Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SmartDeploy.exe

Overview

General Information

Sample name:SmartDeploy.exe
Analysis ID:1586407
MD5:6ec7109891d3e7807651ffaefc36eb7a
SHA1:77d129e6607c57121f2363189f672d9b07485642
SHA256:25a076dd061d646ce750f597553c034a12d314776384834b34fbc7f4ecd2cd9f
Infos:

Detection

Score:80
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Adds a new user with administrator rights
Creates an undocumented autostart registry key
Disables UAC (registry)
Modifies the windows firewall
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Uses cmd line tools excessively to alter registry or file data
Uses netsh to modify the Windows network and firewall settings
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to create new users
Contains functionality to delete services
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries disk information (often used to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Add User to Local Administrators Group
Sigma detected: CurrentVersion NT Autorun Keys Modification
Sigma detected: New User Created Via Net.EXE
Too many similar processes found
Uses 32bit PE files
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)
Uses net.exe to stop services
Uses reg.exe to modify the Windows registry

Classification

Process Tree

  • System is w10x64
  • SmartDeploy.exe (PID: 6932 cmdline: "C:\Users\user\Desktop\SmartDeploy.exe" MD5: 6EC7109891D3E7807651FFAEFC36EB7A)
    • conhost.exe (PID: 6956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • conhost.exe (PID: 5216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 7100 cmdline: C:\Windows\system32\cmd.exe /c net user /add Comprise S@mtwo345 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • net.exe (PID: 7092 cmdline: net user /add Comprise S@mtwo345 MD5: 31890A7DE89936F922D44D677F681A7F)
        • net1.exe (PID: 6160 cmdline: C:\Windows\system32\net1 user /add Comprise S@mtwo345 MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
    • cmd.exe (PID: 6188 cmdline: C:\Windows\system32\cmd.exe /c net localgroup users Comprise /add MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • net.exe (PID: 7156 cmdline: net localgroup users Comprise /add MD5: 31890A7DE89936F922D44D677F681A7F)
        • net1.exe (PID: 7116 cmdline: C:\Windows\system32\net1 localgroup users Comprise /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
    • cmd.exe (PID: 648 cmdline: C:\Windows\system32\cmd.exe /c net localgroup administrators Comprise /add MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • net.exe (PID: 2488 cmdline: net localgroup administrators Comprise /add MD5: 31890A7DE89936F922D44D677F681A7F)
        • net1.exe (PID: 3940 cmdline: C:\Windows\system32\net1 localgroup administrators Comprise /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
    • cmd.exe (PID: 1216 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\PrintUI.exe /dl /n "Send To OneNote 2013" /q MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • printui.exe (PID: 5788 cmdline: C:\Windows\system32\PrintUI.exe /dl /n "Send To OneNote 2013" /q MD5: D39EFE3FAAF079EAD278F86FB1FCA8C0)
    • cmd.exe (PID: 3236 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\PrintUI.exe /dl /n "Fax" /q MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • printui.exe (PID: 4228 cmdline: C:\Windows\system32\PrintUI.exe /dl /n "Fax" /q MD5: D39EFE3FAAF079EAD278F86FB1FCA8C0)
    • cmd.exe (PID: 6048 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\net.exe Stop SPOOLER MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • net.exe (PID: 6576 cmdline: C:\Windows\system32\net.exe Stop SPOOLER MD5: 31890A7DE89936F922D44D677F681A7F)
        • net1.exe (PID: 5764 cmdline: C:\Windows\system32\net1 Stop SPOOLER MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
    • cmd.exe (PID: 7088 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\net.exe START SPOOLER MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • net.exe (PID: 7108 cmdline: C:\Windows\system32\net.exe START SPOOLER MD5: 31890A7DE89936F922D44D677F681A7F)
        • net1.exe (PID: 5848 cmdline: C:\Windows\system32\net1 START SPOOLER MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
    • cmd.exe (PID: 5788 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\netsh advfirewall firewall add rule name="SAM Rule In" dir=in action=allow protocol=TCP localport=2002 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • netsh.exe (PID: 1216 cmdline: C:\Windows\system32\netsh advfirewall firewall add rule name="SAM Rule In" dir=in action=allow protocol=TCP localport=2002 MD5: 4E89A1A088BE715D6C946E55AB07C7DF)
    • cmd.exe (PID: 3720 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\netsh advfirewall firewall add rule name="SAM Rule Out" dir=out action=allow protocol=TCP localport=2002 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • netsh.exe (PID: 4508 cmdline: C:\Windows\system32\netsh advfirewall firewall add rule name="SAM Rule Out" dir=out action=allow protocol=TCP localport=2002 MD5: 4E89A1A088BE715D6C946E55AB07C7DF)
    • cmd.exe (PID: 2204 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\reg ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0x0 /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • reg.exe (PID: 7080 cmdline: C:\Windows\system32\reg ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0x0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
    • cmd.exe (PID: 6332 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • reg.exe (PID: 4136 cmdline: C:\Windows\system32\reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
    • cmd.exe (PID: 6268 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11" /t /e /g Users:f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • cacls.exe (PID: 1620 cmdline: C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11" /t /e /g Users:f MD5: 00BAAE10C69DAD58F169A3ED638D6C59)
    • cmd.exe (PID: 1216 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Configuration" /t /e /g Users:f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • cacls.exe (PID: 3236 cmdline: C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Configuration" /t /e /g Users:f MD5: 00BAAE10C69DAD58F169A3ED638D6C59)
    • cmd.exe (PID: 2740 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\images" /t /e /g Users:f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • cacls.exe (PID: 5432 cmdline: C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\images" /t /e /g Users:f MD5: 00BAAE10C69DAD58F169A3ED638D6C59)
    • cmd.exe (PID: 1800 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Jobs" /t /e /g Everyone:f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • cacls.exe (PID: 1368 cmdline: C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Jobs" /t /e /g Everyone:f MD5: 00BAAE10C69DAD58F169A3ED638D6C59)
    • cmd.exe (PID: 4904 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Languages" /t /e /g Users:f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • cacls.exe (PID: 2740 cmdline: C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Languages" /t /e /g Users:f MD5: 00BAAE10C69DAD58F169A3ED638D6C59)
    • cmd.exe (PID: 2256 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\logs" /t /e /g Everyone:f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • cacls.exe (PID: 1216 cmdline: C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\logs" /t /e /g Everyone:f MD5: 00BAAE10C69DAD58F169A3ED638D6C59)
    • cmd.exe (PID: 6268 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Themes" /t /e /g Everyone:f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • cacls.exe (PID: 1620 cmdline: C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Themes" /t /e /g Everyone:f MD5: 00BAAE10C69DAD58F169A3ED638D6C59)
    • cmd.exe (PID: 3872 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\tmpDownload" /t /e /g Everyone:f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • cacls.exe (PID: 1368 cmdline: C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\tmpDownload" /t /e /g Everyone:f MD5: 00BAAE10C69DAD58F169A3ED638D6C59)
    • cmd.exe (PID: 3052 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Update" /t /e /g Everyone:f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • cacls.exe (PID: 3068 cmdline: C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Update" /t /e /g Everyone:f MD5: 00BAAE10C69DAD58F169A3ED638D6C59)
    • cmd.exe (PID: 7100 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Computers" /t /e /g Everyone:f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • cacls.exe (PID: 1368 cmdline: C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Computers" /t /e /g Everyone:f MD5: 00BAAE10C69DAD58F169A3ED638D6C59)
    • cmd.exe (PID: 1216 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Users" /t /e /g Everyone:f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • cacls.exe (PID: 6268 cmdline: C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Users" /t /e /g Everyone:f MD5: 00BAAE10C69DAD58F169A3ED638D6C59)
    • cmd.exe (PID: 3260 cmdline: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Windows\System32\spool\PRINTERS" /t /e /g Everyone:f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • cacls.exe (PID: 1368 cmdline: C:\Windows\system32\cacls "C:\Windows\System32\spool\PRINTERS" /t /e /g Everyone:f MD5: 00BAAE10C69DAD58F169A3ED638D6C59)
    • cmd.exe (PID: 1620 cmdline: C:\Windows\system32\cmd.exe /c C:\Program Files (x86)\SAM 11\SetEdgePolicies.reg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
  • spoolsv.exe (PID: 7116 cmdline: C:\Windows\System32\spoolsv.exe MD5: 0D4B1E3E4488E9BDC035F23E1F4FE22F)
  • svchost.exe (PID: 5848 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Source: Threat createdAuthor: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\System32\spoolsv.exe, SourceProcessId: 7116, StartAddress: 215CDF50, TargetImage: C:\Windows\SysWOW64\net1.exe, TargetProcessId: 7116
Sigma detected: Add User to Local Administrators Group
Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c net localgroup administrators Comprise /add, CommandLine: C:\Windows\system32\cmd.exe /c net localgroup administrators Comprise /add, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\SmartDeploy.exe", ParentImage: C:\Users\user\Desktop\SmartDeploy.exe, ParentProcessId: 6932, ParentProcessName: SmartDeploy.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c net localgroup administrators Comprise /add, ProcessId: 648, ProcessName: cmd.exe
Sigma detected: CurrentVersion NT Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Program Files (x86)\SAM 11\SamClient11.exe, C:\Windows\system32\userinit.exe,, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SmartDeploy.exe, ProcessId: 6932, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
Sigma detected: New User Created Via Net.EXE
Source: Process startedAuthor: Endgame, JHasenbusch (adapted to Sigma for oscd.community): Data: Command: net user /add Comprise S@mtwo345, CommandLine: net user /add Comprise S@mtwo345, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c net user /add Comprise S@mtwo345, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7100, ParentProcessName: cmd.exe, ProcessCommandLine: net user /add Comprise S@mtwo345, ProcessId: 7092, ProcessName: net.exe
Sigma detected: Net.exe Execution
Source: Process startedAuthor: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net user /add Comprise S@mtwo345, CommandLine: net user /add Comprise S@mtwo345, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c net user /add Comprise S@mtwo345, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7100, ParentProcessName: cmd.exe, ProcessCommandLine: net user /add Comprise S@mtwo345, ProcessId: 7092, ProcessName: net.exe
Sigma detected: Start Windows Service Via Net.EXE
Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\net.exe START SPOOLER, CommandLine: C:\Windows\system32\net.exe START SPOOLER, CommandLine|base64offset|contains: I0, Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\net.exe START SPOOLER, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7088, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\net.exe START SPOOLER, ProcessId: 7108, ProcessName: net.exe
Sigma detected: Stop Windows Service Via Net.EXE
Source: Process startedAuthor: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\net.exe Stop SPOOLER, CommandLine: C:\Windows\system32\net.exe Stop SPOOLER, CommandLine|base64offset|contains: J), Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\net.exe Stop SPOOLER, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6048, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\net.exe Stop SPOOLER, ProcessId: 6576, ProcessName: net.exe
Sigma detected: Windows Processes Suspicious Parent Directory
Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5848, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: SmartDeploy.exeVirustotal: Detection: 48%Perma Link
Source: SmartDeploy.exeReversingLabs: Detection: 58%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 84.8% probability
Source: SmartDeploy.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: Binary string: C:\Users\ChristopherWall\Documents\Local Edits\3-23-2022 standard client\Install\SAMUpgrade\Debug\SmartDeploy.pdbX source: SmartDeploy.exe
Source: Binary string: C:\Users\ChristopherWall\Documents\Local Edits\3-23-2022 standard client\Install\SAMUpgrade\Debug\SmartDeploy.pdb source: SmartDeploy.exe
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: 0_2_00405630 GetSystemInfo,FindFirstFileA,FindFirstFileA,wsprintfA,CreateDirectoryA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,CreateDirectoryA,wsprintfA,CreateDirectoryA,wsprintfA,CreateDirectoryA,wsprintfA,CreateDirectoryA,wsprintfA,CreateDirectoryA,wsprintfA,CreateDirectoryA,wsprintfA,wsprintfA,wsprintfA,CopyFileA,wsprintfA,CopyFileA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,wsprintfA,DeleteFileA,DeleteFileA,DeleteFileA,DeleteFileA,DeleteFileA,DeleteFileA,DeleteFileA,0_2_00405630
Source: SmartDeploy.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SmartDeploy.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SmartDeploy.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: svchost.exe, 00000023.00000002.2994827432.000001B522000000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
Source: SmartDeploy.exeString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SmartDeploy.exeString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SmartDeploy.exeString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: svchost.exe, 00000023.00000003.1829958465.000001B522218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.35.dr, edb.log.35.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.35.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.35.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.35.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000023.00000003.1829958465.000001B522218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.35.dr, edb.log.35.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000023.00000003.1829958465.000001B522218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.35.dr, edb.log.35.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000023.00000003.1829958465.000001B52224D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.35.dr, edb.log.35.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.35.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: SmartDeploy.exeString found in binary or memory: http://ocsp.digicert.com0A
Source: SmartDeploy.exeString found in binary or memory: http://ocsp.digicert.com0C
Source: SmartDeploy.exeString found in binary or memory: http://ocsp.digicert.com0X
Source: svchost.exe, 00000023.00000003.1829958465.000001B5222C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.35.dr, edb.log.35.drString found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.35.drString found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.35.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.35.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000023.00000003.1829958465.000001B5222C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.35.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000023.00000003.1829958465.000001B5222C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.35.dr, edb.log.35.drString found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.35.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: cmd.exeProcess created: 42
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: 0_2_00404900 OpenSCManagerA,OpenServiceA,OpenServiceA,OpenServiceA,CloseServiceHandle,DeleteService,CloseServiceHandle,CloseServiceHandle,0_2_00404900
Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmpJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: 0_2_00415C600_2_00415C60
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: 0_2_00414E400_2_00414E40
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: String function: 0040CAC0 appears 52 times
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: String function: 00409CF0 appears 40 times
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: String function: 0040100A appears 43 times
Source: SmartDeploy.exeStatic PE information: invalid certificate
Source: SmartDeploy.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe C:\Windows\system32\reg ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0x0 /f
Source: classification engineClassification label: mal80.evad.winEXE@101/17@0/1
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: OpenSCManagerA,CreateServiceA,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,0_2_00404F10
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: 0_2_00402E50 CoInitialize,CoUninitialize,CoCreateInstance,CoUninitialize,GetLastError,wsprintfA,MessageBoxA,CoUninitialize,MultiByteToWideChar,CoUninitialize,0_2_00402E50
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: 0_2_00404F10 OpenSCManagerA,CreateServiceA,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,0_2_00404F10
Source: C:\Users\user\Desktop\SmartDeploy.exeFile created: C:\Program Files (x86)\SAM 11Jump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6956:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5216:120:WilError_03
Source: SmartDeploy.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SmartDeploy.exeFile read: C:\Program Files (x86)\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: SmartDeploy.exeVirustotal: Detection: 48%
Source: SmartDeploy.exeReversingLabs: Detection: 58%
Source: SmartDeploy.exeString found in binary or memory: CertMgr.Exe -add c:\program files (x86)\sam_10\Sam.cer -s -r localMachine trustedpublisher
Source: SmartDeploy.exeString found in binary or memory: CertMgr.Exe -add c:\program files (x86)\sam_10\Sam.cer -s -r localMachine root
Source: SmartDeploy.exeString found in binary or memory: net localgroup users Comprise /add
Source: SmartDeploy.exeString found in binary or memory: net localgroup administrators Comprise /add
Source: SmartDeploy.exeString found in binary or memory: net user /add Comprise S@mtwo345
Source: SmartDeploy.exeString found in binary or memory: CertMgr.Exe -add c:\program files (x86)\sam_10\Sam.cer -s -r localMachine trustedpublisher
Source: SmartDeploy.exeString found in binary or memory: CertMgr.Exe -add c:\program files (x86)\sam_10\Sam.cer -s -r localMachine root
Source: SmartDeploy.exeString found in binary or memory: net localgroup administrators Comprise /add
Source: SmartDeploy.exeString found in binary or memory: net localgroup users Comprise /add
Source: SmartDeploy.exeString found in binary or memory: net user /add Comprise S@mtwo345
Source: SmartDeploy.exeString found in binary or memory: %s\logs\SAMUpgradeLog%d%d%d.txtC:\Program Files (x86)\SAM 11%d:%d:%dkernel32IsWow64ProcessSAMPrinterPortSOFTWARE\Microsoft\Windows NT\CurrentVersion\PortsOutputFolderSoftware\ActMask Virtual Printer SDKC:\Program Files (x86)\SAM 11\JobsTransModeTagWndMsgIDInstallPrintersSAM PrinterDisableRebootMsgDisableInstallDrvMsg1TagWndTitleTagWndClassDesktopBarSoftware\Sam Printervirtualprinter.exe /VERYSILENT /PASSWORD=452193106-tric@comprisetechnologies.comSHCreateShortcutEx: %d, %s%s\SamStart.lnkC:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartupSamStartCommon Startup%sSoftware\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersError RegSetValueExRegSetValueEx Error:%dUserinitError RegCreateKeyExMakeRegStartUp Error:%dSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonC:\Program Files (x86)\SAM 11\SamClient11.exe, C:\Windows\system32\userinit.exe,DefaultDomainNameSoftware\Microsoft\Windows NT\CurrentVersion\WinlogonZ:SamSoftedSam Administrator AccountS@mtwo345CompriseAdministratorsGroup for the AdministratorsDomain AdminsComprise user failed Unknown errorComprise user failed NERR_PasswordTooShortComprise user failed NERR_UserExistsComprise user failed NERR_GroupExistsComprise user failed NERR_NotPrimaryComprise user failed NERR_InvalidComputerComprise user failed ERROR_ACCESS_DENIEDComprise user Successfully createdcreateuser.\\.\Comprise2\\.\CompriseAdministratorsCompriseSamSoftware\Microsoft\Windows\CurrentVersion\RunOPACControlSamClient10SCClientAPPSiteMeteringSamStarterInstallCertInstallCert 2CertMgr.Exe -add c:\program files (x86)\sam_10\Sam.cer -s -r localMachine trustedpublisher%s\CertMgr.ExeInstallCert 1CertMgr.Exe -add c:\program files (x86)\sam_10\Sam.cer -s -r localMachine rootImagePathSYSTEM\CurrentControlSet\Services\SamClientManagerService deleted successfully
Source: SmartDeploy.exeString found in binary or memory: Sam Client ControlSamClientManagerSam Client Remote Manager.\CompriseS@mtwo345error:%dMoveSamDirectory toMoveSamDirectory from10ProductNameSOFTWARE\Microsoft\Windows NT\CurrentVersionshutdown /r /fRebooting PCC:\Program Files (x86)\SAM 11\SetEdgePolicies.reg%SystemRoot%\system32\cacls "C:\Windows\System32\spool\PRINTERS" /t /e /g Everyone:f%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Users" /t /e /g Everyone:f%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Computers" /t /e /g Everyone:f%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Update" /t /e /g Everyone:f%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\tmpDownload" /t /e /g Everyone:f%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Themes" /t /e /g Everyone:f%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\logs" /t /e /g Everyone:f%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Languages" /t /e /g Users:f%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Jobs" /t /e /g Everyone:f%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\images" /t /e /g Users:f%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Configuration" /t /e /g Users:f%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11" /t /e /g Users:f%SystemRoot%\system32\reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f%SystemRoot%\system32\reg ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0x0 /fFirewall Outbound rule%SystemRoot%\system32\netsh advfirewall firewall add rule name="SAM Rule Out" dir=out action=allow protocol=TCP localport=2002TCP port 2002Firewall Inbound rule%SystemRoot%\system32\netsh advfirewall firewall add rule name="SAM Rule In" dir=in action=allow protocol=TCP localport=2002After Installing PDF driver%SystemRoot%\system32\rundll32 printui.dll,PrintUIEntry /if /b "Smart Solution Printer" /r "SAMPrinterPort" /m "Microsoft XPS Document Writer v4"Installing PDF Driver.YesC:\Sam\SCClient.exeC:\Program Files (x86)\SAM_10\SamClient10.exeC:\Program Files (x86)\SAM_10\SamStarter.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SamStart.lnk%s\SamClient11.exeInstallationisPDFEnabledSettingsUserBookingLocIDSBIDSBCustomerAnyTownSBAddressBranchUseSSL443WebServerNameVersionNumber11.0.104CopyFile newINIFileCopyFile fromPath%s_%s\clntinfo.iniCopyFile C:\Sam\clntinfo.iniC:\Sam\clntinfo.ini9Sam Print manager InstalledSam Print manager DeletedSam Print manager StoppedUpgrade%s\SamPrintManager.exeNew install so no copy config fileCopyFile NEW INSTALL%s\*.*%s\Users%s\Computers%s\Update%s\Themes%s\logsCreateDirectory%s\JobsnewThemeINIFile%s\Themes\Themes.ininewRootObjectINIFile%s\rootcnf.ininewINIFile%s\Clntinfo.ininewversionpath%s %sC:\Program Files\SAMC:\Program Files\SAM_10\SamPrinting.exeC:\Program Files (x86)\SAMC:\Program Files (x86)\SAM_10\SamPrinting.exe%SystemRoot%\system32\net.exe START SPOOLER%SystemRoot%\s
Source: unknownProcess created: C:\Users\user\Desktop\SmartDeploy.exe "C:\Users\user\Desktop\SmartDeploy.exe"
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c net user /add Comprise S@mtwo345
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe net user /add Comprise S@mtwo345
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user /add Comprise S@mtwo345
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c net localgroup users Comprise /add
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe net localgroup users Comprise /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup users Comprise /add
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c net localgroup administrators Comprise /add
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe net localgroup administrators Comprise /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators Comprise /add
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\PrintUI.exe /dl /n "Send To OneNote 2013" /q
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\printui.exe C:\Windows\system32\PrintUI.exe /dl /n "Send To OneNote 2013" /q
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\PrintUI.exe /dl /n "Fax" /q
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\printui.exe C:\Windows\system32\PrintUI.exe /dl /n "Fax" /q
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\net.exe Stop SPOOLER
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe C:\Windows\system32\net.exe Stop SPOOLER
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 Stop SPOOLER
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\net.exe START SPOOLER
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe C:\Windows\system32\net.exe START SPOOLER
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 START SPOOLER
Source: unknownProcess created: C:\Windows\System32\spoolsv.exe C:\Windows\System32\spoolsv.exe
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\netsh advfirewall firewall add rule name="SAM Rule In" dir=in action=allow protocol=TCP localport=2002
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe C:\Windows\system32\netsh advfirewall firewall add rule name="SAM Rule In" dir=in action=allow protocol=TCP localport=2002
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\netsh advfirewall firewall add rule name="SAM Rule Out" dir=out action=allow protocol=TCP localport=2002
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe C:\Windows\system32\netsh advfirewall firewall add rule name="SAM Rule Out" dir=out action=allow protocol=TCP localport=2002
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\reg ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0x0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe C:\Windows\system32\reg ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0x0 /f
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe C:\Windows\system32\reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11" /t /e /g Users:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11" /t /e /g Users:f
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Configuration" /t /e /g Users:f
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\images" /t /e /g Users:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\images" /t /e /g Users:f
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Jobs" /t /e /g Everyone:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Jobs" /t /e /g Everyone:f
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Languages" /t /e /g Users:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Languages" /t /e /g Users:f
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\logs" /t /e /g Everyone:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\logs" /t /e /g Everyone:f
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\tmpDownload" /t /e /g Everyone:f
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Update" /t /e /g Everyone:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Update" /t /e /g Everyone:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Users" /t /e /g Everyone:f
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Windows\System32\spool\PRINTERS" /t /e /g Everyone:f
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Program Files (x86)\SAM 11\SetEdgePolicies.reg
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c net user /add Comprise S@mtwo345Jump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c net localgroup users Comprise /addJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c net localgroup administrators Comprise /addJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\PrintUI.exe /dl /n "Send To OneNote 2013" /qJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\PrintUI.exe /dl /n "Fax" /qJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\net.exe Stop SPOOLERJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\net.exe START SPOOLERJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\printui.exe C:\Windows\system32\PrintUI.exe /dl /n "Send To OneNote 2013" /qJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\netsh advfirewall firewall add rule name="SAM Rule Out" dir=out action=allow protocol=TCP localport=2002Jump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\reg ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0x0 /fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11" /t /e /g Users:fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\PrintUI.exe /dl /n "Send To OneNote 2013" /qJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\images" /t /e /g Users:fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Jobs" /t /e /g Everyone:fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Languages" /t /e /g Users:fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\logs" /t /e /g Everyone:fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11" /t /e /g Users:fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\tmpDownload" /t /e /g Everyone:fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Update" /t /e /g Everyone:fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c net user /add Comprise S@mtwo345Jump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\PrintUI.exe /dl /n "Send To OneNote 2013" /qJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Windows\System32\spool\PRINTERS" /t /e /g Everyone:fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11" /t /e /g Users:fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe net user /add Comprise S@mtwo345Jump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user /add Comprise S@mtwo345Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe net localgroup users Comprise /addJump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup users Comprise /addJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe net localgroup administrators Comprise /addJump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators Comprise /addJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\printui.exe C:\Windows\system32\PrintUI.exe /dl /n "Send To OneNote 2013" /qJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\printui.exe C:\Windows\system32\PrintUI.exe /dl /n "Fax" /qJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe C:\Windows\system32\net.exe Stop SPOOLERJump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 Stop SPOOLERJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe C:\Windows\system32\net.exe START SPOOLERJump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 START SPOOLERJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe C:\Windows\system32\netsh advfirewall firewall add rule name="SAM Rule In" dir=in action=allow protocol=TCP localport=2002Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe C:\Windows\system32\netsh advfirewall firewall add rule name="SAM Rule Out" dir=out action=allow protocol=TCP localport=2002Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe C:\Windows\system32\reg ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0x0 /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe C:\Windows\system32\reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11" /t /e /g Users:fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Configuration" /t /e /g Users:fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\images" /t /e /g Users:fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Jobs" /t /e /g Everyone:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Languages" /t /e /g Users:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\logs" /t /e /g Everyone:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Themes" /t /e /g Everyone:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\tmpDownload" /t /e /g Everyone:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Update" /t /e /g Everyone:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Computers" /t /e /g Everyone:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Users" /t /e /g Everyone:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Windows\System32\spool\PRINTERS" /t /e /g Everyone:f
Source: C:\Users\user\Desktop\SmartDeploy.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samlib.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samlib.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samlib.dllJump to behavior
Source: C:\Windows\SysWOW64\printui.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\printui.exeSection loaded: printui.dllJump to behavior
Source: C:\Windows\SysWOW64\printui.exeSection loaded: puiapi.dllJump to behavior
Source: C:\Windows\SysWOW64\printui.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\printui.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\printui.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\printui.exeSection loaded: printui.dllJump to behavior
Source: C:\Windows\SysWOW64\printui.exeSection loaded: puiapi.dllJump to behavior
Source: C:\Windows\SysWOW64\printui.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\printui.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\spoolsv.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\System32\spoolsv.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\spoolsv.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\spoolsv.exeSection loaded: ualapi.dllJump to behavior
Source: C:\Windows\System32\spoolsv.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\spoolsv.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Windows\System32\spoolsv.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Windows\System32\spoolsv.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\spoolsv.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ifmon.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasmontr.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mfc42u.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: authfwcfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpolicyiomgr.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: firewallapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwbase.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcmonitor.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3cfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3api.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: onex.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappcfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappprxy.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwcfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: hnetmon.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netshell.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netsetupapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netiohlp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: httpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshipsec.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: activeds.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: polstore.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winipsec.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: adsldpc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshwfp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2pnetsh.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2p.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rpcnsh.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: whhelper.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlancfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlanapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wshelper.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wevtapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: peerdistsh.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wcmapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rmclient.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mobilenetworking.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ktmw32.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprmsg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ifmon.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasmontr.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mfc42u.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: authfwcfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpolicyiomgr.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: firewallapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwbase.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcmonitor.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3cfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3api.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: onex.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappcfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappprxy.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwcfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: hnetmon.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netshell.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netsetupapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netiohlp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: httpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshipsec.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: activeds.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: polstore.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winipsec.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: adsldpc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: adsldpc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshwfp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2pnetsh.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2p.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rpcnsh.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: whhelper.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlancfg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlanapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wshelper.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wevtapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: peerdistsh.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wcmapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rmclient.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mobilenetworking.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ktmw32.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprmsg.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: esent.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: webio.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: es.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cacls.exeSection loaded: ntmarta.dll
Source: C:\Users\user\Desktop\SmartDeploy.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeFile written: C:\Program Files (x86)\SAM 11\rootcnf.iniJump to behavior
Source: SmartDeploy.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\ChristopherWall\Documents\Local Edits\3-23-2022 standard client\Install\SAMUpgrade\Debug\SmartDeploy.pdbX source: SmartDeploy.exe
Source: Binary string: C:\Users\ChristopherWall\Documents\Local Edits\3-23-2022 standard client\Install\SAMUpgrade\Debug\SmartDeploy.pdb source: SmartDeploy.exe
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: 0_2_00413DD0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00413DD0
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: 0_2_0040AAD0 push eax; ret 0_2_0040AAFE

Persistence and Installation Behavior

barindex
Adds a new user with administrator rights
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe net localgroup administrators Comprise /add
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe net localgroup administrators Comprise /addJump to behavior
Uses cmd line tools excessively to alter registry or file data
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exeJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: 0_2_004038D0 NetUserAdd,NetGroupAddUser,NetUserSetInfo,0_2_004038D0

Boot Survival

barindex
Creates an undocumented autostart registry key
Source: C:\Users\user\Desktop\SmartDeploy.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon UserinitJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe C:\Windows\system32\net.exe Stop SPOOLER
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: 0_2_00404F10 OpenSCManagerA,CreateServiceA,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,0_2_00404F10
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11" /t /e /g Users:f
Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5356Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\cmd.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\cmd.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\cmd.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\net1.exeLast function: Thread delayed
Source: C:\Windows\SysWOW64\net1.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: 0_2_00405630 GetSystemInfo,FindFirstFileA,FindFirstFileA,wsprintfA,CreateDirectoryA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,CreateDirectoryA,wsprintfA,CreateDirectoryA,wsprintfA,CreateDirectoryA,wsprintfA,CreateDirectoryA,wsprintfA,CreateDirectoryA,wsprintfA,CreateDirectoryA,wsprintfA,wsprintfA,wsprintfA,CopyFileA,wsprintfA,CopyFileA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,wsprintfA,DeleteFileA,DeleteFileA,DeleteFileA,DeleteFileA,DeleteFileA,DeleteFileA,DeleteFileA,0_2_00405630
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: 0_2_00403540 GetSystemInfo,RegOpenKeyExA,RegOpenKeyExA,GetLastError,wsprintfA,RegSetValueExA,GetLastError,wsprintfA,RegFlushKey,RegCloseKey,0_2_00403540
Source: svchost.exe, 00000023.00000002.2994896863.000001B522058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000023.00000002.2994116896.000001B51CC2B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: spoolsv.exe, 00000016.00000002.2993327167.00000000009A3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\SmartDeploy.exeAPI call chain: ExitProcess graph end nodegraph_0-10919
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: 0_2_00413DD0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00413DD0
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: 0_2_004011B0 wsprintfA,wsprintfW,GetLastError,LsaClose,GetProcessHeap,HeapFree,0_2_004011B0
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: 0_2_00417BC0 SetUnhandledExceptionFilter,0_2_00417BC0
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: 0_2_00417BE0 SetUnhandledExceptionFilter,0_2_00417BE0
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c net user /add Comprise S@mtwo345Jump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c net localgroup users Comprise /addJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c net localgroup administrators Comprise /addJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\PrintUI.exe /dl /n "Send To OneNote 2013" /qJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\PrintUI.exe /dl /n "Fax" /qJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\net.exe Stop SPOOLERJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\net.exe START SPOOLERJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\printui.exe C:\Windows\system32\PrintUI.exe /dl /n "Send To OneNote 2013" /qJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\netsh advfirewall firewall add rule name="SAM Rule Out" dir=out action=allow protocol=TCP localport=2002Jump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\reg ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0x0 /fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11" /t /e /g Users:fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\PrintUI.exe /dl /n "Send To OneNote 2013" /qJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\images" /t /e /g Users:fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Jobs" /t /e /g Everyone:fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Languages" /t /e /g Users:fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\logs" /t /e /g Everyone:fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11" /t /e /g Users:fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\tmpDownload" /t /e /g Everyone:fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Update" /t /e /g Everyone:fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c net user /add Comprise S@mtwo345Jump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\PrintUI.exe /dl /n "Send To OneNote 2013" /qJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Windows\System32\spool\PRINTERS" /t /e /g Everyone:fJump to behavior
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11" /t /e /g Users:fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe net user /add Comprise S@mtwo345Jump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user /add Comprise S@mtwo345Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe net localgroup users Comprise /addJump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup users Comprise /addJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe net localgroup administrators Comprise /addJump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators Comprise /addJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\printui.exe C:\Windows\system32\PrintUI.exe /dl /n "Send To OneNote 2013" /qJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\printui.exe C:\Windows\system32\PrintUI.exe /dl /n "Fax" /qJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe C:\Windows\system32\net.exe Stop SPOOLERJump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 Stop SPOOLERJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe C:\Windows\system32\net.exe START SPOOLERJump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 START SPOOLERJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe C:\Windows\system32\netsh advfirewall firewall add rule name="SAM Rule In" dir=in action=allow protocol=TCP localport=2002Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe C:\Windows\system32\netsh advfirewall firewall add rule name="SAM Rule Out" dir=out action=allow protocol=TCP localport=2002Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe C:\Windows\system32\reg ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0x0 /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe C:\Windows\system32\reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11" /t /e /g Users:fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Configuration" /t /e /g Users:fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\images" /t /e /g Users:fJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Jobs" /t /e /g Everyone:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Languages" /t /e /g Users:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\logs" /t /e /g Everyone:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Themes" /t /e /g Everyone:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\tmpDownload" /t /e /g Everyone:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Update" /t /e /g Everyone:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Computers" /t /e /g Everyone:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Users" /t /e /g Everyone:f
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cacls.exe C:\Windows\system32\cacls "C:\Windows\System32\spool\PRINTERS" /t /e /g Everyone:f
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: 0_2_00401970 GetLocalTime,wsprintfA,wsprintfA,0_2_00401970
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: 0_2_004013C0 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,LookupAccountNameA,GetLastError,GetProcessHeap,HeapReAlloc,GetProcessHeap,HeapReAlloc,0_2_004013C0
Source: C:\Users\user\Desktop\SmartDeploy.exeCode function: 0_2_0040AB00 EntryPoint,GetVersion,GetCommandLineA,0_2_0040AB00

Lowering of HIPS / PFW / Operating System Security Settings

barindex
Disables UAC (registry)
Source: C:\Windows\SysWOW64\reg.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUAJump to behavior
Modifies the windows firewall
Source: C:\Users\user\Desktop\SmartDeploy.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\netsh advfirewall firewall add rule name="SAM Rule In" dir=in action=allow protocol=TCP localport=2002
Uses netsh to modify the Windows network and firewall settings
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe C:\Windows\system32\netsh advfirewall firewall add rule name="SAM Rule In" dir=in action=allow protocol=TCP localport=2002
Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts3
Windows Management Instrumentation		11
Create Account		22
Windows Service		11
Masquerading		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts12
Command and Scripting Interpreter		22
Windows Service		11
Process Injection		3
Disable or Modify Tools		LSASS Memory41
Security Software Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts22
Service Execution		1
Registry Run Keys / Startup Folder		1
Registry Run Keys / Startup Folder		1
Modify Registry		Security Account Manager3
Virtualization/Sandbox Evasion		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal Accounts1
Native API		1
Services File Permissions Weakness		1
Services File Permissions Weakness		3
Virtualization/Sandbox Evasion		NTDS1
Account Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchd1
DLL Side-Loading		1
DLL Side-Loading		11
Process Injection		LSA Secrets1
System Owner/User Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Deobfuscate/Decode Files or Information		Cached Domain Credentials3
File and Directory Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
Obfuscated Files or Information		DCSync44
System Information Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Services File Permissions Weakness		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
DLL Side-Loading		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1586407 Sample: SmartDeploy.exe Startdate: 09/01/2025 Architecture: WINDOWS Score: 80 58 Multi AV Scanner detection for submitted file 2->58 60 AI detected suspicious sample 2->60 62 Sigma detected: Rare Remote Thread Creation By Uncommon Source Image 2->62 8 SmartDeploy.exe 1 12 2->8         started        11 svchost.exe 1 1 2->11         started        14 spoolsv.exe 2->14         started        process3 dnsIp4 64 Creates an undocumented autostart registry key 8->64 66 Modifies the windows firewall 8->66 16 cmd.exe 1 8->16         started        19 cmd.exe 1 8->19         started        21 cmd.exe 1 8->21         started        23 22 other processes 8->23 50 127.0.0.1 unknown unknown 11->50 signatures5 process6 signatures7 52 Uses cmd line tools excessively to alter registry or file data 16->52 54 Uses netsh to modify the Windows network and firewall settings 16->54 56 Adds a new user with administrator rights 16->56 25 net.exe 1 16->25         started        27 reg.exe 1 19->27         started        30 net.exe 1 21->30         started        32 net.exe 1 23->32         started        34 net.exe 1 23->34         started        36 net.exe 1 23->36         started        38 18 other processes 23->38 process8 signatures9 40 net1.exe 1 25->40         started        68 Disables UAC (registry) 27->68 42 net1.exe 1 30->42         started        44 net1.exe 1 32->44         started        46 net1.exe 1 34->46         started        48 net1.exe 1 36->48         started        process10

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
SmartDeploy.exe49%VirustotalBrowse
SmartDeploy.exe58%ReversingLabsWin32.Trojan.IcedID

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.210.172
truefalse
    		high

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://g.live.com/odclientsettings/Prod.C:edb.log.35.drfalse
      		high
      http://crl.ver)svchost.exe, 00000023.00000002.2994827432.000001B522000000.00000004.00000020.00020000.00000000.sdmpfalse
        		high
        https://g.live.com/odclientsettings/ProdV2.C:edb.log.35.drfalse
          		high
          https://g.live.com/odclientsettings/ProdV2edb.log.35.drfalse
            		high
            https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96svchost.exe, 00000023.00000003.1829958465.000001B5222C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.35.drfalse
              		high
              https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6svchost.exe, 00000023.00000003.1829958465.000001B5222C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.35.dr, edb.log.35.drfalse
                		high

                World Map of Contacted IPs

                • No. of IPs < 25%
                • 25% < No. of IPs < 50%
                • 50% < No. of IPs < 75%
                • 75% < No. of IPs

                Public IPs

                IPDomainCountryFlagASNASN NameMalicious

                Private

                IP
                127.0.0.1

                General Information

                Joe Sandbox version:41.0.0 Charoite
                Analysis ID:1586407
                Start date and time:2025-01-09 02:22:28 +01:00
                Joe Sandbox product:CloudBasic
                Overall analysis duration:0h 5m 39s
                Hypervisor based Inspection enabled:false
                Report type:full
                Cookbook file name:default.jbs
                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                Number of analysed new started processes analysed:64
                Number of new started drivers analysed:0
                Number of existing processes analysed:0
                Number of existing drivers analysed:0
                Number of injected processes analysed:0
                Technologies:
                • HCA enabled
                • EGA enabled
                • AMSI enabled
                Analysis Mode:default
                Analysis stop reason:Timeout
                Sample name:SmartDeploy.exe
                Detection:MAL
                Classification:mal80.evad.winEXE@101/17@0/1
                EGA Information:
                • Successful, ratio: 100%
                HCA Information:
                • Successful, ratio: 100%
                • Number of executed functions: 24
                • Number of non-executed functions: 62
                Cookbook Comments:
                • Found application associated with file extension: .exe

                Warnings

                • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe
                • Excluded IPs from analysis (whitelisted): 52.149.20.212, 20.242.39.171, 184.28.90.27, 13.95.31.18, 40.69.42.241, 13.107.246.45
                • Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, e16604.g.akamaiedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
                • Not all processes where analyzed, report is missing behavior information
                • Report size exceeded maximum capacity and may have missing behavior information.

                Simulations

                Behavior and APIs

                TimeTypeDescription
                20:23:34API Interceptor2x Sleep call for process: svchost.exe modified

                Joe Sandbox View / Context

                IPs

                ⊘No context

                Domains

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                bg.microsoft.map.fastly.net82eqjqLrzE.exeGet hashmaliciousAsyncRATBrowse
                • 199.232.214.172
                EEdSGSana5.exeGet hashmaliciousAsyncRATBrowse
                • 199.232.210.172
                Magicleap-bonus disbursment.pdfGet hashmaliciousUnknownBrowse
                • 199.232.210.172
                eqRHH2whJu.exeGet hashmaliciousUnknownBrowse
                • 199.232.210.172
                Selvi Payroll Benefits & Bonus Agreementfdp.pdfGet hashmaliciousUnknownBrowse
                • 199.232.214.172
                atomxml.ps1Get hashmaliciousPureLog Stealer, RHADAMANTHYS, zgRATBrowse
                • 199.232.210.172
                proforma invoice pdf.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                • 199.232.214.172
                Payment-Order #24560274 for 8,380 USD.exeGet hashmaliciousXWormBrowse
                • 199.232.214.172
                PEDIDO DE COMPRAS OC 1203 CRI234.xlsx.exeGet hashmaliciousAsyncRAT, PureLog StealerBrowse
                • 199.232.210.172
                invoice-1623385214.pdf.jsGet hashmaliciousPureLog Stealer, RHADAMANTHYS, zgRATBrowse
                • 199.232.214.172

                ASNs

                ⊘No context

                JA3 Fingerprints

                ⊘No context

                Dropped Files

                ⊘No context

                Created / dropped Files

                C:\Program Files (x86)\SAM 11\Clntinfo.ini

                Download File
                Process:C:\Users\user\Desktop\SmartDeploy.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):31
                Entropy (8bit):4.17146526179041
                Encrypted:false
                SSDEEP:3:HWRFRLM+11gyJOv:H4RLM+3Uv
                MD5:3EA1568ADE7D6C1B88EB5BE6C1B754F3
                SHA1:8E7358FB08CEE86E2BDE54B5295B5A713442158A
                SHA-256:F46E146F3ECD69D517D88DB9780FEC8FE1CAA90A93481772C24F95AEAC3EEABC
                SHA-512:C8DBFA6E3DA256D7F7BF6675D41C042F4957D13E63F90FE097A46DDE27CBB1FB71B98BE29739858ABEDECF34CF84003E0A81A66A8D672026478685B5B5785FB2
                Malicious:false
                Preview:[Installation]..isPDFEnabled=..

                C:\Program Files (x86)\SAM 11\logs\SAMUpgradeLog182025.txt

                Download File
                Process:C:\Users\user\Desktop\SmartDeploy.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):766
                Entropy (8bit):5.140342370624674
                Encrypted:false
                SSDEEP:12:Jt62TVft62TWft62TxHNft62TU/ft62ToF/+2S2THAXEl2XtNBGW2OtRU3XiDf/V:JI8VfI8WfI8NJI8U/fI8q/+78gjw3yjd
                MD5:8E6F7D763AADD4F26ED751F3504BDE82
                SHA1:0381FB8D423EEF871FC11150F553B40B07E4B241
                SHA-256:6D4321B7287974A3B41D5D8361C7283F01B19774E98F71CBDC6B4EE40C0EFEEE
                SHA-512:866C42610E4306BED6DD284ADE7540AB50589B967539112E413B697761D9CFC4279FCB6AE8C3EFE21084A9E4A8A492D14854E4214DBE96D4C98CF1C74300EE70
                Malicious:false
                Preview:20:23:33 CreateDirectory C:\Program Files (x86)\SAM 11\logs..20:23:33 CreateDirectory C:\Program Files (x86)\SAM 11\Themes..20:23:33 CreateDirectory C:\Program Files (x86)\SAM 11\Update..20:23:33 CreateDirectory C:\Program Files (x86)\SAM 11\Computers..20:23:33 CreateDirectory C:\Program Files (x86)\SAM 11\Users..20:23:33 MoveSamDirectory from C:\Program Files (x86)\SAM\*.*..20:23:33 MoveSamDirectory to C:\Program Files (x86)\SAM 11..20:23:33 CopyFile NEW INSTALL New install so no copy config file..20:23:33 SamServer ..20:23:33 Port ..20:23:33 Location ..20:23:34 SBAddress ..20:23:34 SBCustomer ..20:23:34 SBID ..20:23:34 RootObject Machine..20:23:34 IsPDFEnabled ..20:23:34 Firewall Inbound rule TCP port 2002..20:23:34 Firewall Outbound rule TCP port 2002..

                C:\Program Files (x86)\SAM 11\rootcnf.ini

                Download File
                Process:C:\Users\user\Desktop\SmartDeploy.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):32
                Entropy (8bit):4.226409765557392
                Encrypted:false
                SSDEEP:3:l4yhGLR+H0ov:lX3HJ
                MD5:2A4FFECF7EE15E792BB33D4AA5B6D8D8
                SHA1:73BD438615D87C2079A911813F4C315A657138D8
                SHA-256:35979A3F6A2702B892F5C678C764E003BE613A516267F8BD11DE99C1F1E6DD09
                SHA-512:EC9A10A2FBCD5C545496D27B66019FBE53E79436C9A965BED88F7A39DB25FB5ADC21101622DDB9495D9C59DFF40DF7443D40C4E4E90C5BFBE76BFCC582526AC5
                Malicious:false
                Preview:[Settings]..RootObject=Machine..

                C:\ProgramData\Microsoft\Network\Downloader\edb.log

                Download File
                Process:C:\Windows\System32\svchost.exe
                File Type:data
                Category:dropped
                Size (bytes):1310720
                Entropy (8bit):1.3073553714809487
                Encrypted:false
                SSDEEP:3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr3:KooCEYhgYEL0In
                MD5:F0AB26534A07D037615DE93DCFDDA59F
                SHA1:993ABB54172D15ACC5DB831B1718C2789D1216E0
                SHA-256:45C8FB191F9DDF24EDF5CE00C29A24812D27494AD1FF96557D51763C3470893E
                SHA-512:8B74D1A2E75BB26DB138B8CB366160CA3F906919D814C2F76CBD6DF35970B7401868BD8CD83BBC3506C96F2BB159152CE3AF52320F38BE5265C6D869AD135001
                Malicious:false
                Preview:z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

                C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                Download File
                Process:C:\Windows\System32\svchost.exe
                File Type:Extensible storage engine DataBase, version 0x620, checksum 0xad2e4c29, page size 16384, DirtyShutdown, Windows version 10.0
                Category:dropped
                Size (bytes):1310720
                Entropy (8bit):0.42213738742602847
                Encrypted:false
                SSDEEP:1536:JSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Jaza/vMUM2Uvz7DO
                MD5:A6AC2D05252A46B5D42D1ED8BCC4BF79
                SHA1:1846DB8F3865B90CBE86A0FF0AC016D9A0C548A5
                SHA-256:7CCDC7633EDB3EB531BF654BF35AE91E40CC9DFADFBDE19ED1A5E928204F30A3
                SHA-512:5E59C9E22375EF269C0CB35FE80CECD91F03040FBDF4B31B000A30763303AE9AFFA39B916F9BD08D932099D241E6F7288D528F63168DEA9A7A0910D27FC9ABE2
                Malicious:false
                Preview:..L)... .......A.......X\...;...{......................0.!..........{A.#....}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{....................................}#....}...................3]F#....}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

                C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                Download File
                Process:C:\Windows\System32\svchost.exe
                File Type:data
                Category:dropped
                Size (bytes):16384
                Entropy (8bit):0.0770300477461845
                Encrypted:false
                SSDEEP:3:PWllEYext7ajn13a/XTYXAllcVO/lnlZMxZNQl:Vzxpa53qXuAOewk
                MD5:5DAC4802350634FBE2AFA9A6A30521E3
                SHA1:32A0604096951F37BAEC416C0E3858552A4D64E2
                SHA-256:8ABFEFFD5328807523F5BCDB7A0668768D395DB4C17E7D43761FDC5083EC4A40
                SHA-512:EF4557B63007789D3EB9AA0404F36A458B125152CF633260BB416E442B2C4EE74F67C9FE657496C318D16CF555BCD4B6F7AD940DA12ADA9CDA91237D7398BD99
                Malicious:false
                Preview:?p.D.....................................;...{..#....}.......{A..............{A......{A..........{A].................3]F#....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                Download File
                Process:C:\Windows\System32\svchost.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):55
                Entropy (8bit):4.306461250274409
                Encrypted:false
                SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                MD5:DCA83F08D448911A14C22EBCACC5AD57
                SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                Malicious:false
                Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                \Device\ConDrv

                Download File
                Process:C:\Windows\SysWOW64\cacls.exe
                File Type:ASCII text, with no line terminators
                Category:dropped
                Size (bytes):15
                Entropy (8bit):3.240223928941852
                Encrypted:false
                SSDEEP:3:o3F:o1
                MD5:509B054634B6DE74F111C3E646BC80FD
                SHA1:99B4C0F39144A92FE42E22473A2A2552FB16BD13
                SHA-256:07C7C151ADD6D955F3C876359C0E2A3A3FB0C519DD1E574413F0B68B345D8C36
                SHA-512:A9C2D23947DBE09D5ECFBF6B3109F3CF8409E43176AE10C18083446EDE006E60E41C3EA2D2765036A967FC81B085D5F271686606AED4154AE45287D412CF6D40
                Malicious:false
                Preview:processed dir:

                Static File Info

                General

                File type:PE32 executable (console) Intel 80386, for MS Windows
                Entropy (8bit):4.358175681110876
                TrID:
                • Win32 Executable (generic) a (10002005/4) 99.83%
                • Windows Screen Saver (13104/52) 0.13%
                • Generic Win/DOS Executable (2004/3) 0.02%
                • DOS Executable Generic (2002/1) 0.02%
                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                File name:SmartDeploy.exe
                File size:260'832 bytes
                MD5:6ec7109891d3e7807651ffaefc36eb7a
                SHA1:77d129e6607c57121f2363189f672d9b07485642
                SHA256:25a076dd061d646ce750f597553c034a12d314776384834b34fbc7f4ecd2cd9f
                SHA512:f420d3ef181e37262bd2a03d8c89f2907ef70172643d21e33021e64e3cba182483697218dec9c03ad7e54e973b73b3a95e16ef7b002f533944a25c47a6827ffc
                SSDEEP:3072:6txUPPe1ileMRDuxj4u1sCeMEBcIDCVG0fQVplUn+9IHuCVADoko:te1ig6Duxj4u1DdEBcIDCSVGV3
                TLSH:74444B00E640C439F9D345FA9BFA8B7AE668AE305B4110D393E4BA6DD7796E17D3100E
                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o...o...o.......}...Y...>.......h...o...l.......b...o.......Y...c...Richo...........................PE..L.....=b...........

                File Icon

                Icon Hash:90cececece8e8eb0

                Static PE Info

                General

                Entrypoint:0x40ab00
                Entrypoint Section:.text
                Digitally signed:true
                Imagebase:0x400000
                Subsystem:windows cui
                Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                DLL Characteristics:
                Time Stamp:0x623DF085 [Fri Mar 25 16:40:37 2022 UTC]
                TLS Callbacks:
                CLR (.Net) Version:
                OS Version Major:4
                OS Version Minor:0
                File Version Major:4
                File Version Minor:0
                Subsystem Version Major:4
                Subsystem Version Minor:0
                Import Hash:d251128bb294eac58448331a06d68b72

                Authenticode Signature

                Signature Valid:false
                Signature Issuer:CN=SAM Certificate by Comprise Technologies Inc
                Signature Validation Error:A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
                Error Number:-2146762487
                Not Before, Not After
                • 06/03/2013 17:25:16 31/12/2039 23:59:59
                Subject Chain
                • CN=SAM Certificate by Comprise Technologies Inc
                Version:3
                Thumbprint MD5:7C991F53F995E1A12A9801682DEC0F4B
                Thumbprint SHA-1:5E6388479A72D330548E20900755D8FA518B5679
                Thumbprint SHA-256:8F74D1AFE4147E0D05C23998F43CE58983E3B294130E0F7D6E20301A4920E79C
                Serial:7028BE2B11B0A3924E09E1BB4C61A7B1

                Entrypoint Preview

                Instruction
                push ebp
                mov ebp, esp
                push FFFFFFFFh
                push 00433E10h
                push 00409E20h
                mov eax, dword ptr fs:[00000000h]
                push eax
                mov dword ptr fs:[00000000h], esp
                add esp, FFFFFFF0h
                push ebx
                push esi
                push edi
                mov dword ptr [ebp-18h], esp
                call dword ptr [0043D4DCh]
                mov dword ptr [0043A6F0h], eax
                mov eax, dword ptr [0043A6F0h]
                shr eax, 08h
                and eax, 000000FFh
                mov dword ptr [0043A6FCh], eax
                mov ecx, dword ptr [0043A6F0h]
                and ecx, 000000FFh
                mov dword ptr [0043A6F8h], ecx
                mov edx, dword ptr [0043A6F8h]
                shl edx, 08h
                add edx, dword ptr [0043A6FCh]
                mov dword ptr [0043A6F4h], edx
                mov eax, dword ptr [0043A6F0h]
                shr eax, 10h
                and eax, 0000FFFFh
                mov dword ptr [0043A6F0h], eax
                push 00000000h
                call 00007F53CC7F2BC2h
                add esp, 04h
                test eax, eax
                jne 00007F53CC7EAEFCh
                push 0000001Ch
                call 00007F53CC7EAFC4h
                add esp, 04h
                mov dword ptr [ebp-04h], 00000000h
                call 00007F53CC7EBCD5h
                call dword ptr [0043D4D8h]
                mov dword ptr [0043AD20h], eax
                call 00007F53CC7F26E5h
                mov dword ptr [0043A6B8h], eax
                call 00007F53CC7F21CBh
                call 00007F53CC7F2076h
                call 00007F53CC7F0611h
                mov ecx, dword ptr [0000A70Ch]

                Rich Headers

                Programming Language:
                • [ C ] VS98 (6.0) SP6 build 8804
                • [C++] VS98 (6.0) build 8168
                • [C++] VS98 (6.0) SP6 build 8804

                Data Directories

                NameVirtual AddressVirtual Size Is in Section
                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                IMAGE_DIRECTORY_ENTRY_IMPORT0x3d0000x8c.idata
                IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                IMAGE_DIRECTORY_ENTRY_SECURITY0x3e0880x1a58
                IMAGE_DIRECTORY_ENTRY_BASERELOC0x3f0000x1620.reloc
                IMAGE_DIRECTORY_ENTRY_DEBUG0x320000x1c.rdata
                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                IMAGE_DIRECTORY_ENTRY_IAT0x3d3980x30c.idata
                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                Sections

                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                .text0x10000x304c00x3100014c67820d238add309993bd62a2401d0False0.220947265625data4.208791347122431IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                .rdata0x320000x3ca90x40002a4306fc884820134da413750021d520False0.288818359375data4.431268643848471IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                .data0x360000x60840x4000480b8d23f9380480506c73c0d309c0b7False0.04632568359375data0.5278285549789683IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                .idata0x3d0000x10520x2000804adeb1102cc3caf83d412f4c09c54bFalse0.1785888671875data2.6803125018413603IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                .reloc0x3f0000x1ab80x20001e11a496c3ce7ef28dd003141adfe69dFalse0.582763671875data5.436287394163452IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                Imports

                DLLImport
                KERNEL32.dllOpenProcess, DeleteFileA, WritePrivateProfileStringA, CopyFileA, CreateDirectoryA, FindFirstFileA, TerminateProcess, CompareStringW, CompareStringA, GetStringTypeW, GetStringTypeA, GetOEMCP, GetACP, GetCPInfo, GetComputerNameA, GetSystemInfo, MultiByteToWideChar, CreateProcessA, WaitForSingleObject, CloseHandle, GetModuleHandleA, GetProcAddress, GetCurrentProcess, GetLocalTime, FormatMessageA, GetStdHandle, WriteFile, LocalFree, lstrlenW, HeapAlloc, HeapReAlloc, GetLastError, GetProcessHeap, HeapFree, GetExitCodeProcess, SetEnvironmentVariableA, LCMapStringW, LCMapStringA, IsBadCodePtr, SetUnhandledExceptionFilter, VirtualAlloc, SetConsoleCtrlHandler, SetEndOfFile, SetStdHandle, RtlUnwind, GetCommandLineA, GetVersion, ExitProcess, ReadFile, SetFilePointer, SetHandleCount, GetFileType, GetStartupInfoA, CreateFileA, DebugBreak, InterlockedDecrement, OutputDebugStringA, LoadLibraryA, InterlockedIncrement, GetModuleFileNameA, IsBadWritePtr, IsBadReadPtr, HeapValidate, GetFileAttributesA, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStrings, GetEnvironmentStringsW, GetEnvironmentVariableA, GetVersionExA, HeapDestroy, HeapCreate, VirtualFree, FlushFileBuffers
                USER32.dllwsprintfW, wsprintfA, MessageBoxA, PostMessageA, FindWindowA, GetWindowThreadProcessId
                ADVAPI32.dllControlService, StartServiceA, OpenSCManagerA, OpenServiceA, CloseServiceHandle, DeleteService, RegDeleteValueA, RegOpenKeyExA, RegQueryValueExA, RegCreateKeyExA, RegSetValueExA, RegFlushKey, RegCloseKey, LsaNtStatusToWinError, LsaOpenPolicy, LsaAddAccountRights, LsaRemoveAccountRights, LookupAccountNameA, LsaClose, CreateServiceA
                SHELL32.dllSHFileOperationA
                ole32.dllCoCreateInstance, CoUninitialize, CoInitialize
                NETAPI32.dllNetUserAdd, NetGroupAddUser, NetUserSetInfo

                Network Behavior

                DNS Answers

                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                Jan 9, 2025 02:23:39.449587107 CET1.1.1.1192.168.2.40x6d2fNo error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                Jan 9, 2025 02:23:39.449587107 CET1.1.1.1192.168.2.40x6d2fNo error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false

                Statistics

                CPU Usage

                Click to jump to process

                Memory Usage

                Click to jump to process

                High Level Behavior Distribution

                Click to dive into process behavior distribution

                Behavior

                Click to jump to process

                System Behavior

                General

                Target ID:0
                Start time:20:23:25
                Start date:08/01/2025
                Path:C:\Users\user\Desktop\SmartDeploy.exe
                Wow64 process (32bit):true
                Commandline:"C:\Users\user\Desktop\SmartDeploy.exe"
                Imagebase:0x400000
                File size:260'832 bytes
                MD5 hash:6EC7109891D3E7807651FFAEFC36EB7A
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:low
                Has exited:true

                General

                Target ID:1
                Start time:20:23:25
                Start date:08/01/2025
                Path:C:\Windows\System32\conhost.exe
                Wow64 process (32bit):false
                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Imagebase:0x7ff7699e0000
                File size:862'208 bytes
                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:2
                Start time:20:23:25
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c net user /add Comprise S@mtwo345
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:3
                Start time:20:23:25
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\net.exe
                Wow64 process (32bit):true
                Commandline:net user /add Comprise S@mtwo345
                Imagebase:0x2f0000
                File size:47'104 bytes
                MD5 hash:31890A7DE89936F922D44D677F681A7F
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:4
                Start time:20:23:25
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\net1.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\net1 user /add Comprise S@mtwo345
                Imagebase:0x9f0000
                File size:139'776 bytes
                MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:5
                Start time:20:23:25
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c net localgroup users Comprise /add
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:7
                Start time:20:23:26
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\net.exe
                Wow64 process (32bit):true
                Commandline:net localgroup users Comprise /add
                Imagebase:0x2f0000
                File size:47'104 bytes
                MD5 hash:31890A7DE89936F922D44D677F681A7F
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:8
                Start time:20:23:26
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\net1.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\net1 localgroup users Comprise /add
                Imagebase:0x9f0000
                File size:139'776 bytes
                MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:9
                Start time:20:23:26
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c net localgroup administrators Comprise /add
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:10
                Start time:20:23:26
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\net.exe
                Wow64 process (32bit):true
                Commandline:net localgroup administrators Comprise /add
                Imagebase:0x2f0000
                File size:47'104 bytes
                MD5 hash:31890A7DE89936F922D44D677F681A7F
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:11
                Start time:20:23:26
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\net1.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\net1 localgroup administrators Comprise /add
                Imagebase:0x9f0000
                File size:139'776 bytes
                MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:12
                Start time:20:23:26
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\PrintUI.exe /dl /n "Send To OneNote 2013" /q
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:13
                Start time:20:23:26
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\printui.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\PrintUI.exe /dl /n "Send To OneNote 2013" /q
                Imagebase:0x570000
                File size:62'464 bytes
                MD5 hash:D39EFE3FAAF079EAD278F86FB1FCA8C0
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:14
                Start time:20:23:28
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\PrintUI.exe /dl /n "Fax" /q
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:15
                Start time:20:23:28
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\printui.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\PrintUI.exe /dl /n "Fax" /q
                Imagebase:0x570000
                File size:62'464 bytes
                MD5 hash:D39EFE3FAAF079EAD278F86FB1FCA8C0
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:16
                Start time:20:23:28
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\net.exe Stop SPOOLER
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:17
                Start time:20:23:28
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\net.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\net.exe Stop SPOOLER
                Imagebase:0x2f0000
                File size:47'104 bytes
                MD5 hash:31890A7DE89936F922D44D677F681A7F
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:18
                Start time:20:23:28
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\net1.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\net1 Stop SPOOLER
                Imagebase:0x9f0000
                File size:139'776 bytes
                MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:19
                Start time:20:23:31
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\net.exe START SPOOLER
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:20
                Start time:20:23:31
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\net.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\net.exe START SPOOLER
                Imagebase:0x2f0000
                File size:47'104 bytes
                MD5 hash:31890A7DE89936F922D44D677F681A7F
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:21
                Start time:20:23:31
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\net1.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\net1 START SPOOLER
                Imagebase:0x9f0000
                File size:139'776 bytes
                MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:22
                Start time:20:23:31
                Start date:08/01/2025
                Path:C:\Windows\System32\spoolsv.exe
                Wow64 process (32bit):false
                Commandline:C:\Windows\System32\spoolsv.exe
                Imagebase:0x7ff646ff0000
                File size:842'752 bytes
                MD5 hash:0D4B1E3E4488E9BDC035F23E1F4FE22F
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:false

                General

                Target ID:24
                Start time:20:23:34
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\netsh advfirewall firewall add rule name="SAM Rule In" dir=in action=allow protocol=TCP localport=2002
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:25
                Start time:20:23:34
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\netsh.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\netsh advfirewall firewall add rule name="SAM Rule In" dir=in action=allow protocol=TCP localport=2002
                Imagebase:0x1560000
                File size:82'432 bytes
                MD5 hash:4E89A1A088BE715D6C946E55AB07C7DF
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:26
                Start time:20:23:34
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\netsh advfirewall firewall add rule name="SAM Rule Out" dir=out action=allow protocol=TCP localport=2002
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:27
                Start time:20:23:34
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\netsh.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\netsh advfirewall firewall add rule name="SAM Rule Out" dir=out action=allow protocol=TCP localport=2002
                Imagebase:0x1560000
                File size:82'432 bytes
                MD5 hash:4E89A1A088BE715D6C946E55AB07C7DF
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:28
                Start time:20:23:34
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\reg ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0x0 /f
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:29
                Start time:20:23:34
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\reg.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\reg ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0x0 /f
                Imagebase:0x220000
                File size:59'392 bytes
                MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:30
                Start time:20:23:34
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:31
                Start time:20:23:34
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\reg.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                Imagebase:0x220000
                File size:59'392 bytes
                MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:32
                Start time:20:23:34
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11" /t /e /g Users:f
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:34
                Start time:20:23:34
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cacls.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11" /t /e /g Users:f
                Imagebase:0xfa0000
                File size:27'648 bytes
                MD5 hash:00BAAE10C69DAD58F169A3ED638D6C59
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:35
                Start time:20:23:34
                Start date:08/01/2025
                Path:C:\Windows\System32\svchost.exe
                Wow64 process (32bit):false
                Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                Imagebase:0x7ff6eef20000
                File size:55'320 bytes
                MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:false

                General

                Target ID:36
                Start time:20:23:34
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Configuration" /t /e /g Users:f
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:37
                Start time:20:23:34
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cacls.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Configuration" /t /e /g Users:f
                Imagebase:0xfa0000
                File size:27'648 bytes
                MD5 hash:00BAAE10C69DAD58F169A3ED638D6C59
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:39
                Start time:20:23:35
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\images" /t /e /g Users:f
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:40
                Start time:20:23:35
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cacls.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\images" /t /e /g Users:f
                Imagebase:0xfa0000
                File size:27'648 bytes
                MD5 hash:00BAAE10C69DAD58F169A3ED638D6C59
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:41
                Start time:20:23:35
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Jobs" /t /e /g Everyone:f
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:42
                Start time:20:23:36
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cacls.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Jobs" /t /e /g Everyone:f
                Imagebase:0xfa0000
                File size:27'648 bytes
                MD5 hash:00BAAE10C69DAD58F169A3ED638D6C59
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:43
                Start time:20:23:36
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Languages" /t /e /g Users:f
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:44
                Start time:20:23:36
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cacls.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Languages" /t /e /g Users:f
                Imagebase:0xfa0000
                File size:27'648 bytes
                MD5 hash:00BAAE10C69DAD58F169A3ED638D6C59
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:45
                Start time:20:23:36
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\logs" /t /e /g Everyone:f
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:46
                Start time:20:23:36
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cacls.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\logs" /t /e /g Everyone:f
                Imagebase:0xfa0000
                File size:27'648 bytes
                MD5 hash:00BAAE10C69DAD58F169A3ED638D6C59
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:47
                Start time:20:23:36
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Themes" /t /e /g Everyone:f
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:48
                Start time:20:23:36
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cacls.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Themes" /t /e /g Everyone:f
                Imagebase:0xfa0000
                File size:27'648 bytes
                MD5 hash:00BAAE10C69DAD58F169A3ED638D6C59
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:49
                Start time:20:23:36
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\tmpDownload" /t /e /g Everyone:f
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:50
                Start time:20:23:36
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cacls.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\tmpDownload" /t /e /g Everyone:f
                Imagebase:0xfa0000
                File size:27'648 bytes
                MD5 hash:00BAAE10C69DAD58F169A3ED638D6C59
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:51
                Start time:20:23:36
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Update" /t /e /g Everyone:f
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:52
                Start time:20:23:36
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cacls.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Update" /t /e /g Everyone:f
                Imagebase:0xfa0000
                File size:27'648 bytes
                MD5 hash:00BAAE10C69DAD58F169A3ED638D6C59
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:53
                Start time:20:23:36
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Computers" /t /e /g Everyone:f
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:54
                Start time:20:23:36
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cacls.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Computers" /t /e /g Everyone:f
                Imagebase:0xfa0000
                File size:27'648 bytes
                MD5 hash:00BAAE10C69DAD58F169A3ED638D6C59
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:55
                Start time:20:23:36
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Users" /t /e /g Everyone:f
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:56
                Start time:20:23:36
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cacls.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cacls "C:\Program Files (x86)\SAM 11\Users" /t /e /g Everyone:f
                Imagebase:0xfa0000
                File size:27'648 bytes
                MD5 hash:00BAAE10C69DAD58F169A3ED638D6C59
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:58
                Start time:20:23:37
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c %SystemRoot%\system32\cacls "C:\Windows\System32\spool\PRINTERS" /t /e /g Everyone:f
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:59
                Start time:20:23:37
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cacls.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cacls "C:\Windows\System32\spool\PRINTERS" /t /e /g Everyone:f
                Imagebase:0xfa0000
                File size:27'648 bytes
                MD5 hash:00BAAE10C69DAD58F169A3ED638D6C59
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:60
                Start time:20:23:37
                Start date:08/01/2025
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:C:\Windows\system32\cmd.exe /c C:\Program Files (x86)\SAM 11\SetEdgePolicies.reg
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:62
                Start time:20:23:42
                Start date:08/01/2025
                Path:C:\Windows\System32\conhost.exe
                Wow64 process (32bit):false
                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Imagebase:0x7ff7699e0000
                File size:862'208 bytes
                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                Has elevated privileges:true
                Has administrator privileges:false
                Programmed in:C, C++ or other language
                Has exited:true

                Disassembly

                Reset < >

                  Execution Graph

                  Execution Coverage:10.8%
                  Dynamic/Decrypted Code Coverage:0%
                  Signature Coverage:20.5%
                  Total number of Nodes:1550
                  Total number of Limit Nodes:26
                  execution_graph 11016 403540 GetSystemInfo 11017 409cf0 64 API calls 11016->11017 11018 403571 _calloc 11017->11018 11019 4035f8 RegOpenKeyExA 11018->11019 11020 4035c9 RegOpenKeyExA 11018->11020 11022 409cf0 64 API calls 11019->11022 11021 409cf0 64 API calls 11020->11021 11023 4035f0 11021->11023 11022->11023 11024 403630 GetLastError 11023->11024 11029 40362e _calloc 11023->11029 11025 409cf0 64 API calls 11024->11025 11026 40363f wsprintfA 11025->11026 11027 409cf0 64 API calls 11026->11027 11027->11029 11028 40367e RegSetValueExA 11030 409cf0 64 API calls 11028->11030 11029->11028 11031 4036ab 11030->11031 11032 4036bc GetLastError 11031->11032 11039 4036ba 11031->11039 11033 409cf0 64 API calls 11032->11033 11035 4036cb wsprintfA 11033->11035 11034 4036fe RegFlushKey 11036 409cf0 64 API calls 11034->11036 11037 409cf0 64 API calls 11035->11037 11038 403714 RegCloseKey 11036->11038 11037->11039 11040 409cf0 64 API calls 11038->11040 11039->11034 11041 40372a 11040->11041 11042 409cf0 64 API calls 11041->11042 11043 40373c 11042->11043 12256 402040 12289 40a5c0 12256->12289 12259 409cf0 64 API calls 12260 4020de _calloc 12259->12260 12261 4020ee RegSetValueExA 12260->12261 12262 409cf0 64 API calls 12261->12262 12263 402119 _calloc 12262->12263 12264 402129 RegSetValueExA 12263->12264 12265 409cf0 64 API calls 12264->12265 12266 402154 _calloc 12265->12266 12267 402166 RegSetValueExA 12266->12267 12268 409cf0 64 API calls 12267->12268 12269 402193 _calloc 12268->12269 12270 4021a3 RegSetValueExA 12269->12270 12271 409cf0 64 API calls 12270->12271 12272 4021ce _calloc 12271->12272 12273 4021de RegSetValueExA 12272->12273 12274 409cf0 64 API calls 12273->12274 12275 402209 _calloc 12274->12275 12276 402219 RegSetValueExA 12275->12276 12277 409cf0 64 API calls 12276->12277 12278 402244 RegSetValueExA 12277->12278 12279 409cf0 64 API calls 12278->12279 12280 40227c RegSetValueExA 12279->12280 12281 409cf0 64 API calls 12280->12281 12282 4022b4 RegFlushKey 12281->12282 12283 409cf0 64 API calls 12282->12283 12284 4022d0 RegCloseKey 12283->12284 12285 409cf0 64 API calls 12284->12285 12286 4022e6 12285->12286 12287 409cf0 64 API calls 12286->12287 12288 4022f8 12287->12288 12290 40208c RegCreateKeyExA 12289->12290 12290->12259 12035 401970 GetLocalTime 12036 409cf0 64 API calls 12035->12036 12037 4019d5 wsprintfA 12036->12037 12038 409cf0 64 API calls 12037->12038 12039 401a34 wsprintfA 12038->12039 12040 409cf0 64 API calls 12039->12040 12041 401a7d 12040->12041 12056 407ed0 12041->12056 12046 407440 8 API calls 12047 401ad1 12046->12047 12048 407440 8 API calls 12047->12048 12049 401ad8 12048->12049 12050 407440 8 API calls 12049->12050 12051 401adf 12050->12051 12052 407440 8 API calls 12051->12052 12053 401ae6 12052->12053 12054 409cf0 64 API calls 12053->12054 12055 401b19 12054->12055 12057 407efb 12056->12057 12067 40b070 12057->12067 12059 407f2f Concurrency::details::ContextBase::GetWorkQueueIdentity 12070 409370 12059->12070 12061 401a9a 12062 407440 12061->12062 12151 407230 12062->12151 12064 401aca 12064->12046 12065 40744f 12065->12064 12155 407310 12065->12155 12068 40e330 __nh_malloc 64 API calls 12067->12068 12069 40b08a 12068->12069 12069->12059 12072 409389 12070->12072 12073 409382 12070->12073 12072->12073 12080 40c070 12072->12080 12073->12061 12074 409561 12074->12073 12077 4085d0 5 API calls 12074->12077 12075 4094f6 12075->12073 12075->12074 12076 40b070 64 API calls 12075->12076 12078 40954f 12076->12078 12077->12073 12078->12074 12108 409b20 12078->12108 12081 40c090 12080->12081 12096 40c0fc _calloc 12081->12096 12112 412e40 12081->12112 12084 40c32d CreateFileA 12085 40c356 GetLastError 12084->12085 12086 40c36d GetFileType 12084->12086 12085->12096 12087 40c380 CloseHandle GetLastError 12086->12087 12088 40c3a1 12086->12088 12106 40c396 _calloc 12087->12106 12116 412f70 12088->12116 12091 40b890 _calloc 2 API calls 12092 40c42d 12091->12092 12093 40c439 12092->12093 12094 40c45b 12092->12094 12093->12096 12098 40b090 5 API calls 12093->12098 12124 40b430 12094->12124 12096->12075 12097 40c46e 12099 40c4a4 12097->12099 12133 413240 12097->12133 12098->12096 12100 40b890 _calloc 2 API calls 12099->12100 12102 40c4b1 12100->12102 12102->12096 12105 40b090 5 API calls 12102->12105 12104 40c493 12107 40b090 5 API calls 12104->12107 12105->12106 12106->12096 12107->12106 12109 409b4d 12108->12109 12110 409b32 12108->12110 12109->12074 12110->12109 12111 40afe0 64 API calls 12110->12111 12111->12109 12113 412e5f 12112->12113 12114 40e2e0 __malloc_dbg 64 API calls 12113->12114 12115 40c308 12113->12115 12114->12115 12115->12084 12115->12096 12117 412f83 12116->12117 12118 40c3cd 12116->12118 12117->12118 12119 412fb1 12117->12119 12120 412fbf SetStdHandle 12117->12120 12118->12091 12118->12096 12121 412fb7 12119->12121 12122 412fcd SetStdHandle 12119->12122 12120->12118 12121->12118 12123 412fdb SetStdHandle 12121->12123 12122->12118 12123->12118 12125 40b441 12124->12125 12129 40b460 _calloc 12124->12129 12126 40b540 ReadFile 12125->12126 12125->12129 12127 40b56f GetLastError 12126->12127 12128 40b5b9 12126->12128 12127->12129 12128->12129 12130 40b758 ReadFile 12128->12130 12132 40b890 _calloc 2 API calls 12128->12132 12129->12097 12130->12128 12131 40b795 GetLastError 12130->12131 12131->12128 12132->12128 12135 41324d _findenv 12133->12135 12134 40c48b 12134->12099 12134->12104 12135->12134 12136 40cac0 _calloc 64 API calls 12135->12136 12137 4132cf 12135->12137 12136->12135 12138 40b890 _calloc 2 API calls 12137->12138 12139 4132dc 12138->12139 12139->12134 12140 40b890 _calloc 2 API calls 12139->12140 12141 4132fb 12140->12141 12141->12134 12142 41342a 12141->12142 12148 413331 _calloc 12141->12148 12144 40b890 _calloc 2 API calls 12142->12144 12150 4133d8 12142->12150 12143 40b890 _calloc 2 API calls 12143->12134 12145 413442 _calloc 12144->12145 12146 41344e SetEndOfFile 12145->12146 12147 41346e GetLastError 12146->12147 12146->12150 12147->12150 12149 40b180 _calloc 6 API calls 12148->12149 12148->12150 12149->12148 12150->12143 12152 407248 12151->12152 12153 40725d 12152->12153 12161 407480 12152->12161 12153->12065 12156 407343 12155->12156 12158 4073d3 12156->12158 12165 40ac90 12156->12165 12158->12064 12160 40ac90 8 API calls 12160->12158 12162 407498 12161->12162 12164 408a40 6 API calls 12162->12164 12163 4074d2 12163->12153 12164->12163 12166 40aca5 12165->12166 12167 40ac99 12165->12167 12177 40acf0 12166->12177 12173 40adc0 12167->12173 12171 4073a0 12171->12160 12175 40addd 12173->12175 12174 40ae8c 12174->12171 12175->12174 12176 40ac90 8 API calls 12175->12176 12176->12175 12178 40ad11 12177->12178 12179 40acae 12177->12179 12178->12179 12180 40b180 _calloc 6 API calls 12178->12180 12179->12171 12181 412c30 12179->12181 12180->12179 12182 412c3f _calloc 12181->12182 12185 412c5e 12181->12185 12183 412c95 FlushFileBuffers 12182->12183 12182->12185 12184 412ca3 GetLastError 12183->12184 12183->12185 12184->12185 12185->12171 11044 40ab00 GetVersion 11063 412850 HeapCreate 11044->11063 11047 40ab94 11077 40b980 11047->11077 11048 40ab8a 11142 40ac60 11048->11142 11052 40aba0 GetCommandLineA 11091 4123a0 11052->11091 11056 40abba 11126 411d40 11056->11126 11058 40abbf 11139 410320 11058->11139 11064 40ab83 11063->11064 11065 41287c 11063->11065 11064->11047 11064->11048 11152 412620 11065->11152 11068 4128b3 11071 4169e0 __nh_malloc 5 API calls 11068->11071 11074 4128b1 11068->11074 11069 41288f 11164 414d10 HeapAlloc 11069->11164 11073 4128c1 11071->11073 11073->11074 11076 4128c5 HeapDestroy 11073->11076 11074->11064 11075 4128a0 HeapDestroy 11075->11064 11076->11064 11078 40e2e0 __malloc_dbg 64 API calls 11077->11078 11079 40b99c 11078->11079 11080 40b9af GetStartupInfoA 11079->11080 11205 40ac30 11079->11205 11087 40bb8e 11080->11087 11089 40ba14 11080->11089 11083 40bc7b SetHandleCount 11083->11052 11084 40bbeb GetStdHandle 11086 40bbfe GetFileType 11084->11086 11084->11087 11085 40e2e0 __malloc_dbg 64 API calls 11085->11089 11086->11087 11087->11083 11087->11084 11088 40ba98 11088->11087 11090 40bb4b GetFileType 11088->11090 11089->11085 11089->11087 11089->11088 11090->11088 11092 4123cc 11091->11092 11093 4123bd GetEnvironmentStringsW 11091->11093 11095 412407 11092->11095 11096 4124fe 11092->11096 11093->11092 11094 4123d8 GetEnvironmentStrings 11093->11094 11094->11092 11097 40abb0 11094->11097 11098 41240d GetEnvironmentStringsW 11095->11098 11101 412423 WideCharToMultiByte 11095->11101 11096->11097 11099 412511 GetEnvironmentStrings 11096->11099 11104 412527 11096->11104 11117 411e90 11097->11117 11098->11097 11098->11101 11099->11097 11099->11104 11102 4124a4 FreeEnvironmentStringsW 11101->11102 11103 412486 11101->11103 11102->11097 11105 40e2e0 __malloc_dbg 64 API calls 11103->11105 11106 40e2e0 __malloc_dbg 64 API calls 11104->11106 11107 412498 11105->11107 11108 412576 11106->11108 11107->11102 11109 4124b5 WideCharToMultiByte 11107->11109 11110 412590 _calloc 11108->11110 11111 412582 FreeEnvironmentStringsA 11108->11111 11112 4124d7 11109->11112 11113 4124ec FreeEnvironmentStringsW 11109->11113 11115 4125a1 FreeEnvironmentStringsA 11110->11115 11111->11097 11114 40ed50 _calloc 64 API calls 11112->11114 11113->11097 11116 4124e2 11114->11116 11115->11097 11116->11113 11118 411ea4 GetModuleFileNameA 11117->11118 11119 411e9f 11117->11119 11121 411ecc 11118->11121 11228 419280 11119->11228 11122 40e2e0 __malloc_dbg 64 API calls 11121->11122 11123 411f18 11122->11123 11124 411f2b 11123->11124 11125 40ac30 67 API calls 11123->11125 11124->11056 11125->11124 11127 411d4f 11126->11127 11130 411d54 _calloc 11126->11130 11128 419280 20 API calls 11127->11128 11128->11130 11129 40e2e0 __malloc_dbg 64 API calls 11131 411db2 11129->11131 11130->11129 11132 40ac30 67 API calls 11131->11132 11137 411dd1 _calloc 11131->11137 11132->11137 11133 411e57 11134 40ed50 _calloc 64 API calls 11133->11134 11135 411e65 11134->11135 11135->11058 11136 40e2e0 __malloc_dbg 64 API calls 11136->11137 11137->11133 11137->11136 11138 40ac30 67 API calls 11137->11138 11138->11137 11140 4103a0 ArrayUnwindFilter 64 API calls 11139->11140 11141 40abf8 11140->11141 11148 411b30 11141->11148 11143 40ac71 11142->11143 11144 40ac6c 11142->11144 11146 412a20 ArrayUnwindFilter 67 API calls 11143->11146 11145 4129d0 67 API calls 11144->11145 11145->11143 11147 40ac7a ExitProcess 11146->11147 11149 411b3f 11148->11149 11150 411b54 UnhandledExceptionFilter 11149->11150 11151 40ac0f 11149->11151 11150->11151 11166 40aad0 11152->11166 11154 41262d GetVersionExA 11155 412652 11154->11155 11156 41266e GetEnvironmentVariableA 11154->11156 11155->11156 11158 412664 11155->11158 11159 41268d 11156->11159 11163 4127e8 11156->11163 11158->11068 11158->11069 11160 4126f8 GetModuleFileNameA 11159->11160 11161 4126ea 11159->11161 11160->11161 11161->11163 11168 4192b0 11161->11168 11163->11158 11171 4125c0 GetModuleHandleA 11163->11171 11165 412899 11164->11165 11165->11074 11165->11075 11167 40aadc 11166->11167 11167->11154 11167->11167 11173 4192d0 11168->11173 11172 4125ea 11171->11172 11172->11158 11175 4192f4 11173->11175 11174 4179c0 _mbtowc 6 API calls 11174->11175 11175->11174 11176 419349 11175->11176 11177 4179c0 6 API calls _mbtowc 11176->11177 11179 4192c6 11176->11179 11180 41a280 11176->11180 11177->11176 11179->11163 11182 41a2ac 11180->11182 11185 41a28f 11180->11185 11181 41a2c9 11181->11185 11186 417cb0 11181->11186 11182->11181 11183 4179c0 _mbtowc 6 API calls 11182->11183 11183->11181 11185->11176 11187 417cfb _mbtowc 11186->11187 11188 417cdf LCMapStringW 11186->11188 11190 417d58 LCMapStringA 11187->11190 11191 417d7b 11187->11191 11188->11187 11189 417d07 LCMapStringA 11188->11189 11189->11187 11198 417d2f 11189->11198 11190->11198 11192 417d97 MultiByteToWideChar 11191->11192 11191->11198 11193 417dcb _findenv 11192->11193 11192->11198 11194 417e1a MultiByteToWideChar 11193->11194 11193->11198 11195 417e41 LCMapStringW 11194->11195 11194->11198 11196 417e6b 11195->11196 11195->11198 11197 417e78 11196->11197 11200 417ebb _findenv 11196->11200 11197->11198 11199 417e8d LCMapStringW 11197->11199 11198->11185 11199->11198 11200->11198 11201 417f10 LCMapStringW 11200->11201 11201->11198 11202 417f36 11201->11202 11203 417f6a WideCharToMultiByte 11202->11203 11204 417f3c WideCharToMultiByte 11202->11204 11203->11198 11204->11198 11206 40ac41 11205->11206 11207 40ac3c 11205->11207 11217 412a20 11206->11217 11211 4129d0 11207->11211 11212 4129dc 11211->11212 11213 412a14 11212->11213 11214 412a20 ArrayUnwindFilter 67 API calls 11212->11214 11213->11206 11215 4129f8 11214->11215 11216 412a20 ArrayUnwindFilter 67 API calls 11215->11216 11216->11213 11219 412a35 11217->11219 11218 40ac4a 11218->11080 11219->11218 11220 412a8b 11219->11220 11222 40cac0 _calloc 64 API calls 11219->11222 11221 412aaf _calloc 11220->11221 11223 412ae8 11220->11223 11224 412ac5 GetStdHandle WriteFile 11221->11224 11222->11220 11223->11218 11225 412af5 GetModuleFileNameA 11223->11225 11224->11218 11226 412b0d _calloc 11225->11226 11227 413dd0 _calloc 4 API calls 11226->11227 11227->11218 11229 41928c 11228->11229 11231 419293 11228->11231 11232 418af0 11229->11232 11231->11118 11247 418df0 11232->11247 11235 418b1d 11252 418f50 GetCPInfo 11235->11252 11236 418b2e 11237 418c87 GetCPInfo 11236->11237 11238 418c82 11236->11238 11243 418b5f 11236->11243 11240 418dd0 11237->11240 11242 418c9e 11237->11242 11238->11237 11241 418f50 17 API calls 11240->11241 11246 418b10 11240->11246 11241->11246 11244 418f50 17 API calls 11242->11244 11245 418f50 17 API calls 11243->11245 11244->11246 11245->11246 11246->11231 11248 418e03 GetOEMCP 11247->11248 11249 418e15 11247->11249 11250 418aff 11248->11250 11249->11250 11251 418e1b GetACP 11249->11251 11250->11235 11250->11236 11250->11246 11251->11250 11254 418f76 11252->11254 11259 4190ab 11252->11259 11253 419740 _mbtowc 6 API calls 11255 419041 11253->11255 11254->11253 11256 417cb0 _mbtowc 10 API calls 11255->11256 11257 419076 11256->11257 11258 417cb0 _mbtowc 10 API calls 11257->11258 11258->11259 11259->11246 12186 404f10 OpenSCManagerA 12187 409cf0 64 API calls 12186->12187 12188 404f45 12187->12188 12189 404f4e 12188->12189 12190 404f9c CreateServiceA 12188->12190 12191 404f5e CreateServiceA 12188->12191 12192 409cf0 64 API calls 12189->12192 12194 409cf0 64 API calls 12190->12194 12193 409cf0 64 API calls 12191->12193 12195 405027 12192->12195 12196 404f97 StartServiceA 12193->12196 12194->12196 12198 409cf0 64 API calls 12196->12198 12199 404ff2 CloseServiceHandle 12198->12199 12200 409cf0 64 API calls 12199->12200 12201 405005 CloseServiceHandle 12200->12201 12202 409cf0 64 API calls 12201->12202 12203 405018 12202->12203 12203->12189 11751 405630 11752 40aad0 _findenv 11751->11752 11753 405653 GetSystemInfo 11752->11753 11754 409cf0 64 API calls 11753->11754 11755 40567e type_info::operator!= _calloc 11754->11755 11756 40a930 106 API calls 11755->11756 11757 405e13 11756->11757 11758 40a930 106 API calls 11757->11758 11759 405e20 11758->11759 11760 40a930 106 API calls 11759->11760 11761 405e2d 11760->11761 11762 40a930 106 API calls 11761->11762 11763 405e55 11762->11763 11764 40a930 106 API calls 11763->11764 11765 405e62 11764->11765 11766 40a930 106 API calls 11765->11766 11767 405e8a 11766->11767 11768 40a930 106 API calls 11767->11768 11769 405e97 FindFirstFileA 11768->11769 11770 409cf0 64 API calls 11769->11770 11771 405f12 11770->11771 11772 405f37 FindFirstFileA 11771->11772 11776 405f21 _calloc 11771->11776 11773 409cf0 64 API calls 11772->11773 11773->11776 11774 405f8b wsprintfA 11775 409cf0 64 API calls 11774->11775 11777 405fb5 CreateDirectoryA 11775->11777 11776->11774 11778 409cf0 64 API calls 11777->11778 11779 405fd4 11778->11779 11780 405ff4 wsprintfA 11779->11780 11781 409cf0 64 API calls 11780->11781 11782 406036 11781->11782 11783 406047 wsprintfA 11782->11783 11784 409cf0 64 API calls 11783->11784 11785 40608a 11784->11785 11786 40609b wsprintfA 11785->11786 11787 409cf0 64 API calls 11786->11787 11788 4060de 11787->11788 11789 4060ef wsprintfA 11788->11789 11790 409cf0 64 API calls 11789->11790 11791 406131 CreateDirectoryA 11790->11791 11792 409cf0 64 API calls 11791->11792 11793 406149 11792->11793 11794 40615a wsprintfA 11793->11794 11795 409cf0 64 API calls 11794->11795 11796 406182 CreateDirectoryA 11795->11796 11797 409cf0 64 API calls 11796->11797 11798 40619a 11797->11798 11799 4061ab wsprintfA 11798->11799 11800 409cf0 64 API calls 11799->11800 11801 4061d3 CreateDirectoryA 11800->11801 11802 409cf0 64 API calls 11801->11802 11803 4061eb 11802->11803 11804 4061fc wsprintfA 11803->11804 11805 409cf0 64 API calls 11804->11805 11806 406224 CreateDirectoryA 11805->11806 11807 409cf0 64 API calls 11806->11807 11808 40623c 11807->11808 11809 40624d wsprintfA 11808->11809 11810 409cf0 64 API calls 11809->11810 11811 406275 CreateDirectoryA 11810->11811 11812 409cf0 64 API calls 11811->11812 11813 40628d 11812->11813 11814 40629e wsprintfA 11813->11814 11815 409cf0 64 API calls 11814->11815 11816 4062c6 CreateDirectoryA 11815->11816 11817 409cf0 64 API calls 11816->11817 11818 4062de 11817->11818 11819 4062ef wsprintfA 11818->11819 11820 409cf0 64 API calls 11819->11820 11821 406332 type_info::operator!= 11820->11821 11822 40635e 11821->11822 11825 4063c7 11821->11825 11823 40636d wsprintfA 11822->11823 11824 409cf0 64 API calls 11823->11824 11828 4063b1 type_info::operator!= 11824->11828 11826 4063f7 wsprintfA 11825->11826 11827 409cf0 64 API calls 11826->11827 11832 40643c type_info::operator!= 11827->11832 11829 4065bd WritePrivateProfileStringA 11828->11829 11831 4065e2 type_info::operator!= 11828->11831 11830 409cf0 64 API calls 11829->11830 11830->11831 11833 40660a WritePrivateProfileStringA 11831->11833 11839 40666a type_info::operator!= 11831->11839 11834 4064c6 type_info::operator!= 11832->11834 11835 40648b CopyFileA 11832->11835 11836 409cf0 64 API calls 11833->11836 11834->11828 11840 4064e0 wsprintfA 11834->11840 11837 409cf0 64 API calls 11835->11837 11838 40662f type_info::operator!= 11836->11838 11862 4064a8 11837->11862 11838->11839 11843 406645 WritePrivateProfileStringA 11838->11843 11841 406692 WritePrivateProfileStringA 11839->11841 11848 4066b7 type_info::operator!= 11839->11848 11842 409cf0 64 API calls 11840->11842 11845 409cf0 64 API calls 11841->11845 11846 40650a CopyFileA 11842->11846 11844 409cf0 64 API calls 11843->11844 11844->11839 11845->11848 11847 409cf0 64 API calls 11846->11847 11850 406529 11847->11850 11849 4066df WritePrivateProfileStringA 11848->11849 11855 406729 type_info::operator!= 11848->11855 11851 409cf0 64 API calls 11849->11851 11852 40654e WritePrivateProfileStringA 11850->11852 11853 406704 WritePrivateProfileStringA 11851->11853 11856 409cf0 64 API calls 11852->11856 11854 409cf0 64 API calls 11853->11854 11854->11855 11857 406751 WritePrivateProfileStringA 11855->11857 11861 40679b type_info::operator!= 11855->11861 11856->11862 11858 409cf0 64 API calls 11857->11858 11859 406776 WritePrivateProfileStringA 11858->11859 11860 409cf0 64 API calls 11859->11860 11860->11861 11863 4067c3 WritePrivateProfileStringA 11861->11863 11864 40680d 11861->11864 11862->11828 11865 409cf0 64 API calls 11863->11865 11868 40a8a0 16 API calls 11864->11868 11866 4067e8 WritePrivateProfileStringA 11865->11866 11867 409cf0 64 API calls 11866->11867 11867->11864 11869 40682e 11868->11869 11870 406835 WritePrivateProfileStringA 11869->11870 11871 40685c WritePrivateProfileStringA 11869->11871 11872 409cf0 64 API calls 11870->11872 11873 409cf0 64 API calls 11871->11873 11874 40685a 11872->11874 11873->11874 11875 406890 WritePrivateProfileStringA 11874->11875 11876 409cf0 64 API calls 11875->11876 11877 4068b8 wsprintfA 11876->11877 11878 409cf0 64 API calls 11877->11878 11879 4068f7 11878->11879 11880 40696f DeleteFileA 11879->11880 11884 406900 type_info::operator!= 11879->11884 11881 409cf0 64 API calls 11880->11881 11882 406983 DeleteFileA 11881->11882 11883 409cf0 64 API calls 11882->11883 11885 406997 DeleteFileA 11883->11885 11887 406959 DeleteFileA 11884->11887 11888 40691b DeleteFileA 11884->11888 11886 409cf0 64 API calls 11885->11886 11897 406957 11886->11897 11889 409cf0 64 API calls 11887->11889 11890 409cf0 64 API calls 11888->11890 11891 40696d 11889->11891 11892 40692f DeleteFileA 11890->11892 11894 40a8a0 16 API calls 11891->11894 11893 409cf0 64 API calls 11892->11893 11895 406943 DeleteFileA 11893->11895 11899 4069dc 11894->11899 11896 409cf0 64 API calls 11895->11896 11896->11897 11897->11891 11898 40a930 106 API calls 11900 406a22 11898->11900 11901 40a930 106 API calls 11899->11901 11902 406a01 11899->11902 11903 40a930 106 API calls 11900->11903 11901->11902 11902->11898 11904 406a41 11903->11904 11905 40a930 106 API calls 11904->11905 11906 406a60 11905->11906 11907 40a930 106 API calls 11906->11907 11908 406a6d 11907->11908 11909 40a930 106 API calls 11908->11909 11910 406a7a 11909->11910 11911 40a930 106 API calls 11910->11911 11912 406a87 11911->11912 11913 40a930 106 API calls 11912->11913 11914 406a94 11913->11914 11915 40a930 106 API calls 11914->11915 11916 406aa1 11915->11916 11917 40a930 106 API calls 11916->11917 11918 406aae 11917->11918 11919 40a930 106 API calls 11918->11919 11920 406abb 11919->11920 11921 40a930 106 API calls 11920->11921 11922 406ac8 11921->11922 11923 40a930 106 API calls 11922->11923 11924 406ad5 11923->11924 11925 40a930 106 API calls 11924->11925 11926 406ae2 11925->11926 11927 40a930 106 API calls 11926->11927 11928 406aef 11927->11928 11929 40a930 106 API calls 11928->11929 11930 406afc 11929->11930 11931 40a930 106 API calls 11930->11931 11932 406b09 11931->11932 11933 40a930 106 API calls 11932->11933 11934 406b16 11933->11934 11935 40a8a0 16 API calls 11934->11935 11938 406b28 11935->11938 11936 406b4b 11937 409cf0 64 API calls 11936->11937 11939 406b6a 11937->11939 11938->11936 11940 40a930 106 API calls 11938->11940 11940->11936 10560 4054c0 RegOpenKeyExA 10571 409cf0 10560->10571 10562 405526 RegQueryValueExA 10563 409cf0 64 API calls 10562->10563 10564 405568 RegFlushKey 10563->10564 10565 409cf0 64 API calls 10564->10565 10566 405584 RegCloseKey 10565->10566 10567 409cf0 64 API calls 10566->10567 10568 4055a0 10567->10568 10569 409cf0 64 API calls 10568->10569 10570 4055e1 10569->10570 10572 409cf2 10571->10572 10573 409cf3 10571->10573 10572->10562 10576 40cac0 10573->10576 10577 40cacd _findenv 10576->10577 10578 40cbe0 10577->10578 10579 40cb40 InterlockedIncrement 10577->10579 10588 409d16 10577->10588 10583 40cc02 _calloc 10578->10583 10605 4138a0 10578->10605 10579->10578 10580 40cb53 10579->10580 10581 40cb5c LoadLibraryA 10580->10581 10582 40cb9e OutputDebugStringA InterlockedDecrement 10580->10582 10585 40cb76 GetProcAddress 10581->10585 10581->10588 10604 40c9b0 DebugBreak 10582->10604 10590 40ccd5 _calloc 10583->10590 10615 4137a0 10583->10615 10585->10582 10585->10588 10588->10562 10594 40cd30 10590->10594 10595 40cd4c _calloc 10590->10595 10591 40cd9b 10592 40cdb9 10591->10592 10593 40cdac OutputDebugStringA 10591->10593 10596 40ce38 10592->10596 10601 40cdca _calloc 10592->10601 10593->10592 10594->10588 10597 40cd36 InterlockedDecrement 10594->10597 10595->10591 10599 40cd7f WriteFile 10595->10599 10596->10588 10598 40ce3e InterlockedDecrement 10596->10598 10597->10588 10598->10588 10599->10591 10625 40ce50 10601->10625 10603 40ce25 InterlockedDecrement 10603->10588 10604->10588 10606 4138af 10605->10606 10607 40cac0 _calloc 64 API calls 10606->10607 10608 4138d9 10606->10608 10607->10606 10609 40cac0 _calloc 64 API calls 10608->10609 10610 413903 10608->10610 10609->10608 10639 40d380 10610->10639 10613 413956 10613->10583 10616 4137b5 10615->10616 10617 40cac0 _calloc 64 API calls 10616->10617 10618 4137df 10616->10618 10617->10616 10619 40cac0 _calloc 64 API calls 10618->10619 10620 413809 10618->10620 10619->10618 10621 40d380 _calloc 64 API calls 10620->10621 10622 41383e 10621->10622 10623 41385c 10622->10623 10624 414150 _calloc 64 API calls 10622->10624 10623->10590 10624->10623 10628 40ce5d _findenv 10625->10628 10626 40cac0 _calloc 63 API calls 10626->10628 10627 40ce8e GetModuleFileNameA 10630 40cea6 _calloc 10627->10630 10628->10626 10628->10627 10902 40c9b0 DebugBreak 10628->10902 10631 4137a0 _calloc 63 API calls 10630->10631 10632 40d0f2 _calloc 10631->10632 10903 413dd0 10632->10903 10635 40ce16 10635->10588 10635->10603 10648 40d3ab _calloc _get_int_arg _get_short_arg 10639->10648 10640 40e02e 10640->10613 10649 414150 10640->10649 10641 40e140 64 API calls _calloc 10641->10648 10643 40e1c0 64 API calls _calloc 10643->10648 10644 40e200 64 API calls _calloc 10644->10648 10645 40cac0 _calloc 64 API calls 10645->10648 10647 413fc0 WideCharToMultiByte _calloc 10647->10648 10648->10640 10648->10641 10648->10643 10648->10644 10648->10645 10648->10647 10665 40e2e0 10648->10665 10668 40ed50 10648->10668 10650 414159 10649->10650 10651 40cac0 _calloc 64 API calls 10650->10651 10653 414183 _calloc 10650->10653 10651->10650 10652 4141af 10652->10613 10653->10652 10654 41428c 10653->10654 10880 419670 10653->10880 10655 4142a3 10654->10655 10656 414379 10654->10656 10658 4142d9 10655->10658 10660 40cac0 _calloc 64 API calls 10655->10660 10657 40b180 _calloc 6 API calls 10656->10657 10657->10652 10661 41430a 10658->10661 10663 414326 10658->10663 10660->10655 10886 40b180 10661->10886 10663->10652 10897 40b890 10663->10897 10712 40e330 10665->10712 10669 40ed93 10668->10669 10670 40ed63 10668->10670 10673 40ede8 10669->10673 10674 40edbd 10669->10674 10705 40ed99 _calloc 10669->10705 10670->10669 10671 40f410 _calloc 64 API calls 10670->10671 10672 40ed6c 10670->10672 10671->10670 10672->10670 10675 40cac0 _calloc 64 API calls 10672->10675 10678 40edf8 10673->10678 10681 40ee1f 10673->10681 10832 40f850 10673->10832 10676 40cac0 _calloc 64 API calls 10674->10676 10680 40ede3 10674->10680 10675->10672 10676->10674 10678->10673 10679 40cac0 _calloc 64 API calls 10678->10679 10679->10678 10680->10705 10682 40ee81 10681->10682 10687 40ee5a 10681->10687 10683 40ef56 10682->10683 10684 40f380 _calloc 64 API calls 10682->10684 10685 40efcb 10683->10685 10686 40ef5f 10683->10686 10688 40eea6 10684->10688 10691 40efec 10685->10691 10701 40f013 10685->10701 10689 40ef74 10686->10689 10697 40ef9b _calloc 10686->10697 10687->10681 10690 40cac0 _calloc 64 API calls 10687->10690 10692 40eef0 10688->10692 10693 40eead 10688->10693 10689->10686 10694 40cac0 _calloc 64 API calls 10689->10694 10690->10687 10691->10685 10695 40cac0 _calloc 64 API calls 10691->10695 10698 40f380 _calloc 64 API calls 10692->10698 10693->10692 10696 40cac0 _calloc 64 API calls 10693->10696 10694->10689 10695->10691 10696->10693 10843 412ce0 10697->10843 10699 40ef0c 10698->10699 10699->10683 10700 40ef13 10699->10700 10700->10683 10703 40cac0 _calloc 64 API calls 10700->10703 10701->10705 10706 40f03c 10701->10706 10708 40f057 10701->10708 10703->10700 10704 40cac0 _calloc 64 API calls 10704->10708 10705->10648 10709 40f093 _calloc 10706->10709 10710 40f0ad 10706->10710 10707 40cac0 _calloc 64 API calls 10707->10710 10708->10701 10708->10704 10711 412ce0 _calloc 9 API calls 10709->10711 10710->10706 10710->10707 10711->10705 10714 40e334 __nh_malloc 10712->10714 10715 40e2ff 10714->10715 10716 40e3a0 10714->10716 10715->10648 10717 40e3ec 10716->10717 10718 40e3bc 10716->10718 10722 40e484 10717->10722 10723 40e426 10717->10723 10718->10717 10720 40e3c5 10718->10720 10737 40f410 10718->10737 10720->10718 10721 40cac0 _calloc 64 API calls 10720->10721 10721->10720 10727 40e4b7 10722->10727 10729 40e4e3 10722->10729 10724 40e457 10723->10724 10725 40e42c 10723->10725 10726 40cac0 _calloc 64 API calls 10724->10726 10732 40e47d 10724->10732 10728 40cac0 _calloc 64 API calls 10725->10728 10736 40e455 _calloc 10725->10736 10726->10724 10730 40cac0 _calloc 64 API calls 10727->10730 10727->10736 10728->10725 10731 40e530 10729->10731 10735 40e504 10729->10735 10730->10727 10771 4144b0 10731->10771 10732->10714 10734 40cac0 _calloc 64 API calls 10734->10735 10735->10731 10735->10734 10736->10732 10738 40f42f 10737->10738 10755 40f425 10737->10755 10782 414b30 10738->10782 10741 40f44b 10742 40f511 10741->10742 10743 40f464 10741->10743 10749 40cac0 _calloc 64 API calls 10742->10749 10742->10755 10744 40f4c1 10743->10744 10745 40f4e9 10743->10745 10746 40f499 10743->10746 10747 40f46e 10743->10747 10750 40cac0 _calloc 64 API calls 10744->10750 10744->10755 10752 40cac0 _calloc 64 API calls 10745->10752 10745->10755 10753 40cac0 _calloc 64 API calls 10746->10753 10746->10755 10751 40cac0 _calloc 64 API calls 10747->10751 10747->10755 10748 40f543 10748->10755 10789 40f380 10748->10789 10749->10742 10750->10744 10751->10747 10752->10745 10753->10746 10755->10718 10756 40f60e 10757 40f380 _calloc 64 API calls 10756->10757 10763 40f631 10757->10763 10758 40cac0 _calloc 64 API calls 10759 40f5d4 10758->10759 10759->10756 10759->10758 10760 40f66b 10764 40f380 _calloc 64 API calls 10760->10764 10769 40f6c4 10760->10769 10761 40cac0 _calloc 64 API calls 10761->10763 10762 40f740 10762->10718 10763->10760 10763->10761 10770 40f695 10764->10770 10765 40f70d 10765->10762 10767 40cac0 _calloc 64 API calls 10765->10767 10766 40cac0 _calloc 64 API calls 10766->10769 10767->10765 10768 40cac0 _calloc 64 API calls 10768->10770 10769->10762 10769->10765 10769->10766 10770->10768 10770->10769 10772 4144e7 10771->10772 10773 4144bd 10771->10773 10774 4144d1 10772->10774 10779 4144f0 10772->10779 10773->10774 10799 415420 10773->10799 10775 414554 HeapAlloc 10774->10775 10777 4144dd 10774->10777 10775->10777 10777->10736 10778 414533 HeapAlloc 10778->10777 10779->10778 10805 416ea0 10779->10805 10781 414522 10781->10777 10781->10778 10783 414b44 10782->10783 10786 414b49 _calloc 10782->10786 10793 416380 IsBadWritePtr 10783->10793 10785 414b6f HeapValidate 10787 414b83 GetLastError 10785->10787 10788 40f434 10785->10788 10786->10785 10787->10788 10788->10741 10788->10748 10792 40f38e 10789->10792 10790 40f3fe 10790->10759 10791 40cac0 _calloc 64 API calls 10791->10792 10792->10790 10792->10791 10794 4163ab 10793->10794 10798 4163a3 10793->10798 10795 4163e4 IsBadWritePtr 10794->10795 10794->10798 10796 416413 10795->10796 10795->10798 10797 4164cc IsBadWritePtr 10796->10797 10796->10798 10797->10798 10798->10786 10802 415458 10799->10802 10800 415567 10804 415570 10800->10804 10819 415a70 10800->10819 10802->10800 10802->10804 10812 415960 10802->10812 10804->10774 10810 416eae __nh_malloc 10805->10810 10806 4171ec 10823 4169e0 10806->10823 10809 41704f VirtualAlloc 10811 416f3f _calloc 10809->10811 10810->10806 10810->10809 10810->10811 10811->10781 10813 415971 HeapReAlloc 10812->10813 10814 4159bb HeapAlloc 10812->10814 10815 4159a3 10813->10815 10816 41599c 10813->10816 10814->10816 10817 4159f5 VirtualAlloc 10814->10817 10815->10814 10816->10800 10817->10816 10818 415a18 HeapFree 10817->10818 10818->10816 10821 415a8f VirtualAlloc 10819->10821 10822 415b21 10821->10822 10822->10804 10824 4169f8 HeapAlloc 10823->10824 10825 4169ef 10823->10825 10826 416a1b VirtualAlloc 10824->10826 10831 416a14 _calloc 10824->10831 10825->10826 10827 416b9c 10826->10827 10828 416a3c VirtualAlloc 10826->10828 10830 416ba5 HeapFree 10827->10830 10827->10831 10829 416b8b VirtualFree 10828->10829 10828->10831 10829->10827 10830->10831 10831->10811 10833 40f863 10832->10833 10840 40f85c _calloc 10832->10840 10856 40f800 10833->10856 10836 40f8ee 10837 40f95a HeapValidate 10836->10837 10841 40f8f7 _calloc 10836->10841 10837->10840 10838 40f88a _calloc 10839 40f8d4 HeapValidate 10838->10839 10838->10840 10839->10840 10840->10673 10841->10840 10842 40f942 HeapValidate 10841->10842 10842->10840 10844 412cf1 10843->10844 10853 412cec 10843->10853 10845 412d3a 10844->10845 10848 412cfa _calloc 10844->10848 10846 412d43 _calloc 10845->10846 10847 412d8e HeapFree 10845->10847 10851 412d71 10846->10851 10867 416e30 10846->10867 10847->10853 10854 412d1c 10848->10854 10861 414e40 10848->10861 10850 412d25 HeapFree 10850->10853 10852 412d7a HeapFree 10851->10852 10851->10853 10852->10853 10853->10705 10854->10850 10854->10853 10857 40f80a IsBadReadPtr 10856->10857 10860 40f834 10856->10860 10858 40f81c 10857->10858 10857->10860 10859 40f822 IsBadWritePtr 10858->10859 10858->10860 10859->10860 10860->10836 10860->10838 10860->10840 10864 414e9d 10861->10864 10866 414e98 CatchIt 10861->10866 10862 4152c4 VirtualFree 10863 415351 10862->10863 10865 415375 VirtualFree HeapFree 10863->10865 10863->10866 10864->10862 10864->10866 10865->10866 10866->10854 10868 416e95 10867->10868 10869 416e78 10867->10869 10868->10851 10869->10868 10871 416c40 10869->10871 10875 416c4e 10871->10875 10872 416d93 10872->10868 10873 416c9f VirtualFree 10873->10875 10875->10872 10875->10873 10876 416bc0 VirtualFree 10875->10876 10877 416be2 10876->10877 10878 416c27 10877->10878 10879 416bf7 HeapFree 10877->10879 10878->10875 10879->10878 10881 419677 10880->10881 10882 4196a1 10881->10882 10883 40cac0 _calloc 64 API calls 10881->10883 10884 40e2e0 __malloc_dbg 64 API calls 10882->10884 10883->10881 10885 4196c9 10884->10885 10885->10654 10888 40b194 10886->10888 10894 40b1b3 _calloc 10886->10894 10887 40b218 10890 40b241 10887->10890 10891 40b349 WriteFile 10887->10891 10888->10887 10889 40b890 _calloc 2 API calls 10888->10889 10888->10894 10889->10887 10890->10894 10895 40b2d7 WriteFile 10890->10895 10892 40b37b 10891->10892 10893 40b38d GetLastError 10891->10893 10892->10894 10893->10894 10894->10652 10895->10890 10896 40b337 GetLastError 10895->10896 10896->10894 10898 40b8a1 _calloc 10897->10898 10901 40b8c0 _calloc 10897->10901 10899 40b900 SetFilePointer 10898->10899 10898->10901 10900 40b91d GetLastError 10899->10900 10899->10901 10900->10901 10901->10652 10902->10628 10904 413de6 LoadLibraryA 10903->10904 10907 40d123 10903->10907 10905 413dfa GetProcAddress 10904->10905 10904->10907 10906 413e1b GetProcAddress GetProcAddress 10905->10906 10905->10907 10906->10907 10907->10635 10908 413bb0 10907->10908 10909 413bcb ArrayUnwindFilter 10908->10909 10911 40d13c 10908->10911 10910 410340 ArrayUnwindFilter 64 API calls 10909->10910 10909->10911 10910->10911 10912 410340 10911->10912 10915 4103a0 10912->10915 10916 4103ad GetCurrentProcess TerminateProcess 10915->10916 10917 4103be ArrayUnwindFilter 10915->10917 10916->10917 10918 410459 10917->10918 10922 4100e0 10917->10922 10919 410461 ExitProcess 10918->10919 10920 41045f 10918->10920 10929 40fa80 10922->10929 10924 4100f2 10925 40cac0 _calloc 64 API calls 10924->10925 10926 410141 10924->10926 10927 41013a 10924->10927 10925->10924 10926->10918 10935 40fd10 10927->10935 10930 40fa8f 10929->10930 10934 40faba 10929->10934 10931 40cac0 _calloc 64 API calls 10930->10931 10932 40fab5 10930->10932 10931->10930 10932->10924 10933 40cac0 _calloc 64 API calls 10933->10934 10934->10932 10934->10933 10936 40fd20 10935->10936 10937 40cac0 _calloc 64 API calls 10936->10937 10938 40fd46 10936->10938 10937->10936 10939 40ff88 10938->10939 10941 40fd7c 10938->10941 10940 40cac0 _calloc 64 API calls 10939->10940 10942 40ffae 10939->10942 10940->10939 10943 40fe07 10941->10943 10945 40f800 _calloc 2 API calls 10941->10945 10964 40fdba 10941->10964 10942->10926 10944 40cac0 _calloc 64 API calls 10943->10944 10950 40fe60 10943->10950 10944->10943 10946 40fdd8 10945->10946 10947 40fe09 10946->10947 10948 40fddf 10946->10948 10947->10943 10949 40cac0 _calloc 64 API calls 10947->10949 10948->10943 10951 40cac0 _calloc 64 API calls 10948->10951 10949->10947 10952 40fe71 10950->10952 10953 40fee2 10950->10953 10951->10948 10955 40cac0 _calloc 64 API calls 10952->10955 10958 40feaf 10952->10958 10954 40feeb 10953->10954 10959 40ff28 10953->10959 10956 40cac0 _calloc 64 API calls 10954->10956 10960 40ff1a 10954->10960 10955->10952 10956->10954 10957 40cac0 _calloc 64 API calls 10957->10959 10958->10964 10966 40ffc0 10958->10966 10959->10957 10962 40ff77 10959->10962 10959->10964 10963 40ffc0 ArrayUnwindFilter 64 API calls 10960->10963 10965 40ffc0 ArrayUnwindFilter 64 API calls 10962->10965 10963->10964 10964->10926 10965->10964 10972 40ffd2 10966->10972 10967 40cac0 _calloc 64 API calls 10969 41009c 10967->10969 10969->10967 10971 4100cd 10969->10971 10971->10964 10972->10969 10973 4179c0 10972->10973 10977 4178c0 10972->10977 10974 4179d3 10973->10974 10975 4179ea 10973->10975 10974->10972 10987 419740 10975->10987 10979 4178d5 10977->10979 10978 40cac0 _calloc 64 API calls 10978->10979 10979->10978 10983 4178ff 10979->10983 10980 40cac0 _calloc 64 API calls 10980->10983 10981 417929 10982 40d380 _calloc 64 API calls 10981->10982 10984 41795f 10982->10984 10983->10980 10983->10981 10985 41797d 10984->10985 10986 414150 _calloc 64 API calls 10984->10986 10985->10972 10986->10985 10988 41976f GetStringTypeW 10987->10988 10990 419786 10987->10990 10989 419792 GetStringTypeA 10988->10989 10988->10990 10989->10990 10993 4197b7 10989->10993 10991 4197f5 10990->10991 10992 4197c7 GetStringTypeA 10990->10992 10991->10993 10995 419811 MultiByteToWideChar 10991->10995 10992->10993 10993->10974 10995->10993 10996 419845 _findenv _calloc 10995->10996 10996->10993 10997 4198a5 MultiByteToWideChar 10996->10997 10997->10993 10998 4198ce GetStringTypeW 10997->10998 10998->10993 11260 4013c0 GetProcessHeap 11261 409cf0 64 API calls 11260->11261 11262 40142c HeapAlloc 11261->11262 11263 409cf0 64 API calls 11262->11263 11264 40143a 11263->11264 11265 40144c GetProcessHeap 11264->11265 11272 401447 11264->11272 11266 409cf0 64 API calls 11265->11266 11268 401463 HeapAlloc 11266->11268 11269 409cf0 64 API calls 11268->11269 11286 401471 11269->11286 11271 409cf0 64 API calls 11274 4015d2 11271->11274 11287 401554 GetProcessHeap 11272->11287 11273 40147f LookupAccountNameA 11275 409cf0 64 API calls 11273->11275 11275->11286 11276 4014b4 GetLastError 11277 409cf0 64 API calls 11276->11277 11277->11286 11278 4014c8 GetProcessHeap 11279 409cf0 64 API calls 11278->11279 11280 4014e5 HeapReAlloc 11279->11280 11281 409cf0 64 API calls 11280->11281 11281->11286 11282 401502 GetProcessHeap 11283 409cf0 64 API calls 11282->11283 11284 40151d HeapReAlloc 11283->11284 11285 409cf0 64 API calls 11284->11285 11285->11286 11286->11272 11286->11273 11286->11276 11286->11278 11286->11282 11288 409cf0 64 API calls 11287->11288 11289 40156b HeapFree 11288->11289 11290 409cf0 64 API calls 11289->11290 11291 401579 11290->11291 11292 401552 11291->11292 11293 401587 GetProcessHeap 11291->11293 11292->11271 11294 409cf0 64 API calls 11293->11294 11295 4015a0 HeapFree 11294->11295 11296 409cf0 64 API calls 11295->11296 11296->11292 11941 401cd0 11942 401cf8 11941->11942 11947 408f60 11942->11947 11945 409cf0 64 API calls 11946 401d10 11945->11946 11948 401d03 11947->11948 11949 408f7b 11947->11949 11948->11945 11949->11948 11951 408460 11949->11951 11956 408550 11951->11956 11954 408482 11954->11948 11957 408584 11956->11957 11958 408597 11957->11958 11959 40858d 11957->11959 11975 408a40 11958->11975 11971 4085d0 11959->11971 11962 408595 11981 4097d0 11962->11981 11965 40afe0 11966 40afed 11965->11966 11968 40afef 11965->11968 11966->11954 11967 40b050 11969 40ed50 _calloc 64 API calls 11967->11969 11968->11967 11970 40cac0 _calloc 64 API calls 11968->11970 11969->11966 11970->11968 11972 4085e6 11971->11972 11974 4085e2 11971->11974 11985 40b090 11972->11985 11974->11962 11977 408a5a 11975->11977 11980 408a52 CatchIt 11975->11980 11976 408a94 11979 40b890 _calloc 2 API calls 11976->11979 11976->11980 11977->11976 11978 40b180 _calloc 6 API calls 11977->11978 11977->11980 11978->11976 11979->11980 11980->11962 11983 4097ea 11981->11983 11982 40846f 11982->11954 11982->11965 11983->11982 11984 40afe0 64 API calls 11983->11984 11984->11982 11986 40b0a0 _calloc 11985->11986 11991 40b0bf _calloc 11985->11991 11987 40b129 11986->11987 11989 40b11b CloseHandle 11986->11989 11986->11991 11992 413020 11987->11992 11989->11987 11990 40b132 GetLastError 11989->11990 11990->11987 11991->11974 11993 413033 11992->11993 11999 41308c 11992->11999 11994 413080 11993->11994 11995 41308e SetStdHandle 11993->11995 11993->11999 11996 413086 11994->11996 11997 41309a SetStdHandle 11994->11997 11995->11999 11998 4130a6 SetStdHandle 11996->11998 11996->11999 11997->11999 11998->11999 11999->11991 11297 401de0 RegCreateKeyExA 11298 409cf0 64 API calls 11297->11298 11299 401e23 _calloc 11298->11299 11300 401e30 RegSetValueExA 11299->11300 11301 409cf0 64 API calls 11300->11301 11302 401e58 RegFlushKey 11301->11302 11303 409cf0 64 API calls 11302->11303 11304 401e6e RegCloseKey 11303->11304 11305 409cf0 64 API calls 11304->11305 11306 401e81 11305->11306 11307 409cf0 64 API calls 11306->11307 11308 401e90 11307->11308 10999 405080 11000 4050ac _calloc 10999->11000 11001 40517a SHFileOperationA 11000->11001 11002 409cf0 64 API calls 11001->11002 11003 4051da 11002->11003 11004 4051f0 GetLastError 11003->11004 11005 4051e9 11003->11005 11006 409cf0 64 API calls 11004->11006 11008 409cf0 64 API calls 11005->11008 11007 4051ff wsprintfA 11006->11007 11009 409cf0 64 API calls 11007->11009 11010 405230 11008->11010 11009->11005 12204 401b90 12212 401c90 12204->12212 12217 401bf0 12204->12217 12205 401bb6 12206 409cf0 64 API calls 12205->12206 12207 401bc0 12206->12207 12208 409cf0 64 API calls 12207->12208 12209 401bd0 12208->12209 12213 407480 6 API calls 12212->12213 12214 401cb0 12213->12214 12215 409cf0 64 API calls 12214->12215 12216 401cbd 12215->12216 12216->12205 12218 401c17 12217->12218 12219 409cf0 64 API calls 12218->12219 12220 401c2b 12219->12220 12220->12205 11011 4040a0 GetComputerNameA 11012 409cf0 64 API calls 11011->11012 11013 4040dc 11012->11013 11014 409cf0 64 API calls 11013->11014 11015 4040ff 11014->11015 11309 4056ae 11310 4056bd type_info::operator!= _calloc 11309->11310 11496 40a930 11310->11496 11313 40a930 106 API calls 11314 405e20 11313->11314 11315 40a930 106 API calls 11314->11315 11316 405e2d 11315->11316 11317 40a930 106 API calls 11316->11317 11318 405e55 11317->11318 11319 40a930 106 API calls 11318->11319 11320 405e62 11319->11320 11321 40a930 106 API calls 11320->11321 11322 405e8a 11321->11322 11323 40a930 106 API calls 11322->11323 11324 405e97 FindFirstFileA 11323->11324 11325 409cf0 64 API calls 11324->11325 11326 405f12 11325->11326 11327 405f37 FindFirstFileA 11326->11327 11331 405f21 _calloc 11326->11331 11328 409cf0 64 API calls 11327->11328 11328->11331 11329 405f8b wsprintfA 11330 409cf0 64 API calls 11329->11330 11332 405fb5 CreateDirectoryA 11330->11332 11331->11329 11333 409cf0 64 API calls 11332->11333 11334 405fd4 11333->11334 11335 405ff4 wsprintfA 11334->11335 11336 409cf0 64 API calls 11335->11336 11337 406036 11336->11337 11338 406047 wsprintfA 11337->11338 11339 409cf0 64 API calls 11338->11339 11340 40608a 11339->11340 11341 40609b wsprintfA 11340->11341 11342 409cf0 64 API calls 11341->11342 11343 4060de 11342->11343 11344 4060ef wsprintfA 11343->11344 11345 409cf0 64 API calls 11344->11345 11346 406131 CreateDirectoryA 11345->11346 11347 409cf0 64 API calls 11346->11347 11348 406149 11347->11348 11349 40615a wsprintfA 11348->11349 11350 409cf0 64 API calls 11349->11350 11351 406182 CreateDirectoryA 11350->11351 11352 409cf0 64 API calls 11351->11352 11353 40619a 11352->11353 11354 4061ab wsprintfA 11353->11354 11355 409cf0 64 API calls 11354->11355 11356 4061d3 CreateDirectoryA 11355->11356 11357 409cf0 64 API calls 11356->11357 11358 4061eb 11357->11358 11359 4061fc wsprintfA 11358->11359 11360 409cf0 64 API calls 11359->11360 11361 406224 CreateDirectoryA 11360->11361 11362 409cf0 64 API calls 11361->11362 11363 40623c 11362->11363 11364 40624d wsprintfA 11363->11364 11365 409cf0 64 API calls 11364->11365 11366 406275 CreateDirectoryA 11365->11366 11367 409cf0 64 API calls 11366->11367 11368 40628d 11367->11368 11369 40629e wsprintfA 11368->11369 11370 409cf0 64 API calls 11369->11370 11371 4062c6 CreateDirectoryA 11370->11371 11372 409cf0 64 API calls 11371->11372 11373 4062de 11372->11373 11374 4062ef wsprintfA 11373->11374 11375 409cf0 64 API calls 11374->11375 11376 406332 type_info::operator!= 11375->11376 11377 40635e 11376->11377 11380 4063c7 11376->11380 11378 40636d wsprintfA 11377->11378 11379 409cf0 64 API calls 11378->11379 11383 4063b1 type_info::operator!= 11379->11383 11381 4063f7 wsprintfA 11380->11381 11382 409cf0 64 API calls 11381->11382 11387 40643c type_info::operator!= 11382->11387 11384 4065bd WritePrivateProfileStringA 11383->11384 11386 4065e2 type_info::operator!= 11383->11386 11385 409cf0 64 API calls 11384->11385 11385->11386 11388 40660a WritePrivateProfileStringA 11386->11388 11394 40666a type_info::operator!= 11386->11394 11389 4064c6 type_info::operator!= 11387->11389 11390 40648b CopyFileA 11387->11390 11391 409cf0 64 API calls 11388->11391 11389->11383 11395 4064e0 wsprintfA 11389->11395 11392 409cf0 64 API calls 11390->11392 11393 40662f type_info::operator!= 11391->11393 11417 4064a8 11392->11417 11393->11394 11398 406645 WritePrivateProfileStringA 11393->11398 11396 406692 WritePrivateProfileStringA 11394->11396 11403 4066b7 type_info::operator!= 11394->11403 11397 409cf0 64 API calls 11395->11397 11400 409cf0 64 API calls 11396->11400 11401 40650a CopyFileA 11397->11401 11399 409cf0 64 API calls 11398->11399 11399->11394 11400->11403 11402 409cf0 64 API calls 11401->11402 11405 406529 11402->11405 11404 4066df WritePrivateProfileStringA 11403->11404 11410 406729 type_info::operator!= 11403->11410 11406 409cf0 64 API calls 11404->11406 11407 40654e WritePrivateProfileStringA 11405->11407 11408 406704 WritePrivateProfileStringA 11406->11408 11411 409cf0 64 API calls 11407->11411 11409 409cf0 64 API calls 11408->11409 11409->11410 11412 406751 WritePrivateProfileStringA 11410->11412 11416 40679b type_info::operator!= 11410->11416 11411->11417 11413 409cf0 64 API calls 11412->11413 11414 406776 WritePrivateProfileStringA 11413->11414 11415 409cf0 64 API calls 11414->11415 11415->11416 11418 4067c3 WritePrivateProfileStringA 11416->11418 11419 40680d 11416->11419 11417->11383 11420 409cf0 64 API calls 11418->11420 11509 40a8a0 11419->11509 11421 4067e8 WritePrivateProfileStringA 11420->11421 11422 409cf0 64 API calls 11421->11422 11422->11419 11425 406835 WritePrivateProfileStringA 11427 409cf0 64 API calls 11425->11427 11426 40685c WritePrivateProfileStringA 11428 409cf0 64 API calls 11426->11428 11429 40685a 11427->11429 11428->11429 11430 406890 WritePrivateProfileStringA 11429->11430 11431 409cf0 64 API calls 11430->11431 11432 4068b8 wsprintfA 11431->11432 11433 409cf0 64 API calls 11432->11433 11434 4068f7 11433->11434 11435 40696f DeleteFileA 11434->11435 11439 406900 type_info::operator!= 11434->11439 11436 409cf0 64 API calls 11435->11436 11437 406983 DeleteFileA 11436->11437 11438 409cf0 64 API calls 11437->11438 11440 406997 DeleteFileA 11438->11440 11442 406959 DeleteFileA 11439->11442 11443 40691b DeleteFileA 11439->11443 11441 409cf0 64 API calls 11440->11441 11453 406957 11441->11453 11444 409cf0 64 API calls 11442->11444 11445 409cf0 64 API calls 11443->11445 11446 40696d 11444->11446 11447 40692f DeleteFileA 11445->11447 11449 40a8a0 16 API calls 11446->11449 11448 409cf0 64 API calls 11447->11448 11450 406943 DeleteFileA 11448->11450 11455 4069dc 11449->11455 11451 409cf0 64 API calls 11450->11451 11451->11453 11452 406a01 11454 40a930 106 API calls 11452->11454 11453->11446 11456 406a22 11454->11456 11455->11452 11457 40a930 106 API calls 11455->11457 11458 40a930 106 API calls 11456->11458 11457->11452 11459 406a41 11458->11459 11460 40a930 106 API calls 11459->11460 11461 406a60 11460->11461 11462 40a930 106 API calls 11461->11462 11463 406a6d 11462->11463 11464 40a930 106 API calls 11463->11464 11465 406a7a 11464->11465 11466 40a930 106 API calls 11465->11466 11467 406a87 11466->11467 11468 40a930 106 API calls 11467->11468 11469 406a94 11468->11469 11470 40a930 106 API calls 11469->11470 11471 406aa1 11470->11471 11472 40a930 106 API calls 11471->11472 11473 406aae 11472->11473 11474 40a930 106 API calls 11473->11474 11475 406abb 11474->11475 11476 40a930 106 API calls 11475->11476 11477 406ac8 11476->11477 11478 40a930 106 API calls 11477->11478 11479 406ad5 11478->11479 11480 40a930 106 API calls 11479->11480 11481 406ae2 11480->11481 11482 40a930 106 API calls 11481->11482 11483 406aef 11482->11483 11484 40a930 106 API calls 11483->11484 11485 406afc 11484->11485 11486 40a930 106 API calls 11485->11486 11487 406b09 11486->11487 11488 40a930 106 API calls 11487->11488 11489 406b16 11488->11489 11490 40a8a0 16 API calls 11489->11490 11493 406b28 11490->11493 11491 406b4b 11492 409cf0 64 API calls 11491->11492 11494 406b6a 11492->11494 11493->11491 11495 40a930 106 API calls 11493->11495 11495->11491 11513 411a60 11496->11513 11499 40a97c 11501 40a986 11499->11501 11503 40a9aa 11499->11503 11500 40a94f 11508 405e13 11500->11508 11538 411a00 GetFileAttributesA 11500->11538 11501->11499 11502 40cac0 _calloc 64 API calls 11501->11502 11502->11501 11505 40a9d5 11503->11505 11519 411790 11503->11519 11505->11508 11541 4114b0 11505->11541 11508->11313 11510 40682e 11509->11510 11511 40a8f3 11509->11511 11510->11425 11510->11426 11511->11510 11512 411380 16 API calls 11511->11512 11512->11511 11514 40a943 11513->11514 11515 411a7e 11513->11515 11514->11499 11514->11500 11517 411a92 _calloc 11515->11517 11567 418a40 11515->11567 11517->11514 11563 4189f0 11517->11563 11520 4117a7 _calloc 11519->11520 11524 40e2e0 __malloc_dbg 64 API calls 11520->11524 11526 411802 _calloc 11520->11526 11521 411874 11523 411a00 2 API calls 11521->11523 11522 4118a7 _calloc 11527 40e2e0 __malloc_dbg 64 API calls 11522->11527 11525 41187f 11523->11525 11524->11526 11530 41189c 11525->11530 11711 411990 11525->11711 11526->11521 11526->11522 11532 41180e 11526->11532 11528 4118c8 _calloc 11527->11528 11528->11532 11533 411957 11528->11533 11535 411a00 2 API calls 11528->11535 11536 411942 11528->11536 11531 40ed50 _calloc 64 API calls 11530->11531 11530->11532 11531->11532 11532->11505 11534 40ed50 _calloc 64 API calls 11533->11534 11534->11530 11535->11528 11537 411990 81 API calls 11536->11537 11537->11533 11539 411a17 GetLastError 11538->11539 11540 411a23 _calloc 11538->11540 11539->11540 11540->11508 11542 4114c0 11541->11542 11543 40cac0 _calloc 64 API calls 11542->11543 11544 4114ea 11542->11544 11543->11542 11545 40cac0 _calloc 64 API calls 11544->11545 11546 411518 11544->11546 11545->11544 11547 411542 11546->11547 11548 40cac0 _calloc 64 API calls 11546->11548 11549 40cac0 _calloc 64 API calls 11547->11549 11550 41156e 11547->11550 11548->11546 11549->11547 11551 40cac0 _calloc 64 API calls 11550->11551 11552 41159e 11550->11552 11551->11550 11553 411790 83 API calls 11552->11553 11557 4115b3 11553->11557 11554 41160f 11555 411780 11554->11555 11556 40ed50 _calloc 64 API calls 11554->11556 11555->11508 11556->11555 11557->11554 11558 411a60 87 API calls 11557->11558 11559 4115e4 11558->11559 11559->11554 11560 40e2e0 __malloc_dbg 64 API calls 11559->11560 11561 411603 _calloc 11560->11561 11561->11554 11562 411790 83 API calls 11561->11562 11562->11561 11564 4189fe 11563->11564 11566 4189fa 11563->11566 11574 4199d0 11564->11574 11566->11517 11570 418a4e 11567->11570 11568 418a7d 11568->11517 11569 418a5a WideCharToMultiByte 11569->11568 11569->11570 11570->11568 11570->11569 11571 40e2e0 __malloc_dbg 64 API calls 11570->11571 11572 418aa5 WideCharToMultiByte 11570->11572 11593 419e20 11570->11593 11571->11570 11572->11568 11572->11570 11575 4199ff CompareStringW 11574->11575 11577 419a1b _findenv 11574->11577 11576 419a27 CompareStringA 11575->11576 11575->11577 11576->11577 11589 419a4f 11576->11589 11578 419a91 CompareStringA 11577->11578 11579 419ab4 11577->11579 11578->11589 11580 419c5c MultiByteToWideChar 11579->11580 11581 419b12 GetCPInfo 11579->11581 11579->11589 11583 419c84 _findenv 11580->11583 11580->11589 11582 419b2b 11581->11582 11581->11589 11584 419b43 11582->11584 11587 419b6a 11582->11587 11585 419cd3 MultiByteToWideChar 11583->11585 11583->11589 11584->11582 11586 40cac0 _calloc 64 API calls 11584->11586 11588 419cfa MultiByteToWideChar 11585->11588 11585->11589 11586->11584 11587->11580 11587->11589 11588->11589 11590 419d22 _findenv 11588->11590 11589->11566 11590->11589 11591 419d6e MultiByteToWideChar 11590->11591 11591->11589 11592 419d92 CompareStringW 11591->11592 11592->11589 11594 419e2d 11593->11594 11617 419e4c 11593->11617 11595 419e7d 11594->11595 11594->11617 11618 41a180 11594->11618 11598 419ea1 11595->11598 11602 419eb7 11595->11602 11610 419ea6 11595->11610 11603 418a40 86 API calls 11598->11603 11599 41a001 11607 40e780 _calloc 72 API calls 11599->11607 11599->11617 11601 419ee0 11606 40e2e0 __malloc_dbg 64 API calls 11601->11606 11601->11610 11601->11617 11602->11601 11605 40e2e0 __malloc_dbg 64 API calls 11602->11605 11602->11617 11603->11610 11604 419f7a 11608 40ed50 _calloc 64 API calls 11604->11608 11611 419fdc _calloc 11604->11611 11605->11601 11606->11610 11607->11611 11609 419f91 11608->11609 11630 40e780 11609->11630 11610->11617 11626 41a100 11610->11626 11613 40e2e0 __malloc_dbg 64 API calls 11611->11613 11611->11617 11614 41a09b _calloc 11613->11614 11615 41a0b4 SetEnvironmentVariableA 11614->11615 11614->11617 11616 40ed50 _calloc 64 API calls 11615->11616 11616->11617 11617->11570 11619 41a1a0 11618->11619 11620 41a199 11618->11620 11621 40e2e0 __malloc_dbg 64 API calls 11619->11621 11620->11595 11622 41a1d9 11621->11622 11623 40ac30 67 API calls 11622->11623 11625 41a1f2 _calloc 11622->11625 11623->11625 11624 40e2e0 __malloc_dbg 64 API calls 11624->11625 11625->11620 11625->11624 11629 41a10e 11626->11629 11627 419f5e 11627->11599 11627->11604 11628 4189f0 _findenv 73 API calls 11628->11629 11629->11627 11629->11628 11633 40e7b0 11630->11633 11634 40e7e3 11633->11634 11635 40e7c6 11633->11635 11638 40e7ef 11634->11638 11641 40e806 11634->11641 11636 40e2e0 __malloc_dbg 64 API calls 11635->11636 11653 40e79f 11636->11653 11637 40e842 11643 40e8dc 11637->11643 11644 40e87e 11637->11644 11640 40ed50 _calloc 64 API calls 11638->11640 11639 40f410 _calloc 64 API calls 11639->11641 11640->11653 11641->11637 11641->11639 11642 40cac0 _calloc 64 API calls 11641->11642 11642->11641 11647 40e8e2 11643->11647 11652 40e90e 11643->11652 11645 40e884 11644->11645 11646 40e8af 11644->11646 11648 40cac0 _calloc 64 API calls 11645->11648 11645->11653 11649 40cac0 _calloc 64 API calls 11646->11649 11646->11653 11650 40cac0 _calloc 64 API calls 11647->11650 11647->11653 11648->11645 11649->11646 11650->11647 11651 40f850 _calloc 5 API calls 11655 40e956 11651->11655 11654 40cac0 _calloc 64 API calls 11652->11654 11652->11655 11653->11611 11654->11652 11655->11651 11656 40e98d 11655->11656 11657 40cac0 _calloc 64 API calls 11655->11657 11658 40e9ac 11656->11658 11662 40e9ea 11656->11662 11657->11655 11659 40cac0 _calloc 64 API calls 11658->11659 11661 40e9e8 11658->11661 11659->11658 11660 40cac0 _calloc 64 API calls 11660->11662 11663 40ea54 11661->11663 11664 40ea79 11661->11664 11662->11660 11662->11661 11673 414710 11663->11673 11694 414590 11664->11694 11667 40ea64 _calloc 11667->11653 11668 40cac0 _calloc 64 API calls 11667->11668 11670 40ebbd 11667->11670 11668->11667 11669 40cac0 _calloc 64 API calls 11669->11670 11670->11653 11670->11669 11672 40ebdb 11670->11672 11671 40cac0 _calloc 64 API calls 11671->11672 11672->11653 11672->11671 11674 414733 11673->11674 11675 414722 11673->11675 11677 414739 11674->11677 11678 41474c 11674->11678 11704 414430 11675->11704 11680 412ce0 _calloc 9 API calls 11677->11680 11681 414908 11678->11681 11691 414759 __nh_malloc _calloc 11678->11691 11679 41472b 11679->11667 11680->11679 11683 414ab9 __nh_malloc 11681->11683 11692 414915 __nh_malloc _calloc 11681->11692 11682 414ad3 HeapReAlloc 11682->11683 11683->11679 11683->11682 11684 4148af HeapReAlloc 11684->11691 11685 414a6f HeapReAlloc 11685->11692 11686 41482f HeapAlloc 11686->11691 11687 414a06 HeapAlloc 11687->11692 11688 415420 __nh_malloc 5 API calls 11688->11691 11689 416ea0 __nh_malloc 6 API calls 11689->11692 11690 414e40 VirtualFree VirtualFree HeapFree _calloc 11690->11691 11691->11679 11691->11684 11691->11686 11691->11688 11691->11690 11692->11679 11692->11685 11692->11687 11692->11689 11693 416e30 VirtualFree HeapFree VirtualFree _calloc 11692->11693 11693->11692 11695 4145a3 11694->11695 11702 41459c _calloc 11694->11702 11696 414631 11695->11696 11699 4145b0 _calloc 11695->11699 11697 4146d2 HeapReAlloc 11696->11697 11700 41463e _calloc 11696->11700 11697->11702 11701 414608 HeapReAlloc 11699->11701 11699->11702 11700->11702 11703 4146b6 HeapReAlloc 11700->11703 11701->11702 11702->11667 11703->11702 11707 414450 11704->11707 11708 414443 11707->11708 11710 41445e __nh_malloc 11707->11710 11708->11679 11709 4144b0 __nh_malloc 13 API calls 11709->11710 11710->11708 11710->11709 11720 418630 11711->11720 11715 4119d1 11716 40ed50 _calloc 64 API calls 11715->11716 11717 4119e2 11716->11717 11718 40ed50 _calloc 64 API calls 11717->11718 11719 4119b7 11718->11719 11719->11530 11721 418645 _calloc 11720->11721 11722 40e2e0 __malloc_dbg 64 API calls 11721->11722 11725 41868e _calloc 11722->11725 11723 4119af 11723->11719 11733 4182d0 11723->11733 11724 4123a0 74 API calls 11730 418732 _calloc 11724->11730 11725->11723 11725->11724 11725->11730 11732 418716 _calloc 11725->11732 11726 40e2e0 __malloc_dbg 64 API calls 11728 41881f 11726->11728 11727 40ed50 _calloc 64 API calls 11727->11723 11729 41882f 11728->11729 11728->11732 11731 40ed50 _calloc 64 API calls 11729->11731 11730->11723 11730->11726 11731->11723 11732->11727 11734 418326 _calloc 11733->11734 11736 418305 _calloc 11733->11736 11734->11715 11748 40e6f0 11736->11748 11738 40ed50 _calloc 64 API calls 11739 418593 11738->11739 11739->11734 11740 4185bd 11739->11740 11742 410340 ArrayUnwindFilter 64 API calls 11739->11742 11743 4185c3 WaitForSingleObject GetExitCodeProcess CloseHandle 11740->11743 11744 4185e9 11740->11744 11742->11740 11745 418608 CloseHandle 11743->11745 11746 418602 11744->11746 11747 4185ef CloseHandle 11744->11747 11745->11734 11746->11745 11747->11745 11749 40e2e0 __malloc_dbg 64 API calls 11748->11749 11750 40e715 CreateProcessA GetLastError 11749->11750 11750->11738 12000 4052b0 FindWindowA 12001 409cf0 64 API calls 12000->12001 12002 4052e9 PostMessageA 12001->12002 12003 409cf0 64 API calls 12002->12003 12004 4052f7 FindWindowA 12003->12004 12005 409cf0 64 API calls 12004->12005 12006 405318 PostMessageA 12005->12006 12007 409cf0 64 API calls 12006->12007 12008 405326 FindWindowA 12007->12008 12009 409cf0 64 API calls 12008->12009 12010 405347 PostMessageA 12009->12010 12011 409cf0 64 API calls 12010->12011 12012 405355 FindWindowA 12011->12012 12013 409cf0 64 API calls 12012->12013 12014 405376 PostMessageA 12013->12014 12015 409cf0 64 API calls 12014->12015 12016 405384 FindWindowA 12015->12016 12017 409cf0 64 API calls 12016->12017 12018 4053a5 PostMessageA 12017->12018 12019 409cf0 64 API calls 12018->12019 12020 4053b3 FindWindowA 12019->12020 12021 409cf0 64 API calls 12020->12021 12022 4053d4 PostMessageA 12021->12022 12023 409cf0 64 API calls 12022->12023 12024 4053e2 FindWindowA 12023->12024 12025 409cf0 64 API calls 12024->12025 12026 405403 PostMessageA 12025->12026 12027 409cf0 64 API calls 12026->12027 12028 405411 FindWindowA 12027->12028 12029 409cf0 64 API calls 12028->12029 12030 405432 PostMessageA 12029->12030 12031 409cf0 64 API calls 12030->12031 12032 405440 12031->12032 12033 409cf0 64 API calls 12032->12033 12034 40544f 12033->12034 12221 4011b0 wsprintfA 12222 409cf0 64 API calls 12221->12222 12223 401218 wsprintfW 12222->12223 12224 409cf0 64 API calls 12223->12224 12226 40123a 12224->12226 12225 401261 12228 409cf0 64 API calls 12225->12228 12226->12225 12227 4012e6 GetLastError 12226->12227 12230 40129b 12226->12230 12229 409cf0 64 API calls 12227->12229 12231 401353 12228->12231 12229->12230 12232 401303 LsaClose 12230->12232 12232->12225 12233 401315 GetProcessHeap 12232->12233 12234 409cf0 64 API calls 12233->12234 12235 40132f HeapFree 12234->12235 12236 409cf0 64 API calls 12235->12236 12236->12225 12237 4017b0 12238 4017d5 _calloc 12237->12238 12239 4017fd LsaOpenPolicy 12238->12239 12240 409cf0 64 API calls 12239->12240 12241 40181f 12240->12241

                  Executed Functions

                  Function 00405630 Relevance: 260.4, APIs: 48, Strings: 100, Instructions: 1350fileCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 0 405630-4056c6 call 40aad0 GetSystemInfo call 409cf0 6 405d29-405d3d call 40aa40 0->6 7 4056cc-4056e8 call 40a820 0->7 12 405d51-405d65 call 40aa40 6->12 13 405d3f-405d4e call 40a5c0 6->13 14 405757-405773 call 40a820 7->14 15 4056ea-4056fb 7->15 26 405d67-405d76 call 40a5c0 12->26 27 405d79-405d8d call 40aa40 12->27 13->12 24 4057e2-4057fe call 40a820 14->24 25 405775-405786 14->25 18 40570c-405727 call 40a540 15->18 32 405752 18->32 33 405729-405750 18->33 42 405800-405811 24->42 43 40586d-405889 call 40a820 24->43 29 405797-4057b2 call 40a540 25->29 26->27 44 405da1-405f1f call 40101e call 401028 call 40a930 * 3 call 401078 call 40a930 * 2 call 401041 call 40a930 * 2 FindFirstFileA call 409cf0 27->44 45 405d8f-405d9e call 40a5c0 27->45 49 4057b4-4057db 29->49 50 4057dd 29->50 39 405d24 32->39 33->18 39->6 51 405822-40583d call 40a540 42->51 57 4058f8-405914 call 40a820 43->57 58 40588b-40589c 43->58 171 405f21-405f35 call 40a5c0 44->171 172 405f37-405f4d FindFirstFileA call 409cf0 44->172 45->44 49->29 50->39 61 405868 51->61 62 40583f-405866 51->62 72 405983-40599f call 40a820 57->72 73 405916-405927 57->73 63 4058ad-4058c8 call 40a540 58->63 61->39 62->51 77 4058f3 63->77 78 4058ca-4058f1 63->78 84 4059a1-4059b2 72->84 85 405a0e-405a2a call 40a820 72->85 74 405938-405953 call 40a540 73->74 88 405955-40597c 74->88 89 40597e 74->89 77->39 78->63 90 4059c3-4059de call 40a540 84->90 96 405a99-405ab5 call 40a820 85->96 97 405a2c-405a3d 85->97 88->74 89->39 102 4059e0-405a07 90->102 103 405a09 90->103 111 405b24-405b40 call 40a820 96->111 112 405ab7-405ac8 96->112 100 405a4e-405a69 call 40a540 97->100 115 405a94 100->115 116 405a6b-405a92 100->116 102->90 103->39 124 405b42-405b53 111->124 125 405baf-405bcb call 40a820 111->125 117 405ad9-405af4 call 40a540 112->117 115->39 116->100 126 405af6-405b1d 117->126 127 405b1f 117->127 129 405b64-405b7f call 40a540 124->129 135 405c3a-405c56 call 40a820 125->135 136 405bcd-405bde 125->136 126->117 127->39 142 405b81-405ba8 129->142 143 405baa 129->143 150 405cc2-405cde call 40a820 135->150 151 405c58-405c69 135->151 139 405bef-405c0a call 40a540 136->139 153 405c35 139->153 154 405c0c-405c33 139->154 142->129 143->39 150->39 161 405ce0-405cfc call 40a820 150->161 156 405c7a-405c95 call 40a540 151->156 153->39 154->139 164 405cc0 156->164 165 405c97-405cbe 156->165 173 405d12-405d21 call 40a5c0 161->173 174 405cfe-405d10 call 40a5c0 161->174 164->39 165->156 183 405f8b-40635c wsprintfA call 409cf0 CreateDirectoryA call 409cf0 call 40100a wsprintfA call 409cf0 call 40100a wsprintfA call 409cf0 call 40100a wsprintfA call 409cf0 call 40100a wsprintfA call 409cf0 CreateDirectoryA call 409cf0 call 40100a wsprintfA call 409cf0 CreateDirectoryA call 409cf0 call 40100a wsprintfA call 409cf0 CreateDirectoryA call 409cf0 call 40100a wsprintfA call 409cf0 CreateDirectoryA call 409cf0 call 40100a wsprintfA call 409cf0 CreateDirectoryA call 409cf0 call 40100a wsprintfA call 409cf0 CreateDirectoryA call 409cf0 call 40100a wsprintfA call 409cf0 call 4010aa call 40aa40 171->183 180 405f52-405f5f 172->180 173->39 174->39 184 405f61-405f75 call 40a5c0 180->184 185 405f77-405f88 call 40a5c0 180->185 251 4063c7-406489 call 401050 call 40100a call 401064 call 40100a wsprintfA call 409cf0 call 4010b9 call 40100a call 40aa40 183->251 252 40635e-4063ba call 40100a wsprintfA call 409cf0 call 4010b9 183->252 184->183 185->183 291 4064c6-4064da call 40aa40 251->291 292 40648b-4064c1 CopyFileA call 409cf0 call 40100a call 40102d 251->292 263 4063bf-4063c2 252->263 265 406595-4065bb call 40100a call 40aa40 263->265 275 4065e2-406608 call 40100a call 40aa40 265->275 276 4065bd-4065dd WritePrivateProfileStringA call 409cf0 265->276 288 40666a-406690 call 40100a call 40aa40 275->288 289 40660a-406643 WritePrivateProfileStringA call 409cf0 call 40aa40 275->289 276->275 306 406692-4066b2 WritePrivateProfileStringA call 409cf0 288->306 307 4066b7-4066dd call 40100a call 40aa40 288->307 289->288 310 406645-406665 WritePrivateProfileStringA call 409cf0 289->310 291->265 304 4064e0-406592 wsprintfA call 409cf0 CopyFileA call 409cf0 call 40100a * 2 WritePrivateProfileStringA call 409cf0 call 4010cd call 4010d2 call 4010be 291->304 292->265 304->265 306->307 324 406729-40674f call 40100a call 40aa40 307->324 325 4066df-406724 WritePrivateProfileStringA call 409cf0 WritePrivateProfileStringA call 409cf0 307->325 310->288 337 406751-406796 WritePrivateProfileStringA call 409cf0 WritePrivateProfileStringA call 409cf0 324->337 338 40679b-4067c1 call 40100a call 40aa40 324->338 325->324 337->338 352 4067c3-406808 WritePrivateProfileStringA call 409cf0 WritePrivateProfileStringA call 409cf0 338->352 353 40680d-406833 call 40100a call 40a8a0 338->353 352->353 361 406835-40685a WritePrivateProfileStringA call 409cf0 353->361 362 40685c-40687c WritePrivateProfileStringA call 409cf0 353->362 366 406881-4068fe call 40100a WritePrivateProfileStringA call 409cf0 wsprintfA call 409cf0 361->366 362->366 373 406900-406919 call 4010b4 call 40aa40 366->373 374 40696f-4069ab DeleteFileA call 409cf0 DeleteFileA call 409cf0 DeleteFileA call 409cf0 call 4010b4 366->374 384 406959-406968 DeleteFileA call 409cf0 373->384 385 40691b-406957 DeleteFileA call 409cf0 DeleteFileA call 409cf0 DeleteFileA call 409cf0 373->385 392 4069b0-4069e1 call 40a8a0 374->392 389 40696d 384->389 385->389 389->392 398 4069e3-406a15 call 40100a call 40a930 call 40100a 392->398 399 406a18-406b11 call 40a930 call 40100a call 40a930 call 40100a call 40a930 * 15 392->399 398->399 444 406b16-406b2d call 40a8a0 399->444 447 406b4e-406b6d call 409cf0 444->447 448 406b2f-406b4b call 40100a call 40a930 444->448 448->447
                  APIs
                  • GetSystemInfo.KERNELBASE(?,?,?,?,?,?,004201C0,000000FF), ref: 00405671
                  • FindFirstFileA.KERNELBASE(C:\Program Files (x86)\SAM_10\SamPrinting.exe,?), ref: 00405F05
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: FileFindFirstInfoSystem
                  • String ID: %SystemRoot%\system32\PrintUI.exe /dl /n "Fax" /q$%SystemRoot%\system32\PrintUI.exe /dl /n "Send To OneNote 2013" /q$%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11" /t /e /g Users:f$%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Computers" /t /e /g Everyone:f$%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Configuration" /t /e /g Users:f$%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Jobs" /t /e /g Everyone:f$%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Languages" /t /e /g Users:f$%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Themes" /t /e /g Everyone:f$%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Update" /t /e /g Everyone:f$%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\Users" /t /e /g Everyone:f$%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\images" /t /e /g Users:f$%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\logs" /t /e /g Everyone:f$%SystemRoot%\system32\cacls "C:\Program Files (x86)\SAM 11\tmpDownload" /t /e /g Everyone:f$%SystemRoot%\system32\cacls "C:\Windows\System32\spool\PRINTERS" /t /e /g Everyone:f$%SystemRoot%\system32\net.exe START SPOOLER$%SystemRoot%\system32\net.exe Stop SPOOLER$%SystemRoot%\system32\netsh advfirewall firewall add rule name="SAM Rule In" dir=in action=allow protocol=TCP localport=2002$%SystemRoot%\system32\netsh advfirewall firewall add rule name="SAM Rule Out" dir=out action=allow protocol=TCP localport=2002$%SystemRoot%\system32\reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$%SystemRoot%\system32\reg ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0x0 /f$%SystemRoot%\system32\rundll32 printui.dll,PrintUIEntry /if /b "Smart Solution Printer" /r "SAMPrinterPort" /m "Microsoft XPS Document Writer v4"$%s %s$%s\*.*$%s\Clntinfo.ini$%s\Computers$%s\Jobs$%s\SamClient11.exe$%s\SamPrintManager.exe$%s\Themes$%s\Themes\Themes.ini$%s\Update$%s\Users$%s\logs$%s\rootcnf.ini$%s_%s\clntinfo.ini$11.0.104$443$After Installing PDF driver$AnyTown$BookingAddress$BookingCustomer$BookingID$BookingLocID$Branch$C:\Program Files (x86)\SAM$C:\Program Files (x86)\SAM 11\SetEdgePolicies.reg$C:\Program Files (x86)\SAM_10\SamClient10.exe$C:\Program Files (x86)\SAM_10\SamPrinting.exe$C:\Program Files (x86)\SAM_10\SamStarter.exe$C:\Program Files\SAM$C:\Program Files\SAM_10\SamPrinting.exe$C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SamStart.lnk$C:\Sam\SCClient.exe$C:\Sam\clntinfo.ini$CopyFile C:\Sam\clntinfo.ini$CopyFile NEW INSTALL$CopyFile fromPath$CopyFile newINIFile$CreateDirectory$CurrentVersion$Firewall Inbound rule$Firewall Outbound rule$Installation$Installing PDF Driver.$IsPDFEnabled$Location$Machine$Machine$Name$New install so no copy config file$NewVersion$PDFDriver$Port$Reboot$Rebooting PC$RootObject$SBAddress$SBCustomer$SBID$Sam Print manager Deleted$Sam Print manager Installed$Sam Print manager Stopped$SamServer$Settings$TCP port 2002$Upgrade$UseSSL$User$VersionNumber$WebServer$Yes$isPDFEnabled$net localgroup administrators Comprise /add$net localgroup users Comprise /add$net user /add Comprise S@mtwo345$newINIFile$newRootObjectINIFile$newThemeINIFile$newversionpath$shutdown /r /f
                  • API String ID: 3644953116-4251652345
                  • Opcode ID: cfa50498d8dafe05846f5539c0c319857479c49e948f077b16e141aba44236d6
                  • Instruction ID: ff4dfdd032401efb29f7c9df041ca6dec3ffe2b2ce6d46d6877df69f8b0b2e70
                  • Opcode Fuzzy Hash: cfa50498d8dafe05846f5539c0c319857479c49e948f077b16e141aba44236d6
                  • Instruction Fuzzy Hash: F2B2C371E00214ABDB20EF50DC42B99B770AB58709F1441ABF809772C2DA7D6F94CF9A
                  Function 00403540 Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 144registryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  APIs
                  • GetSystemInfo.KERNELBASE(?), ref: 00403564
                  • RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon,00000000,000F013F,?), ref: 004035E3
                  • RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon,00000000,000F003F,?), ref: 00403612
                  • GetLastError.KERNEL32 ref: 00403632
                  • wsprintfA.USER32 ref: 0040364E
                  • RegSetValueExA.KERNELBASE(?,Userinit,00000000,00000001,?,-00000001), ref: 0040369E
                  • GetLastError.KERNEL32 ref: 004036BE
                  • wsprintfA.USER32 ref: 004036DA
                  • RegFlushKey.ADVAPI32(?), ref: 00403707
                  • RegCloseKey.KERNELBASE(?), ref: 0040371D
                  Strings
                  • RegSetValueEx Error:%d, xrefs: 004036CE
                  • SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, xrefs: 004035D9, 00403608
                  • Userinit, xrefs: 00403692
                  • Error RegSetValueEx, xrefs: 004036EA
                  • C:\Program Files (x86)\SAM 11\SamClient11.exe, C:\Windows\system32\userinit.exe,, xrefs: 004035AC
                  • MakeRegStartUp Error:%d, xrefs: 00403642
                  • Error RegCreateKeyEx, xrefs: 0040365E
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: ErrorLastOpenwsprintf$CloseFlushInfoSystemValue
                  • String ID: C:\Program Files (x86)\SAM 11\SamClient11.exe, C:\Windows\system32\userinit.exe,$Error RegCreateKeyEx$Error RegSetValueEx$MakeRegStartUp Error:%d$RegSetValueEx Error:%d$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon$Userinit
                  • API String ID: 2911293276-3958806321
                  • Opcode ID: 21ae8aa44c6e7f398c176a6d5b10041ce40eae9b11838bec9c2bc297f3ac8004
                  • Instruction ID: bfc3640c29b09f1aa98e81f1e1a8ef9315a59d9100fd7683860783b2ff78966d
                  • Opcode Fuzzy Hash: 21ae8aa44c6e7f398c176a6d5b10041ce40eae9b11838bec9c2bc297f3ac8004
                  • Instruction Fuzzy Hash: 5941E572D001246BD720BB64AD9BBDD7668AB08704F4001BAFD0A73182DA7D5F84CFDA
                  Function 004011B0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 118memoryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: Heapwsprintf$CloseFreeProcess
                  • String ID: %hS$%hS$GetAccountSid$OpenPolicy$SeServiceLogonRight$SetPrivilegeOnAccount
                  • API String ID: 2396970130-164264487
                  • Opcode ID: fe03aa7d0421c154b3acceeb339ff7fe906dd8bee2cad8bff05fe7d535670083
                  • Instruction ID: 55cd151614e0701a38516d51086b2348b5a53a4882c576b566f8e549c05a479a
                  • Opcode Fuzzy Hash: fe03aa7d0421c154b3acceeb339ff7fe906dd8bee2cad8bff05fe7d535670083
                  • Instruction Fuzzy Hash: 9E41F971D00218ABDB24EBA4DC56BDD7378AB44700F4041AAFA09772D2D67D5F84CF9A
                  Function 00404F10 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 97serviceCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  APIs
                  • OpenSCManagerA.SECHOST(00000000,00000000,00000002), ref: 00404F38
                  • CreateServiceA.ADVAPI32(00000000,SamClientManager,Sam Client Remote Manager,000F01FF,00000110,00000002,00000001,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00404F8A
                  • StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00404FE5
                  • CloseServiceHandle.ADVAPI32(00000000), ref: 00404FF8
                  • CloseServiceHandle.ADVAPI32(00000000), ref: 0040500B
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: Service$CloseHandle$CreateManagerOpenStart
                  • String ID: .\Comprise$S@mtwo345$Sam Client Remote Manager$SamClientManager
                  • API String ID: 1113237811-3835709777
                  • Opcode ID: 09c603895fb43a380bab46ffba85c61fa4d57374b1689534caaeccf815a8d1b7
                  • Instruction ID: 0d40bcfabe4f4d2828494bf431fdebbd6f387a614428cb640e6d966fb4616ee6
                  • Opcode Fuzzy Hash: 09c603895fb43a380bab46ffba85c61fa4d57374b1689534caaeccf815a8d1b7
                  • Instruction Fuzzy Hash: A031AE31E402187FE720BBA89C97F9E7761AB04B10F40452AFA157B2C2C6F95D4087DA
                  Function 004013C0 Relevance: 15.1, APIs: 10, Instructions: 140memoryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  APIs
                  • GetProcessHeap.KERNEL32(00000000,00000080), ref: 0040141F
                  • HeapAlloc.KERNEL32(00000000), ref: 0040142D
                  • GetProcessHeap.KERNEL32(00000000,00000010), ref: 00401456
                  • HeapAlloc.KERNEL32(00000000), ref: 00401464
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: Heap$AllocProcess
                  • String ID:
                  • API String ID: 1617791916-0
                  • Opcode ID: 9e924a0e68a894527a2a2e2e026ea38c7810f9f8e987dacf47d0a4304638d57a
                  • Instruction ID: a864fd682cee180a14d714d020cbc3f9b169fae78e198f1722fe0aa3d20ff815
                  • Opcode Fuzzy Hash: 9e924a0e68a894527a2a2e2e026ea38c7810f9f8e987dacf47d0a4304638d57a
                  • Instruction Fuzzy Hash: 93519171D002059FDB10EF98D895B9E73B6AB48714F50412AF816BB2D1CB3CAD41CBDA
                  Function 00401970 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 113timeCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: wsprintf$LocalTime
                  • String ID: %d:%d:%d$%s\logs\SAMUpgradeLog%d%d%d.txt$C:\Program Files (x86)\SAM 11$o6@$o6@
                  • API String ID: 4235281863-1535024359
                  • Opcode ID: f173680818ef91d06525104d87e8b696fbe7d1569a53882c1d57560155ec3848
                  • Instruction ID: 542fc5baf9b30b8471fff50b1d68515e00102217f00eb99e8bb5b602bb49b9df
                  • Opcode Fuzzy Hash: f173680818ef91d06525104d87e8b696fbe7d1569a53882c1d57560155ec3848
                  • Instruction Fuzzy Hash: B041C872E042186BDB24EB24CC53BEA7775DF45704F0042FAB609772C2CA796E54CB9A
                  Function 0040AB00 Relevance: 3.1, APIs: 2, Instructions: 72COMMON
                  Download Yara Rule
                  APIs
                  • GetVersion.KERNEL32 ref: 0040AB26
                    • Part of subcall function 00412850: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0040AB83,00000000), ref: 00412864
                  • GetCommandLineA.KERNEL32 ref: 0040ABA0
                    • Part of subcall function 0040AC60: ExitProcess.KERNEL32 ref: 0040AC82
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: CommandCreateExitHeapLineProcessVersion
                  • String ID:
                  • API String ID: 2053199708-0
                  • Opcode ID: 246f9ce273f12af8a25a9ca7b96a2147e0c020305b4c8e659b18555c29abed1c
                  • Instruction ID: 313a5baecfc1d38842d14e7553fba13a7ef1011b5af569ac662abe082049608a
                  • Opcode Fuzzy Hash: 246f9ce273f12af8a25a9ca7b96a2147e0c020305b4c8e659b18555c29abed1c
                  • Instruction Fuzzy Hash: 5121B4B19806059FC700EF99EC82B5A77B5FB48304F04523EE594933A1E73C98A0CB9E
                  Function 004052B0 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 132windowCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  APIs
                  • FindWindowA.USER32(DesktopBar,DesktopBar), ref: 004052DC
                  • PostMessageA.USER32(00000000), ref: 004052EA
                  • FindWindowA.USER32(DesktopBar,DesktopBar), ref: 0040530B
                  • PostMessageA.USER32(00000000), ref: 00405319
                  • FindWindowA.USER32(SamStarter,SamStarter), ref: 0040533A
                  • PostMessageA.USER32(00000000), ref: 00405348
                  • FindWindowA.USER32(SamStarter,SamStarter), ref: 00405369
                  • PostMessageA.USER32(00000000), ref: 00405377
                  • FindWindowA.USER32(APPSiteMetering,APPSiteMetering), ref: 00405398
                  • PostMessageA.USER32(00000000), ref: 004053A6
                  • FindWindowA.USER32(APPSiteMetering,APPSiteMetering), ref: 004053C7
                  • PostMessageA.USER32(00000000), ref: 004053D5
                  • FindWindowA.USER32(SamClient10,SamClient10), ref: 004053F6
                  • PostMessageA.USER32(00000000), ref: 00405404
                  • FindWindowA.USER32(SamClient10,SamClient10), ref: 00405425
                  • PostMessageA.USER32(00000000), ref: 00405433
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: FindMessagePostWindow
                  • String ID: APPSiteMetering$DesktopBar$SamClient10$SamStarter
                  • API String ID: 2578315405-1214712019
                  • Opcode ID: 69aaaaf59aea80a1fa60701a26955b8da406798433779eb3ff3567827bc33462
                  • Instruction ID: b5ae28f5a1714979621e24f8ea81a45685ca28cc2b8281d8c7f9e796253d0ce6
                  • Opcode Fuzzy Hash: 69aaaaf59aea80a1fa60701a26955b8da406798433779eb3ff3567827bc33462
                  • Instruction Fuzzy Hash: 64316032F8061437E2207B2AAE5BB4E39069F40F20FA11122F91A7B1D38DFD6C4191CE
                  Function 004199D0 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 330COMMONLIBRARYCODE
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 567 4199d0-4199fd 568 419a56-419a5a 567->568 569 4199ff-419a19 CompareStringW 567->569 572 419a5c-419a6c call 419dd0 568->572 573 419a6f-419a73 568->573 570 419a27-419a41 CompareStringA 569->570 571 419a1b-419a25 569->571 576 419a43-419a4d 570->576 577 419a4f-419a51 570->577 571->568 572->573 574 419a75-419a85 call 419dd0 573->574 575 419a88-419a8f 573->575 574->575 581 419a91-419aaf CompareStringA 575->581 582 419ab4-419abb 575->582 576->568 583 419db4-419dc7 577->583 581->583 585 419ac1-419ac5 582->585 586 419db2 582->586 587 419ad0-419ad4 585->587 588 419ac7-419acd 585->588 586->583 589 419ae0-419ae6 587->589 590 419ad6-419ada 587->590 588->587 592 419af2-419af6 589->592 593 419ae8-419aed 589->593 590->589 591 419c5c-419c7b MultiByteToWideChar 590->591 594 419c84-419cca call 40aad0 591->594 595 419c7d-419c7f 591->595 596 419b02-419b06 592->596 597 419af8-419afd 592->597 593->583 610 419cd3-419cf1 MultiByteToWideChar 594->610 611 419ccc-419cce 594->611 595->583 598 419b12-419b22 GetCPInfo 596->598 599 419b08-419b0d 596->599 597->583 601 419b24-419b26 598->601 602 419b2b-419b2f 598->602 599->583 601->583 604 419b31-419b35 602->604 605 419b37-419b3b 602->605 604->605 607 419b64-419b68 604->607 608 419b43-419b61 call 40cac0 605->608 609 419b3d-419b41 605->609 607->602 613 419b6a-419b6e 607->613 608->607 623 419b63 608->623 609->607 609->608 614 419cf3-419cf5 610->614 615 419cfa-419d19 MultiByteToWideChar 610->615 611->583 617 419b70-419b74 613->617 618 419be3-419be7 613->618 614->583 619 419d22-419d68 call 40aad0 615->619 620 419d1b-419d1d 615->620 624 419b80-419b86 617->624 625 419b76-419b7b 617->625 618->591 622 419be9-419bed 618->622 635 419d6a-419d6c 619->635 636 419d6e-419d8c MultiByteToWideChar 619->636 620->583 628 419bf9-419bff 622->628 629 419bef-419bf4 622->629 623->607 626 419b91-419b9a 624->626 625->583 630 419bd9-419bde 626->630 631 419b9c-419ba6 626->631 633 419c0a-419c13 628->633 629->583 630->583 631->630 634 419ba8-419bb8 631->634 637 419c52-419c57 633->637 638 419c15-419c1f 633->638 640 419bd7 634->640 641 419bba-419bcb 634->641 635->583 642 419d92-419db0 CompareStringW 636->642 643 419d8e-419d90 636->643 637->583 638->637 639 419c21-419c31 638->639 644 419c50 639->644 645 419c33-419c44 639->645 640->626 641->640 646 419bcd-419bd2 641->646 642->583 643->583 644->633 645->644 648 419c46-419c4b 645->648 646->583 648->583
                  APIs
                  • CompareStringW.KERNEL32(00000000,00000000,00434D68,00000001,00434D68,00000001,?), ref: 00419A11
                  • CompareStringA.KERNEL32(00000000,00000000,00434D64,00000001,00434D64,00000001), ref: 00419A39
                  • CompareStringA.KERNEL32(00000000,?,00000000,00000000,?,00000000,?), ref: 00419AA9
                  Strings
                  • cchCount1==0 && cchCount2==1 || cchCount1==1 && cchCount2==0, xrefs: 00419B43
                  • a_cmp.c, xrefs: 00419B4F
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: CompareString
                  • String ID: a_cmp.c$cchCount1==0 && cchCount2==1 || cchCount1==1 && cchCount2==0
                  • API String ID: 1825529933-3979739857
                  • Opcode ID: b71c94e92ce71bbcf0ab343d4c9e343f5b0c0bcf89270057bb37da2f2c3efaf2
                  • Instruction ID: 8fde20313409248b1925aa8c49cc0194a3624e1343fb4cfa6d149abe6d230bb7
                  • Opcode Fuzzy Hash: b71c94e92ce71bbcf0ab343d4c9e343f5b0c0bcf89270057bb37da2f2c3efaf2
                  • Instruction Fuzzy Hash: BDC16B70A04249DBDF14CF98E865BEF77B5BB49704F14412AF546A7280D338EC82CB9A
                  Function 004182D0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 256processsynchronizationCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 671 4182d0-418303 672 418305-41830b 671->672 673 418326-41833d 671->673 675 418320-418324 672->675 676 418312-418316 672->676 677 418318 672->677 678 41831a-41831e 672->678 674 418615-418618 673->674 679 418342-418345 675->679 676->679 677->679 678->679 680 418348-418350 679->680 681 418383-4183a2 call 409f00 680->681 682 418352-41835a 680->682 689 4183ad-4183b1 681->689 683 418367-418370 682->683 684 41835c-418365 682->684 686 418381 683->686 687 418372-41837e 683->687 684->682 686->680 687->686 690 4183b3-4183d3 689->690 691 4183d7-41843f call 40e6f0 689->691 690->691 692 4183d5 690->692 696 41845c-418462 691->696 692->689 697 4184b3-4184b9 696->697 698 418464-418489 696->698 701 4184bb-4184d8 697->701 702 41853a-41859d CreateProcessA GetLastError call 40ed50 697->702 699 4184a2-4184ab 698->699 700 41848b-4184a0 698->700 704 4184b1 699->704 700->704 705 4184f5-4184f9 701->705 710 4185b0-4185b4 702->710 711 41859f-4185ae call 412db0 702->711 704->696 708 418506 705->708 709 4184fb-418504 705->709 712 418510-418519 708->712 709->712 714 4185b6-4185b8 call 410340 710->714 715 4185bd-4185c1 710->715 711->674 716 41851b-41852a 712->716 717 41852c-418534 712->717 714->715 720 4185c3-4185e7 WaitForSingleObject GetExitCodeProcess CloseHandle 715->720 721 4185e9-4185ed 715->721 716->705 717->702 723 418608-418612 CloseHandle 720->723 724 418602-418605 721->724 725 4185ef-418600 CloseHandle 721->725 723->674 724->723 725->723
                  APIs
                  • CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000001,00000000,004119D1,00000000,00000044,004119D1), ref: 00418573
                  • GetLastError.KERNEL32 ref: 0041857F
                  • WaitForSingleObject.KERNEL32(004119D1,000000FF), ref: 004185C9
                  • GetExitCodeProcess.KERNELBASE(004119D1,?), ref: 004185D7
                  • CloseHandle.KERNEL32(004119D1), ref: 004185E1
                  • CloseHandle.KERNEL32(004119D1), ref: 004185F3
                  • CloseHandle.KERNEL32(?), ref: 0041860C
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: CloseHandle$Process$CodeCreateErrorExitLastObjectSingleWait
                  • String ID: D$dospawn.c
                  • API String ID: 966596688-1510589663
                  • Opcode ID: 885568d4840139fe4de3643e6d7f98d9eda14ed47e219c9ae68fc3ff4f38ef1f
                  • Instruction ID: 1356227dba497ed9216f2886205c653a88e499b5cf4998e3b00c96a04cf53bb9
                  • Opcode Fuzzy Hash: 885568d4840139fe4de3643e6d7f98d9eda14ed47e219c9ae68fc3ff4f38ef1f
                  • Instruction Fuzzy Hash: 8DC11870D04249CFDB14CFA4C994BEEBBB1BB45304F24825EE855AB381DB35A981CF59
                  Function 0040B980 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 766 40b980-40b9a6 call 40e2e0 769 40b9b2-40b9c4 766->769 770 40b9a8-40b9af call 40ac30 766->770 772 40b9cf-40b9de 769->772 770->769 774 40b9e0-40b9f7 772->774 775 40b9f9-40ba0e GetStartupInfoA 772->775 774->772 777 40ba14-40ba18 775->777 778 40bb8e-40bb95 775->778 777->778 780 40ba1e-40ba3f 777->780 779 40bba0-40bba4 778->779 781 40bbaa-40bbbf 779->781 782 40bc7b-40bc8a SetHandleCount 779->782 783 40ba41-40ba47 780->783 784 40ba49 780->784 785 40bbc5-40bbd0 781->785 786 40bc67-40bc73 781->786 787 40ba50-40ba5d 783->787 784->787 789 40bbd2-40bbd9 785->789 790 40bbdb-40bbe8 785->790 788 40bc76 786->788 791 40ba68-40ba70 787->791 788->779 795 40bbeb-40bbfc GetStdHandle 789->795 790->795 792 40ba76-40ba96 call 40e2e0 791->792 793 40bafd-40bb04 791->793 804 40baa3-40babf 792->804 805 40ba98-40baa1 792->805 797 40bb21-40bb27 793->797 798 40bc56-40bc62 795->798 799 40bbfe-40bc0f GetFileType 795->799 797->778 803 40bb29-40bb2f 797->803 800 40bc65 798->800 799->798 802 40bc11-40bc25 799->802 800->788 806 40bc37-40bc43 802->806 807 40bc27-40bc35 802->807 808 40bb31-40bb3c 803->808 809 40bb89 803->809 811 40baca-40badd 804->811 805->793 812 40bc54 806->812 813 40bc45-40bc51 806->813 807->812 808->809 814 40bb3e-40bb49 808->814 809->797 815 40baf8 811->815 816 40badf-40baf6 811->816 812->800 813->812 817 40bb5b-40bb86 814->817 818 40bb4b-40bb59 GetFileType 814->818 815->791 816->811 817->809 818->809 818->817
                  APIs
                  • __malloc_dbg.LIBCMTD ref: 0040B997
                  • GetStartupInfoA.KERNEL32(?), ref: 0040B9FD
                  • __malloc_dbg.LIBCMTD ref: 0040BA87
                  • GetFileType.KERNEL32(0040ABA0), ref: 0040BB51
                  • GetStdHandle.KERNEL32(?), ref: 0040BBEF
                  • GetFileType.KERNELBASE(000000FF), ref: 0040BC02
                  • SetHandleCount.KERNEL32(00000020), ref: 0040BC81
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: FileHandleType__malloc_dbg$CountInfoStartup
                  • String ID: ioinit.c
                  • API String ID: 2656353590-350981760
                  • Opcode ID: 98c072c3731ac34d5951d2dcc850bba5358e5c5257b4deb16b9249854dde9413
                  • Instruction ID: d9b06d580c5073a17c7cd498638113537771badf0aff83bfefba3976abba1d96
                  • Opcode Fuzzy Hash: 98c072c3731ac34d5951d2dcc850bba5358e5c5257b4deb16b9249854dde9413
                  • Instruction Fuzzy Hash: E6B14874E04258CFDB04CFD8C894AADBBB2FF45305F24826AD4556F399C378A846CB89
                  Function 00405080 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 115COMMON
                  Download Yara Rule

                  Control-flow Graph

                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: ErrorFileLastOperationwsprintf
                  • String ID: Ec@$MoveSamDirectory from$MoveSamDirectory to$error:%d
                  • API String ID: 83795116-3708296390
                  • Opcode ID: 12020aff215eef7c6151f30216af7116527fe97425b65d34d28b81daf3105d2b
                  • Instruction ID: ff0b6bc7551a4f9a53180a447f113f9abd53dd10b7c3bd6becbacd9e0cb30d8e
                  • Opcode Fuzzy Hash: 12020aff215eef7c6151f30216af7116527fe97425b65d34d28b81daf3105d2b
                  • Instruction Fuzzy Hash: E4419572E00218ABDB20DB68DC427DAB7B5AF48304F0045F5E909B7282DA795F94CF96
                  Function 0040C070 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 338fileCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 868 40c070-40c08e 869 40c090-40c09b 868->869 870 40c09d-40c0a4 868->870 871 40c0a8-40c0b3 869->871 870->871 872 40c0e1-40c0ee 871->872 873 40c0b5-40c0c0 871->873 876 40c0f0-40c0f4 872->876 877 40c0fe-40c105 872->877 874 40c0c2-40c0ca 873->874 875 40c0cc-40c0d6 873->875 874->872 875->872 878 40c0d8-40c0de 875->878 879 40c0f6-40c0fa 876->879 880 40c107-40c10e 876->880 881 40c135-40c148 877->881 878->872 884 40c110-40c117 879->884 885 40c0fc-40c130 879->885 880->881 882 40c180-40c197 881->882 883 40c14a-40c155 881->883 890 40c517-40c51a 882->890 883->882 886 40c165-40c16c 883->886 887 40c177-40c17e 883->887 888 40c15c-40c163 883->888 889 40c16e-40c175 883->889 884->881 885->890 892 40c19c-40c1af 886->892 887->892 888->892 889->892 893 40c1b1-40c1b8 892->893 894 40c1e8-40c1ef 892->894 897 40c205-40c20c 893->897 898 40c1ba-40c1c1 893->898 895 40c1f1-40c1f8 894->895 896 40c217-40c21e 894->896 899 40c220-40c227 895->899 900 40c1fa-40c201 895->900 901 40c24e-40c260 896->901 897->901 902 40c1c3-40c1ca 898->902 903 40c1dd-40c1e4 898->903 899->901 900->896 904 40c203 900->904 905 40c262-40c296 901->905 906 40c29f-40c2a7 901->906 902->899 907 40c1cc-40c1d0 902->907 908 40c1e6 903->908 909 40c229-40c230 903->909 910 40c232-40c249 904->910 905->906 911 40c298 905->911 913 40c2c1-40c2cb 906->913 914 40c2a9-40c2be 906->914 907->897 912 40c1d2-40c1d9 907->912 908->910 909->901 910->890 911->906 915 40c1db 912->915 916 40c20e-40c215 912->916 917 40c2d6-40c2de 913->917 918 40c2cd-40c2d3 913->918 914->913 915->910 916->901 919 40c2e0-40c2eb 917->919 920 40c2ed-40c2f5 917->920 918->917 921 40c303-40c30f call 412e40 919->921 920->921 922 40c2f7-40c300 920->922 925 40c311-40c328 921->925 926 40c32d-40c354 CreateFileA 921->926 922->921 925->890 927 40c356-40c368 GetLastError call 412db0 926->927 928 40c36d-40c37e GetFileType 926->928 927->890 930 40c380-40c39c CloseHandle GetLastError call 412db0 928->930 931 40c3a1-40c3a5 928->931 930->890 932 40c3b2-40c3b6 931->932 933 40c3a7-40c3b0 931->933 936 40c3c0-40c3fb call 412f70 932->936 937 40c3b8-40c3bd 932->937 933->936 941 40c401-40c40c 936->941 942 40c4ce-40c4d7 936->942 937->936 941->942 945 40c412-40c41a 941->945 943 40c514 942->943 944 40c4d9-40c4e1 942->944 943->890 944->943 946 40c4e3-40c510 944->946 945->942 947 40c420-40c437 call 40b890 945->947 946->943 950 40c439-40c443 947->950 951 40c45b-40c473 call 40b430 947->951 953 40c445-40c454 call 40b090 950->953 954 40c459 950->954 957 40c4a4-40c4bb call 40b890 951->957 958 40c475-40c47c 951->958 953->890 954->942 957->942 965 40c4bd-40c4cc call 40b090 957->965 958->957 960 40c47e-40c491 call 413240 958->960 960->957 966 40c493-40c4a2 call 40b090 960->966 965->890 966->890
                  APIs
                  • CreateFileA.KERNELBASE(00000000,80000000,00000000,0000000C,00000001,00000080,00000000), ref: 0040C347
                  • GetLastError.KERNEL32 ref: 0040C356
                  • GetFileType.KERNELBASE(000000FF), ref: 0040C371
                  • CloseHandle.KERNEL32(000000FF), ref: 0040C384
                  • GetLastError.KERNEL32 ref: 0040C38A
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: ErrorFileLast$CloseCreateHandleType
                  • String ID: 0
                  • API String ID: 2834158390-4108050209
                  • Opcode ID: c0973789003835538f3026797f2a2e461a046f35200687a5ee55277c893cd251
                  • Instruction ID: b2fb39c49a650f49ff8b7d6bdd12faf641a7a2d0c805ddfd46f1a5b80906b4b6
                  • Opcode Fuzzy Hash: c0973789003835538f3026797f2a2e461a046f35200687a5ee55277c893cd251
                  • Instruction Fuzzy Hash: FAE18E70C00208DBEF14CFA4D9D57EEBBB1AB44318F28832AE5617B2C1D7789945CB5A
                  Function 004054C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78registryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  APIs
                  • RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,000F003F,?), ref: 00405519
                  • RegQueryValueExA.KERNELBASE(?,ProductName,00000000,?,?,00000105), ref: 0040555B
                  • RegFlushKey.ADVAPI32(?), ref: 00405577
                  • RegCloseKey.KERNELBASE(?), ref: 00405593
                  Strings
                  • ProductName, xrefs: 0040554F
                  • SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0040550F
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: CloseFlushOpenQueryValue
                  • String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                  • API String ID: 4111967329-1787575317
                  • Opcode ID: d1d6ab43e847d7f209f569be8e799d38da7bfee90ea3b5e02a592b77b1c510e4
                  • Instruction ID: e088f05f16f6f404c027fc306680b1bb979ecb1aed8bc525bdf9a75f291c7122
                  • Opcode Fuzzy Hash: d1d6ab43e847d7f209f569be8e799d38da7bfee90ea3b5e02a592b77b1c510e4
                  • Instruction Fuzzy Hash: AA216F72D002189BDB24EF58DD46BDAB7B59B44704F0041E9AA0977282D7B86F848FD6
                  Function 00401DE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 64registryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  APIs
                  • RegCreateKeyExA.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports,00000000,00000000,00000000,00000002,00000000,?,?), ref: 00401E16
                  • RegSetValueExA.KERNELBASE(?,SAMPrinterPort,00000000,00000001,0043211C,-00000001), ref: 00401E4B
                  • RegFlushKey.ADVAPI32(?), ref: 00401E61
                  • RegCloseKey.ADVAPI32(?), ref: 00401E74
                  Strings
                  • SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports, xrefs: 00401E0C
                  • SAMPrinterPort, xrefs: 00401E42
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: CloseCreateFlushValue
                  • String ID: SAMPrinterPort$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports
                  • API String ID: 607596385-2713600930
                  • Opcode ID: c203d0cd89e70f111258d162cb81e07015e7d12ff2de3e53e9917bc62c8d59d9
                  • Instruction ID: a499de9c4333d7b1f3b2c12d33ed8da62c5c2b79a636b4ae7424c37ffd2dacdb
                  • Opcode Fuzzy Hash: c203d0cd89e70f111258d162cb81e07015e7d12ff2de3e53e9917bc62c8d59d9
                  • Instruction Fuzzy Hash: 7011E972E402047BE720BBA99D47FDE7768DB04B00F50016AFE05B72C3D5B96E0086DA
                  Function 0040B180 Relevance: 6.2, APIs: 4, Instructions: 189fileCOMMONLIBRARYCODE
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 1000 40b180-40b192 1001 40b1b3-40b1ca 1000->1001 1002 40b194-40b1b1 1000->1002 1004 40b41e-40b421 1001->1004 1002->1001 1003 40b1cf-40b1e3 1002->1003 1005 40b1e5-40b1e7 1003->1005 1006 40b1ec-40b209 1003->1006 1005->1004 1007 40b21b-40b23b 1006->1007 1008 40b20b-40b213 call 40b890 1006->1008 1010 40b241-40b247 1007->1010 1011 40b349-40b379 WriteFile 1007->1011 1012 40b218 1008->1012 1015 40b24e-40b257 1010->1015 1013 40b37b-40b38b 1011->1013 1014 40b38d-40b393 GetLastError 1011->1014 1012->1007 1016 40b396-40b39a 1013->1016 1014->1016 1017 40b347 1015->1017 1018 40b25d-40b263 1015->1018 1019 40b415-40b418 1016->1019 1020 40b39c-40b3a0 1016->1020 1017->1016 1021 40b266-40b276 1018->1021 1019->1004 1022 40b3a2-40b3a6 1020->1022 1023 40b3ce-40b3eb 1020->1023 1024 40b2d7-40b312 WriteFile 1021->1024 1025 40b278-40b281 1021->1025 1026 40b3a8-40b3bb 1022->1026 1027 40b3bd-40b3c6 call 412db0 1022->1027 1031 40b3fc-40b413 1023->1031 1032 40b3ed-40b3f6 1023->1032 1029 40b314-40b331 1024->1029 1030 40b337-40b340 GetLastError 1024->1030 1025->1024 1028 40b283-40b2a1 1025->1028 1033 40b3c9-40b3cc 1026->1033 1027->1033 1034 40b2c1-40b2d5 1028->1034 1035 40b2a3-40b2be 1028->1035 1037 40b333 1029->1037 1038 40b335-40b342 1029->1038 1030->1017 1031->1004 1032->1031 1039 40b3f8-40b3fa 1032->1039 1033->1004 1034->1021 1035->1034 1037->1017 1038->1015 1039->1004
                  APIs
                  • WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 0040B30A
                  • GetLastError.KERNEL32 ref: 0040B337
                  • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040B371
                  • GetLastError.KERNEL32 ref: 0040B38D
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: ErrorFileLastWrite
                  • String ID:
                  • API String ID: 442123175-0
                  • Opcode ID: 835ac31d7c9feea8ccc0e7f3871eb0f0b13f424bcde3f4cd91cae3e607b06d1a
                  • Instruction ID: 2f06d47be4bd36b79366ec2b8a8e553c4a10a701beef8d8e9f007607f543fc77
                  • Opcode Fuzzy Hash: 835ac31d7c9feea8ccc0e7f3871eb0f0b13f424bcde3f4cd91cae3e607b06d1a
                  • Instruction Fuzzy Hash: 8A818F70A00209DFCB14CF58D895BAE7BB1FB44304F2485AAE915AB385C734AA91CF8D
                  Function 00412850 Relevance: 6.0, APIs: 4, Instructions: 42memoryCOMMON
                  Download Yara Rule
                  APIs
                  • HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0040AB83,00000000), ref: 00412864
                  • ___sbh_heap_init.LIBCMTD ref: 00412894
                  • HeapDestroy.KERNEL32(022B0000), ref: 004128A7
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: Heap$CreateDestroy___sbh_heap_init
                  • String ID:
                  • API String ID: 3481495115-0
                  • Opcode ID: 26a7dd6b3561615fc787af0459d412f6738d508c32821cbbcdb1294292ed4395
                  • Instruction ID: 96ef0bcbe0014322d41c68b5aeb533b19806f2f10c9aaa8b0a78e491b0d9a041
                  • Opcode Fuzzy Hash: 26a7dd6b3561615fc787af0459d412f6738d508c32821cbbcdb1294292ed4395
                  • Instruction Fuzzy Hash: 2C018670A40218EFE7107BB0BE4979376A56B58399F201536E902C5150F6F994F4D71F
                  Function 00411790 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 175COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: __malloc_dbg
                  • String ID: spawnve.c
                  • API String ID: 95588982-1097270895
                  • Opcode ID: 71b57e3994693e4eafa381ec00331284eba71d3fc998c6cd8cb26955e9289798
                  • Instruction ID: d104d9dc910cb01bb4e83ffcb0b06864d7ed5fae1cfc5f203fd1eb3e356468d2
                  • Opcode Fuzzy Hash: 71b57e3994693e4eafa381ec00331284eba71d3fc998c6cd8cb26955e9289798
                  • Instruction Fuzzy Hash: 41517EB5D00209ABCB00EBA4DC42BEF7774BB44318F24891EE62577381E6399A50CB95
                  Function 004103A0 Relevance: 4.6, APIs: 3, Instructions: 57COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • GetCurrentProcess.KERNEL32(00413C5F,0043A878,?,00410350,00413C5F,00000001,00000000,?,00413C5F,00000003), ref: 004103B1
                  • TerminateProcess.KERNEL32(00000000,?,00410350,00413C5F,00000001,00000000,?,00413C5F,00000003), ref: 004103B8
                  • ExitProcess.KERNEL32 ref: 0041046F
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: Process$CurrentExitTerminate
                  • String ID:
                  • API String ID: 1703294689-0
                  • Opcode ID: 497c0e43c0943ebfa532b2028e3931ef12576fc7dcf41052208895c69caba28d
                  • Instruction ID: 175835da32f52a9891ad8cc9c00005d5a1586f6fd13a89e5d783b402b2b68f97
                  • Opcode Fuzzy Hash: 497c0e43c0943ebfa532b2028e3931ef12576fc7dcf41052208895c69caba28d
                  • Instruction Fuzzy Hash: 64219A74940308EFDB10DFA4E8897D97BB0EB18349F10913AE950562A1C7BDA9D4CB9E
                  Function 004040A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON
                  Download Yara Rule
                  APIs
                  • GetComputerNameA.KERNEL32(?,00000014), ref: 004040CF
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: ComputerName
                  • String ID: Comprise
                  • API String ID: 3545744682-1301085562
                  • Opcode ID: ee819897ec92ac64b0d44739dc097596512f83166f841fe3957bc4c4efc6fb98
                  • Instruction ID: fe8e0f88a17da3b61dd98f2ef65d7e2ecad92ea9c121ddab4ec21a13a4ffd2c0
                  • Opcode Fuzzy Hash: ee819897ec92ac64b0d44739dc097596512f83166f841fe3957bc4c4efc6fb98
                  • Instruction Fuzzy Hash: E6F0E972E003081BD710F698EC82BDE7368CB44310F404125ED0967141E9795A4CC7D2
                  Function 0040B890 Relevance: 3.1, APIs: 2, Instructions: 69COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • SetFilePointer.KERNELBASE(000000FF,000000FF,00000000,?), ref: 0040B90E
                  • GetLastError.KERNEL32 ref: 0040B91D
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: ErrorFileLastPointer
                  • String ID:
                  • API String ID: 2976181284-0
                  • Opcode ID: 6ced3716e7afe9fc1f0dff62b8107c072ba1eff671ca05ab790c82816c67cdf6
                  • Instruction ID: f54d066ce47e1a751ab25a449179b6a5d09ca56d7f10368ef5dbb16b2292fa0e
                  • Opcode Fuzzy Hash: 6ced3716e7afe9fc1f0dff62b8107c072ba1eff671ca05ab790c82816c67cdf6
                  • Instruction Fuzzy Hash: FE219470900208EBCB00DF64E995BAD3BB1EB40364F24C369E6655F2D5C734AA61CB89
                  Function 00411A00 Relevance: 3.0, APIs: 2, Instructions: 31COMMON
                  Download Yara Rule
                  APIs
                  • GetFileAttributesA.KERNELBASE(00000000,?,?,0041193A,00000000,00000000), ref: 00411A08
                  • GetLastError.KERNEL32(?,?,0041193A,00000000), ref: 00411A17
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: AttributesErrorFileLast
                  • String ID:
                  • API String ID: 1799206407-0
                  • Opcode ID: 0a390da71667118e6a341e53edb9183a32b6f7237ad25bab8b4563bbdf2a3c85
                  • Instruction ID: 04b54f48c71a076d890718632e7d80e61c9bb1e55c4f75619a3fc70ffd61483f
                  • Opcode Fuzzy Hash: 0a390da71667118e6a341e53edb9183a32b6f7237ad25bab8b4563bbdf2a3c85
                  • Instruction Fuzzy Hash: 7CF0E970D06308DBCB10DF75ED197AE3B64AF05335F24532AE93A872E0D73599508B49
                  Function 0040B090 Relevance: 2.6, APIs: 2, Instructions: 74COMMON
                  Download Yara Rule
                  APIs
                  • CloseHandle.KERNELBASE(00000000), ref: 0040B11F
                  • GetLastError.KERNEL32 ref: 0040B132
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: CloseErrorHandleLast
                  • String ID:
                  • API String ID: 918212764-0
                  • Opcode ID: 62d71efbb53d272289cf56c79d8f9f7e8d5ba9a02efe3b1621e67166b52deb9f
                  • Instruction ID: 89b7489446b9be5f0dcc220ec5458f5d5cf402571509b15a44da76c5adf15ec0
                  • Opcode Fuzzy Hash: 62d71efbb53d272289cf56c79d8f9f7e8d5ba9a02efe3b1621e67166b52deb9f
                  • Instruction Fuzzy Hash: 9321C9719002049BDB10DF64EC56BAA3BA5EB00399F14823AF8555F3C1D739EA51C7CE
                  Function 004017B0 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                  Download Yara Rule
                  APIs
                  • LsaOpenPolicy.ADVAPI32(00000000,?,?,?), ref: 0040180D
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: OpenPolicy
                  • String ID:
                  • API String ID: 2030686058-0
                  • Opcode ID: b344a72e2318b8c962639f2900e0e683ca75331400889193b4c6a0c06265c2fd
                  • Instruction ID: a44dc7a7132ab6d58b16635c222f97031092040941128c58462829f39c9e054b
                  • Opcode Fuzzy Hash: b344a72e2318b8c962639f2900e0e683ca75331400889193b4c6a0c06265c2fd
                  • Instruction Fuzzy Hash: C20144B6D0020C6BCB10DE99D841FEF77BCAB48304F00412AFA05B7281D679AA55C7F5

                  Non-executed Functions

                  Function 00404900 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 94serviceCOMMON
                  Download Yara Rule
                  APIs
                  • OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00404923
                  • OpenServiceA.ADVAPI32(00000000,Sam Client Remote Manager,00010000), ref: 0040494E
                  • OpenServiceA.ADVAPI32(00000000,SamClientManager,00010000), ref: 00404974
                  • OpenServiceA.ADVAPI32(00000000,Sam Client Control,00010000), ref: 0040499A
                  • CloseServiceHandle.ADVAPI32(00000000), ref: 004049B6
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: OpenService$CloseHandleManager
                  • String ID: Sam Client Control$Sam Client Remote Manager$SamClientManager$Service deleted successfully
                  • API String ID: 4136619037-2199163648
                  • Opcode ID: 8b76c48478c253b40a88f6758df272aa9fe7df75614cf8d4f86f783618faa359
                  • Instruction ID: 0a175e066411e1086f66f67a61808387faa3f5bfbf4f24492a4c522422893cdd
                  • Opcode Fuzzy Hash: 8b76c48478c253b40a88f6758df272aa9fe7df75614cf8d4f86f783618faa359
                  • Instruction Fuzzy Hash: 6E31B4B2E00214BFD720FBB9988679E76B59B44B24F510176FE0677282C67C5E80D7CA
                  Function 00402E50 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 273comCOMMON
                  Download Yara Rule
                  APIs
                  • CoInitialize.OLE32(00000000), ref: 00402E8E
                  • CoUninitialize.OLE32 ref: 00402F07
                  • CoCreateInstance.OLE32(00433B80,00000000,00000001,00433B90,00000000), ref: 00402F35
                  • CoUninitialize.OLE32 ref: 00402F89
                  Strings
                  • SHCreateShortcutEx: %d, %s, xrefs: 004030C2
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: Uninitialize$CreateInitializeInstance
                  • String ID: SHCreateShortcutEx: %d, %s
                  • API String ID: 1968832861-1887925125
                  • Opcode ID: fdb9a426047e1e9708c07fd2c2614115c87a29a658de742b4dfe6b3247a94ac4
                  • Instruction ID: 0dd0d752fda0969ad6e72652a6d757748330f5fcc401ef32efbebc232a87480e
                  • Opcode Fuzzy Hash: fdb9a426047e1e9708c07fd2c2614115c87a29a658de742b4dfe6b3247a94ac4
                  • Instruction Fuzzy Hash: 4FB12C35D005249FD721EF28C896B99B3B9AB48714F4142D9FD196B292C638AF80CFD5
                  Function 004038D0 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 194COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 0040A750: __nh_malloc.LIBCMTD ref: 0040A75A
                  • NetUserAdd.NETAPI32(00000000,00000003,?,?), ref: 00403BF7
                  • NetGroupAddUser.NETAPI32(00000000,00432678,00432604,00000000,00000003,?,?), ref: 00403C11
                  • NetUserSetInfo.NETAPI32(00000000,?,0000041B,00000200,?,00000000,00432678,00432604,00000000,00000003,?,?), ref: 00403C41
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: User$GroupInfo__nh_malloc
                  • String ID: 0&C$A$Comprise$Sam$Softed$x&C$%C
                  • API String ID: 156899566-1179688295
                  • Opcode ID: df45e50f7deadcafa74e31a3dfe5629190632b22952c827e0e37224be0bf228b
                  • Instruction ID: bdcb4726c6c9bfdd2f0070f44e8dc9de6c95b839f36e682c28ca20d96024fb5f
                  • Opcode Fuzzy Hash: df45e50f7deadcafa74e31a3dfe5629190632b22952c827e0e37224be0bf228b
                  • Instruction Fuzzy Hash: B9913CB1D003289BEB20DF94DD55BCEB7B4AB48308F1081AAE50977381D7B99A89CF55
                  Function 00413DD0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 54libraryloaderCOMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • LoadLibraryA.KERNEL32(user32.dll,Microsoft Visual C++ Debug Library), ref: 00413DEB
                  • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 00413E03
                  • GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00413E24
                  • GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00413E38
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: AddressProc$LibraryLoad
                  • String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
                  • API String ID: 2238633743-4044615076
                  • Opcode ID: 9c0f90e5229db84198db5a2a587d078d0154a3e00fa5449dba5b747ec228c144
                  • Instruction ID: 528971f157475d8e14cb3a846b19a4009252a4c6b698f175add9b66364b8cc2b
                  • Opcode Fuzzy Hash: 9c0f90e5229db84198db5a2a587d078d0154a3e00fa5449dba5b747ec228c144
                  • Instruction Fuzzy Hash: F01121B4940304EFDB19EFA4E80CBAE7BF4AB08302F10656AE44593250D7785A91DF5A
                  Function 00414E40 Relevance: 9.5, APIs: 3, Strings: 3, Instructions: 458COMMONLIBRARYCODE
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID:
                  • String ID: $ $
                  • API String ID: 0-3665324030
                  • Opcode ID: cf5136e8ced66afdc088c6572c0d6b3d3427b60d6353e4178410a8229c451cd8
                  • Instruction ID: 7da955f6caa4b30621e14b7b24c715def273ea2e9274ff6d8eeac7cc5e4916d3
                  • Opcode Fuzzy Hash: cf5136e8ced66afdc088c6572c0d6b3d3427b60d6353e4178410a8229c451cd8
                  • Instruction Fuzzy Hash: 2922B374E012099FDB08CF98D590AADFBB2BF88314F28D199E819AB355C735A981CF54
                  Function 00415C60 Relevance: 6.7, Strings: 5, Instructions: 489COMMONLIBRARYCODE
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID:
                  • String ID: $ $EA$EA$EA
                  • API String ID: 0-3718958290
                  • Opcode ID: b98c9b7b019ad7f2de2bb5b43c50729e4ee20e1ac89c4c9f7e511d28801b1b90
                  • Instruction ID: b950b7c99b6faa43a2a9047ae24ec8fdda2e747ac569a85a6cfeb3872e388a98
                  • Opcode Fuzzy Hash: b98c9b7b019ad7f2de2bb5b43c50729e4ee20e1ac89c4c9f7e511d28801b1b90
                  • Instruction Fuzzy Hash: 49327074A011199FDB08CF98D990AEEFBF2BF88304F24C299D809AB355D735A942CF54
                  Function 00417BC0 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                  Download Yara Rule
                  APIs
                  • SetUnhandledExceptionFilter.KERNEL32(Function_00017B60), ref: 00417BC8
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: ExceptionFilterUnhandled
                  • String ID:
                  • API String ID: 3192549508-0
                  • Opcode ID: a5884697f826e67f154cf15c229782e4de49739114052cd0352c7b3c9a971b5b
                  • Instruction ID: d9cae0097f1fa44c6858f4ae351721a2a76778d7f8e1bf9053eb5cb17498bab9
                  • Opcode Fuzzy Hash: a5884697f826e67f154cf15c229782e4de49739114052cd0352c7b3c9a971b5b
                  • Instruction Fuzzy Hash: 93B01230C8C30C6F86006BD6BC058113BBCE9106283041032F50C42350D6757020455E
                  Function 00417BE0 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                  Download Yara Rule
                  APIs
                  • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00417BE9
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: ExceptionFilterUnhandled
                  • String ID:
                  • API String ID: 3192549508-0
                  • Opcode ID: b146ac87dfc9406160b041addc4f0c16e4e639718587dad58e009feea46ff7ca
                  • Instruction ID: 19e365a271e195b733a10d3cd097c28906d007f263b725212487a68ede3557c9
                  • Opcode Fuzzy Hash: b146ac87dfc9406160b041addc4f0c16e4e639718587dad58e009feea46ff7ca
                  • Instruction Fuzzy Hash: 23B012314403089BCE0067DCBC0880137DCAA185143041020B10C83110C634F4204659
                  Function 00404230 Relevance: 61.5, APIs: 28, Strings: 7, Instructions: 209threadCOMMON
                  Download Yara Rule
                  APIs
                  • FindWindowA.USER32(SamStart,SamStart), ref: 0040425A
                  • GetWindowThreadProcessId.USER32(00000000), ref: 00404268
                  • OpenProcess.KERNEL32(00100001,00000000,?,00000000), ref: 00404286
                  • TerminateProcess.KERNEL32(00000000), ref: 00404294
                  • FindWindowA.USER32(SamStarter,SamStarter), ref: 004042B3
                  • GetWindowThreadProcessId.USER32(00000000), ref: 004042C1
                  • OpenProcess.KERNEL32(00100001,00000000,?,00000000), ref: 004042DF
                  • TerminateProcess.KERNEL32(00000000), ref: 004042ED
                  • FindWindowA.USER32(DesktopBar,DesktopBar), ref: 0040430C
                  • GetWindowThreadProcessId.USER32(00000000), ref: 0040431A
                  • OpenProcess.KERNEL32(00100001,00000000,?,00000000), ref: 00404338
                  • TerminateProcess.KERNEL32(00000000), ref: 00404346
                  • FindWindowA.USER32(APPSiteMetering,APPSiteMetering), ref: 00404365
                  • GetWindowThreadProcessId.USER32(00000000), ref: 00404373
                  • OpenProcess.KERNEL32(00100001,00000000,?,00000000), ref: 00404391
                  • TerminateProcess.KERNEL32(00000000), ref: 0040439F
                  • FindWindowA.USER32(SCClient,SCClient), ref: 004043BE
                  • GetWindowThreadProcessId.USER32(00000000), ref: 004043CC
                  • OpenProcess.KERNEL32(00100001,00000000,?,00000000), ref: 004043EA
                  • TerminateProcess.KERNEL32(00000000), ref: 004043F8
                  • FindWindowA.USER32(SamClient10,SamClient10), ref: 00404417
                  • GetWindowThreadProcessId.USER32(00000000), ref: 00404425
                  • OpenProcess.KERNEL32(00100001,00000000,?,00000000), ref: 00404443
                  • TerminateProcess.KERNEL32(00000000), ref: 00404451
                  • FindWindowA.USER32(OPACControl,OPACControl), ref: 00404470
                  • GetWindowThreadProcessId.USER32(00000000), ref: 0040447E
                  • OpenProcess.KERNEL32(00100001,00000000,?,00000000), ref: 0040449C
                  • TerminateProcess.KERNEL32(00000000), ref: 004044AA
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: Process$Window$FindOpenTerminateThread
                  • String ID: APPSiteMetering$DesktopBar$OPACControl$SCClient$SamClient10$SamStart$SamStarter
                  • API String ID: 3722451504-67329142
                  • Opcode ID: ba25be0015e78b48df034ce0181edf2e1d70332c00a1183ee3c6c10dca35b765
                  • Instruction ID: 513c9f909bf0441b24482030b8d18f86205802c429a914b4b72be6ed4fbf61be
                  • Opcode Fuzzy Hash: ba25be0015e78b48df034ce0181edf2e1d70332c00a1183ee3c6c10dca35b765
                  • Instruction Fuzzy Hash: 4E516272E402007FD310BB69ED9BB4E766A9F44B10F911125F80AB71D3CEB96E4096DE
                  Function 00402040 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 195registryCOMMON
                  Download Yara Rule
                  APIs
                  • RegCreateKeyExA.ADVAPI32(80000002,Software\ActMask Virtual Printer SDK,00000000,00000000,00000000,00000002,00000000,?,?), ref: 004020D1
                  • RegSetValueExA.ADVAPI32(?,TagWndClass,00000000,00000001,DesktopBar,-00000001), ref: 0040210C
                  • RegSetValueExA.ADVAPI32(?,TagWndTitle,00000000,00000001,DesktopBar,-00000001), ref: 00402147
                  • RegSetValueExA.ADVAPI32(?,OutputFolder,00000000,00000001,?,-00000001), ref: 00402186
                  • RegSetValueExA.ADVAPI32(?,DisableInstallDrvMsg,00000000,00000001,0043226C,-00000001), ref: 004021C1
                  • RegSetValueExA.ADVAPI32(?,DisableRebootMsg,00000000,00000001,0043226C,-00000001), ref: 004021FC
                  • RegSetValueExA.ADVAPI32(?,InstallPrinters,00000000,00000001,SAM Printer,-00000001), ref: 00402237
                  • RegSetValueExA.ADVAPI32(?,TagWndMsgID,00000000,00000004,00008000,00000004), ref: 0040226F
                  • RegSetValueExA.ADVAPI32(?,TransMode,00000000,00000004,00000001,00000004), ref: 004022A7
                  • RegFlushKey.ADVAPI32(?), ref: 004022C3
                  • RegCloseKey.ADVAPI32(?), ref: 004022D9
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: Value$CloseCreateFlush
                  • String ID: C:\Program Files (x86)\SAM 11\Jobs$DesktopBar$DisableInstallDrvMsg$DisableRebootMsg$InstallPrinters$OutputFolder$SAM Printer$Software\ActMask Virtual Printer SDK$TagWndClass$TagWndMsgID$TagWndTitle$TransMode
                  • API String ID: 2285503177-3405986724
                  • Opcode ID: 7888c7c8312f9e3706859393123f2c9ededfd49e567ac47300ba872b0521211d
                  • Instruction ID: 907a39789c07a7171180b2ae40293a7a282edd816bea4a1d96b4db72ff4e1712
                  • Opcode Fuzzy Hash: 7888c7c8312f9e3706859393123f2c9ededfd49e567ac47300ba872b0521211d
                  • Instruction Fuzzy Hash: D161E7B2D403247BE720AB64DC8BBDA7664AB04704F1011E9FE15B71C2D5F95E908FDA
                  Function 00402520 Relevance: 35.2, APIs: 10, Strings: 10, Instructions: 179registryCOMMON
                  Download Yara Rule
                  APIs
                  • RegCreateKeyExA.ADVAPI32(80000002,Software\Sam Printer,00000000,00000000,00000000,00000002,00000000,?,?), ref: 004025B1
                  • RegSetValueExA.ADVAPI32(?,TagWndClass,00000000,00000001,DesktopBar,-00000001), ref: 004025EC
                  • RegSetValueExA.ADVAPI32(?,TagWndTitle,00000000,00000001,DesktopBar,-00000001), ref: 00402627
                  • RegSetValueExA.ADVAPI32(?,OutputFolder,00000000,00000001,?,-00000001), ref: 00402666
                  • RegSetValueExA.ADVAPI32(?,DisableInstallDrvMsg,00000000,00000001,0043226C,-00000001), ref: 004026A1
                  • RegSetValueExA.ADVAPI32(?,DisableRebootMsg,00000000,00000001,0043226C,-00000001), ref: 004026DC
                  • RegSetValueExA.ADVAPI32(?,TagWndMsgID,00000000,00000004,00008000,00000004), ref: 00402714
                  • RegSetValueExA.ADVAPI32(?,TransMode,00000000,00000004,00000001,00000004), ref: 0040274C
                  • RegFlushKey.ADVAPI32(?), ref: 00402768
                  • RegCloseKey.ADVAPI32(?), ref: 0040277E
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: Value$CloseCreateFlush
                  • String ID: C:\Program Files (x86)\SAM 11\Jobs$DesktopBar$DisableInstallDrvMsg$DisableRebootMsg$OutputFolder$Software\Sam Printer$TagWndClass$TagWndMsgID$TagWndTitle$TransMode
                  • API String ID: 2285503177-120940452
                  • Opcode ID: 749b2731e5aa28880a45e306da022fd1f15f2bd1e5db2fb4ce96a1d0807972fe
                  • Instruction ID: 8eec675e0874c5d03f5a3072015d0ced02059a613ecc5960b7e0b6270f1a40a1
                  • Opcode Fuzzy Hash: 749b2731e5aa28880a45e306da022fd1f15f2bd1e5db2fb4ce96a1d0807972fe
                  • Instruction Fuzzy Hash: 9E51C6B2D403247BE720AB649C8BBDA7664AB04704F1011E9FA19771C2D5F95E908FDA
                  Function 004029C0 Relevance: 35.2, APIs: 10, Strings: 10, Instructions: 179registryCOMMON
                  Download Yara Rule
                  APIs
                  • RegCreateKeyExA.ADVAPI32(80000001,Software\Sam Printer,00000000,00000000,00000000,00000002,00000000,?,?), ref: 00402A51
                  • RegSetValueExA.ADVAPI32(?,TagWndClass,00000000,00000001,DesktopBar,-00000001), ref: 00402A8C
                  • RegSetValueExA.ADVAPI32(?,TagWndTitle,00000000,00000001,DesktopBar,-00000001), ref: 00402AC7
                  • RegSetValueExA.ADVAPI32(?,OutputFolder,00000000,00000001,?,-00000001), ref: 00402B06
                  • RegSetValueExA.ADVAPI32(?,DisableInstallDrvMsg,00000000,00000001,0043226C,-00000001), ref: 00402B41
                  • RegSetValueExA.ADVAPI32(?,DisableRebootMsg,00000000,00000001,0043226C,-00000001), ref: 00402B7C
                  • RegSetValueExA.ADVAPI32(?,TagWndMsgID,00000000,00000004,00008000,00000004), ref: 00402BB4
                  • RegSetValueExA.ADVAPI32(?,TransMode,00000000,00000004,00000001,00000004), ref: 00402BEC
                  • RegFlushKey.ADVAPI32(?), ref: 00402C08
                  • RegCloseKey.ADVAPI32(?), ref: 00402C1E
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: Value$CloseCreateFlush
                  • String ID: C:\Program Files (x86)\SAM 11\Jobs$DesktopBar$DisableInstallDrvMsg$DisableRebootMsg$OutputFolder$Software\Sam Printer$TagWndClass$TagWndMsgID$TagWndTitle$TransMode
                  • API String ID: 2285503177-120940452
                  • Opcode ID: 6e1d187866ad0011a1fa6b13956059341f49b03ae41287f55ed0ea0658091bae
                  • Instruction ID: 004f778c5b1fbf6ec4fa8b3b5f156895d6cecf6d696fee2ed7faefad01c9c50b
                  • Opcode Fuzzy Hash: 6e1d187866ad0011a1fa6b13956059341f49b03ae41287f55ed0ea0658091bae
                  • Instruction Fuzzy Hash: C051C6B2D403247BE720AB649C8BBDA7664AB04704F1011E9FA19771C2D5F95E908FDA
                  Function 0040CAC0 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 248libraryloaderCOMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • InterlockedIncrement.KERNEL32(00436FB0), ref: 0040CB45
                  • LoadLibraryA.KERNEL32(user32.dll), ref: 0040CB61
                  • GetProcAddress.KERNEL32(?,wsprintfA), ref: 0040CB82
                  • OutputDebugStringA.KERNEL32(?,00000000,00000000), ref: 0040CBC2
                  • InterlockedDecrement.KERNEL32(00436FB0), ref: 0040CBCD
                    • Part of subcall function 0040C9B0: DebugBreak.KERNEL32(?,0040CE88), ref: 0040C9B3
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: DebugInterlocked$AddressBreakDecrementIncrementLibraryLoadOutputProcString
                  • String ID: %s(%d) : %s$Second Chance Assertion Failed: File %s, Line %d$_CrtDbgReport: String too long or IO Error$user32.dll$wsprintfA
                  • API String ID: 1590524403-1062629290
                  • Opcode ID: cf4b5d20e73ecb4e004a3f31e8d96f11af445c46f84c8827435c0a81965d1844
                  • Instruction ID: 7554fb563eda5d61a79ea990e903419364ef6fd823da8198d0b72debe33012c0
                  • Opcode Fuzzy Hash: cf4b5d20e73ecb4e004a3f31e8d96f11af445c46f84c8827435c0a81965d1844
                  • Instruction Fuzzy Hash: B7A1B375900204EBDB25DF54DC99BDA7778BB08305F1086BAF509A62C0D7789BC8CF99
                  Function 00404CB0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 129serviceCOMMON
                  Download Yara Rule
                  APIs
                  • OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00404CFC
                  • OpenServiceA.ADVAPI32(00000000,Sam Client Remote Manager,000F003F), ref: 00404D35
                  • ControlService.ADVAPI32(00000000,00000001,?), ref: 00404D63
                  • CloseServiceHandle.ADVAPI32(00000000), ref: 00404E52
                  • CloseServiceHandle.ADVAPI32(00000000), ref: 00404E68
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: Service$CloseHandleOpen$ControlManager
                  • String ID: Sam Client Control$Sam Client Remote Manager$SamClientManager
                  • API String ID: 2705437689-2546360929
                  • Opcode ID: 2d192dbdd4e389d86fc8126003d3f0ee3f1dc40e22621b149602615b567a3940
                  • Instruction ID: 3d5bd107aff9baa645d8a3cc15c9efd8daa2fb7fe3ea4a3ea5d268456ac812c4
                  • Opcode Fuzzy Hash: 2d192dbdd4e389d86fc8126003d3f0ee3f1dc40e22621b149602615b567a3940
                  • Instruction Fuzzy Hash: CA416372D002249FD730BB69DC46BE9B675AB48710F4002AAEE4A77183C7795D90DBCA
                  Function 00404A70 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 126serviceCOMMON
                  Download Yara Rule
                  APIs
                  • OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00404ABC
                  • OpenServiceA.ADVAPI32(00000000,Sam Client Remote Manager,000F003F), ref: 00404AF5
                  • StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00404B1E
                  • CloseServiceHandle.ADVAPI32(00000000), ref: 00404C00
                  • CloseServiceHandle.ADVAPI32(00000000), ref: 00404C16
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: Service$CloseHandleOpen$ManagerStart
                  • String ID: Sam Client Control$Sam Client Remote Manager$SamClientManager
                  • API String ID: 1485051382-2546360929
                  • Opcode ID: 98f6e9594b279ebe9b63d2677e8cff45f743e88cbc24413b49b00e96333cf4af
                  • Instruction ID: b4210b0134f1d30006ec0f0c7bff67990c1048bbe9cc9673cbceee9d826f96d1
                  • Opcode Fuzzy Hash: 98f6e9594b279ebe9b63d2677e8cff45f743e88cbc24413b49b00e96333cf4af
                  • Instruction Fuzzy Hash: 65418571E042246FD730BB289C56BDA7671AB48710F4002A5EE4A771C3C7799D80DBCA
                  Function 00403D50 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 90COMMON
                  Download Yara Rule
                  APIs
                  • NetUserAdd.NETAPI32(00432828,00000001,00432604,00000000), ref: 00403DB8
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: User
                  • String ID: /$A$Comprise$Comprise user Successfully created$Comprise user failed ERROR_ACCESS_DENIED$Comprise user failed NERR_GroupExists$Comprise user failed NERR_InvalidComputer$Comprise user failed NERR_NotPrimary$Comprise user failed NERR_PasswordTooShort$Comprise user failed NERR_UserExists$Comprise user failed Unknown error$createuser$%C
                  • API String ID: 765557111-1455068009
                  • Opcode ID: 6ce048304a447d61194bf43b6337cfe03aa46f6f1961c606a2067ea40dc70c93
                  • Instruction ID: 5faeaada5548ec8e0adb08da5710e4612ceea66c108ce267de2d33e37371f44c
                  • Opcode Fuzzy Hash: 6ce048304a447d61194bf43b6337cfe03aa46f6f1961c606a2067ea40dc70c93
                  • Instruction Fuzzy Hash: 673163B0E4030896EB14AA95D907BDE7665AB1870BF20963BF454312C1D7FD1A848BFF
                  Function 0040E7B0 Relevance: 23.2, APIs: 1, Strings: 12, Instructions: 431COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  Strings
                  • pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ, xrefs: 0040E9C1
                  • Client hook re-allocation failure., xrefs: 0040E8AF
                  • _pFirstBlock == pOldBlock, xrefs: 0040EC49
                  • Client hook re-allocation failure at file %hs line %d., xrefs: 0040E88C
                  • Error: memory allocation: bad memory block type., xrefs: 0040E930
                  • fRealloc || (!fRealloc && pNewBlock == pOldBlock), xrefs: 0040EB96
                  • _BLOCK_TYPE(pOldBlock->nBlockUse)==_BLOCK_TYPE(nBlockUse), xrefs: 0040EA27
                  • _CrtIsValidHeapPointer(pUserData), xrefs: 0040E966
                  • _CrtCheckMemory(), xrefs: 0040E81B
                  • Allocation too large or negative: %u bytes., xrefs: 0040E8E6
                  • _pLastBlock == pOldBlock, xrefs: 0040EBF5
                  • dbgheap.c, xrefs: 0040E827, 0040E972, 0040E9CD, 0040EA33, 0040EBA2, 0040EC01, 0040EC55
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: __malloc_dbg
                  • String ID: Allocation too large or negative: %u bytes.$Client hook re-allocation failure at file %hs line %d.$Client hook re-allocation failure.$Error: memory allocation: bad memory block type.$_BLOCK_TYPE(pOldBlock->nBlockUse)==_BLOCK_TYPE(nBlockUse)$_CrtCheckMemory()$_CrtIsValidHeapPointer(pUserData)$_pFirstBlock == pOldBlock$_pLastBlock == pOldBlock$dbgheap.c$fRealloc || (!fRealloc && pNewBlock == pOldBlock)$pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ
                  • API String ID: 95588982-221452589
                  • Opcode ID: fa00228fcc90eb890b8a2764aa2e5bb0dec88db0428b33f4fa0375967e9ccb73
                  • Instruction ID: 9a4aab04e4fe71575a1287b67ddf7de5605eaf157fa4a09e36c6e9b1b8d42289
                  • Opcode Fuzzy Hash: fa00228fcc90eb890b8a2764aa2e5bb0dec88db0428b33f4fa0375967e9ccb73
                  • Instruction Fuzzy Hash: C1F1C171A00209ABDB24DF55D886BAF7771FB88304F24897AE905B73C1D378E960CB59
                  Function 004123A0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 173COMMON
                  Download Yara Rule
                  APIs
                  • GetEnvironmentStringsW.KERNEL32 ref: 004123BD
                  • GetEnvironmentStrings.KERNEL32 ref: 004123D8
                  • GetEnvironmentStringsW.KERNEL32 ref: 0041240D
                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,0040ABB0,00000000,00000000,00000000,00000000), ref: 00412477
                  • __malloc_dbg.LIBCMTD ref: 00412493
                  • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004124A8
                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,0040ABB0,00000000,00000000,00000000,00000000), ref: 004124CD
                  • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004124F0
                  • GetEnvironmentStrings.KERNEL32 ref: 00412511
                  • __malloc_dbg.LIBCMTD ref: 00412571
                  • FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00412586
                  • FreeEnvironmentStringsA.KERNEL32(00000000), ref: 004125A8
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: EnvironmentStrings$Free$ByteCharMultiWide__malloc_dbg
                  • String ID: a_env.c
                  • API String ID: 3241012610-1218344748
                  • Opcode ID: 438fd899fbfa02b4ff70d5991dda8217349e97c1af0fd0fd62616b2f77ae8ceb
                  • Instruction ID: bed1bc1d1200af75ddc87aa603885bcd4b3bccdd1782411fbde34ba54e7c20c7
                  • Opcode Fuzzy Hash: 438fd899fbfa02b4ff70d5991dda8217349e97c1af0fd0fd62616b2f77ae8ceb
                  • Instruction Fuzzy Hash: 70614E70E00209EFDB14DFA5D989BBFBBB1FB48308F244469E501E6280D7B85991CF99
                  Function 0040D95C Relevance: 21.5, APIs: 6, Strings: 6, Instructions: 497COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: __malloc_dbg_get_int_arg
                  • String ID: -$.$5$ch != _T('\0')$output.c$rC
                  • API String ID: 3840687771-404910928
                  • Opcode ID: e9d9b46cc178f3efcd529c743f76cca3d60f6b6286f7ed4980d0a348361722f6
                  • Instruction ID: 41472fe64697857d6754e9f622859785b97a9808f963c193e99f07e14650fbc0
                  • Opcode Fuzzy Hash: e9d9b46cc178f3efcd529c743f76cca3d60f6b6286f7ed4980d0a348361722f6
                  • Instruction Fuzzy Hash: 2A2279B1D04218DFDB14DF95C894BEEB7B1AF88304F2485EAE4197B281D7389A84CF59
                  Function 0040D58D Relevance: 19.7, APIs: 5, Strings: 6, Instructions: 479COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID:
                  • String ID: $(AC$.$5$ch != _T('\0')$output.c$rC
                  • API String ID: 0-3730215509
                  • Opcode ID: a5b00956e3e853740847bb66c9c62f182a54cb09527582b9aca6d18cc440c708
                  • Instruction ID: 7adcb32f0608712261db9d21e36d4d74e4957dca4be2be5d429327379e5c75d9
                  • Opcode Fuzzy Hash: a5b00956e3e853740847bb66c9c62f182a54cb09527582b9aca6d18cc440c708
                  • Instruction Fuzzy Hash: 5B227A71D00218DFDF14DF95C994BEEB7B1AF88304F2485AAE4197B281D7389A84CF59
                  Function 00404570 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 140processCOMMON
                  Download Yara Rule
                  APIs
                  • wsprintfA.USER32 ref: 00404601
                  • CreateProcessA.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 0040466B
                  • wsprintfA.USER32 ref: 004046B2
                  • CreateProcessA.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 0040471C
                  Strings
                  • InstallCert 2, xrefs: 0040468C
                  • CertMgr.Exe -add c:\program files (x86)\sam_10\Sam.cer -s -r localMachine root, xrefs: 004045C7
                  • CertMgr.Exe -add c:\program files (x86)\sam_10\Sam.cer -s -r localMachine trustedpublisher, xrefs: 00404678
                  • D, xrefs: 004046E8
                  • InstallCert, xrefs: 00404729
                  • InstallCert 1, xrefs: 004045DB
                  • %s\CertMgr.Exe, xrefs: 004045F5, 004046A6
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: CreateProcesswsprintf
                  • String ID: %s\CertMgr.Exe$CertMgr.Exe -add c:\program files (x86)\sam_10\Sam.cer -s -r localMachine root$CertMgr.Exe -add c:\program files (x86)\sam_10\Sam.cer -s -r localMachine trustedpublisher$D$InstallCert$InstallCert 1$InstallCert 2
                  • API String ID: 3691570402-466836416
                  • Opcode ID: 2dc377f07a7368dca8d7533d2380a05bca19fe0f3e741b387684a7521aaf0064
                  • Instruction ID: 29856307cd1f17a8bd54db3d307c8acf980c4a9b4a0f76898f9b452360c4fa9b
                  • Opcode Fuzzy Hash: 2dc377f07a7368dca8d7533d2380a05bca19fe0f3e741b387684a7521aaf0064
                  • Instruction Fuzzy Hash: 1141ECB6D402146AD720E750DC47FE97338AB58704F0405A9FA0D771C2EAB96F84CBE9
                  Function 004032F0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 127registryCOMMON
                  Download Yara Rule
                  APIs
                  • wsprintfA.USER32 ref: 00403359
                  • RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F,?), ref: 00403385
                  • RegQueryValueExA.ADVAPI32(?,Common Startup,00000000,?,?,00000105), ref: 004033C7
                  • RegCloseKey.ADVAPI32(?), ref: 004033E3
                  • wsprintfA.USER32 ref: 0040347E
                  Strings
                  • %s\SamStart.lnk, xrefs: 00403472
                  • Common Startup, xrefs: 004033BB
                  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup, xrefs: 0040346D
                  • Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00403348
                  • SamStart, xrefs: 00403444
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: wsprintf$CloseOpenQueryValue
                  • String ID: %s\SamStart.lnk$C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup$Common Startup$SamStart$Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
                  • API String ID: 61757238-2027637321
                  • Opcode ID: 5e39c7a652e828c6ba6bf7a678f37755ae826ca1eded5de6a01a65e015c331f9
                  • Instruction ID: 49aed739fb61f73ab4e7d4bdf22fff33ec68fccef05919067cf4e16d5ddbb9ca
                  • Opcode Fuzzy Hash: 5e39c7a652e828c6ba6bf7a678f37755ae826ca1eded5de6a01a65e015c331f9
                  • Instruction Fuzzy Hash: 14419472D002586BDB209B68DC567DAB775AB48300F0041EAEA0977282DAB81F84CFD5
                  Function 00403F10 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 76COMMON
                  Download Yara Rule
                  APIs
                  • NetGroupAddUser.NETAPI32(00432828,Administrators,Comprise), ref: 00403FB4
                    • Part of subcall function 0040A750: __nh_malloc.LIBCMTD ref: 0040A75A
                  • NetUserSetInfo.NETAPI32(00432828,Comprise,000003ED,00000002,00000000), ref: 0040400A
                  • NetUserSetInfo.NETAPI32(00432828,Comprise,0000041B,00000002,?,00432828,Comprise,000003ED,00000002,00000000), ref: 00404030
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: User$Info$Group__nh_malloc
                  • String ID: 0&C$Administrators$Comprise$P(C$\\.\Comprise2$p(C$%C
                  • API String ID: 1955020611-4207971336
                  • Opcode ID: d8479df6cd587eaf3e4bc610e9be2b87d60d58a6564c87b0401623a455bd0ef2
                  • Instruction ID: 397bf4a379e77b15b5775e0131e5665ee8225fab7f9ea0ab2749835d8b597d5a
                  • Opcode Fuzzy Hash: d8479df6cd587eaf3e4bc610e9be2b87d60d58a6564c87b0401623a455bd0ef2
                  • Instruction Fuzzy Hash: EA311AB1D40308AADB14EFE5DA46BDDBBB4AB48308F10952AE5047A281D3FD56098F99
                  Function 0040CE50 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 197COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0040CE16,00000002,00000000,00000000,?,?), ref: 0040CE9C
                    • Part of subcall function 0040C9B0: DebugBreak.KERNEL32(?,0040CE88), ref: 0040C9B3
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: BreakDebugFileModuleName
                  • String ID: ...$<program name unknown>$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$dbgrpt.c$szUserMessage != NULL$?C
                  • API String ID: 3969911889-2704023950
                  • Opcode ID: 3f51ba9504fd3aaddbcc272f74eb60e599be9fc97b0ece1c0c0b56a9b23325bf
                  • Instruction ID: a7aa7f8abf0f290c9a8b5a45f41441873a2062262df285b80fe8ecce8fac0d4b
                  • Opcode Fuzzy Hash: 3f51ba9504fd3aaddbcc272f74eb60e599be9fc97b0ece1c0c0b56a9b23325bf
                  • Instruction Fuzzy Hash: 8F8164B4D00218EBCB24DF50CD82ADAB771AB49309F1041EAE719762C1D3B85BD5CF9A
                  Function 00417CB0 Relevance: 15.3, APIs: 10, Instructions: 253COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • LCMapStringW.KERNEL32(00000000,00000100,00434D68,00000001,00000000,00000000), ref: 00417CF1
                  • LCMapStringA.KERNEL32(00000000,00000100,00434D64,00000001,00000000,00000000), ref: 00417D19
                  • LCMapStringA.KERNEL32(00000000,00000003,004194D6,00000000,00000100,00000200), ref: 00417D70
                  • MultiByteToWideChar.KERNEL32(00000000,0041A36F,004194D6,00000000,00000000,00000000), ref: 00417DB5
                  • MultiByteToWideChar.KERNEL32(00000000,00000001,004194D6,00000000,00000000,00000000), ref: 00417E30
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: String$ByteCharMultiWide
                  • String ID:
                  • API String ID: 352835431-0
                  • Opcode ID: 01278195971723342fbabdfc1b2a873a6db67d6fc300b4a9b5224824228a19c4
                  • Instruction ID: 05156953cc69995d9a9b0754f977aed96c249debba4c3025e36c8f34cdb06064
                  • Opcode Fuzzy Hash: 01278195971723342fbabdfc1b2a873a6db67d6fc300b4a9b5224824228a19c4
                  • Instruction Fuzzy Hash: E1912E71A18209EFDB14CF98DC85FEF77B5AB4C714F104519F516A7280D378A882CB69
                  Function 004114B0 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 258COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: __malloc_dbg
                  • String ID: **argv != _T('\0')$*argv != NULL$*filename != _T('\0')$PATH$argv != NULL$filename != NULL$spawnvpe.c
                  • API String ID: 95588982-2541656211
                  • Opcode ID: 80bf3dba0f26099f04ae9f923c9f9d5e291853e0466a80584471af6c7a438ff7
                  • Instruction ID: 37af444ce89d8d7e135453ac8d829c0e2a6d6bbd6e28f3890fe94f2f5fac1944
                  • Opcode Fuzzy Hash: 80bf3dba0f26099f04ae9f923c9f9d5e291853e0466a80584471af6c7a438ff7
                  • Instruction Fuzzy Hash: EF8135B5E00308B7DF10EB609D82BEF3361AB54709F24406BF615662D2E27D9E80C75A
                  Function 00412A20 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 131fileCOMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • GetStdHandle.KERNEL32(000000F4,?,00000000), ref: 00412AD6
                  • WriteFile.KERNEL32(00000000,?,00000000), ref: 00412ADD
                  • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00412B03
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: File$HandleModuleNameWrite
                  • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                  • API String ID: 3784150691-4022980321
                  • Opcode ID: 88d0e2207bf43fd7bec36afd29e3b3fd9d15f823a4aeb70c5964c8176722d63d
                  • Instruction ID: db537be0bfcd3d2edc3e2339de3e67db8b267f8ac8a2ac74428378f563bcf3e1
                  • Opcode Fuzzy Hash: 88d0e2207bf43fd7bec36afd29e3b3fd9d15f823a4aeb70c5964c8176722d63d
                  • Instruction Fuzzy Hash: B141C975D00208BBDB24DF50EC81FEE7734FB58304F10456AF505A6281E7796AA4CB59
                  Function 00402850 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 87registryCOMMON
                  Download Yara Rule
                  APIs
                  • RegCreateKeyExA.ADVAPI32(80000001,Software\Sam Printer,00000000,00000000,00000000,00000002,00000000,?,?), ref: 004028E1
                  • RegSetValueExA.ADVAPI32(?,OutputFolder,00000000,00000001,?,-00000001), ref: 00402920
                  • RegFlushKey.ADVAPI32(?), ref: 0040293C
                  • RegCloseKey.ADVAPI32(?), ref: 00402952
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: CloseCreateFlushValue
                  • String ID: C:\Program Files (x86)\SAM 11\Jobs$OutputFolder$Software\Sam Printer
                  • API String ID: 607596385-751017500
                  • Opcode ID: 7acfe40bf6c2600186672f0f0bb44ec28c0e104aa534d3420f876f35d9f36e4b
                  • Instruction ID: f724d4fe83f9ca2e2576fe9349c1ed22fa989598f9d417b1a2c4d78639071db0
                  • Opcode Fuzzy Hash: 7acfe40bf6c2600186672f0f0bb44ec28c0e104aa534d3420f876f35d9f36e4b
                  • Instruction Fuzzy Hash: B121B972D002186BDB20A768DD87BDAB765AB54704F0001EAFF09771C2D9B96E848FD6
                  Function 00401ED0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 87registryCOMMON
                  Download Yara Rule
                  APIs
                  • RegCreateKeyExA.ADVAPI32(80000002,Software\ActMask Virtual Printer SDK,00000000,00000000,00000000,00000002,00000000,?,?), ref: 00401F61
                  • RegSetValueExA.ADVAPI32(?,OutputFolder,00000000,00000001,?,-00000001), ref: 00401FA0
                  • RegFlushKey.ADVAPI32(?), ref: 00401FBC
                  • RegCloseKey.ADVAPI32(?), ref: 00401FD2
                  Strings
                  • Software\ActMask Virtual Printer SDK, xrefs: 00401F57
                  • C:\Program Files (x86)\SAM 11\Jobs, xrefs: 00401F0B
                  • OutputFolder, xrefs: 00401F94
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: CloseCreateFlushValue
                  • String ID: C:\Program Files (x86)\SAM 11\Jobs$OutputFolder$Software\ActMask Virtual Printer SDK
                  • API String ID: 607596385-357137661
                  • Opcode ID: a40f99916c30ebaaf48728e05caf15fe3d73696a7c06a9e99ccc1ad45ed8b389
                  • Instruction ID: c2f7ad114af68db23c007025cc7d27e66da39161ba311401493da86c670d454c
                  • Opcode Fuzzy Hash: a40f99916c30ebaaf48728e05caf15fe3d73696a7c06a9e99ccc1ad45ed8b389
                  • Instruction Fuzzy Hash: E621E972D002186BDB20A768DD87BDAB765AB14704F0001EAFF09771C2D9B86E848FD6
                  Function 004023B0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 87registryCOMMON
                  Download Yara Rule
                  APIs
                  • RegCreateKeyExA.ADVAPI32(80000002,Software\Sam Printer,00000000,00000000,00000000,00000002,00000000,?,?), ref: 00402441
                  • RegSetValueExA.ADVAPI32(?,OutputFolder,00000000,00000001,?,-00000001), ref: 00402480
                  • RegFlushKey.ADVAPI32(?), ref: 0040249C
                  • RegCloseKey.ADVAPI32(?), ref: 004024B2
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: CloseCreateFlushValue
                  • String ID: C:\Program Files (x86)\SAM 11\Jobs$OutputFolder$Software\Sam Printer
                  • API String ID: 607596385-751017500
                  • Opcode ID: 0ee82b993aab1234e95ee4bbce18c1fb7a0830a31ca9abe23a9a1628999e9747
                  • Instruction ID: a4734e544219d9386784afe7e2ec6f90688d1338933e3b51f73bfb38de5f7283
                  • Opcode Fuzzy Hash: 0ee82b993aab1234e95ee4bbce18c1fb7a0830a31ca9abe23a9a1628999e9747
                  • Instruction Fuzzy Hash: A521B972D002186BDB20A768DD87BDAB765AB54704F0001EAFF09771C2D9B96E848FD6
                  Function 00414710 Relevance: 10.8, APIs: 5, Strings: 2, Instructions: 347COMMONLIBRARYCODE
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID:
                  • String ID: d@$d@
                  • API String ID: 0-1147163746
                  • Opcode ID: b1475cb87a9877e66f595339a6ad205f6aeb72d99980a4b45f50f55950d7bb4a
                  • Instruction ID: 307b395747d11533b076147d32faa5ce34bcf4089e78d1b6b7c5a1a571645bd1
                  • Opcode Fuzzy Hash: b1475cb87a9877e66f595339a6ad205f6aeb72d99980a4b45f50f55950d7bb4a
                  • Instruction Fuzzy Hash: 54E10AB5D00108EFDB04DFA5D885BEE77B5AF88314F10C52AE9299B241D339EA81CF59
                  Function 00419E20 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 224COMMON
                  Download Yara Rule
                  APIs
                  • __malloc_dbg.LIBCMTD ref: 00419EDB
                  • _findenv.LIBCMTD ref: 00419F59
                  • __malloc_dbg.LIBCMTD ref: 0041A096
                  • SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0041A0E5
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: __malloc_dbg$EnvironmentVariable_findenv
                  • String ID: setenv.c
                  • API String ID: 1519929335-187379886
                  • Opcode ID: 2040b55ea285fe89902350f308f12956239bd2ec155e54f7ad2ba3256e75e557
                  • Instruction ID: 61efbb96844000ee2a3a718c588ffd2aa265b787f8534e4120c083474cddf316
                  • Opcode Fuzzy Hash: 2040b55ea285fe89902350f308f12956239bd2ec155e54f7ad2ba3256e75e557
                  • Instruction Fuzzy Hash: 2D916C74D00208EFDB10DF95C889BEE7BB1FB48308F10856AE555A73C1D7799A91CB8A
                  Function 00412620 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 154COMMON
                  Download Yara Rule
                  APIs
                  • GetVersionExA.KERNEL32(00000094), ref: 00412648
                  • GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 0041267F
                  • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00412706
                  • _mbtowc.LIBCMTD ref: 004127E3
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: EnvironmentFileModuleNameVariableVersion_mbtowc
                  • String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
                  • API String ID: 134279942-4131005785
                  • Opcode ID: b2d8cf7bc35e8c40f83ec13327a6c35a46c77cfc7e76626142c4c69ecb5f5610
                  • Instruction ID: 5062cca0f06b481aa7ed101116206be575b164fb37d3a9c212a44303c433d39f
                  • Opcode Fuzzy Hash: b2d8cf7bc35e8c40f83ec13327a6c35a46c77cfc7e76626142c4c69ecb5f5610
                  • Instruction Fuzzy Hash: C651A030900258DBDB24DB64CA90BEEB7B1AF45304F2442DAE415EB291D7B89FE0DF19
                  Function 00402CF0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 86processsynchronizationCOMMON
                  Download Yara Rule
                  APIs
                  • CreateProcessA.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 00402D95
                  • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00402DB6
                  • CloseHandle.KERNEL32(?), ref: 00402DCC
                  • CloseHandle.KERNEL32(?), ref: 00402DE2
                  Strings
                  • D, xrefs: 00402D3D
                  • virtualprinter.exe /VERYSILENT /PASSWORD=452193106-tric@comprisetechnologies.com, xrefs: 00402D5A
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: CloseHandle$CreateObjectProcessSingleWait
                  • String ID: D$virtualprinter.exe /VERYSILENT /PASSWORD=452193106-tric@comprisetechnologies.com
                  • API String ID: 2059082233-759434158
                  • Opcode ID: b232bbb914c00a8e003f588dc49571e3945ef95c4d4d787101b1d4d06ef8f823
                  • Instruction ID: eebaf1e81db780cde43fe9674fdba576f348e83c56bb236c4124903c5c4d6b1c
                  • Opcode Fuzzy Hash: b232bbb914c00a8e003f588dc49571e3945ef95c4d4d787101b1d4d06ef8f823
                  • Instruction Fuzzy Hash: A9210B72D001146BD730AB68DC46BE977789B44714F0002B9FA1DB72C2DA7C5E84CBD5
                  Function 004047D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74registryCOMMON
                  Download Yara Rule
                  APIs
                  • RegCreateKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Services\SamClientManager,00000000,00000000,00000000,00000002,00000000,?,?), ref: 0040482F
                  • RegSetValueExA.ADVAPI32(?,ImagePath,00000000,00000001,?,-00000001), ref: 00404868
                  • RegFlushKey.ADVAPI32(?), ref: 00404884
                  • RegCloseKey.ADVAPI32(?), ref: 0040489A
                  Strings
                  • ImagePath, xrefs: 0040485C
                  • SYSTEM\CurrentControlSet\Services\SamClientManager, xrefs: 00404825
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: CloseCreateFlushValue
                  • String ID: ImagePath$SYSTEM\CurrentControlSet\Services\SamClientManager
                  • API String ID: 607596385-3284653867
                  • Opcode ID: c144b6504adfd2cb64d15ccc9ca924e855c85d1973fc5bf3d39ae48f10376fb2
                  • Instruction ID: b2a3103e658a6491abf32455b508b900433a8ebc410f49996e79a3761425a264
                  • Opcode Fuzzy Hash: c144b6504adfd2cb64d15ccc9ca924e855c85d1973fc5bf3d39ae48f10376fb2
                  • Instruction Fuzzy Hash: AF21A872E002146BD730EB68DC87BDA7765AB48700F1041A9FE49B72C2D5B96E848FD6
                  Function 00404120 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 64registryCOMMON
                  Download Yara Rule
                  APIs
                  • RegCreateKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Run,00000000,00000000,00000000,00000002,00000000,?,?), ref: 0040417F
                  • RegDeleteValueA.ADVAPI32(?,Sam), ref: 004041A0
                  • RegFlushKey.ADVAPI32(?), ref: 004041BC
                  • RegCloseKey.ADVAPI32(?), ref: 004041D2
                  Strings
                  • Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00404175
                  • Sam, xrefs: 00404194
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: CloseCreateDeleteFlushValue
                  • String ID: Sam$Software\Microsoft\Windows\CurrentVersion\Run
                  • API String ID: 2712752813-1728992844
                  • Opcode ID: 7b3d7beae0c3f5083302c3174eb07c88ec47d9569eb4b73dfef10b0fa4b84f91
                  • Instruction ID: b2bce595e0a5c668712f7e9de05f4ce2e40f6ae1a90d0cc60e6cd71dfadcef2e
                  • Opcode Fuzzy Hash: 7b3d7beae0c3f5083302c3174eb07c88ec47d9569eb4b73dfef10b0fa4b84f91
                  • Instruction Fuzzy Hash: 9511C832D042246FD730AB68DC87BD9B7659B48710F4042E9FE4977282C9B81E848FD6
                  Function 00401D30 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46libraryloaderCOMMON
                  Download Yara Rule
                  APIs
                  • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401D5D
                  • GetProcAddress.KERNEL32(00000000), ref: 00401D6B
                  • GetCurrentProcess.KERNEL32(00000000), ref: 00401D8E
                  • IsWow64Process.KERNEL32(00000000), ref: 00401D9C
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: Process$AddressCurrentHandleModuleProcWow64
                  • String ID: IsWow64Process$kernel32
                  • API String ID: 1745181078-3789238822
                  • Opcode ID: 2cde0d0258dafb766c8c7bac673b83dc3a7f814209b10471ac08e6fc10f76616
                  • Instruction ID: d309744d6cccf2dd664d14ec7c27edfb376958ce5993f95917eba74a0180cdb0
                  • Opcode Fuzzy Hash: 2cde0d0258dafb766c8c7bac673b83dc3a7f814209b10471ac08e6fc10f76616
                  • Instruction Fuzzy Hash: 8C01D672D00614AFD710FB6DEA4B78E76AADB44314F510136FD0AA3243CA7D5E40D6DA
                  Function 00416380 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 331COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • IsBadWritePtr.KERNEL32(00000000,00000000), ref: 00416399
                  • IsBadWritePtr.KERNEL32(?,000041C4), ref: 004163FF
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: Write
                  • String ID: $ $?
                  • API String ID: 3165279579-1466984971
                  • Opcode ID: 69b2636fa6e42c7fdffd5f7f5e4ef6e7f07352957bb5fa0195c18f95215acef6
                  • Instruction ID: 217697bf310d686ded51764168f20f20d041bd8402d007a79e1f20355fc6b99e
                  • Opcode Fuzzy Hash: 69b2636fa6e42c7fdffd5f7f5e4ef6e7f07352957bb5fa0195c18f95215acef6
                  • Instruction Fuzzy Hash: 1BF1D670A01529CBCB64CF58C9907EDB7B2BB85315F2582DAD419AB394C734AEC1CF89
                  Function 00419740 Relevance: 9.1, APIs: 6, Instructions: 143COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • GetStringTypeW.KERNEL32(00000001,00434D68,00000001,00000001), ref: 0041977C
                  • GetStringTypeA.KERNEL32(00000000,00000001,00434D64,00000001,00000001), ref: 004197A1
                  • GetStringTypeA.KERNEL32(00000000,00000000,00000000,00000002,00000001), ref: 004197EA
                  • MultiByteToWideChar.KERNEL32(00000000,00417A5C,00000000,00000002,00000000,00000000), ref: 0041982F
                  • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000002,00000000,00000000), ref: 004198BB
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: StringType$ByteCharMultiWide
                  • String ID:
                  • API String ID: 3852931651-0
                  • Opcode ID: 4c7ef23a516985e17ded5de6c7c4a606beca26534520f8978b139599e65edbbf
                  • Instruction ID: fd6798adf055d9add460c3064494c952ff49f2db520f6c5dbb0a19e8e9e6ffb8
                  • Opcode Fuzzy Hash: 4c7ef23a516985e17ded5de6c7c4a606beca26534520f8978b139599e65edbbf
                  • Instruction Fuzzy Hash: 49516C71A14209EFDB14DF94DC55BEE77B4FB88710F10812AF515A3280D378AC85CBAA
                  Function 0040B430 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 333fileCOMMON
                  Download Yara Rule
                  APIs
                  • ReadFile.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0040B565
                  • GetLastError.KERNEL32 ref: 0040B56F
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: ErrorFileLastRead
                  • String ID: m
                  • API String ID: 1948546556-3775001192
                  • Opcode ID: 35f77114c8bf0869a07bb57ba686ed852672219658d63af2e76933d358489f54
                  • Instruction ID: a0f7936504c64c593639d722cf0b78816e5daf4ae4629877618cae88c3b175bd
                  • Opcode Fuzzy Hash: 35f77114c8bf0869a07bb57ba686ed852672219658d63af2e76933d358489f54
                  • Instruction Fuzzy Hash: 0EE18131A04148DFCB04CF58D891AAE7BB2FF41344F28C1A9E951AF395C735EA61CB89
                  Function 004128E0 Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON
                  Download Yara Rule
                  APIs
                  • VirtualFree.KERNEL32(?,00100000,00004000), ref: 00412929
                  • VirtualFree.KERNEL32(?,00000000,00008000), ref: 0041293D
                  • HeapFree.KERNEL32(022B0000,00000000,?), ref: 00412952
                  • HeapFree.KERNEL32(022B0000,00000000,00000000), ref: 00412972
                  • VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000), ref: 004129A1
                  • HeapDestroy.KERNEL32(022B0000), ref: 004129BE
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: Free$HeapVirtual$Destroy
                  • String ID:
                  • API String ID: 716807051-0
                  • Opcode ID: bf25d3c9a7bf647571f23c924db358fff78b447fcedb87037a5722378769e3d1
                  • Instruction ID: 9fd926b4f73754275418833a2ec83d557b021112a8224f8347f2fcc480ce1c50
                  • Opcode Fuzzy Hash: bf25d3c9a7bf647571f23c924db358fff78b447fcedb87037a5722378769e3d1
                  • Instruction Fuzzy Hash: 5F217F74E40204EFCB04CF94E998FADB775FB48314F209199E6519B390C3B5A991CF49
                  Function 0040DB4C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 107COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: __aulldiv__aullrem
                  • String ID: '$0$9
                  • API String ID: 3839614884-269856862
                  • Opcode ID: a3e86c7f8dfc52b6348d2e03d51af875407cadcfc84a5fe1e8a81ee14d439228
                  • Instruction ID: d44bccd849562a1beabc06ff1544b6064d3e5401f4184879e3d296b38eb31e29
                  • Opcode Fuzzy Hash: a3e86c7f8dfc52b6348d2e03d51af875407cadcfc84a5fe1e8a81ee14d439228
                  • Instruction Fuzzy Hash: B851E570D09219CBEF24DF69C9887A9B7B5BF84304F2481EAD449B6280D7395E89CF04
                  Function 00401890 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64filewindowCOMMON
                  Download Yara Rule
                  APIs
                  • FormatMessageA.KERNEL32(00001100,00000000,?,00000400,?,00000000,00000000), ref: 004018D8
                  • GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00401902
                  • WriteFile.KERNEL32(00000000), ref: 00401910
                  • LocalFree.KERNEL32(?), ref: 00401923
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: FileFormatFreeHandleLocalMessageWrite
                  • String ID: %s error!
                  • API String ID: 1527288610-1051387413
                  • Opcode ID: 795880195908c3300e6398b19a21328890e70b6245be40bba63fed7168db0102
                  • Instruction ID: 66b170ac35bbab82228d69f91c5157293776d5393f6303539785d0e379d3bc05
                  • Opcode Fuzzy Hash: 795880195908c3300e6398b19a21328890e70b6245be40bba63fed7168db0102
                  • Instruction Fuzzy Hash: C811CE72E04208BBD610EB99EC87F8E77699B48750F504125FE05A72C2CA796E40C7EA
                  Function 004037C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64registryCOMMON
                  Download Yara Rule
                  APIs
                  • RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 00403831
                  • RegQueryValueExA.ADVAPI32(00000000,DefaultDomainName,00000000,?,?,00000100), ref: 00403857
                  • RegCloseKey.ADVAPI32(00000000), ref: 0040386A
                  Strings
                  • DefaultDomainName, xrefs: 0040384E
                  • Software\Microsoft\Windows NT\CurrentVersion\Winlogon, xrefs: 00403804
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: CloseOpenQueryValue
                  • String ID: DefaultDomainName$Software\Microsoft\Windows NT\CurrentVersion\Winlogon
                  • API String ID: 3677997916-97618005
                  • Opcode ID: a7e3624a9841b91dc0f66c216c418488b64ff4dd6285605dce40385ce1f64a37
                  • Instruction ID: bd692f9aaa5f5c2b3e9646e02a59196968aaf475f290cf4a62dcc985732ff7c2
                  • Opcode Fuzzy Hash: a7e3624a9841b91dc0f66c216c418488b64ff4dd6285605dce40385ce1f64a37
                  • Instruction Fuzzy Hash: 20118172D003186BD720EB94ED86BDEB7B8EB44704F500129ED097B182D7795E44CBE6
                  Function 00410DB0 Relevance: 7.7, APIs: 5, Instructions: 225COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • ___AdjustPointer.LIBCMTD ref: 00410E5D
                  • ___AdjustPointer.LIBCMTD ref: 00410EE1
                  • ___AdjustPointer.LIBCMTD ref: 00410F3F
                  • ___AdjustPointer.LIBCMTD ref: 00410FBA
                    • Part of subcall function 00417C00: IsBadReadPtr.KERNEL32(?,?), ref: 00417C13
                    • Part of subcall function 00417C30: IsBadWritePtr.KERNEL32(?,00410F84), ref: 00417C43
                  • ___AdjustPointer.LIBCMTD ref: 00410FE3
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: AdjustPointer$ReadWrite
                  • String ID:
                  • API String ID: 152555143-0
                  • Opcode ID: 05bf5dcf9e5f5af0fe948378a8740e19f20d9c6ec931aa4560dc85f144a6f01c
                  • Instruction ID: 6a55d3f2a2a23d25ab4920ce1bfbc6c2f4ac76c38985a11eb11eaf4fd6e37432
                  • Opcode Fuzzy Hash: 05bf5dcf9e5f5af0fe948378a8740e19f20d9c6ec931aa4560dc85f144a6f01c
                  • Instruction Fuzzy Hash: 92818BB5A002069BCB14CF55D881FAB73B5AF48309F14851AFD059B382D779ECD2CBA9
                  Function 004105A0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: Catch
                  • String ID: csm$csm$csm
                  • API String ID: 78271584-393685449
                  • Opcode ID: cb8da262047485ac3e69058ebf785511f3e49ad9220c9afe8584d6966f3e3998
                  • Instruction ID: 89a5e277fb0c64f3aa06cb3304f269d41a1cab52218bf5c431252cf08418c3c4
                  • Opcode Fuzzy Hash: cb8da262047485ac3e69058ebf785511f3e49ad9220c9afe8584d6966f3e3998
                  • Instruction Fuzzy Hash: 5C91FA75900209DFCB14CF94C980AEEB7B5BF88304F10815AE915AB345D779E9D2CF99
                  Function 00413240 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 159fileCOMMON
                  Download Yara Rule
                  APIs
                  • SetEndOfFile.KERNEL32(00000000), ref: 00413452
                  • GetLastError.KERNEL32 ref: 00413478
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: ErrorFileLast
                  • String ID: chsize.c$size >= 0
                  • API String ID: 734332943-808803129
                  • Opcode ID: 9ac3410b46a12596adc7840d9d00b1934e6f715eca3d89ad5e4ba15c84aa4626
                  • Instruction ID: cc9f4f5e4693952710a726292a8818e6ea1e15adf3032dca80fa3ed5234f577d
                  • Opcode Fuzzy Hash: 9ac3410b46a12596adc7840d9d00b1934e6f715eca3d89ad5e4ba15c84aa4626
                  • Instruction Fuzzy Hash: D361B374D00258EBDB20DF24DC45BD97770AB48356F1082EAE59DAA2C0D7B89BC4CF99
                  Function 0040DB36 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: __aulldiv__aullrem
                  • String ID: 0$9
                  • API String ID: 3839614884-1975997740
                  • Opcode ID: 8bd950620e442c3716fca5be7573bae8d8f7bb93a3a8ef991f64b88d7796bb7c
                  • Instruction ID: ac9dbdc91b4f6fc841931d38ce7ceecc1bbdd38af0108b288e08b2412dc8d783
                  • Opcode Fuzzy Hash: 8bd950620e442c3716fca5be7573bae8d8f7bb93a3a8ef991f64b88d7796bb7c
                  • Instruction Fuzzy Hash: 9151E3B0D09219CBEF24DF69C9887A9B7B5BF84304F2481EAD449B6280D7395E89CF04
                  Function 0040D160 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 103COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: __malloc_dbg
                  • String ID: @mC$_sftbuf.c$str != NULL
                  • API String ID: 95588982-3780869924
                  • Opcode ID: 4d321c7bf40d4a000ac393eb120edc040ce2f2a785ed6f5adbdc31cc006abd76
                  • Instruction ID: 08fb9188538a506b24d1c9f3efd1b8022f9f4739d77c4c5df71152a5e50bdd72
                  • Opcode Fuzzy Hash: 4d321c7bf40d4a000ac393eb120edc040ce2f2a785ed6f5adbdc31cc006abd76
                  • Instruction Fuzzy Hash: E541B474E00208EFDB14CF84D985B9AB7B1FB48354F2480A9E945AB3C1C778DE85DB89
                  Function 00411E90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON
                  Download Yara Rule
                  APIs
                  • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\SmartDeploy.exe,00000104,?,?,?,?,0040ABBA), ref: 00411EB0
                  • __malloc_dbg.LIBCMTD ref: 00411F13
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: FileModuleName__malloc_dbg
                  • String ID: C:\Users\user\Desktop\SmartDeploy.exe$stdargv.c
                  • API String ID: 3332595345-1669785613
                  • Opcode ID: 75d83408be15f303bfa5aa5af35113da1b063a47ce3c66f1959334b658ae2638
                  • Instruction ID: f00f8a17019f099544e696264115f40fd8f119957bbb1239db7eab3345b05ae9
                  • Opcode Fuzzy Hash: 75d83408be15f303bfa5aa5af35113da1b063a47ce3c66f1959334b658ae2638
                  • Instruction Fuzzy Hash: 7E2181B5D40208AFDB00DFD4D881FAE77B5FB48308F10416EE64567291D774AA50CB5A
                  Function 00418A40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMON
                  Download Yara Rule
                  APIs
                  • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00411A92), ref: 00418A6E
                  • __malloc_dbg.LIBCMTD ref: 00418A8F
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: ByteCharMultiWide__malloc_dbg
                  • String ID: wtombenv.c
                  • API String ID: 2549311186-4180475916
                  • Opcode ID: e1c917bb4f07b8d94b77c4d784519f87b05b5afed0aa036dbd62fca03a66d580
                  • Instruction ID: c7f6a1e8167a52646628ed393a0522b59a56b7c999643ddb09d1496b0759700b
                  • Opcode Fuzzy Hash: e1c917bb4f07b8d94b77c4d784519f87b05b5afed0aa036dbd62fca03a66d580
                  • Instruction Fuzzy Hash: 9C21B170F40208FFEB10DBA4DC42FAE7774AF54724F30469AF121AB2C0D6B46A808B49
                  Function 004169E0 Relevance: 6.4, APIs: 5, Instructions: 130memoryCOMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • HeapAlloc.KERNEL32(022B0000,00000000,00002020), ref: 00416A05
                  • VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004), ref: 00416A29
                  • VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004), ref: 00416A4C
                  • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00416B96
                  • HeapFree.KERNEL32(022B0000,00000000,004374F8), ref: 00416BB2
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: AllocVirtual$FreeHeap
                  • String ID:
                  • API String ID: 714016831-0
                  • Opcode ID: b22accb5a9eea814b83b9bd745f6e208ec58a598a158c3d37c1080e40be65c92
                  • Instruction ID: e9867e6603508d298ed6956235b98fe0909b6a4e13d8d757dfe80f82f62ff7f5
                  • Opcode Fuzzy Hash: b22accb5a9eea814b83b9bd745f6e208ec58a598a158c3d37c1080e40be65c92
                  • Instruction Fuzzy Hash: 09512C74E04204EFCB14CF94D844B9DBBB5EB58315F21C1AAE965AB391C374BA81DF48
                  Function 00418630 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 297COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: __malloc_dbg
                  • String ID: cenvarg.c
                  • API String ID: 95588982-3932032245
                  • Opcode ID: fd15f33865eec77170686aa9e386461ba485cc49e9fb06962b8fedaf42ab09ec
                  • Instruction ID: 8392b7bbdc02e31b47bdf0942a35c27f8b5b204cc7366416a45e02a49bc4e6a5
                  • Opcode Fuzzy Hash: fd15f33865eec77170686aa9e386461ba485cc49e9fb06962b8fedaf42ab09ec
                  • Instruction Fuzzy Hash: 06D12BB4D0020ADFCB04CF99C891BAEB7B1BF44308F24856ED4256B391D739A991CF5A
                  Function 00418F50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 175COMMON
                  Download Yara Rule
                  APIs
                  • GetCPInfo.KERNEL32(000004E4,?), ref: 00418F67
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: Info
                  • String ID: $z
                  • API String ID: 1807457897-2251613814
                  • Opcode ID: 205ad91511076d1be262285e19c09a898eb4a49f8057d636aef95d0b897c6013
                  • Instruction ID: 9baef808a439769b998459278c029197b359d1540dcc4d7536add3ce545291f8
                  • Opcode Fuzzy Hash: 205ad91511076d1be262285e19c09a898eb4a49f8057d636aef95d0b897c6013
                  • Instruction Fuzzy Hash: 2981B17098465C9BEB24CB05CC54BEBBB71AF58301F2484DAD8895B342C2361FD2CF99
                  Function 0040DB8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: __aulldiv__aullrem
                  • String ID: 9
                  • API String ID: 3839614884-2366072709
                  • Opcode ID: 5240863b4b0f1fe99bd1ae15ef344833cb327328130b9292cc703f1c8fbefc7a
                  • Instruction ID: 5ecbda6dbae678aaac8c2d3162e85a9b671e7aa2394105d77e4884cad52ab5bb
                  • Opcode Fuzzy Hash: 5240863b4b0f1fe99bd1ae15ef344833cb327328130b9292cc703f1c8fbefc7a
                  • Instruction Fuzzy Hash: AD41F8B0D09618CBEF24DF69C9897A9B7B5BF44304F2081EAD449B7240D7395E85CF04
                  Function 00411D40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: __malloc_dbg
                  • String ID: stdenvp.c
                  • API String ID: 95588982-3286689081
                  • Opcode ID: e2fe1ead4b8c92239a9ea3bc4b995376f546fe374ff00761613de13af461d41e
                  • Instruction ID: d964b0b71603f246a60cdb85f8017a736bbee03781c1718698a1ced11194fb48
                  • Opcode Fuzzy Hash: e2fe1ead4b8c92239a9ea3bc4b995376f546fe374ff00761613de13af461d41e
                  • Instruction Fuzzy Hash: 5B4195B4E00208EFDB04DF95D881BAEB7B1FF45308F1484AAD50567391E779AA50CF4A
                  Function 0040DB2A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: __aulldiv__aullrem_get_int_arg
                  • String ID: 9
                  • API String ID: 1225292562-2366072709
                  • Opcode ID: 90cefe1e75e522b05bf6c1a4a30b4fc34200fe635c1827205c8287b62815e8a3
                  • Instruction ID: d0321a02ebea2f52841344aee81d6355e59d451c8192c71b1c214e81e102795a
                  • Opcode Fuzzy Hash: 90cefe1e75e522b05bf6c1a4a30b4fc34200fe635c1827205c8287b62815e8a3
                  • Instruction Fuzzy Hash: 1741D5B0D09619CBEF24DF69C989BA9B7B5BF84304F2081EAD44DB6240D7395E89CF14
                  Function 00412E40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: __malloc_dbg
                  • String ID: @$osfinfo.c
                  • API String ID: 95588982-966336706
                  • Opcode ID: 9091913b4739e7ccfc595d8042fab2edca70cdb15088939cedfc7048a3f4d9af
                  • Instruction ID: 00d5413ff8f2d8db586b5a552b3f3c9e0d31fa21395091c2ed0e7c4a1e266fc8
                  • Opcode Fuzzy Hash: 9091913b4739e7ccfc595d8042fab2edca70cdb15088939cedfc7048a3f4d9af
                  • Instruction Fuzzy Hash: B5316530D44209EFCB14CF98D650BEDB772EB45301F2482AAD565A7380D3746FA2DB4A
                  Function 0041A180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: __malloc_dbg
                  • String ID: setenv.c
                  • API String ID: 95588982-187379886
                  • Opcode ID: f94ec4dd0d6ab9e5baacbbbe5d08e3137a1acb9090fed191d73ea0736ed20ade
                  • Instruction ID: 27f00529cc0d7a119a5210c29027b32d2c8dc3f7d20d2740d736df350a6846e2
                  • Opcode Fuzzy Hash: f94ec4dd0d6ab9e5baacbbbe5d08e3137a1acb9090fed191d73ea0736ed20ade
                  • Instruction Fuzzy Hash: 54312FB4E00208EFDB04DF95C881B9EB771FF44308F1484AAE8156B381E779AA91CF85
                  Function 00419670 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: __malloc_dbg
                  • String ID: _getbuf.c$str != NULL
                  • API String ID: 95588982-3136621515
                  • Opcode ID: f71df8850d88d23fc3a49fe9619690e4aa9c543667c04609423243e574051be9
                  • Instruction ID: c98d75c3aa28871fab40fd9fda5b0ba59d892f5332ab6d6bd35ecdcf0f7e3a3e
                  • Opcode Fuzzy Hash: f71df8850d88d23fc3a49fe9619690e4aa9c543667c04609423243e574051be9
                  • Instruction Fuzzy Hash: E1211D74A40208EFD704CF49C995FAAB7B5FB88354F248199E8096B382D375AE81DB94
                  Function 00415960 Relevance: 5.1, APIs: 4, Instructions: 78memoryCOMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • HeapReAlloc.KERNEL32(022B0000,00000000,00000000,-00000010,004144D1,?,00415567), ref: 0041598D
                  • HeapAlloc.KERNEL32(022B0000,00000008,000041C4,004144D1,?,00415567), ref: 004159DC
                  • VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,00415567), ref: 00415A03
                  • HeapFree.KERNEL32(022B0000,00000000,00000000,?,00415567), ref: 00415A28
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: AllocHeap$FreeVirtual
                  • String ID:
                  • API String ID: 3499195154-0
                  • Opcode ID: 3ebdc3569c7b462db479a2a337c279ef576faa9efb06f187f1826613a87165f0
                  • Instruction ID: 02f67957300e9014589ce4c0b18274e3c93b59e408241cebb520ee892cb77153
                  • Opcode Fuzzy Hash: 3ebdc3569c7b462db479a2a337c279ef576faa9efb06f187f1826613a87165f0
                  • Instruction Fuzzy Hash: 8E318D70A40204EFD704CF98D994B99F7B2FB88314F209669E6459B391C371BE81CB59
                  Function 00401554 Relevance: 5.0, APIs: 4, Instructions: 33memoryCOMMON
                  Download Yara Rule
                  APIs
                  • GetProcessHeap.KERNEL32(00000000,00000000,00401552), ref: 0040155E
                  • HeapFree.KERNEL32(00000000), ref: 0040156C
                  • GetProcessHeap.KERNEL32(00000000), ref: 00401593
                  • HeapFree.KERNEL32(00000000), ref: 004015A1
                  Memory Dump Source
                  • Source File: 00000000.00000002.1852721871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                  • Associated: 00000000.00000002.1852706331.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852721871.0000000000420000.00000020.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852775337.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852798937.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852882733.0000000000437000.00000008.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852901725.000000000043D000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.1852938279.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_400000_SmartDeploy.jbxd
                  Similarity
                  • API ID: Heap$FreeProcess
                  • String ID:
                  • API String ID: 3859560861-0
                  • Opcode ID: f53fac98da3c3c10764ad42025903b402c47cb6674f0c796e4b683bb8dfba7f8
                  • Instruction ID: 49aa0ca6972029055dd0f8efe2820bf1442150f8f725fb93c3f0bcf9582c2c2a
                  • Opcode Fuzzy Hash: f53fac98da3c3c10764ad42025903b402c47cb6674f0c796e4b683bb8dfba7f8
                  • Instruction Fuzzy Hash: 22F05471D002019FD710BF24DC9AB5E3366AF94724F814125F8166B2D2CB3CAC40CBD9