Edit tour

Windows Analysis Report
Lic.exe

Overview

General Information

Sample name:	Lic.exe
Analysis ID:	1579538
MD5:	c5eaff76b3a6615840b4e0bc7e92fbc8
SHA1:	73e004370c39788699c010a09638d350a0d8fe1a
SHA256:	2316de75234975ef265f843eb585a3b34d875507a6f7506209a7df932de48667
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

Tries to detect virtualization through RDTSC time measurements

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Lic.exe (PID: 7072 cmdline: "C:\Users\user\Desktop\Lic.exe" MD5: C5EAFF76B3A6615840B4E0BC7E92FBC8)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Lic.exe	ReversingLabs: Detection: 19%
Source: Lic.exe	Virustotal: Detection: 19%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.4% probability

Machine Learning detection for sample

Source: Lic.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\Lic.exe	Code function: 0_2_00007FFE133027C0 CryptQueryObject,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CertFreeCertificateContext,CertCloseStore,CryptMsgClose,CryptMsgGetParam,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CertFreeCertificateContext,CertCloseStore,CryptMsgClose,LocalAlloc,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CertFreeCertificateContext,CertCloseStore,CryptMsgClose,CryptMsgGetParam,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CertFreeCertificateContext,CertCloseStore,CryptMsgClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CertFreeCertificateContext,CertCloseStore,CryptMsgClose,	0_2_00007FFE133027C0
Source: C:\Users\user\Desktop\Lic.exe	Code function: 0_2_00007FFE13302E35 lstrcmpA,CryptDecodeObject,CertFreeCertificateContext,	0_2_00007FFE13302E35
Source: C:\Users\user\Desktop\Lic.exe	Code function: 0_2_00007FFE13302E00 lstrcmpA,CryptDecodeObject,CertFreeCertificateContext,LocalAlloc,CertFreeCertificateContext,CryptDecodeObject,CertFreeCertificateContext,CertFreeCertificateContext,	0_2_00007FFE13302E00

Source: Lic.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: clrjit.pdb source: Lic.exe, 00000000.00000002.1725058787.0000024B719D2000.00000004.00000020.00020000.00000000.sdmp

Source: Lic.exe

String found in binary or memory: https://#/SCClientPing.php#Invalid

Source: C:\Users\user\Desktop\Lic.exe	Code function: 0_2_00007FFE13301D70	0_2_00007FFE13301D70
Source: C:\Users\user\Desktop\Lic.exe	Code function: 0_2_00007FFE13303270	0_2_00007FFE13303270
Source: C:\Users\user\Desktop\Lic.exe	Code function: 0_2_00007FFE133014D0	0_2_00007FFE133014D0
Source: C:\Users\user\Desktop\Lic.exe	Code function: 0_2_00007FFD9B7D6C12	0_2_00007FFD9B7D6C12
Source: C:\Users\user\Desktop\Lic.exe	Code function: 0_2_00007FFD9B7D5E66	0_2_00007FFD9B7D5E66

Source: Lic.exe	Binary or memory string: OriginalFilename vs Lic.exe
Source: Lic.exe, 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename vs Lic.exe
Source: Lic.exe, 00000000.00000002.1724955220.0000024B69201000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Lic.exe

Source: AgileDotNetRT64.dll.0.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: AgileDotNetRT64.dll.0.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: mal60.evad.winEXE@1/2@0/0

Source: C:\Users\user\Desktop\Lic.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Lic.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Lic.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\Lic.exe	Mutant created: \Sessions\1\BaseNamedObjects\{37c18af4-686a-4078-aea2-125b9784b6de}

Source: C:\Users\user\Desktop\Lic.exe

File created: C:\Users\user\AppData\Local\Temp\9d157fef-9d80-4c40-8e32-b40db35317cb

Jump to behavior

Source: Lic.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Lic.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Lic.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: C:\Users\user\Desktop\Lic.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Lic.exe	ReversingLabs: Detection: 19%
Source: Lic.exe	Virustotal: Detection: 19%

Source: Lic.exe	String found in binary or memory: application/xml)/authorize/stops.xml1/authorize/authorize.xml'www.decisionbar.com
Source: Lic.exe	String found in binary or memory: application/xml)/authorize/stops.xml1/authorize/authorize.xml'www.decisionbar.com

Source: C:\Users\user\Desktop\Lic.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\Lic.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Lic.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Lic.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: clrjit.pdb source: Lic.exe, 00000000.00000002.1725058787.0000024B719D2000.00000004.00000020.00020000.00000000.sdmp

Source: Lic.exe

Static PE information: 0xE66D18D1 [Thu Jul 3 07:44:17 2092 UTC]

Source: C:\Users\user\Desktop\Lic.exe

Code function: 0_2_00007FFE13308C00 GetCurrentProcess,GetCurrentProcess,GetFileVersionInfoSizeW,GetFileVersionInfoSizeExW,GetProcessHeap,HeapAlloc,GetFileVersionInfoW,VerQueryValueA,LoadLibraryW,GetProcAddress,GetProcessHeap,HeapFree,

0_2_00007FFE13308C00

Source: C:\Users\user\Desktop\Lic.exe	Code function: 0_2_00007FFE13304803 push D84C6147h; ret	0_2_00007FFE1330480C
Source: C:\Users\user\Desktop\Lic.exe	Code function: 0_2_00007FFE1331F5C5 push 37ED6F56h; ret	0_2_00007FFE1331F5CC
Source: C:\Users\user\Desktop\Lic.exe	Code function: 0_2_00007FFD9B7D00BD pushad ; iretd	0_2_00007FFD9B7D00C1

Source: C:\Users\user\Desktop\Lic.exe

File created: C:\Users\user\AppData\Local\Temp\9d157fef-9d80-4c40-8e32-b40db35317cb\AgileDotNetRT64.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Lic.exe

RDTSC instruction interceptor: First address: 7FFE13301F0F second address: 7FFE13301F90 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec eax 0x0000000a mov dword ptr [esp+28h], eax 0x0000000e dec eax 0x0000000f mov eax, dword ptr [esp+30h] 0x00000013 dec eax 0x00000014 mov ecx, dword ptr [esp+28h] 0x00000018 dec eax 0x00000019 sub ecx, eax 0x0000001b dec eax 0x0000001c mov eax, ecx 0x0000001e dec eax 0x0000001f add esp, 48h 0x00000022 ret 0x00000023 dec eax 0x00000024 mov dword ptr [00010326h], eax 0x0000002a mov dword ptr [esp+28h], 00000000h 0x00000032 jmp 00007FBCC0E8733Ch 0x00000034 mov eax, dword ptr [esp+50h] 0x00000038 cmp dword ptr [esp+28h], eax 0x0000003c jnl 00007FBCC0E87374h 0x0000003e rdtsc

Source: C:\Users\user\Desktop\Lic.exe	Memory allocated: 24B59170000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\Lic.exe	Memory allocated: 24B71200000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\Lic.exe

Code function: 0_2_00007FFE13301F40 rdtsc

0_2_00007FFE13301F40

Source: C:\Users\user\Desktop\Lic.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Lic.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\9d157fef-9d80-4c40-8e32-b40db35317cb\AgileDotNetRT64.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Lic.exe TID: 6168

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Lic.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS

Source: C:\Users\user\Desktop\Lic.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: C:\Users\user\Desktop\Lic.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Lic.exe	API call chain: ExitProcess graph end node	graph_0-7283
Source: C:\Users\user\Desktop\Lic.exe	API call chain: ExitProcess graph end node	graph_0-7288
Source: C:\Users\user\Desktop\Lic.exe	API call chain: ExitProcess graph end node	graph_0-7303
Source: C:\Users\user\Desktop\Lic.exe	API call chain: ExitProcess graph end node	graph_0-7294
Source: C:\Users\user\Desktop\Lic.exe	API call chain: ExitProcess graph end node	graph_0-7265

Source: C:\Users\user\Desktop\Lic.exe

Code function: 0_2_00007FFE13301F40 rdtsc

0_2_00007FFE13301F40

Source: C:\Users\user\Desktop\Lic.exe

0_2_00007FFE13308C00

Source: C:\Users\user\Desktop\Lic.exe

Code function: 0_2_00007FFE133012E0 K32EnumProcessModules,GetProcessHeap,HeapAlloc,EnumProcessModules,K32EnumProcessModules,GetProcessHeap,HeapFree,GetModuleBaseNameA,K32GetModuleBaseNameA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00007FFE133012E0

Source: C:\Users\user\Desktop\Lic.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Lic.exe

Queries volume information: C:\Users\user\Desktop\Lic.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Lic.exe

Code function: 0_2_00007FFE13306880 MessageBoxW,GetSystemTimeAsFileTime,CompareFileTime,MessageBoxW,

0_2_00007FFE13306880

Source: C:\Users\user\Desktop\Lic.exe

Code function: 0_2_00007FFE133010A0 GetVersionExW,

0_2_00007FFE133010A0

Source: C:\Users\user\Desktop\Lic.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	13 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	125 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
Lic.exe	20%	ReversingLabs
Lic.exe	19%	Virustotal	Browse
Lic.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\9d157fef-9d80-4c40-8e32-b40db35317cb\AgileDotNetRT64.dll	7%	ReversingLabs

Name	Source	Malicious	Antivirus Detection	Reputation
https://#/SCClientPing.php#Invalid	Lic.exe	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579538
Start date and time:	2024-12-22 23:26:25 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Lic.exe
Detection:	MAL
Classification:	mal60.evad.winEXE@1/2@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 23 Number of non-executed functions: 25
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\9d157fef-9d80-4c40-8e32-b40db35317cb\AgileDotNetRT64.dll	iBypass LPro A12+.exe	Get hash	malicious	Unknown	Browse
	iBypass LPro A12+.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Variant.Bulz.468687.12862.exe	Get hash	malicious	Unknown	Browse
	Ambrosial.exe	Get hash	malicious	RedLine	Browse
	FIa4FloXT2.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Lic.exe.log

Download File

Process:	C:\Users\user\Desktop\Lic.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1076
Entropy (8bit):	5.368877155569937
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4K6sXE4NpOKDE4KGKZI6Khk:MxHKQ71qHGIs0HKJHNpOYHKGSI6ok
MD5:	B7F637406C3D2DABB67C7F2CBE42BCBE
SHA1:	2C93AABEB33B56CAFEE571D3C78287AA58F59BBA
SHA-256:	37C992EAFB1DC7713D1DF489A0F7F0E090F0526915770071A3D6528559BD807B
SHA-512:	2CC57B6274DBB8A820249016A8915DD8081CBFF2B3FEDDB2FC56354D2F8D9EDE1881CE4C9C303396C343D6B17AC59C3B8E4A3CB05E5621853D40A7DCB010B7DA
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\8af759007c012da690062882e06694f1\System.Management.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.3

C:\Users\user\AppData\Local\Temp\9d157fef-9d80-4c40-8e32-b40db35317cb\AgileDotNetRT64.dll

Download File

Process:	C:\Users\user\Desktop\Lic.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	146414
Entropy (8bit):	6.346082537918833
Encrypted:	false
SSDEEP:	3072:tvfStxRL/l1JLnPynOuA7tuPkVg4qm5a4:ZKFJdvhqm5/
MD5:	9C43F77CB7CFF27CB47ED67BABE3EDA5
SHA1:	B0400CF68249369D21DE86BD26BB84CCFFD47C43
SHA-256:	F25B9288FE370DCFCB4823FB4E44AB88C7F5FCE6E137D0DBA389A3DBA07D621E
SHA-512:	CDE6FB6CF8DB6F9746E69E6C10214E60B3646700D70B49668A2A792E309714DD2D4C5A5241977A833A95FCDE8318ABCC89EB9968A5039A0B75726BBFA27125A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Joe Sandbox View:	Filename: iBypass LPro A12+.exe, Detection: malicious, Browse Filename: iBypass LPro A12+.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Variant.Bulz.468687.12862.exe, Detection: malicious, Browse Filename: Ambrosial.exe, Detection: malicious, Browse Filename: FIa4FloXT2.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t...0..J0..J0..J_.&J3..J9..J;..J0..Jf..J_..J1..J+,.J1..J+,&J(..J+,.J1..J+,.J1..J+,.J1..JRich0..J........................PE..d......Y.........." .........0...............................................p......8&....@.............................................s.......x....@.......0...............P..................................................................`....................text...1........................... ..`.rdata..c...........................@..@.data...X.... ......................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P....... ..............`...........................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.634655478974511
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Lic.exe
File size:	341'504 bytes
MD5:	c5eaff76b3a6615840b4e0bc7e92fbc8
SHA1:	73e004370c39788699c010a09638d350a0d8fe1a
SHA256:	2316de75234975ef265f843eb585a3b34d875507a6f7506209a7df932de48667
SHA512:	604edb43a261dd05a74f7bc330c3c858d6ea6639cb59d7eba64982233eea7e78a4ac61d4672e8aca10681cd655ea1fb76626a46b9fd4fe787f2d160a2dc06968
SSDEEP:	6144:lazBLJpL1pda3+LEfC7w2bhafQEPx96w3KK6cDwSL0JVu9:lazBLJpL1pda3+LEAjd1Ev1L0c
TLSH:	FA74472D65C8C200E99F36F4CC621AF8D5266D4DE463888B3CC8FE2A36731DCD69D665
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....m..........."...0.. ...2.......?... ...`....@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x453f06
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xE66D18D1 [Thu Jul 3 07:44:17 2092 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x53eac	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x54000	0x1050	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x56000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x51f2c	0x52000	4b3388da3cecf7de99883b9140003be5	False	0.631174971417683	data	6.6289203929392375	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x54000	0x1050	0x1200	a45e192ccd91f105b90720a0e3ed8391	False	0.3524305555555556	data	4.749249871797706	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x56000	0xc	0x200	5a2baff07ebc0abd5535dff91ab0d823	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x540a0	0x348	data			0.38452380952380955
RT_MANIFEST	0x543e8	0xc66	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.3916194076874606

Imports

DLL	Import
mscoree.dll	_CorExeMain

Target ID:	0
Start time:	17:27:16
Start date:	22/12/2024
Path:	C:\Users\user\Desktop\Lic.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Lic.exe"
Imagebase:	0x24b57630000
File size:	341'504 bytes
MD5 hash:	C5EAFF76B3A6615840B4E0BC7E92FBC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	0.8%
Signature Coverage:	11.6%
Total number of Nodes:	614
Total number of Limit Nodes:	17

Executed Functions

Function 00007FFE13308C00 Relevance: 45.8, APIs: 11, Strings: 15, Instructions: 259
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FFE13308C78

Part of subcall function 00007FFE1330F750: lstrcatW.KERNEL32 ref: 00007FFE1330F768

GetCurrentProcess.KERNEL32 ref: 00007FFE13308CD8
GetFileVersionInfoSizeW.VERSION ref: 00007FFE13308D43
GetProcessHeap.KERNEL32 ref: 00007FFE13308D58
HeapAlloc.KERNEL32 ref: 00007FFE13308D6E
GetFileVersionInfoW.VERSION ref: 00007FFE13308D93
VerQueryValueA.VERSION ref: 00007FFE13308DCC
LoadLibraryW.KERNEL32 ref: 00007FFE1330905E
GetProcAddress.KERNEL32 ref: 00007FFE13309083
GetProcessHeap.KERNEL32 ref: 00007FFE1330915B
HeapFree.KERNEL32 ref: 00007FFE1330916E

Part of subcall function 00007FFE1330EFD0: lstrcmpA.KERNEL32 ref: 00007FFE1330EFE8

Strings

clrjit.dll, xrefs: 00007FFE13308CAB
mscorjit.dll, xrefs: 00007FFE13308D0B
clrjit.dll, xrefs: 00007FFE13308C7E
4.0.30319.17020 built by: FXM3REL, xrefs: 00007FFE13308F6D
4.0.30319.17379, xrefs: 00007FFE13308F98
4.0.30319.17626, xrefs: 00007FFE13308FF2
mscorjit.dll, xrefs: 00007FFE13308CDE
\StringFileInfo\040904b0\FileVersion, xrefs: 00007FFE13308D98
2.0.50727.3068 (QFE.050727-3000), xrefs: 00007FFE13308E0A
2.0.50727., xrefs: 00007FFE13308E35
v4.0, xrefs: 00007FFE13308C3D
2.0.50727.3053 (netfxsp.050727-3000), xrefs: 00007FFE13308DE7
.text, xrefs: 00007FFE1330911F
getJit, xrefs: 00007FFE13309070
.text, xrefs: 00007FFE1330913E

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: HeapProcess$CurrentFileInfoVersion$AddressAllocFreeLibraryLoadProcQuerySizeValuelstrcatlstrcmp
String ID: .text$.text$2.0.50727.$2.0.50727.3053 (netfxsp.050727-3000)$2.0.50727.3068 (QFE.050727-3000)$4.0.30319.17020 built by: FXM3REL$4.0.30319.17379$4.0.30319.17626$\StringFileInfo\040904b0\FileVersion$clrjit.dll$clrjit.dll$getJit$mscorjit.dll$mscorjit.dll$v4.0
API String ID: 1337683846-2252446965
Opcode ID: bf7c1317f622244dced4724584e83ced2fe33d4f420fe2c36be6f14a33b3fa1d
Instruction ID: 6a004a5daa55671776aaa32c6abfd5f711fb8141fb426f2754dfad2acaf05816
Opcode Fuzzy Hash: bf7c1317f622244dced4724584e83ced2fe33d4f420fe2c36be6f14a33b3fa1d
Instruction Fuzzy Hash: 92E16836618AC289EB70EB12E4503AEB7A1FBD4798F404072DA9D93B69DF7CD544CB04

Function 00007FFE133012E0 Relevance: 15.1, APIs: 10, Instructions: 95
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FFE13301355
HeapAlloc.KERNEL32 ref: 00007FFE1330136B
EnumProcessModules.PSAPI ref: 00007FFE13301390
GetProcessHeap.KERNEL32 ref: 00007FFE133013B8
HeapFree.KERNEL32 ref: 00007FFE133013C8

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeModules
String ID:
API String ID: 384433944-0
Opcode ID: 4bdb968fcc38d39109dc59b9e1baebd67f78a17c960ccfb52890f12f631b5947
Instruction ID: 6212dd90385fbd84e1c69fc49622551fda545cd5ee1de61ca458a852398bfe48
Opcode Fuzzy Hash: 4bdb968fcc38d39109dc59b9e1baebd67f78a17c960ccfb52890f12f631b5947
Instruction Fuzzy Hash: 2B51C676A1CE81C6D670DB16E4843AEA3A0FB98798F400165EB9D93B68DF3CD5458B08

Function 00007FFE13301D70 Relevance: 7.5, APIs: 5, Instructions: 31
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventW.KERNEL32 ref: 00007FFE13301D81
CreateEventW.KERNEL32 ref: 00007FFE13301D9B
CreateEventW.KERNEL32 ref: 00007FFE13301DB5
GetCurrentThreadId.KERNEL32 ref: 00007FFE13301DC2
CreateThread.KERNELBASE ref: 00007FFE13301DEE

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Create$Event$Thread$Current
String ID:
API String ID: 4115085679-0
Opcode ID: 81d0fca3617dce84e9447a9b99591e8606d6e50b48b280d0001a6c6406541dee
Instruction ID: 9f789a3567d31d39c8e08d0f939e49eb049fe693bb0fe48688b11d35ee21155b
Opcode Fuzzy Hash: 81d0fca3617dce84e9447a9b99591e8606d6e50b48b280d0001a6c6406541dee
Instruction Fuzzy Hash: 7C01AD39B18F02CAF3E48B31B816F2A7261EB64328F405079C81E52B31CE3DD1598708

Function 00007FFE13301F40 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

SleepEx.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FFE13301C82), ref: 00007FFE13301FA3

Part of subcall function 00007FFE13301EC0: GetTickCount.KERNEL32 ref: 00007FFE13301ED6
Part of subcall function 00007FFE13301EC0: GetTickCount.KERNEL32 ref: 00007FFE13301EFB

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: f80cb61c89d33c2232b3e099c83d3592c43c439f46915bcc95f91fc8b3857663
Instruction ID: 28fadd943ee2ea84fdeffbaa5fa52e18406825c64e46faa07a1b79f0e6424277
Opcode Fuzzy Hash: f80cb61c89d33c2232b3e099c83d3592c43c439f46915bcc95f91fc8b3857663
Instruction Fuzzy Hash: D0011275E18E42CED750CB16E88022E7791E7983A4F100275E59D92775DF3CD1518B44

Function 00007FFD9B7D5E66 Relevance: .5, Instructions: 469COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725679296.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_Lic.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7b7e70e17a6a0424ea5c8f7451054a2120f043743075bca2e0563aa7763b896
Instruction ID: 1b7e015ad30ddf60b8fa560713364fd42b022999932071d3ef9121962dc69154
Opcode Fuzzy Hash: a7b7e70e17a6a0424ea5c8f7451054a2120f043743075bca2e0563aa7763b896
Instruction Fuzzy Hash: 3BF1A630A09A4D8FEBA8DF28C855BE977D1FF54350F04436EE84DC72A5DB34A9458B81

Function 00007FFD9B7D6C12 Relevance: .5, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725679296.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_Lic.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2f7e4c2bbf21e56496e63755d3b74043148e010ee63086f7836d712f06ce49
Instruction ID: a7a7afb3abdf7af970ffc478d00ae58beb3cb448b9fee728211a09a804a17b7a
Opcode Fuzzy Hash: 5f2f7e4c2bbf21e56496e63755d3b74043148e010ee63086f7836d712f06ce49
Instruction Fuzzy Hash: 8AE1D630A09A8D8FEBA8DF28C8557E937E1FF94310F04436ED84DC72A5CE34A9448B81

Function 00007FFE13308690 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 230
memorysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFE1330A4D0: EnterCriticalSection.KERNEL32 ref: 00007FFE1330A4E3

Part of subcall function 00007FFE13305A70: _wcsupr_s.LIBCMTD ref: 00007FFE13305AB4

Part of subcall function 00007FFE1330A510: LeaveCriticalSection.KERNEL32 ref: 00007FFE1330A52E

RaiseException.KERNEL32 ref: 00007FFE1330883E
WaitForSingleObject.KERNEL32 ref: 00007FFE1330890C
WaitForSingleObject.KERNEL32 ref: 00007FFE1330895B
GetProcessHeap.KERNEL32 ref: 00007FFE133089EF
HeapAlloc.KERNEL32 ref: 00007FFE13308A00
GetProcessHeap.KERNEL32 ref: 00007FFE13308B1F
HeapFree.KERNEL32 ref: 00007FFE13308B2F
GetProcessHeap.KERNEL32 ref: 00007FFE13308B3D
HeapFree.KERNEL32 ref: 00007FFE13308B4D

Strings

cr, xrefs: 00007FFE13308A6A
Agile.NET runtime internal error occurred., xrefs: 00007FFE133087F1

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Heap$Process$CriticalFreeObjectSectionSingleWait$AllocEnterExceptionLeaveRaise_wcsupr_s
String ID: Agile.NET runtime internal error occurred.$cr
API String ID: 1784018953-3111436492
Opcode ID: b57ee397af7449738234008319c071eeff7daba371090b3499b93e4d6dde85af
Instruction ID: 1417a9a5a135a1dfe20d7690cccb4952d2a1dbcc13d15d9a4e306497386b43c4
Opcode Fuzzy Hash: b57ee397af7449738234008319c071eeff7daba371090b3499b93e4d6dde85af
Instruction Fuzzy Hash: FEC1F87660CAC5C9DB60CB56E4883AEB7A0F7D8BA0F044126DA9D53B69DF3CD445CB04

Function 00007FFE133057D0 Relevance: 15.1, APIs: 10, Instructions: 136
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumProcessModules.PSAPI ref: 00007FFE13305817
GetProcessHeap.KERNEL32 ref: 00007FFE1330583B
HeapAlloc.KERNEL32 ref: 00007FFE13305851
EnumProcessModules.PSAPI ref: 00007FFE13305873
GetModuleInformation.PSAPI ref: 00007FFE133058E1
GetProcessHeap.KERNEL32 ref: 00007FFE13305927
HeapFree.KERNEL32 ref: 00007FFE13305937
GetProcessHeap.KERNEL32 ref: 00007FFE13305957
HeapFree.KERNEL32 ref: 00007FFE13305967
VirtualQuery.KERNEL32 ref: 00007FFE1330599A

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Heap$Process$EnumFreeModules$AllocInformationModuleQueryVirtual
String ID:
API String ID: 4262206646-0
Opcode ID: ceea9e61ae2fdccb7e003e48507b8b41b37007da2f5e0dd68eb70b98ab781cd9
Instruction ID: 6480736aa54ed364364eaf4dadd133bc1b3cae42753fefc7c476e6644cc7d537
Opcode Fuzzy Hash: ceea9e61ae2fdccb7e003e48507b8b41b37007da2f5e0dd68eb70b98ab781cd9
Instruction Fuzzy Hash: C761092660CA81CAE670CB16E48476EB7A0F7D87A4F404136EADD93BA8DF3CD5448F04

Function 00007FFE13305DA0 Relevance: 10.9, APIs: 7, Instructions: 351
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: QueryVirtual
String ID:
API String ID: 1804819252-0
Opcode ID: 46795164dbcdf3ad6bfdf78799c737a423ce520b6a28aab93283d408ad6caa38
Instruction ID: 9366a6bb53cf96d76c2f0857c3f3034135d92c34618a2de534b9c50531b9cfb7
Opcode Fuzzy Hash: 46795164dbcdf3ad6bfdf78799c737a423ce520b6a28aab93283d408ad6caa38
Instruction Fuzzy Hash: 5012F936609AC18ADB70CB1AE4903AEB7A1F7D87A0F504066DA8D87B69DF3DD450CF44

Function 00007FFE13305A70 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcsupr_s.LIBCMTD ref: 00007FFE13305AB4
_wcsupr_s.LIBCMTD ref: 00007FFE13305ADC

Strings

UKKED, xrefs: 00007FFE13305B10

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: _wcsupr_s
String ID: UKKED
API String ID: 600324503-4206113906
Opcode ID: 7d9d03ef57153a7d8990ac08e01eabe82736bdebbc62b7f712c11e85fb6f341f
Instruction ID: f7d141aa2a8152dce658e892875099ca092791b1bc9782b9d74b5bff5d4da6ea
Opcode Fuzzy Hash: 7d9d03ef57153a7d8990ac08e01eabe82736bdebbc62b7f712c11e85fb6f341f
Instruction Fuzzy Hash: 7B711D71A1CAC289EA71DB17E0553FF6390FBA8B90F004076D9AD57BAADE2CD140CB44

Function 00007FFE1330BCC0 Relevance: 6.1, APIs: 4, Instructions: 68
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFE1330F5A0: lstrcpyW.KERNEL32 ref: 00007FFE1330F5B8

CreateFileW.KERNELBASE ref: 00007FFE1330BD33
GetFileSize.KERNEL32 ref: 00007FFE1330BD48

Part of subcall function 00007FFE1330EE80: GetProcessHeap.KERNEL32 ref: 00007FFE1330EE89
Part of subcall function 00007FFE1330EE80: HeapAlloc.KERNEL32 ref: 00007FFE1330EE99

ReadFile.KERNELBASE ref: 00007FFE1330BD97
CloseHandle.KERNELBASE ref: 00007FFE1330BDA2

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: File$Heap$AllocCloseCreateHandleProcessReadSizelstrcpy
String ID:
API String ID: 4123427219-0
Opcode ID: 567d08ba2c89455098c4444cdfaea48bb366337489d0e66e012deeb7eca67cf1
Instruction ID: 33a91f486324ddcf685bb11937056c509e0c3851ee55494590a4fcbbfe690110
Opcode Fuzzy Hash: 567d08ba2c89455098c4444cdfaea48bb366337489d0e66e012deeb7eca67cf1
Instruction Fuzzy Hash: F8418276A18B84C7EB008F6AE49435ABBA0F7C8B94F204165EB8C07B69CF7DC1558F44

Function 00007FFE13309A90 Relevance: 4.6, APIs: 3, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_mbsset.LIBCMTD ref: 00007FFE13309AAB
GetProcessHeap.KERNEL32 ref: 00007FFE13309B0D
HeapAlloc.KERNEL32 ref: 00007FFE13309B1E

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Heap$AllocProcess_mbsset
String ID:
API String ID: 3511588043-0
Opcode ID: 9c28ee106da2329ad5654b6099321f634c73ddb4ba123690c7baacf6208007d8
Instruction ID: b7e9595b284951063fefe8b447089f332c4854c244ca38535ab2ef5a013a6893
Opcode Fuzzy Hash: 9c28ee106da2329ad5654b6099321f634c73ddb4ba123690c7baacf6208007d8
Instruction Fuzzy Hash: 6E21D436618F858ADB11DB2AE09041EB7B4FBD9BE0B108226EA9D53739DF3DD441CB04

Function 00007FFE133055B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FFE133055F4

Strings

UKKED, xrefs: 00007FFE133055ED

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: EnvironmentVariable
String ID: UKKED
API String ID: 1431749950-4206113906
Opcode ID: 441cf544d721819efb2fbca064090cdbdfca75b8e2f78038212f9997d2fe2eda
Instruction ID: 560e003d213a0038e12c2b70fe3ff850bdf2a4f5c45e74f3440ac70d48050fb5
Opcode Fuzzy Hash: 441cf544d721819efb2fbca064090cdbdfca75b8e2f78038212f9997d2fe2eda
Instruction Fuzzy Hash: AE21F976A0CF86C9EA508B56E48022EB7A0FBA47A0F405171EA9D53BB8DF7CD544CB04

Function 00007FFE1330617F Relevance: 3.1, APIs: 2, Instructions: 102
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFE13306343
VirtualProtect.KERNELBASE ref: 00007FFE133063B2

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0eb568c96684d28ba4cb8e813b2d4ad9b343b1c078d87e873991cd519d3fdef6
Instruction ID: 38af97ebd086b2d02a1e91bef8aeaab698a417fcf83c744f16a468adf3000898
Opcode Fuzzy Hash: 0eb568c96684d28ba4cb8e813b2d4ad9b343b1c078d87e873991cd519d3fdef6
Instruction Fuzzy Hash: 0351E67A209BC08ADB60CF19E0806AEB7A1F3D8750F505026EA8D87BA9CF7DD451CF44

Function 00007FFE133030A0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FFE13303148

Strings

(, xrefs: 00007FFE133030D4

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: (
API String ID: 32694325-3887548279
Opcode ID: 6655f92b84779f2b370c3b458e4e4ddd3821fe7da9848a1ed36c6bb0665e2be6
Instruction ID: 10e0c8297a544c800091759cb793aef800864a857c113b69ad10f1bd3f7510e4
Opcode Fuzzy Hash: 6655f92b84779f2b370c3b458e4e4ddd3821fe7da9848a1ed36c6bb0665e2be6
Instruction Fuzzy Hash: 38118F21A0CEC588F7B0AB22F4443AE62A1ABE4764F000570D5AC576B6DF3ED0658B14

Function 00007FFE13301C30 Relevance: 3.0, APIs: 2, Instructions: 20COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 00007FFE13301C40
SetEvent.KERNEL32 ref: 00007FFE13301C6E

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Event
String ID:
API String ID: 4201588131-0
Opcode ID: da6e1521970e8147b380b29ed3ccbf01235c3cb970a1b0a537bc7a0f487dbe5c
Instruction ID: d9376bb49ce98c7c8ac198b9831716de3324f304e60d1c7335c584a458917abf
Opcode Fuzzy Hash: da6e1521970e8147b380b29ed3ccbf01235c3cb970a1b0a537bc7a0f487dbe5c
Instruction Fuzzy Hash: 1EF0A075D0CC42CFEA20DB22D84927E62A0BFA8318F8001B1D19EB5671CF6CD449C708

Function 00007FFE1330EEB0 Relevance: 3.0, APIs: 2, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,00007FFE1330D89C), ref: 00007FFE1330EEB9
RtlFreeHeap.NTDLL(?,?,?,?,00007FFE1330D89C), ref: 00007FFE1330EEC9

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 6698e917849451a0aef8a6552657a417083e1d6884d0f5a15d5d9bf2732f7bc0
Instruction ID: f7f0337160328580e0e7c87f4f1ebaea8db113e3d9eb983f9cfd9c5c9482d4cf
Opcode Fuzzy Hash: 6698e917849451a0aef8a6552657a417083e1d6884d0f5a15d5d9bf2732f7bc0
Instruction Fuzzy Hash: 94C08064F15E41C1D604EB77B888015A360FFDC740F404075E58D11335DD3CC0554704

Function 00007FFE13309ED0 Relevance: 2.6, APIs: 2, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE133098F0: GetProcessHeap.KERNEL32 ref: 00007FFE1330999F
Part of subcall function 00007FFE133098F0: HeapAlloc.KERNEL32 ref: 00007FFE133099B2

GetProcessHeap.KERNEL32 ref: 00007FFE13309FB9
HeapFree.KERNEL32 ref: 00007FFE13309FC9

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 1aedfdc7593e60c27b125e012a3b97ac117d4af274e1274a9e130c1e161c9417
Instruction ID: b9cc5d8b000fd203561fdd56d0c358200d1ac4555e4d6a859975443d23fef272
Opcode Fuzzy Hash: 1aedfdc7593e60c27b125e012a3b97ac117d4af274e1274a9e130c1e161c9417
Instruction Fuzzy Hash: 96317236619F88CACB50CB1AE48061EB7A1F7C9B94F104126EA9E83B78DF3CD451CB04

Function 00007FFE133098F0 Relevance: 2.6, APIs: 2, Instructions: 56memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FFE1330999F
HeapAlloc.KERNEL32 ref: 00007FFE133099B2

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: a95fe1be4c71c6c06e46e549ec4844d4ee8cf09f426d05ad2846a831cdd59600
Instruction ID: 0cbabc9a6167cb7eb5115c9edb379788d6dc9d9fe046323ab0f853693264f773
Opcode Fuzzy Hash: a95fe1be4c71c6c06e46e549ec4844d4ee8cf09f426d05ad2846a831cdd59600
Instruction Fuzzy Hash: 46218776608B85CBDB14CF1AE08421ABBB0F7C9B94F218126EB9D43764DB7EC545CB40

Function 00007FFE1330EE80 Relevance: 2.5, APIs: 2, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FFE1330EE89
HeapAlloc.KERNEL32 ref: 00007FFE1330EE99

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: f449d6422ae271e761a07f547b04faa659581171b9b121866ee1c2c1e5dc86c0
Instruction ID: 6877c550593db151dab1492b388895944fb749c351b896bb8c938d00cc55c12b
Opcode Fuzzy Hash: f449d6422ae271e761a07f547b04faa659581171b9b121866ee1c2c1e5dc86c0
Instruction Fuzzy Hash: B7C08020F15E41C1D644EB77B888015A360FFDC744F404075D58D11335DD3CC0594704

Function 00007FFD9B7D0D15 Relevance: 1.7, APIs: 1, Instructions: 217libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00007FFD9B7D0EA1

Memory Dump Source

Source File: 00000000.00000002.1725679296.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_Lic.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0ad417b4c819c02802a9395850b0ca261dd264a10ab78db06c9c14b2169d377b
Instruction ID: 9e2ded305b78006d3915ecb91020d767e9d3490f52fd6191fcf977fdfba12168
Opcode Fuzzy Hash: 0ad417b4c819c02802a9395850b0ca261dd264a10ab78db06c9c14b2169d377b
Instruction Fuzzy Hash: 0F61D430609A8D8FEB59EF68C8657F53BE1FF95310F10426EE84DC72A2CA749945CB81

Function 00007FFE13305730 Relevance: 1.5, APIs: 1, Instructions: 25memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FFE13305769

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ca87b605d7527a805af6e528b24c58af9919f7da83d2830c66545cda446b07fe
Instruction ID: f8209ce0a7aa8e4260f9430beec6c782cd9e2b2a8557f7348d5d92c27ae13bfc
Opcode Fuzzy Hash: ca87b605d7527a805af6e528b24c58af9919f7da83d2830c66545cda446b07fe
Instruction Fuzzy Hash: 8EE0E527B1DD41CDE6204B42F48006EE750FBA47B4F540471FA9E167A5CE6CD0019B48

Function 00007FFE133056DE Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FFE13305703

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 10401bf45a24ac4b4ad64ec24bcd1d238dc0a9a1670b3a19d1ecccf79937b4a6
Instruction ID: 8feed251991538808426dd9a9762b25b7d02d0d450ebf97312b3026d6546e693
Opcode Fuzzy Hash: 10401bf45a24ac4b4ad64ec24bcd1d238dc0a9a1670b3a19d1ecccf79937b4a6
Instruction Fuzzy Hash: 37E04F63A4DC45DDE6208B86E44066EE310EB547B0F444476FBAE22AA9CE7CE004DB08

Non-executed Functions

Function 00007FFE133027C0 Relevance: 84.3, APIs: 44, Strings: 4, Instructions: 259encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32 ref: 00007FFE13302882
LocalFree.KERNEL32 ref: 00007FFE133028AA
LocalFree.KERNEL32 ref: 00007FFE133028C3
LocalFree.KERNEL32 ref: 00007FFE133028DC
LocalFree.KERNEL32 ref: 00007FFE133028F5
LocalFree.KERNEL32 ref: 00007FFE1330290E
CertFreeCertificateContext.CRYPT32 ref: 00007FFE13302921
CertCloseStore.CRYPT32 ref: 00007FFE1330293C
CryptMsgClose.CRYPT32 ref: 00007FFE13302955
CryptMsgGetParam.CRYPT32 ref: 00007FFE13302982
LocalFree.KERNEL32 ref: 00007FFE133029AA
LocalFree.KERNEL32 ref: 00007FFE133029C3
LocalFree.KERNEL32 ref: 00007FFE133029DC
LocalFree.KERNEL32 ref: 00007FFE133029F5
LocalFree.KERNEL32 ref: 00007FFE13302A0E
CertFreeCertificateContext.CRYPT32 ref: 00007FFE13302A21
CertCloseStore.CRYPT32 ref: 00007FFE13302A3C
CryptMsgClose.CRYPT32 ref: 00007FFE13302A55
LocalAlloc.KERNEL32 ref: 00007FFE13302A70
LocalFree.KERNEL32 ref: 00007FFE13302A9A
LocalFree.KERNEL32 ref: 00007FFE13302AB3
LocalFree.KERNEL32 ref: 00007FFE13302ACC
LocalFree.KERNEL32 ref: 00007FFE13302AE5
LocalFree.KERNEL32 ref: 00007FFE13302AFE
CertFreeCertificateContext.CRYPT32 ref: 00007FFE13302B11
CertCloseStore.CRYPT32 ref: 00007FFE13302B2C
CryptMsgClose.CRYPT32 ref: 00007FFE13302B45
CryptMsgGetParam.CRYPT32 ref: 00007FFE13302B77
LocalFree.KERNEL32 ref: 00007FFE13302B9F
LocalFree.KERNEL32 ref: 00007FFE13302BB8
LocalFree.KERNEL32 ref: 00007FFE13302BD1
LocalFree.KERNEL32 ref: 00007FFE13302BEA
LocalFree.KERNEL32 ref: 00007FFE13302C03
CertFreeCertificateContext.CRYPT32 ref: 00007FFE13302C16
CertCloseStore.CRYPT32 ref: 00007FFE13302C31
CryptMsgClose.CRYPT32 ref: 00007FFE13302C4A
LocalFree.KERNEL32 ref: 00007FFE13302CDE
LocalFree.KERNEL32 ref: 00007FFE13302CF7
LocalFree.KERNEL32 ref: 00007FFE13302D10
LocalFree.KERNEL32 ref: 00007FFE13302D29
LocalFree.KERNEL32 ref: 00007FFE13302D42
CertFreeCertificateContext.CRYPT32 ref: 00007FFE13302D55
CertCloseStore.CRYPT32 ref: 00007FFE13302D70
CryptMsgClose.CRYPT32 ref: 00007FFE13302D89

Strings

Z, xrefs: 00007FFE13302C57
h, xrefs: 00007FFE13302C8E
E, xrefs: 00007FFE13302C7A
~, xrefs: 00007FFE13302C66

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Free$Local$CertClose$Crypt$CertificateContextStore$Param$AllocObjectQuery
String ID: E$Z$h$~
API String ID: 4286058620-1241516678
Opcode ID: b632943e263cc83400ee88c6fab56ac12591eb4569c6cbd96ea87d28789367a7
Instruction ID: 0de398c2cc81df399e0d2c2749c7573fd1e57bfee655da15aedc0e83542b9ea3
Opcode Fuzzy Hash: b632943e263cc83400ee88c6fab56ac12591eb4569c6cbd96ea87d28789367a7
Instruction Fuzzy Hash: 2BF1EC2160CEC2CAE7B0CB16E4483AEA3A1FB90754F504175D6EE969B9DF7CD489CB04

Function 00007FFE133014D0 Relevance: 36.3, APIs: 24, Instructions: 287memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FFE13301544
HeapAlloc.KERNEL32 ref: 00007FFE1330155A
ReadProcessMemory.KERNEL32 ref: 00007FFE1330159D
GetProcessHeap.KERNEL32 ref: 00007FFE133015B5
HeapFree.KERNEL32 ref: 00007FFE133015C5
GetProcessHeap.KERNEL32 ref: 00007FFE1330160E
HeapFree.KERNEL32 ref: 00007FFE1330161E

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Heap$Process$Free$AllocMemoryRead
String ID:
API String ID: 3401992658-0
Opcode ID: 0470b1cd20778e8b5d982d8891017df019858e5454f0fc1727ce42e26a9b0110
Instruction ID: ee145c84a15d14c0b5aaf82f6d83d89449ddc2ccc80c9cf6dcfab9c56f2b9b1b
Opcode Fuzzy Hash: 0470b1cd20778e8b5d982d8891017df019858e5454f0fc1727ce42e26a9b0110
Instruction Fuzzy Hash: 51E1CE36A0CB858AD7A0CB5AF44436EB7A0FB99794F104075EADE93B68DF3CD4448B04

Function 00007FFE13303270 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FFE13303323
HeapAlloc.KERNEL32 ref: 00007FFE13303339
RaiseException.KERNEL32 ref: 00007FFE133033A1

Part of subcall function 00007FFE1330E810: ExitProcess.KERNEL32 ref: 00007FFE1330E821

GetProcessHeap.KERNEL32 ref: 00007FFE133033DB
HeapFree.KERNEL32 ref: 00007FFE133033EB
GetProcessHeap.KERNEL32 ref: 00007FFE13303400
HeapAlloc.KERNEL32 ref: 00007FFE13303416
RaiseException.KERNEL32 ref: 00007FFE1330347E
type_info::_name_internal_method.LIBCMTD ref: 00007FFE133034EE
GetProcessHeap.KERNEL32 ref: 00007FFE13303607
HeapFree.KERNEL32 ref: 00007FFE13303617

Strings

Memory allocation failed for IP_ADAPTER_ADDRESSES struct, xrefs: 00007FFE13303431
Memory allocation failed for IP_ADAPTER_ADDRESSES struct, xrefs: 00007FFE13303354
luetooth, xrefs: 00007FFE133034DE

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Heap$Process$AllocExceptionFreeRaise$Exittype_info::_name_internal_method
String ID: Memory allocation failed for IP_ADAPTER_ADDRESSES struct$Memory allocation failed for IP_ADAPTER_ADDRESSES struct$luetooth
API String ID: 563264890-3343762360
Opcode ID: 1c9afc30f4eff8537f4e853ac963db05aecf75aa9a660d888de8c2afe6f3118b
Instruction ID: 0cbb136ba051f98b8ef18244a8997d2681e042031008f4cc79668af5d750e281
Opcode Fuzzy Hash: 1c9afc30f4eff8537f4e853ac963db05aecf75aa9a660d888de8c2afe6f3118b
Instruction Fuzzy Hash: B5912836A08F858AE760CB66F4543AEB7A1FB987A4F404035EA9D53B69DF7CD144CB00

Function 00007FFE13306880 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 104windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FFE1330698F

Strings

and can not run on this machine., xrefs: 00007FFE13306A53
AgileDotNet, xrefs: 00007FFE13306A6D
AgileDotNet, xrefs: 00007FFE13306A3F
AgileDotNet, xrefs: 00007FFE1330697E
The secured image was created using a trial version of , xrefs: 00007FFE13306A2B
The secured image was created using a trial version of , xrefs: 00007FFE1330693C
and can not run on this machine., xrefs: 00007FFE13306964
AgileDotNet, xrefs: 00007FFE13306950

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Message
String ID: and can not run on this machine.$ and can not run on this machine.$AgileDotNet$AgileDotNet$AgileDotNet$AgileDotNet$The secured image was created using a trial version of $The secured image was created using a trial version of
API String ID: 2030045667-3305494433
Opcode ID: 5b7005dc252598ca0c162469369bbd06851c0251ecf40029832c8d27c0175328
Instruction ID: 1052685b03054fda09ea671090ac30e9816a6d7b164c158f683708364b2a01c2
Opcode Fuzzy Hash: 5b7005dc252598ca0c162469369bbd06851c0251ecf40029832c8d27c0175328
Instruction Fuzzy Hash: 3751746171CDC298EA719722E4503FEA350FBA47A4F404075E5AD925BBEE6CD244CB44

Function 00007FFE13302E00 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105encryptionmemorystringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32 ref: 00007FFE13302E70
CryptDecodeObject.CRYPT32 ref: 00007FFE13302EDC
CertFreeCertificateContext.CRYPT32 ref: 00007FFE13302EFA
LocalAlloc.KERNEL32 ref: 00007FFE13302F14
CertFreeCertificateContext.CRYPT32 ref: 00007FFE13302F3A
CryptDecodeObject.CRYPT32 ref: 00007FFE13302FAB
CertFreeCertificateContext.CRYPT32 ref: 00007FFE13302FC9
CertFreeCertificateContext.CRYPT32 ref: 00007FFE13302FF1

Strings

1.2.840.113549.1.9.6, xrefs: 00007FFE13302E65

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: CertCertificateContextFree$CryptDecodeObject$AllocLocallstrcmp
String ID: 1.2.840.113549.1.9.6
API String ID: 335881361-2921522063
Opcode ID: edcf1bec574ff234b4619ef6f94b37158b1fb6d0de44523390a08343a6577b95
Instruction ID: 6a985c129f53b30c6fdfc3aa85a110ce92b2651b3c25c1f78f540bd1c996e3a2
Opcode Fuzzy Hash: edcf1bec574ff234b4619ef6f94b37158b1fb6d0de44523390a08343a6577b95
Instruction Fuzzy Hash: 1251E976608A41CADB14CB09E49432EB7A0F7D8B94F204126EB9D97B78CF7DD485CB04

Function 00007FFE13302E35 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46encryptionmemorystringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32 ref: 00007FFE13302E70
CryptDecodeObject.CRYPT32 ref: 00007FFE13302EDC
CertFreeCertificateContext.CRYPT32 ref: 00007FFE13302EFA
LocalAlloc.KERNEL32 ref: 00007FFE13302F14
CertFreeCertificateContext.CRYPT32 ref: 00007FFE13302F3A
CertFreeCertificateContext.CRYPT32 ref: 00007FFE13302FF1

Strings

1.2.840.113549.1.9.6, xrefs: 00007FFE13302E65

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: CertCertificateContextFree$AllocCryptDecodeLocalObjectlstrcmp
String ID: 1.2.840.113549.1.9.6
API String ID: 2299954700-2921522063
Opcode ID: db96d14d40d9969ef454a0d0f168804e88a9dc3a6f7c0a8b28ea2049a95f6d33
Instruction ID: 6db974194b6e8aa3e6b2a8ebcbbaf1166d09a47fa0d544f55daf3e323f25cf56
Opcode Fuzzy Hash: db96d14d40d9969ef454a0d0f168804e88a9dc3a6f7c0a8b28ea2049a95f6d33
Instruction Fuzzy Hash: 0421F576608A81CADB04CB0AE49032EB7A0F7D8B94F504136EA9E97B78DF7CD445CB00

Function 00007FFE133010A0 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FFE133010BC

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 16c98b60504202c8745f39f82cb4b79dd388ece3ba03d14d9ea444e5f956a03b
Instruction ID: f8ce436168e642c8ceddfc64a71d35220a301bf9f05cdf3608fbf9ab2c6df1d0
Opcode Fuzzy Hash: 16c98b60504202c8745f39f82cb4b79dd388ece3ba03d14d9ea444e5f956a03b
Instruction Fuzzy Hash: 0C21E136D2D641CEEBB88A02E54432F77A0F7A5769F101179F29E115A8C77DD488CE09

Function 00007FFE13301190 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 72librarymemoryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE133010A0: GetVersionExW.KERNEL32 ref: 00007FFE133010BC

LoadLibraryW.KERNEL32 ref: 00007FFE133011C4
GetProcAddress.KERNEL32 ref: 00007FFE133011F1
GetProcAddress.KERNEL32 ref: 00007FFE1330120A
FreeLibrary.KERNEL32 ref: 00007FFE13301222
VirtualProtect.KERNEL32 ref: 00007FFE13301244
FreeLibrary.KERNEL32 ref: 00007FFE13301253
VirtualProtect.KERNEL32 ref: 00007FFE133012A6
FreeLibrary.KERNEL32 ref: 00007FFE133012B5

Strings

ntdll.dll, xrefs: 00007FFE133011BD
DbgUiRemoteBreakin, xrefs: 00007FFE133011E5
DbgBreakPoint, xrefs: 00007FFE133011FE

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Library$Free$AddressProcProtectVirtual$LoadVersion
String ID: DbgBreakPoint$DbgUiRemoteBreakin$ntdll.dll
API String ID: 3302647564-76633807
Opcode ID: da7a6bb8d533ff6402b070444e82588e32720411109c2aa754e586ca1d77209e
Instruction ID: f605ceab515392b6f1015a561bc3ed34bc297dbab75a166d1e222c7908cfc353
Opcode Fuzzy Hash: da7a6bb8d533ff6402b070444e82588e32720411109c2aa754e586ca1d77209e
Instruction Fuzzy Hash: 70315025A1CE81CAE7608B12E44432EB7A0FBA57A4F5001B1E69E53779CF3DD548CB08

Function 00007FFE13309FE0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 59memorytimefileCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32 ref: 00007FFE13309FF1
GetSystemTime.KERNEL32 ref: 00007FFE13309FFF
GetDateFormatA.KERNEL32 ref: 00007FFE1330A02B
GetTimeFormatA.KERNEL32 ref: 00007FFE1330A057

Part of subcall function 00007FFE1330F180: lstrcpyA.KERNEL32 ref: 00007FFE1330F198

Part of subcall function 00007FFE1330F320: lstrcatA.KERNEL32 ref: 00007FFE1330F338

CreateFileA.KERNEL32 ref: 00007FFE1330A104
GetProcessHeap.KERNEL32 ref: 00007FFE1330A111
HeapAlloc.KERNEL32 ref: 00007FFE1330A122
InitializeCriticalSection.KERNEL32 ref: 00007FFE1330A136

Strings

HH'h'mm'm'ss's', xrefs: 00007FFE1330A046
.txt, xrefs: 00007FFE1330A0C1
RuntimeLog, xrefs: 00007FFE1330A083
dd'd'MM'm'yyyy'y', xrefs: 00007FFE1330A01A

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: FormatHeapTime$AllocCreateCriticalDateFileInitializePathProcessSectionSystemTemplstrcatlstrcpy
String ID: .txt$HH'h'mm'm'ss's'$RuntimeLog$dd'd'MM'm'yyyy'y'
API String ID: 641398865-1436097571
Opcode ID: 60b143c65e979732b5595b6bb65ec2480896aab68157047de5bc1a656c4e681b
Instruction ID: 5c8efb2367b3e39ef9c057732c131401555dba0e964abf869c3db1123eb49731
Opcode Fuzzy Hash: 60b143c65e979732b5595b6bb65ec2480896aab68157047de5bc1a656c4e681b
Instruction Fuzzy Hash: 77311C75A18E82D9F760DB22E8543EAA361FBA8324F804171D69D52A79DF3CD10DCB08

Function 00007FFE13303880 Relevance: 18.2, APIs: 12, Instructions: 223threadinjectionCOMMON

Download Yara Rule

APIs

SuspendThread.KERNEL32 ref: 00007FFE133038BF
GetLastError.KERNEL32 ref: 00007FFE133038CC
GetThreadContext.KERNEL32 ref: 00007FFE1330390C
GetLastError.KERNEL32 ref: 00007FFE13303919
SetThreadContext.KERNEL32 ref: 00007FFE13303D4B
GetLastError.KERNEL32 ref: 00007FFE13303D58
ResumeThread.KERNEL32 ref: 00007FFE13303D71
GetLastError.KERNEL32 ref: 00007FFE13303D7E
SetEvent.KERNEL32 ref: 00007FFE13303DA3

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: ErrorLastThread$Context$EventResumeSuspend
String ID:
API String ID: 1160570678-0
Opcode ID: 6d1b9fb430bf3c3a7482eb446546e3484b6a16ad7a1df2d87e503e5e93534510
Instruction ID: 977cbc02c135540fb949a4953adc114387f68e2f176e4f77c13efdba8db6d7e4
Opcode Fuzzy Hash: 6d1b9fb430bf3c3a7482eb446546e3484b6a16ad7a1df2d87e503e5e93534510
Instruction Fuzzy Hash: 93D1F2B2608AC68AE7708B16E4443AFBBA0F794B59F004075CB9D47BA9DB7DD444CF48

Function 00007FFE1330F8E4 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 202libraryCOMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FFE1330F977
LoadLibraryA.KERNEL32 ref: 00007FFE1330FA1A
GetLastError.KERNEL32 ref: 00007FFE1330FA28
RaiseException.KERNEL32 ref: 00007FFE1330FA65

Strings

H, xrefs: 00007FFE1330F922

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: H
API String ID: 948315288-2852464175
Opcode ID: 43bb971852d7a7fa9d269d26fc1873a3f138505b3f3d5bae846dd4246f9f70b2
Instruction ID: e2ea67b9fde68d093201e6dc22803069ffbf28145f2679e7d0c97ae5ab13cbed
Opcode Fuzzy Hash: 43bb971852d7a7fa9d269d26fc1873a3f138505b3f3d5bae846dd4246f9f70b2
Instruction Fuzzy Hash: F1916C32B05B468EEB55CFA6E8406AC77A1BB18BA8F084035DE1D67B64EF3CE445C704

Function 00007FFE13301FE0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE13301FEB
GetProcAddress.KERNEL32 ref: 00007FFE13302012
GetProcAddress.KERNEL32 ref: 00007FFE1330202D
GetProcAddress.KERNEL32 ref: 00007FFE13302048

Strings

mscoree.dll, xrefs: 00007FFE13301FE4
GetFileVersion, xrefs: 00007FFE1330203A
GetCORVersion, xrefs: 00007FFE13302004
GetRequestedRuntimeInfo, xrefs: 00007FFE1330201F

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetCORVersion$GetFileVersion$GetRequestedRuntimeInfo$mscoree.dll
API String ID: 2238633743-1350728216
Opcode ID: 35337d0929e6747b82974c3f4fb4c31524521e949d39d6a30db05b111a9f12db
Instruction ID: 6db1a09d5858f86141afe0d2659189517bf4cb992d7f2da46ca57d1623df5028
Opcode Fuzzy Hash: 35337d0929e6747b82974c3f4fb4c31524521e949d39d6a30db05b111a9f12db
Instruction Fuzzy Hash: 3B0162A4A09F0ADDE680DB03EC8427DA365BF65760F4016B2D42DA2632DF6CA596C309

Function 00007FFE133036E0 Relevance: 13.6, APIs: 9, Instructions: 88threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1330EE80: GetProcessHeap.KERNEL32 ref: 00007FFE1330EE89
Part of subcall function 00007FFE1330EE80: HeapAlloc.KERNEL32 ref: 00007FFE1330EE99

GetCurrentThread.KERNEL32 ref: 00007FFE1330376B
GetCurrentThreadId.KERNEL32 ref: 00007FFE13303778
OpenThread.KERNEL32 ref: 00007FFE1330378E
CreateEventW.KERNEL32 ref: 00007FFE133037A7
CreateThread.KERNEL32 ref: 00007FFE133037E3
WaitForSingleObject.KERNEL32 ref: 00007FFE133037FC
CloseHandle.KERNEL32 ref: 00007FFE1330380B
GetCurrentThread.KERNEL32 ref: 00007FFE1330381E
CloseHandle.KERNEL32 ref: 00007FFE13303834

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Thread$Current$CloseCreateHandleHeap$AllocEventObjectOpenProcessSingleWait
String ID:
API String ID: 2424404254-0
Opcode ID: 6e6d3b53e848b1c6433ab97937796db298d080aa13cc77777690237fe19a4373
Instruction ID: 084a0a86a81d0e235504d21351e95b794e4b1cd1bba90fece0b9c57d10c6ccef
Opcode Fuzzy Hash: 6e6d3b53e848b1c6433ab97937796db298d080aa13cc77777690237fe19a4373
Instruction Fuzzy Hash: 2941CF36629F858AD790CB16E49072EB7A1FBD8BA4F104165EA9E53B68CF3CC444CB04

Function 00007FFE13304450 Relevance: 13.6, APIs: 9, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION ref: 00007FFE13304473
GetProcessHeap.KERNEL32 ref: 00007FFE13304496
HeapAlloc.KERNEL32 ref: 00007FFE133044AC
GetFileVersionInfoW.VERSION ref: 00007FFE133044CB
VerQueryValueA.VERSION ref: 00007FFE133044EE
GetProcessHeap.KERNEL32 ref: 00007FFE13304598
HeapFree.KERNEL32 ref: 00007FFE133045A8

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Heap$FileInfoProcessVersion$AllocFreeQuerySizeValue
String ID:
API String ID: 182793968-0
Opcode ID: a8f10d33d683de652da5afda89c844352a7bf210f50a967145278a67dd392050
Instruction ID: 0f33f4755f96e37f3626490da77d07f8451e8588318d700e8f6834c378531525
Opcode Fuzzy Hash: a8f10d33d683de652da5afda89c844352a7bf210f50a967145278a67dd392050
Instruction Fuzzy Hash: 7141E876A08B82CAD760CF2AE44036AB7E1FB98750F508136EA9C93768DE3CD045CF04

Function 00007FFE13303DC0 Relevance: 12.1, APIs: 8, Instructions: 61threadsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00007FFE13303DE7
GetCurrentThreadId.KERNEL32 ref: 00007FFE13303DF8
OpenThread.KERNEL32 ref: 00007FFE13303E0E
CreateEventW.KERNEL32 ref: 00007FFE13303E2C
CreateThread.KERNEL32 ref: 00007FFE13303E68
WaitForSingleObject.KERNEL32 ref: 00007FFE13303E81
CloseHandle.KERNEL32 ref: 00007FFE13303E90
CloseHandle.KERNEL32 ref: 00007FFE13303EB5

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Thread$CloseCreateCurrentHandle$EventObjectOpenSingleWait
String ID:
API String ID: 4004156642-0
Opcode ID: 28b1e6984884bcffa3dec0d4d7913924b04b3f7311c8f0e1b3c1eb99137728b0
Instruction ID: 6d98e62559ece50db6b4a5ff9c0ed41a411358269e4ebda728ce9e26cdfd1a33
Opcode Fuzzy Hash: 28b1e6984884bcffa3dec0d4d7913924b04b3f7311c8f0e1b3c1eb99137728b0
Instruction Fuzzy Hash: 55313436629F858AD790CB26E44072AB7A0FB98B64F100065EA9E43B64CF3DC445CB00

Function 00007FFE1330CDC0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 224COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FFE1330CF8B

Part of subcall function 00007FFE1330EFD0: lstrcmpA.KERNEL32 ref: 00007FFE1330EFE8

Strings

@, xrefs: 00007FFE1330D0F5
@, xrefs: 00007FFE1330D076
Table stream was not found., xrefs: 00007FFE1330CF3E
, xrefs: 00007FFE1330CFF9
-, xrefs: 00007FFE1330CFCC

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: ExceptionRaiselstrcmp
String ID: $-$@$@$Table stream was not found.
API String ID: 789130480-3695719007
Opcode ID: e77bc7a638fc51829f6b4dfd8455280927ec383c3c9f72b5050ef09c8b1049e3
Instruction ID: 578e248016f0cd63dfe0bb3f9c95fb4c1c9174d6c58f3c63d6ee8da3e7ad9dc4
Opcode Fuzzy Hash: e77bc7a638fc51829f6b4dfd8455280927ec383c3c9f72b5050ef09c8b1049e3
Instruction Fuzzy Hash: FAC11C32609B858AEB60CB1AE4847AEB7A0F7D8794F104135EA9D87B69DF3DD441CF04

Function 00007FFE1330E150 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 200memorystringCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00007FFE1330E15F
lstrlenW.KERNEL32 ref: 00007FFE1330E16F
GetProcessHeap.KERNEL32 ref: 00007FFE1330E189
HeapAlloc.KERNEL32 ref: 00007FFE1330E19C
lstrcpyW.KERNEL32 ref: 00007FFE1330E1CC

Strings

, xrefs: 00007FFE1330E447

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Heap$AllocCommandLineProcesslstrcpylstrlen
String ID:
API String ID: 3105795567-3916222277
Opcode ID: 6b0df1de6c89057d9d66f6f3798802fc466e9c8699ff9dfd1f681cb8f88723d3
Instruction ID: 3f78159c858a59f8d64b793efc0cdb4ba4067614cceea74d51defa8b94ce6548
Opcode Fuzzy Hash: 6b0df1de6c89057d9d66f6f3798802fc466e9c8699ff9dfd1f681cb8f88723d3
Instruction Fuzzy Hash: A4A1A962708F05C5DB708B16E48023E77A4FB98BA8F140175EAED937B5DF2CD5918B28

Function 00007FFE1330A230 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45filethreadCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FFE1330A264
GetCurrentThreadId.KERNEL32 ref: 00007FFE1330A287
GetCurrentProcessId.KERNEL32 ref: 00007FFE1330A2CE
GetCurrentProcess.KERNEL32 ref: 00007FFE1330A2D8
CloseHandle.KERNEL32 ref: 00007FFE1330A31B

Strings

MiniDump.dmp, xrefs: 00007FFE1330A25D

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Current$Process$CloseCreateFileHandleThread
String ID: MiniDump.dmp
API String ID: 2270032372-271895303
Opcode ID: 1e9184a7d2658d7df3d8dd0d6873f7ad22f50f8468e4fc3095c802ea393ff8d3
Instruction ID: 6dd6acdd3c123fc162c754ecacde6516cb8296b4c6fd92e0740179aa3e1b3e95
Opcode Fuzzy Hash: 1e9184a7d2658d7df3d8dd0d6873f7ad22f50f8468e4fc3095c802ea393ff8d3
Instruction Fuzzy Hash: 7421E436908B81CAE3609B56F44831AB7A0F795764F100279EAED52BA8CF7DD408CF04

Function 00007FFE13304090 Relevance: 10.5, APIs: 7, Instructions: 35COMMON

Download Yara Rule

APIs

UnDecorator::getCallIndex.LIBCMTD ref: 00007FFE133040A5
UnDecorator::getCallIndex.LIBCMTD ref: 00007FFE133040B8
UnDecorator::getCallIndex.LIBCMTD ref: 00007FFE133040CB
UnDecorator::getCallIndex.LIBCMTD ref: 00007FFE133040DE
UnDecorator::getCallIndex.LIBCMTD ref: 00007FFE133040F1
UnDecorator::getCallIndex.LIBCMTD ref: 00007FFE13304104
UnDecorator::getCallIndex.LIBCMTD ref: 00007FFE13304117

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: CallDecorator::getIndex
String ID:
API String ID: 627293820-0
Opcode ID: e763042008c29a6b1794e4c1da32227f3e3eebfdaf65f4da01eb3a9ae766041e
Instruction ID: 7691c0d967bf08c5ed51666be5e9357b6398228ef09eddb793b6eb71a7d4db22
Opcode Fuzzy Hash: e763042008c29a6b1794e4c1da32227f3e3eebfdaf65f4da01eb3a9ae766041e
Instruction Fuzzy Hash: 11014B52F2AB4A42EE44EB5BE09276F5310EFA1B80F401075B98E2B7B7CD6CC0118788

Function 00007FFE133045E0 Relevance: 9.1, APIs: 6, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FFE13304601
OpenProcess.KERNEL32 ref: 00007FFE13304611
EnumProcessModules.PSAPI ref: 00007FFE13304640
GetModuleFileNameExW.PSAPI ref: 00007FFE133046AA
CloseHandle.KERNEL32 ref: 00007FFE1330475A

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Process$CloseCurrentEnumFileHandleModuleModulesNameOpen
String ID:
API String ID: 4110801219-0
Opcode ID: 31b224539508ebc4d5716af36cc2d9259b68b6eb3aa1368948da4186f7942a9a
Instruction ID: 675a881f5df299a36b55732cac823766501dcac9e4714dda8a7ab91d71409932
Opcode Fuzzy Hash: 31b224539508ebc4d5716af36cc2d9259b68b6eb3aa1368948da4186f7942a9a
Instruction Fuzzy Hash: 1741633661DE818AE730DB16E4442BEA3A4FBD8794F404035E69D93AA9DF3CD640CF04

Function 00007FFE1330A3E0 Relevance: 6.0, APIs: 4, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FFE1330A40D
VirtualProtect.KERNEL32 ref: 00007FFE1330A42D
LeaveCriticalSection.KERNEL32 ref: 00007FFE1330A442
VirtualProtect.KERNEL32 ref: 00007FFE1330A479

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Virtual$Protect$CriticalLeaveQuerySection
String ID:
API String ID: 2006288-0
Opcode ID: 6f35eb7db4e4a76644e042df981321757dc8b79510c58313495dbcc33ddb23a0
Instruction ID: 9da984b7dceba82d919260bf4284b481110bf3104a298040223317a685e3d872
Opcode Fuzzy Hash: 6f35eb7db4e4a76644e042df981321757dc8b79510c58313495dbcc33ddb23a0
Instruction Fuzzy Hash: 80119276628E80C6DB508B66E44061EB7A0F789B94F504226EB8D43B68CF3DC549CB04

Function 00007FFE1330A330 Relevance: 6.0, APIs: 4, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FFE1330A34E
VirtualProtect.KERNEL32 ref: 00007FFE1330A36E
EnterCriticalSection.KERNEL32 ref: 00007FFE1330A380
VirtualProtect.KERNEL32 ref: 00007FFE1330A3B8

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Virtual$Protect$CriticalEnterQuerySection
String ID:
API String ID: 2670832257-0
Opcode ID: 59597dd2451da54cd602cab7bd477533b025bb812c6e7ba2c2f25d9824cdeadd
Instruction ID: edd2fc90ce49dfdd76d4a3ede8e0667cc7c96c69d8e91ac786c941b48dacbe74
Opcode Fuzzy Hash: 59597dd2451da54cd602cab7bd477533b025bb812c6e7ba2c2f25d9824cdeadd
Instruction Fuzzy Hash: 23015E76628E80C6DA50DB6AE45461AB7A4F7C8BA4F504226EB8D43B38CF3CC554CF04

Function 00007FFE13303020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FFE13303046

Part of subcall function 00007FFE1330E810: ExitProcess.KERNEL32 ref: 00007FFE1330E821

Strings

AgileDotNet, xrefs: 00007FFE13303036
This application requires .NET Framework 2.0 in order to run properly. Please verify that .NET framework 2.0 is installed on the, xrefs: 00007FFE1330303D

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: ExitMessageProcess
String ID: AgileDotNet$This application requires .NET Framework 2.0 in order to run properly. Please verify that .NET framework 2.0 is installed on the
API String ID: 1220098344-543017848
Opcode ID: e4d37aac3d1c3c0b30195843f6adabed925b3a0cb80ff3edda9355ac895cedaa
Instruction ID: be554e52a86bdda6d1c0c50842982a8df3aadea1496c914722db38b823a7f269
Opcode Fuzzy Hash: e4d37aac3d1c3c0b30195843f6adabed925b3a0cb80ff3edda9355ac895cedaa
Instruction Fuzzy Hash: 6BD01764F08D078AE6446767A8412F9A254AF387A8FC004B1E06DA61B3DD5DE1868399

Function 00007FFE133093E0 Relevance: 5.0, APIs: 4, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FFE13309441
HeapFree.KERNEL32 ref: 00007FFE13309451
GetProcessHeap.KERNEL32 ref: 00007FFE13309466
HeapFree.KERNEL32 ref: 00007FFE13309479

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97b04d9ad609d5a0e2ef50727695d97238f2d6be919eb000c3c8d20340ee418d
Instruction ID: 225b4eb4269ce2121afa46ae80fb212c764e18e302af5df4ff8af33b6d183bd4
Opcode Fuzzy Hash: 97b04d9ad609d5a0e2ef50727695d97238f2d6be919eb000c3c8d20340ee418d
Instruction Fuzzy Hash: A611D636A18F41CAD660CB5AE48432EA7A0FBD8BA4F104176EA9E53778DF7CD1458B04

Function 00007FFE1330E010 Relevance: 5.0, APIs: 4, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FFE1330E026
HeapReAlloc.KERNEL32 ref: 00007FFE1330E03B
GetProcessHeap.KERNEL32 ref: 00007FFE1330E045
HeapAlloc.KERNEL32 ref: 00007FFE1330E055

Memory Dump Source

Source File: 00000000.00000002.1725765280.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000000.00000002.1725748037.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725788114.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725828532.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725852927.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725869627.00007FFE13315000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1725885273.00007FFE13316000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe13300000_Lic.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: b0356d0bae4686313ba9b52df9f4365dc7888078af5079ade7b6e256e4e57d58
Instruction ID: d3a843234f1df26af88e2645590a8af7144c70ee23c03930e945dad0b97ee43c
Opcode Fuzzy Hash: b0356d0bae4686313ba9b52df9f4365dc7888078af5079ade7b6e256e4e57d58
Instruction Fuzzy Hash: F7E06561E18F82C5E684DB63B84836AA3A0FF98754F004075E9AE52635DF3CD0448604

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Lic.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Lic.exe.log

C:\Users\user\AppData\Local\Temp\9d157fef-9d80-4c40-8e32-b40db35317cb\AgileDotNetRT64.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: Lic.exePID: 7072, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: Lic.exePID: 7072, Parent PID: 2580COMMON

Execution Graph

Graph

Windows Analysis Report
Lic.exe

Function 00007FFE13308C00 Relevance: 45.8, APIs: 11, Strings: 15, Instructions: 259
memorylibraryloaderCOMMON

Function 00007FFE133012E0 Relevance: 15.1, APIs: 10, Instructions: 95
memoryCOMMON

Function 00007FFE13301D70 Relevance: 7.5, APIs: 5, Instructions: 31
threadCOMMON

Function 00007FFE13308690 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 230
memorysynchronizationCOMMON

Function 00007FFE133057D0 Relevance: 15.1, APIs: 10, Instructions: 136
memoryCOMMON

Function 00007FFE13305DA0 Relevance: 10.9, APIs: 7, Instructions: 351
COMMON

Function 00007FFE13305A70 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 158
COMMON

Function 00007FFE1330BCC0 Relevance: 6.1, APIs: 4, Instructions: 68
fileCOMMON

Function 00007FFE13309A90 Relevance: 4.6, APIs: 3, Instructions: 59
memoryCOMMON

Function 00007FFE133055B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
COMMON

Function 00007FFE1330617F Relevance: 3.1, APIs: 2, Instructions: 102
memoryCOMMON

Function 00007FFE133030A0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 38
COMMON