEL32(101BE634,10029B73,00000000,00000000,1003508B,101B7FB0,0000000C,10005D7E,zstd), ref: 10029B46

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Once$ExecuteInit__ioinit
String ID:
API String ID: 129814473-0
Opcode ID: 5f84c9e2474b48f1b5df84408ea3fed00915e9808a8aa5c3ede1912be93b9b93
Instruction ID: eb12839c2236a0a66080d8b7707541b2b015dfdafb5b4036e193e8b83220f103
Opcode Fuzzy Hash: 5f84c9e2474b48f1b5df84408ea3fed00915e9808a8aa5c3ede1912be93b9b93
Instruction Fuzzy Hash: 7A415679902B058FD320CB78E885A6E77E4EF413B0B90871DF8AB876D1D774EA408B10

Function 1001E0D0 Relevance: 9.1, APIs: 6, Instructions: 127memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000094,00000000,?,00000000,00000000), ref: 1001E132
_memmove.LIBCMT ref: 1001E18D
InterlockedExchangeAdd.KERNEL32(-00000040,?), ref: 1001E19D
InterlockedDecrement.KERNEL32(00000028), ref: 1001E1B6
HeapFree.KERNEL32(?,00000000,00000000,00000000), ref: 1001E1E0
InterlockedExchangeAdd.KERNEL32(-00000040,?), ref: 1001E1F7

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Interlocked$ExchangeHeap$AllocDecrementFree_memmove
String ID:
API String ID: 3475820249-0
Opcode ID: 8410d57850f0f56a72160be52005f4586bc43fc5666634ebf8d9ae9adf307239
Instruction ID: 7998932e740281b790ced908d299ef40af193b578d293305540e12fdeb0e7596
Opcode Fuzzy Hash: 8410d57850f0f56a72160be52005f4586bc43fc5666634ebf8d9ae9adf307239
Instruction Fuzzy Hash: F5410D72900259AFDB11CF99C884A9EBBF8FF49314F1145AAEC199F211D770ED54CB90

Function 1000C230 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 1000C28F
std::error_category::default_error_condition.LIBCPMTD ref: 1000C2B0
std::error_category::default_error_condition.LIBCPMTD ref: 1000C2CA
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 1000C2D6
_Copy_impl.LIBCPMTD ref: 1000C2F1
std::error_category::default_error_condition.LIBCPMTD ref: 1000C323

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: std::error_category::default_error_condition$Affinity::operator!=Concurrency::details::Hardware$Copy_impl
String ID:
API String ID: 1600619793-0
Opcode ID: b1d60bd1d2c90ce81873208b493584433b2c3e2ab3f7430867161bbb174af34e
Instruction ID: d7a5fca912ec06086403f1c670a1a813a5f108e565bd240dc1cb7e9a7b1914b0
Opcode Fuzzy Hash: b1d60bd1d2c90ce81873208b493584433b2c3e2ab3f7430867161bbb174af34e
Instruction Fuzzy Hash: ED310079910119ABDB08DF95CC91DFFB3B9FF88240B50852DB515A7296DF30BA05CB90

Function 1000B5A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 1000B5E8
inet_addr.WS2_32(?), ref: 1000B5F9
_wprintf.LIBCMT ref: 1000B613

Strings

OnConnect: %s,%d, xrefs: 1000B60E
2, xrefs: 1000B5B3

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _wprintfhtonsinet_addr
String ID: 2$OnConnect: %s,%d
API String ID: 3872430831-1911175251
Opcode ID: c5e6b32b25000850bdcfd3e7752fad518d315f21ca028ddb3caaaf99291d32ff
Instruction ID: b422dd61b17a844059851ccc93c32e4f95b7dbd58dc7ab89f53cd95de4c22344
Opcode Fuzzy Hash: c5e6b32b25000850bdcfd3e7752fad518d315f21ca028ddb3caaaf99291d32ff
Instruction Fuzzy Hash: B111D6B5A00208AFCB14DFA4D9809AEB7B9FF88200F108159F9099B251EB35AA45CB50

Function 100106D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100106F8
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 1001070E
_memset.LIBCMT ref: 10010729
ShellExecuteExA.SHELL32(0000003C), ref: 10010761

Part of subcall function 10022BD3: _doexit.LIBCMT ref: 10022BDD

Strings

<, xrefs: 10010714

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _memset$ExecuteFileModuleNameShell_doexit
String ID: <
API String ID: 862106238-4251816714
Opcode ID: 20cf96c7f9d228022f40f64b64e5aa891d9eb85aec194889f2121776d6cbdfe6
Instruction ID: ed08ded1bf864bf3e223a1e7aee1529ee6b636ef57dacc8919679b4bfa0f8810
Opcode Fuzzy Hash: 20cf96c7f9d228022f40f64b64e5aa891d9eb85aec194889f2121776d6cbdfe6
Instruction Fuzzy Hash: F5112174A443189BDB60DF60DC86BD977B8EB58701F4040D8E54CAA2D1DBB46BC8CF51

Function 1000F017 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34keyboardsleepstringCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000005), ref: 1000EF92
lstrlenA.KERNEL32(00000000), ref: 1000EF9F
_memset.LIBCMT ref: 1000EFDC
GetKeyState.USER32(00000010), ref: 1000F035
GetAsyncKeyState.USER32(?), ref: 1000F05C
GetKeyState.USER32(00000014), ref: 1000F073

Strings

e, xrefs: 1000F026
], xrefs: 1000F092

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: State$AsyncSleep_memsetlstrlen
String ID: ]$e
API String ID: 1122937223-1460998272
Opcode ID: eed0b91c2744c895165e97b4f44415f78997a58abc4c3c7c85806ef0c703c4ee
Instruction ID: 764bce47da2be80fe97f0ee0a60544cb6e7be49dbe84d1d57fcac03222c10f19
Opcode Fuzzy Hash: eed0b91c2744c895165e97b4f44415f78997a58abc4c3c7c85806ef0c703c4ee
Instruction Fuzzy Hash: 35011A34901728CFFB64CF15CC85BA977B2FB80391F1082A9C4095695ACB779EA1EE01

Function 100122A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 100122C1
GetProcAddress.KERNEL32(00000000), ref: 100122C8
GetCurrentProcess.KERNEL32(00000000), ref: 100122DB

Strings

kernel32, xrefs: 100122BC
IsWow64Process, xrefs: 100122B7

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32
API String ID: 4190356694-3789238822
Opcode ID: 4dbbbb52112192865a612101614944367de734d12e029e91dbf73928284f9556
Instruction ID: d8b697d57578edb345ad90496a9b557fc7605fd1813d4f5a4f7f5f71a7bdeb36
Opcode Fuzzy Hash: 4dbbbb52112192865a612101614944367de734d12e029e91dbf73928284f9556
Instruction Fuzzy Hash: 74F0FE75D00208FFDB10EFE4C94879DBBB8EF08205F404099E80997251DB389648DB50

Function 10016750 Relevance: 7.7, APIs: 5, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 100184E0: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,100167AB,0F3104C0,00000000,?,?,?,1001849E), ref: 100184FB
Part of subcall function 100184E0: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,100167AB,0F3104C0,00000000,?,?,?,1001849E), ref: 10018516

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0F3104C0,00000000,?,?,?,1001849E), ref: 100167F5
HeapCreate.KERNEL32(00000004,00000000,00000000,?,?,?,1001849E), ref: 10016889
_free.LIBCMT ref: 1001693E
_free.LIBCMT ref: 10016946
_free.LIBCMT ref: 100169A9

Part of subcall function 100172C0: __CxxThrowException@8.LIBCMT ref: 100172D2
Part of subcall function 100172C0: EnterCriticalSection.KERNEL32(00000000,0F3104C0,00000000,00000098,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005), ref: 10017312
Part of subcall function 100172C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,10035B28,000000FF,?,?,101B722C,?,1001640E,80004005,?,100168C9,00000400,00000400), ref: 1001737B

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: _free$CreateCriticalInfoNativeSectionSystem$EnterEventException@8HeapLeaveThrow
String ID:
API String ID: 471852966-0
Opcode ID: 62dcc8071ba77636672d3d9cd1e185c692ae9957d13345a13a02519507dda5e3
Instruction ID: d7e5b155edf1d74aaead93eb83c8ab603744e77deffcff0117244fe85bcfb593
Opcode Fuzzy Hash: 62dcc8071ba77636672d3d9cd1e185c692ae9957d13345a13a02519507dda5e3
Instruction Fuzzy Hash: C37118B0501B419FE761CF64C958787BBF4FF04308F108A1DE6AA9B691DBB9B148CB90

Function 100143E0 Relevance: 7.6, APIs: 5, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 1001446A
_free.LIBCMT ref: 10014479
VirtualFree.KERNEL32(?,00000000,00008000,?,1001478E), ref: 10014498
GetProcessHeap.KERNEL32(00000000,00000000,?,1001478E), ref: 100144A4
HeapFree.KERNEL32(00000000,?,1001478E), ref: 100144AB

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Free$Heap$LibraryProcessVirtual_free
String ID:
API String ID: 3953351234-0
Opcode ID: d9d32f6ed72f362beb0b78fbb99d4c82a6959af6a865298871246b0d9bcbc94d
Instruction ID: e984664baf45058b12496fb5a6c08b784cfcca4bbda2656e475c534f62021b4f
Opcode Fuzzy Hash: d9d32f6ed72f362beb0b78fbb99d4c82a6959af6a865298871246b0d9bcbc94d
Instruction Fuzzy Hash: 6131B674A00208EFDB14CF94C598B9DB7B6FB49315F258288E9056B391C775EE86DF80

Function 1002354C Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 10023558

Part of subcall function 10020474: __FF_MSGBANNER.LIBCMT ref: 1002048B
Part of subcall function 10020474: __NMSG_WRITE.LIBCMT ref: 10020492
Part of subcall function 10020474: HeapAlloc.KERNEL32(00670000,00000000,00000001,?,?,?,?,100010EB,0000DF68,?,10001048,00000001), ref: 100204B7

_free.LIBCMT ref: 1002356B

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: bad27d9961e6c256fd05d00a16dcfa7813a2fc78cb849604c55e28e4d427328b
Instruction ID: 8f73b662920d403f089da30250cd819716aaae5841175fa17ded837e2a866512
Opcode Fuzzy Hash: bad27d9961e6c256fd05d00a16dcfa7813a2fc78cb849604c55e28e4d427328b
Instruction Fuzzy Hash: 28112731900A366FCB21DB70BC4564E37E4EF003A0FE18525F90D9A1A1DF349940D794

Function 1001B630 Relevance: 7.5, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B651
EnterCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B657
LeaveCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B675
LeaveCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B678
LeaveCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B68A
LeaveCriticalSection.KERNEL32(?,?,1001BE50,?,?,00000054,?,1001D828,00000000,00000000,00000000,00000000), ref: 1001B68D

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: c76d05b3fccb81bbde97bbe8f299796e80221eabea18b0df9aee05efc5887d01
Instruction ID: 15876e7cb504465c55ff25fd79a18e235aef5e7f8048034f6523b5cd64803c08
Opcode Fuzzy Hash: c76d05b3fccb81bbde97bbe8f299796e80221eabea18b0df9aee05efc5887d01
Instruction Fuzzy Hash: 43F044722016146FD711AB6EDCC0A9BB7ECFFC9224B520136E908DB611C779E8458AB0

Function 10003400 Relevance: 7.5, APIs: 5, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000018,00000000,0000003C,00000000,?,?,100033DA), ref: 1000340C
WakeAllConditionVariable.KERNEL32 ref: 1000341D
LeaveCriticalSection.KERNEL32(00000018), ref: 10003424
WaitForSingleObject.KERNEL32(?,000000FF,?), ref: 1000345C
GetLastError.KERNEL32 ref: 1000346D

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterErrorLastLeaveObjectSingleVariableWaitWake
String ID:
API String ID: 2002041392-0
Opcode ID: e75bfb5a0ad93df77c66187c49ea81158b5d7819f7b5d557b30da283341fa316
Instruction ID: 32492cade0fa7766ae1656b716e42035eae87337b4a1db3a89480abb877ebfd1
Opcode Fuzzy Hash: e75bfb5a0ad93df77c66187c49ea81158b5d7819f7b5d557b30da283341fa316
Instruction Fuzzy Hash: 8301B1325002169FEB52EF58DCC469773ECFF45391B018525EA589B119D730E989CBA2

Function 6C913230 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 6C91323C
RtlEncodePointer.NTDLL(00000000), ref: 6C91332D
InterlockedDecrement.KERNEL32(006944E0), ref: 6C9133B6

Strings

Di, xrefs: 6C9133B0, 6C9133CE

Memory Dump Source

Source File: 0000000E.00000002.3013317433.000000006C681000.00000040.00000001.01000000.00000003.sdmp, Offset: 6C680000, based on PE: true

Associated: 0000000E.00000002.3013239239.000000006C680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000E.00000002.3013317433.000000006C9C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000E.00000002.3013317433.000000006CBAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000E.00000002.3013317433.000000006CBB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000E.00000002.3013317433.000000006CBB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000E.00000002.3015754617.000000006CC55000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c680000_rundll32.jbxd

Yara matches

Similarity

API ID: Pointer$DecodeDecrementEncodeInterlocked
String ID: Di
API String ID: 3602974720-1145751393
Opcode ID: 8f15731da986caa946230992b7ebf71952455fe40306a3c33999598b776fb09e
Instruction ID: 92f80892776e3af2ee8edce7e798e8075a7ccf06445e3b7baf39e0cd0704cf2b
Opcode Fuzzy Hash: 8f15731da986caa946230992b7ebf71952455fe40306a3c33999598b776fb09e
Instruction Fuzzy Hash: 1541CEB2A09348EBEB08DBB0D847B6D3735FB56309F604528D6106BFC1DBBA9904CB54

Function 1001D760 Relevance: 6.3, APIs: 5, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1001A990: setsockopt.WS2_32(?,0000FFFF,00007010,00000000,00000004), ref: 1001A9A6

EnterCriticalSection.KERNEL32 ref: 1001D7AC
LeaveCriticalSection.KERNEL32(00000054), ref: 1001D7C7

Part of subcall function 1001BE40: timeGetTime.WINMM(00000007,00000000,00000000,00000000,?,00000001,?,?,00000001,00000000), ref: 1001BE7F

SetLastError.KERNEL32(00000000), ref: 1001D7D1
LeaveCriticalSection.KERNEL32(00000054), ref: 1001D7EC
HeapFree.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 1001D842

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterErrorFreeHeapLastTimesetsockopttime
String ID:
API String ID: 4191520005-0
Opcode ID: d82dbdcae07a67b72c96c9c25426668b2813c80c10765768011baf3510c592d9
Instruction ID: 8b7f9298d96b99960fdb9572d67dbc8946c541a3fe55414fa74220fd8c56f37f
Opcode Fuzzy Hash: d82dbdcae07a67b72c96c9c25426668b2813c80c10765768011baf3510c592d9
Instruction Fuzzy Hash: E131C372600214EFD711DF48CC85B9EB7B8FF49721F10422AF9299B291DB75A840CB60

Function 1002F1F7 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 1002F22B
__isleadbyte_l.LIBCMT ref: 1002F259
MultiByteToWideChar.KERNEL32(00000000,00000009,0000000C,00000000,00000000,00000000), ref: 1002F287
MultiByteToWideChar.KERNEL32(00000000,00000009,0000000C,00000001,00000000,00000000), ref: 1002F2BD

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2b3d1593b62abf2a8beba7a4b33d3e542d277218e77fbf3ac6909a8a0f39df84
Instruction ID: 88f6cfa15c5d6d04ed07b041f1d82007708ea3ed43a2cafbe05b56c4a286dddd
Opcode Fuzzy Hash: 2b3d1593b62abf2a8beba7a4b33d3e542d277218e77fbf3ac6909a8a0f39df84
Instruction Fuzzy Hash: 1D31BC3560029AEFDB11CE64E845BBA3BE5FF422A0F52443DE8249B1A1D770E844DB50

Function 1001E3A0 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(?), ref: 1001E41B
UnmapViewOfFile.KERNEL32(00000000), ref: 1001E441
CloseHandle.KERNEL32(00000000), ref: 1001E461
CloseHandle.KERNEL32(00000000), ref: 1001E483

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle$ErrorFileLastUnmapView
String ID:
API String ID: 4017539725-0
Opcode ID: 496f3fa893c77ec6c9c64e1aa7dc66e4b9ed660e755f62b2c78ec002215d3852
Instruction ID: cba275ec36c653788e4822474d84c3c335d5b1142b70863171b6aa198203d996
Opcode Fuzzy Hash: 496f3fa893c77ec6c9c64e1aa7dc66e4b9ed660e755f62b2c78ec002215d3852
Instruction Fuzzy Hash: 1E3118B5A002599BDB11CFA4CC48BAFBBF8FF48754F004219F805EB241EB75E9448BA0

Function 1001B710 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(00000000,?,00000000), ref: 1001B765
InterlockedCompareExchange.KERNEL32(?,?,?), ref: 1001B777

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CompareExchangeInterlocked
String ID:
API String ID: 3335655927-0
Opcode ID: 9484bcffa374807802c2175ff6f6c2d2e59b0392790023a2fe2f7dd29207cd47
Instruction ID: a411b3ee14b548daa5b868b1c8f2e50aeeae3c08791ef6b703bc2ef0cd82c7fc
Opcode Fuzzy Hash: 9484bcffa374807802c2175ff6f6c2d2e59b0392790023a2fe2f7dd29207cd47
Instruction Fuzzy Hash: 6E219F36304A09ABD720DF6DDD80E96F3EDFBC8311F00456AEA89C7240DB31E9548BA0

Function 10014070 Relevance: 6.1, APIs: 4, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00000000,00001000,00000004), ref: 100140EE
_memset.LIBCMT ref: 1001410A
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,100146FE), ref: 1001412C
_memmove.LIBCMT ref: 1001414A

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocVirtual$_memmove_memset
String ID:
API String ID: 725130153-0
Opcode ID: f53fd65b4befc706c090b7c927cf75363b07fbc3177beadfb71f7d900ef2fefc
Instruction ID: 93ed00f0eb9094769ecb9556d8f7921b1dd27d8a6f78ffda3dd0833cdc577a5f
Opcode Fuzzy Hash: f53fd65b4befc706c090b7c927cf75363b07fbc3177beadfb71f7d900ef2fefc
Instruction Fuzzy Hash: F631EA74A00209EFCB08CF94C995EAEB7B1FF48704F218598E915AB351D770EE81DB50

Function 1001A3A0 Relevance: 6.1, APIs: 4, Instructions: 84fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(00000002,00000004,?,?,?,00000002,00000004), ref: 1001A3B3
CreateFileMappingA.KERNEL32(00000002,00000000,00000004,00000004,00000000,00000000), ref: 1001A3E0
MapViewOfFileEx.KERNEL32(00000000,?,?,?,?,00000000,?,00000002,00000004), ref: 1001A429
CloseHandle.KERNEL32(?,?,00000002,00000004), ref: 1001A43F

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleMappingSizeView
String ID:
API String ID: 1374251026-0
Opcode ID: 4b8af0a805cdf8347236f9c71f45033270cfc3b78af84c4974c8e4d52b637325
Instruction ID: 8fce67c6ff09011a8acf264d9e13d81355b447303082185ad91e7b9cb9a6a423
Opcode Fuzzy Hash: 4b8af0a805cdf8347236f9c71f45033270cfc3b78af84c4974c8e4d52b637325
Instruction Fuzzy Hash: 272167B5A0061AAFD714DF69DC45A5AF7F8FB49350F10812AFD19D7200D770E9A09BD0

Function 1001B090 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 1001B152

Part of subcall function 1001B190: HeapFree.KERNEL32(?,00000000,?), ref: 1001B1E5

DeleteCriticalSection.KERNEL32(?,0F3104C0), ref: 1001B113
DeleteCriticalSection.KERNEL32(?), ref: 1001B124
HeapFree.KERNEL32(?,00000000), ref: 1001B132

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CriticalDeleteFreeHeapSection$_free
String ID:
API String ID: 210024702-0
Opcode ID: 2457e78313824737e41231bfbb3820b753e3b2e9e7e39901a1bfba69df0cf740
Instruction ID: 33c100260f324d21ff77bf2896aba4d0bbdecf1759cfcc0eaa01cd95da98a8db
Opcode Fuzzy Hash: 2457e78313824737e41231bfbb3820b753e3b2e9e7e39901a1bfba69df0cf740
Instruction Fuzzy Hash: 63319E71A00616EFDB11DFA8C884B5AFBF8FF05315F118269E9199F291D731E944CBA0

Function 100152A0 Relevance: 6.1, APIs: 4, Instructions: 62processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,10011CAA), ref: 100152B1

Part of subcall function 1001EF9C: _malloc.LIBCMT ref: 1001EFB4

Process32First.KERNEL32(10011CAA,0F3104C0), ref: 100152E0
Process32Next.KERNEL32(10011CAA,0F3104C0), ref: 10015316
lstrcmpiA.KERNEL32(0F31049C,00000000), ref: 1001532A

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32_malloclstrcmpi
String ID:
API String ID: 242301054-0
Opcode ID: 335c3f3c8a0e05f5839a3b8562ab9f751be2bf2361413e739464e8ead2f72be9
Instruction ID: 03fd10ac50de1202267bfae5930d06ed0f63b87ea6e01dd6c59341b656d33967
Opcode Fuzzy Hash: 335c3f3c8a0e05f5839a3b8562ab9f751be2bf2361413e739464e8ead2f72be9
Instruction Fuzzy Hash: 8321BAB4A04208EBDB14CB98C981A9EB7F5EF48745F2480A8E818AF341D771EF81DB54

Function 10003480 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,10001499,?,?,00000000,?,?,?), ref: 100034A7
SleepConditionVariableCS.KERNEL32(00000000,?,00000000), ref: 100034CB
LeaveCriticalSection.KERNEL32(?), ref: 100034D2
SleepConditionVariableCS.KERNEL32(00000000,?,000000FF), ref: 1000350E

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ConditionCriticalSectionSleepVariable$EnterLeave
String ID:
API String ID: 3020340620-0
Opcode ID: 05074beb6edb66eb96e78de5814604b12c6efd175baefdef2757970339633dab
Instruction ID: f135a66ef4c3fa2a34bb39291fcdf00077fd575a97a3f57769656b34936bebed
Opcode Fuzzy Hash: 05074beb6edb66eb96e78de5814604b12c6efd175baefdef2757970339633dab
Instruction Fuzzy Hash: 42110471500B558FE772CA58D9C4B5773E8FB007A6F51DE1DE4938A899C374F8888B21

Function 10003280 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 10003292
SleepConditionVariableCS.KERNEL32(?,?,000000FF), ref: 100032BD
EnterCriticalSection.KERNEL32(?), ref: 100032ED
WakeConditionVariable.KERNEL32(?), ref: 100032FA

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ConditionCriticalEnterSectionVariable$SleepWake
String ID:
API String ID: 1272541424-0
Opcode ID: d2ef4d3d3bece3ecb2957c56201156f867af3ba4ab4f7a9e8506c951494b066a
Instruction ID: d287fa8a1d97e4fb1d990ba0663406a79fc7a6a744e69c2c1aa7d7a44e5ccb06
Opcode Fuzzy Hash: d2ef4d3d3bece3ecb2957c56201156f867af3ba4ab4f7a9e8506c951494b066a
Instruction Fuzzy Hash: 2C115572100B159FE336DF68DCC485BB3F9FB44360B418E19E4A683A45CB30F8498B60

Function 10012300 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10012328
_strlen.LIBCMT ref: 1001234F
_strncpy.LIBCMT ref: 10012382
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 100123A9

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateDirectory_memset_strlen_strncpy
String ID:
API String ID: 3994138041-0
Opcode ID: 5146f0f5f6924dacce34261d64f74e5090e561bcbd4e5be505613ef66d126bf7
Instruction ID: 101a95c8069f775dae9c248aff8c456d68721b5b320a68391b460c7f447a75fb
Opcode Fuzzy Hash: 5146f0f5f6924dacce34261d64f74e5090e561bcbd4e5be505613ef66d126bf7
Instruction Fuzzy Hash: CB1194B9D041189BCB10DB64DC81BDD77B8EF65304F0082E9E59D9B281DAB4EBD48F91

Function 10026230 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 10026247

Part of subcall function 10026858: ___AdjustPointer.LIBCMT ref: 100268A1

_UnwindNestedFrames.LIBCMT ref: 1002625E
___FrameUnwindToState.LIBCMT ref: 10026270
CallCatchBlock.LIBCMT ref: 10026294

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 6092b50bab1218cd8aabaab9e12c658e2e0f1782f2186364ed2301dcdcc7d9c1
Instruction ID: 780a5d68346db81fedf9f8d85dc8351bab79c3fb61c7619bb358afdc1328406f
Opcode Fuzzy Hash: 6092b50bab1218cd8aabaab9e12c658e2e0f1782f2186364ed2301dcdcc7d9c1
Instruction Fuzzy Hash: 88011732000109FBCF12CF95EC05EDA3BBAFF8C754F518115FA1865121C776E865ABA0

Function 10015350 Relevance: 6.0, APIs: 4, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 10015381
__beginthreadex.LIBCMT ref: 100153A3
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 100153B4
CloseHandle.KERNEL32(00000000), ref: 100153BE

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseCreateEventHandleObjectSingleWait__beginthreadex
String ID:
API String ID: 2993629242-0
Opcode ID: d7dcd88de3af4c7a17b78a3c7ea8846737ab5e00941b9493fb9a3973c1d0ec84
Instruction ID: 28439952cb9d60efeb8680ab5036a31f0774e1b625031860cf64c459a7230e8b
Opcode Fuzzy Hash: d7dcd88de3af4c7a17b78a3c7ea8846737ab5e00941b9493fb9a3973c1d0ec84
Instruction Fuzzy Hash: 9A111EB5A04249AFDB14DFA8CC81BEE7BB4EF49310F504249F919AB381D730AA40CB90

Function 100065C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 10006720
construct.LIBCPMTD ref: 1000674A

Strings

wmic cpu get processorid, xrefs: 100065E0

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: char_traitsconstruct
String ID: wmic cpu get processorid
API String ID: 489808500-2204115948
Opcode ID: 1010ae759fa7e10457475eff9b78d9461d1f2c37ab24339ddda26cbfa1624876
Instruction ID: dd645ee37d0e35d6a0c4dc76963d6f74060cdeeedd1d1d5c8c6965c7acc1db0f
Opcode Fuzzy Hash: 1010ae759fa7e10457475eff9b78d9461d1f2c37ab24339ddda26cbfa1624876
Instruction Fuzzy Hash: 01410F75E00209DFDB08CF98D891AEEB7B6FF4C750F208129E915A7385DB35A941CBA4

Function 100113C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81fileCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 10011461
DeleteFileA.KERNEL32(?), ref: 100114B6

Part of subcall function 10011580: _memset.LIBCMT ref: 100115CC
Part of subcall function 10011580: GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 100115E0
Part of subcall function 10011580: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 10011647
Part of subcall function 10011580: GetFileSize.KERNEL32(000000FF,00000000), ref: 10011669
Part of subcall function 10011580: ReadFile.KERNEL32(000000FF,?,00000000,00000000,00000000), ref: 100116B4

Strings

.key, xrefs: 1001149B

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: File$DirectorySystem$CreateDeleteReadSize_memset
String ID: .key
API String ID: 3518743009-343438762
Opcode ID: eb43b5ddff7011dff6964891f9a77986a6cb4ad83d3904fe4c7462824836723d
Instruction ID: c5e3bf08ea98db34f13579d809896ca9d031d76340f358e502fc38b765e240d6
Opcode Fuzzy Hash: eb43b5ddff7011dff6964891f9a77986a6cb4ad83d3904fe4c7462824836723d
Instruction Fuzzy Hash: 9F31E675A0025C9BDB28CF64DC42BEEB7B9EB45310F5081A9F9059B281DB35AE85CB90

Function 1000F5B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40windowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 1000F5EB
MessageBoxA.USER32(00000000), ref: 1000F5F2

Strings

Shell_TrayWnd, xrefs: 1000F5E6

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: FindMessageWindow
String ID: Shell_TrayWnd
API String ID: 2823233367-2988720461
Opcode ID: fa6ae15565b281fa731f87bbf66bd491b581fbd42e31be7702e6434cd4fda3cb
Instruction ID: 8a2575e9232a4e6788a4e3303b54ed8dbf7533174b6017679d5c7ff6e03b4625
Opcode Fuzzy Hash: fa6ae15565b281fa731f87bbf66bd491b581fbd42e31be7702e6434cd4fda3cb
Instruction Fuzzy Hash: 240116B4D00208EFEB10CFA4D949B9EB7F4FB48341F2084A9E905A7394D675AF40AB54

Function 10012130 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1001214F
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 10012162

Strings

@, xrefs: 10012157

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus_memset
String ID: @
API String ID: 587104284-2766056989
Opcode ID: d7d7f9b0b0953cb5caef1f62c0310114e2340016ed59b2748a12603957ba9fb6
Instruction ID: 3d7f5f32418326eb2dbc6e30da0d634f8bec6cfce8173ea13a502be2592b4bca
Opcode Fuzzy Hash: d7d7f9b0b0953cb5caef1f62c0310114e2340016ed59b2748a12603957ba9fb6
Instruction Fuzzy Hash: 20F06DB0A10208ABDB14DFA4C941B9DBBF8EF18300F50412CE909EB381DB34EA45CB80

Function 1000F3B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000F3D5
wsprintfA.USER32 ref: 1000F3ED

Part of subcall function 1000F630: _memset.LIBCMT ref: 1000F648
Part of subcall function 1000F630: CreateProcessA.KERNEL32(00000000,1000F402,00000000,00000000,00000001,08000020,00000000,00000000,00000044,00000000), ref: 1000F686
Part of subcall function 1000F630: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1000F696
Part of subcall function 1000F630: CloseHandle.KERNEL32(00000000), ref: 1000F6A0
Part of subcall function 1000F630: CloseHandle.KERNEL32(?), ref: 1000F6AA

Strings

taskkill /f /t /im %s, xrefs: 1000F3E1

Memory Dump Source

Source File: 0000000E.00000002.3012198157.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000E.00000002.3012110827.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012409035.0000000010037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BA000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.3012975071.00000000101BE000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle_memset$CreateObjectProcessSingleWaitwsprintf
String ID: taskkill /f /t /im %s
API String ID: 1221303216-1431264914
Opcode ID: e147f47295d6159a0972dd24f2dc00c959dda93d6aa0ae33a39929a26f1210c1
Instruction ID: 7a26d32dd3a77ef8c91e8ca8fb8e6281576ca4a882f0339c21baba38ccc25a09
Opcode Fuzzy Hash: e147f47295d6159a0972dd24f2dc00c959dda93d6aa0ae33a39929a26f1210c1
Instruction Fuzzy Hash: 33F05475E00108ABDF10DBA4DD46BA973B8EF54204F4040A8F94DDB182EE75BB58CB91

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report c2A6GRyAwn.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
c2A6GRyAwn.dll

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre