Create Interactive Tour

Windows Analysis Report NI License Activator 1.1.exe

Overview

General Information

Sample Name:	NI License Activator 1.1.exe
Analysis ID:	494150
MD5:	4996a8ee6e6d88ec1d84b6a82e3ce8c4
SHA1:	c1bf05826cd7b06216fc67321fa6c45231c1ccc6
SHA256:	9cff2c27f5540c58601b4615fbdcda506e031b34a4d4afe6dd85993557f861fb
Infos:
Most interesting Screenshot:

Detection

Score:	26
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Contains functionality to detect sleep reduction / modifications

Uses 32bit PE files

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Found large amount of non-executed APIs

May check if the current machine is a sandbox (GetTickCount - Sleep)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

NI License Activator 1.1.exe (PID: 5380 cmdline: 'C:\Users\user\Desktop\NI License Activator 1.1.exe' MD5: 4996A8EE6E6D88EC1D84B6A82E3CE8C4)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

• Compliance
• Spreading
• Networking
• System Summary
• Data Obfuscation
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

Source: NI License Activator 1.1.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: NI License Activator 1.1.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00DB50D4 FindFirstFileA,FindFirstFileW,	0_2_00DB50D4
Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00E6A1E4 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_wcslen,_IsRootUNCName,GetDriveTypeW,_free,___loctotime32_t,_free,__wsopen_s,__fstat32,__close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	0_2_00E6A1E4
Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00E5D260 FindFirstFileExA,GetLastError,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,_strcpy_s,__invoke_watson,	0_2_00E5D260

Source: NI License Activator 1.1.exe, 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp

String found in binary or memory: http://www.sonsivri.com

Source: NI License Activator 1.1.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: NI License Activator 1.1.exe, 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameNI License Activator.exeJ vs NI License Activator 1.1.exe
Source: NI License Activator 1.1.exe	Binary or memory string: OriginalFilenameNI License Activator.exeJ vs NI License Activator 1.1.exe

Source: NI License Activator 1.1.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: NI License Activator 1.1.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00D43EB0	0_2_00D43EB0
Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00D621BB	0_2_00D621BB
Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00D9E208	0_2_00D9E208
Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00DA9340	0_2_00DA9340
Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00D58336	0_2_00D58336
Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00D424E0	0_2_00D424E0
Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00E25400	0_2_00E25400
Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00D5A634	0_2_00D5A634
Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00D867D9	0_2_00D867D9
Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00D7A795	0_2_00D7A795
Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00E577B0	0_2_00E577B0
Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00E4F720	0_2_00E4F720
Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00D8C710	0_2_00D8C710

Source: C:\Users\user\Desktop\NI License Activator 1.1.exe

Code function: String function: 00E5700E appears 44 times

Source: C:\Users\user\Desktop\NI License Activator 1.1.exe

Code function: 0_2_00DBD280: DeviceIoControl,

0_2_00DBD280

Source: NI License Activator 1.1.exe

Static PE information: Section: UPX1 ZLIB complexity 0.993666116924

Source: C:\Users\user\Desktop\NI License Activator 1.1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: classification engine

Classification label: sus26.evad.winEXE@1/0@0/0

Source: NI License Activator 1.1.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00E62115 push ecx; ret		0_2_00E62128
Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00E5F6E2 push ecx; ret		0_2_00E5F6F5

Source: C:\Users\user\Desktop\NI License Activator 1.1.exe

Code function: 0_2_00D6B20C LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00D6B20C

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Malware Analysis System Evasion:

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Users\user\Desktop\NI License Activator 1.1.exe

Code function: 0_2_00DA553F

0_2_00DA553F

Source: C:\Users\user\Desktop\NI License Activator 1.1.exe

API coverage: 4.8 %

Source: C:\Users\user\Desktop\NI License Activator 1.1.exe

Code function: 0_2_00DA553F

0_2_00DA553F

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00DB50D4 FindFirstFileA,FindFirstFileW,	0_2_00DB50D4
Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00E6A1E4 _wcspbrk,__getdrive,FindFirstFileExW,_wcspbrk,__wfullpath_helper,_wcslen,_IsRootUNCName,GetDriveTypeW,_free,___loctotime32_t,_free,__wsopen_s,__fstat32,__close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	0_2_00E6A1E4
Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: 0_2_00E5D260 FindFirstFileExA,GetLastError,___time64_t_from_ft,___time64_t_from_ft,___time64_t_from_ft,_strcpy_s,__invoke_watson,	0_2_00E5D260

Source: C:\Users\user\Desktop\NI License Activator 1.1.exe

Code function: 0_2_00D6B20C LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00D6B20C

Source: C:\Users\user\Desktop\NI License Activator 1.1.exe

Code function: 0_2_00E69592 __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,RtlAllocateHeap,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_00E69592

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: NI License Activator 1.1.exe, 00000000.00000002.925002092.0000000001C20000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: NI License Activator 1.1.exe, 00000000.00000002.925002092.0000000001C20000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: NI License Activator 1.1.exe, 00000000.00000002.925002092.0000000001C20000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: NI License Activator 1.1.exe, 00000000.00000002.925002092.0000000001C20000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,		0_2_00E6C5ED
Source: C:\Users\user\Desktop\NI License Activator 1.1.exe	Code function: GetLocaleInfoA,		0_2_00E61754

Source: C:\Users\user\Desktop\NI License Activator 1.1.exe

Code function: 0_2_00E6E721 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

0_2_00E6E721

Source: C:\Users\user\Desktop\NI License Activator 1.1.exe

Code function: 0_2_00D44EE0 GetDlgItem,SetWindowPos,DestroyMenu,PostQuitMessage,LoadIconA,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreatePopupMenu,InsertMenuA,LoadBitmapA,DeleteObject,SendDlgItemMessageA,GetVersionExA,ExpandEnvironmentStringsA,SendMessageA,GetDesktopWindow,GetClientRect,GetClientRect,GetWindowRect,SetWindowPos,SetWindowPos,GetClientRect,SetWindowPos,SendMessageA,SendMessageA,SendMessageA,ShellExecuteA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SetMenuInfo,SetMenuItemInfoA,GetCursorPos,TrackPopupMenu,SetMenuInfo,SetMenuItemInfoA,GetCursorPos,TrackPopupMenu,

0_2_00D44EE0

Source: C:\Users\user\Desktop\NI License Activator 1.1.exe

Code function: 0_2_00E58398 GetSystemTimeAsFileTime,__aulldiv,

0_2_00E58398

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Path Interception	Process Injection1	Virtualization/Sandbox Evasion1	OS Credential Dumping	System Time Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Security Software Discovery12	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Deobfuscate/Decode Files or Information1	Security Account Manager	Virtualization/Sandbox Evasion1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information21	NTDS	Process Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing11	LSA Secrets	File and Directory Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Information Discovery13	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
NI License Activator 1.1.exe	6%	Virustotal	Browse
NI License Activator 1.1.exe	6%	Metadefender	Browse
NI License Activator 1.1.exe	5%	ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.NI License Activator 1.1.exe.d40000.0.unpack	100%	Avira	HEUR/AGEN.1110374		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.sonsivri.com	1%	Virustotal		Browse
http://www.sonsivri.com	0%	Avira URL Cloud	safe

Domains and IPs Download Network PCAP: filtered – full

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.sonsivri.com	NI License Activator 1.1.exe, 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	494150
Start date:	30.09.2021
Start time:	11:29:08
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	NI License Activator 1.1.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus26.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 77% Number of executed functions: 8 Number of non-executed functions: 119
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 13.107.253.254, 13.107.3.254, 52.113.196.254, 20.82.209.183, 20.54.110.249, 40.112.88.60, 23.0.174.185, 23.0.174.200, 20.82.210.154, 23.10.249.43, 23.10.249.26 Excluded domains from analysis (whitelisted): s-ring.msedge.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, a1449.dscg2.akamai.net, arc.msn.com, teams-9999.teams-msedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, wu-shim.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, t-ring.msedge.net, s-ring.s-9999.s-msedge.net, download.windowsupdate.com.edgesuite.net, t-9999.fb-t-msedge.net, ris.api.iris.microsoft.com, s-9999.s-msedge.net, teams-ring.teams-9999.teams-msedge.net, t-ring.t-9999.t-msedge.net, teams-ring.msedge.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.9261436027069
TrID:	Win32 Executable (generic) a (10002005/4) 99.39% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	NI License Activator 1.1.exe
File size:	574464
MD5:	4996a8ee6e6d88ec1d84b6a82e3ce8c4
SHA1:	c1bf05826cd7b06216fc67321fa6c45231c1ccc6
SHA256:	9cff2c27f5540c58601b4615fbdcda506e031b34a4d4afe6dd85993557f861fb
SHA512:	487809399beb51f19d3f977aa03eccbdfaa94b5666b8f2a892e522f9956ffc23bca57e76ab4b2cf1ff04717c379ac7e1befd6ffbb07ab93ddf14b78fbef46bf5
SSDEEP:	12288:dQiYHdcZHnZqUsoP2COHKSYVEuWIRWG98rov1PLVu89EAMn:dQQ5q9ssK3VeIMG98y1PJu8KAMn
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........5.~.f.~.f.~.f..ef.~.f..Pf.~.f..Qf.~.f..hf.~.f.~.f...fJ0cf.~.f.~.fH~.f1a.fK~.f..Tf.~.f..af.~.f..ff.~.fRich.~.f...............

File Icon


Icon Hash:	c09894b4f4aea646

Static PE Info

General
Entrypoint:	0x5cf380
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x4D037F3E [Sat Dec 11 13:40:14 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	d79b2e0ed734a3fff9dca7f276233181

Entrypoint Preview

Instruction
pushad
mov esi, 00546000h
lea edi, dword ptr [esi-00145000h]
push edi
or ebp, FFFFFFFFh
jmp 00007F6D74E46982h
nop
nop
nop
nop
nop
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F6D74E46979h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F6D74E4695Fh
mov eax, 00000001h
add ebx, ebx
jne 00007F6D74E46979h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F6D74E4697Dh
jne 00007F6D74E4699Ah
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F6D74E46991h
dec eax
add ebx, ebx
jne 00007F6D74E46979h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007F6D74E46946h
add ebx, ebx
jne 00007F6D74E46979h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007F6D74E469C4h
xor ecx, ecx
sub eax, 03h
jc 00007F6D74E46983h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F6D74E469E7h
sar eax, 1
mov ebp, eax
jmp 00007F6D74E4697Dh
add ebx, ebx
jne 00007F6D74E46979h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F6D74E4693Eh
inc ecx
add ebx, ebx
jne 00007F6D74E46979h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F6D74E46930h
add ebx, ebx
jne 00007F6D74E46979h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F6D74E46961h
jne 00007F6D74E4697Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F6D74E46956h
add ecx, 02h
cmp ebp, FFFFFB00h
adc ecx, 02h
lea edx, dword ptr [eax+eax]

Rich Headers

Programming Language:

[LNK] VS2010 build 30319
[ C ] VS98 (6.0) build 8168
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1d273c	0x274	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1d0000	0x273c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1d29b0	0xc	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x145000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
UPX1	0x146000	0x8a000	0x89600	False	0.993666116924	data	7.94096922371	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x1d0000	0x3000	0x2a00	False	0.306733630952	data	4.71495372309	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_BITMAP	0x1af328	0x6028	data	English	Great Britain
RT_ICON	0x1d032c	0x568	GLS_BINARY_LSB_FIRST	English	Great Britain
RT_ICON	0x1d0898	0x368	GLS_BINARY_LSB_FIRST	English	Great Britain
RT_ICON	0x1d0c04	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16776176, next used block 10526884	English	Great Britain
RT_ICON	0x1d14b0	0xca8	dBase IV DBT of @.DBF, block length 3072, next free block index 40, next free block 1097896257, next used block 2436984977	English	Great Britain
RT_MENU	0x1b7170	0x32	data	English	Great Britain
RT_MENU	0x1b71a4	0x110	data	English	Great Britain
RT_DIALOG	0x1b72b4	0xac	data	English	Great Britain
RT_DIALOG	0x1b7360	0x80	data	English	Great Britain
RT_DIALOG	0x1b73e0	0x184	data	English	Great Britain
RT_GROUP_ICON	0x1d215c	0x3e	data	English	Great Britain
RT_VERSION	0x1d21a0	0x328	data	English	Great Britain
RT_MANIFEST	0x1d24cc	0x26e	ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
ADVAPI32.dll	RegCloseKey
COMCTL32.dll
COMDLG32.dll	GetOpenFileNameA
GDI32.dll	CreateFontA
NETAPI32.dll	Netbios
ole32.dll	CoInitialize
SHELL32.dll	ShellExecuteA
USER32.dll	SetFocus
WSOCK32.dll	htonl

Version Infos

Description	Data
LegalCopyright	Copyright (C) 2010 Top
InternalName	NI License Activator.exe
FileVersion	1.1.0.0
CompanyName	www.sonsivri.com
ProductName	NI License Activator
ProductVersion	1.1.0.0
FileDescription	NI License Activator
OriginalFilename	NI License Activator.exe
Translation	0x0809 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Download Network PCAP: filtered – full

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2021 11:30:19.067550898 CEST	54531	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:30:19.088700056 CEST	53	54531	8.8.8.8	192.168.2.4
Sep 30, 2021 11:30:19.491703033 CEST	49714	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:30:19.504646063 CEST	53	49714	8.8.8.8	192.168.2.4
Sep 30, 2021 11:30:20.918378115 CEST	58028	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:30:20.932174921 CEST	53	58028	8.8.8.8	192.168.2.4
Sep 30, 2021 11:30:27.002650023 CEST	53097	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:30:27.016304970 CEST	53	53097	8.8.8.8	192.168.2.4
Sep 30, 2021 11:30:45.875773907 CEST	49257	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:30:45.960896015 CEST	53	49257	8.8.8.8	192.168.2.4
Sep 30, 2021 11:30:46.354562044 CEST	62389	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:30:46.385173082 CEST	53	62389	8.8.8.8	192.168.2.4
Sep 30, 2021 11:30:46.413266897 CEST	49910	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:30:46.495412111 CEST	53	49910	8.8.8.8	192.168.2.4
Sep 30, 2021 11:30:46.974106073 CEST	55854	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:30:46.988001108 CEST	53	55854	8.8.8.8	192.168.2.4
Sep 30, 2021 11:30:47.343030930 CEST	64549	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:30:47.356249094 CEST	53	64549	8.8.8.8	192.168.2.4
Sep 30, 2021 11:30:47.837497950 CEST	63153	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:30:47.852705002 CEST	53	63153	8.8.8.8	192.168.2.4
Sep 30, 2021 11:30:48.236336946 CEST	52991	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:30:48.248943090 CEST	53	52991	8.8.8.8	192.168.2.4
Sep 30, 2021 11:30:48.334547997 CEST	53700	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:30:48.355341911 CEST	53	53700	8.8.8.8	192.168.2.4
Sep 30, 2021 11:30:48.763148069 CEST	51726	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:30:48.872308969 CEST	53	51726	8.8.8.8	192.168.2.4
Sep 30, 2021 11:30:49.841659069 CEST	56794	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:30:49.911953926 CEST	53	56794	8.8.8.8	192.168.2.4
Sep 30, 2021 11:30:50.647990942 CEST	56534	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:30:50.661669970 CEST	53	56534	8.8.8.8	192.168.2.4
Sep 30, 2021 11:30:51.129290104 CEST	56627	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:30:51.201580048 CEST	53	56627	8.8.8.8	192.168.2.4
Sep 30, 2021 11:31:02.621279001 CEST	56621	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:31:02.625509024 CEST	63116	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:31:02.654305935 CEST	53	63116	8.8.8.8	192.168.2.4
Sep 30, 2021 11:31:02.655036926 CEST	53	56621	8.8.8.8	192.168.2.4
Sep 30, 2021 11:31:05.767478943 CEST	64078	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:31:05.787758112 CEST	53	64078	8.8.8.8	192.168.2.4
Sep 30, 2021 11:31:37.480890989 CEST	64801	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:31:37.494092941 CEST	53	64801	8.8.8.8	192.168.2.4
Sep 30, 2021 11:31:38.368653059 CEST	61721	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:31:38.401387930 CEST	53	61721	8.8.8.8	192.168.2.4
Sep 30, 2021 11:32:10.768266916 CEST	51255	53	192.168.2.4	8.8.8.8
Sep 30, 2021 11:32:10.794362068 CEST	53	51255	8.8.8.8	192.168.2.4

Code Manipulations

Statistics

CPU Usage

• NI License Activator 1.1.exe

Click to jump to process

Memory Usage

• NI License Activator 1.1.exe

Click to jump to process

System Behavior

Analysis Process: NI License Activator 1.1.exe PID: 5380 Parent PID: 6480

Function Logs

General

Start time:	11:30:02
Start date:	30/09/2021
Path:	C:\Users\user\Desktop\NI License Activator 1.1.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\NI License Activator 1.1.exe'
Imagebase:	0xd40000
File size:	574464 bytes
MD5 hash:	4996A8EE6E6D88EC1D84B6A82E3CE8C4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

File Activities

File Attributes Queried

Show Windows behavior

Section Activities

Thread Activities

Thread Information Set

Show Windows behavior

System Activities

Language or Locale ID Queried

Show Windows behavior

Timing Activities

Show Windows behavior

Windows UI Activities

Window UI Enumerated

Message Posted to Windows UI

Show Windows behavior

LPC Port Activities

Chronological Activities

Disassembly

Code Analysis

Analysis Process: NI License Activator 1.1.exe PID: 5380 Parent PID: 6480 NI License Activator 1.1.exeCOMMON

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.7%
Total number of Nodes:	266
Total number of Limit Nodes:	9

Executed Functions

Function 00D44EE0, Relevance: 88.0, APIs: 36, Strings: 14, Instructions: 459
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003E9), ref: 00D44F9D
SetWindowPos.USER32(00000000,?,?,00000004,E739FF75), ref: 00D44FA4

Strings

Deactivate..., xrefs: 00D45891
%ProgramFiles%\National Instruments\Shared\License Manager\Licenses, xrefs: 00D454D0
Right-click to activate, xrefs: 00D45921
@, xrefs: 00D457D1
Activate..., xrefs: 00D4542F, 00D4589B
C:\ProgramData\National Instruments\License Manager\Licenses, xrefs: 00D454C2, 00D454F6
Right-click to deactivate, xrefs: 00D4591A
open, xrefs: 00D45719
%ProgramData%\National Instruments\License Manager\Licenses, xrefs: 00D454C9
Open License Folder..., xrefs: 00D457D9
c:\windows\notepad.exe, xrefs: 00D45714
0, xrefs: 00D457C9
@, xrefs: 00D45882
0, xrefs: 00D4587A

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: ItemWindow
String ID: %ProgramData%\National Instruments\License Manager\Licenses$%ProgramFiles%\National Instruments\Shared\License Manager\Licenses$0$0$@$@$Activate...$C:\ProgramData\National Instruments\License Manager\Licenses$Deactivate...$Open License Folder...$Right-click to activate$Right-click to deactivate$c:\windows\notepad.exe$open
API String ID: 1669990519-397551973
Opcode ID: 96b059e6a6d9f372e01164abd48c2076fe2dd37b65ae26baf77147ae1f1f3315
Instruction ID: 095a81683f700539e7466827f5ed116a6d00defc89912b26fa62dc5ae57a4ac5
Opcode Fuzzy Hash: 96b059e6a6d9f372e01164abd48c2076fe2dd37b65ae26baf77147ae1f1f3315
Instruction Fuzzy Hash: E302E170644785EFE724CF29EC89F6B77A4BB44B10F044A1DF649AB2D1DB70A848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00D43EB0, Relevance: 51.6, APIs: 17, Strings: 12, Instructions: 849windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00D43F2D
GetDlgItem.USER32(?,000003E9), ref: 00D43F44
_strcpy_s.LIBCMT ref: 00D4448F
SendMessageA.USER32(?,00001100,00000000,?), ref: 00D444DB
_strcpy_s.LIBCMT ref: 00D44532
SendMessageA.USER32(?,00001100,00000000,?), ref: 00D4457D
std::_Xinvalid_argument.LIBCPMT ref: 00D446AD

Part of subcall function 00D48590: std::_Xinvalid_argument.LIBCPMT ref: 00D485A9

_strcpy_s.LIBCMT ref: 00D44742
SendMessageA.USER32(?,00001100,00000000,?), ref: 00D44790
SendMessageA.USER32(?,00001102,00000002,?), ref: 00D447C5
SendMessageA.USER32(?,00001102,00000002), ref: 00D447ED
SendMessageA.USER32(?,00001102,00000002,?), ref: 00D44801
SendMessageA.USER32(?,00001113,00000001,?), ref: 00D44811
SendMessageA.USER32(?,00001113,00000001), ref: 00D44820
SendMessageA.USER32(?,00001113,00000001,?), ref: 00D44880
SendMessageA.USER32(?,0000110B,00000009,?), ref: 00D4488E
SendMessageA.USER32(00000000,?,000003E9,00001101), ref: 00D43F47

Part of subcall function 00D43DF0: _strcpy_s.LIBCMT ref: 00D43E1C
Part of subcall function 00D43DF0: SendMessageA.USER32(?,00001100,00000000,?), ref: 00D43E50

Strings

Multisim, xrefs: 00D44384
vector<T> too long, xrefs: 00D446A8
nilm, xrefs: 00D44156
#, xrefs: 00D44780
Modules, xrefs: 00D44344
No Licenses Found, xrefs: 00D446F9
Ultiboard, xrefs: 00D44396
.lic, xrefs: 00D44068
LabVIEW, xrefs: 00D44363
.lc, xrefs: 00D4400C
Right-click to open license folder, xrefs: 00D448E6
Toolkits, xrefs: 00D44305

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: MessageSend$_strcpy_s$ItemXinvalid_argumentstd::_
String ID: #$.lc$.lic$LabVIEW$Modules$Multisim$No Licenses Found$Right-click to open license folder$Toolkits$Ultiboard$nilm$vector<T> too long
API String ID: 1421272713-303924008
Opcode ID: a3c6d7c70c4ca092a42cf7495b8fcd3c133a24fecdedaa571b49e10ae8720ba3
Instruction ID: ad9ea684d64fef618ef5c6d0afa90722e0ea5b90886dd4d0ef0237938d5f6b25
Opcode Fuzzy Hash: a3c6d7c70c4ca092a42cf7495b8fcd3c133a24fecdedaa571b49e10ae8720ba3
Instruction Fuzzy Hash: F662D071E002149BDF24DF68D881BAEB7B5AF45300F1485A9E949B7382DB709D85CFB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D45980, Relevance: 10.6, APIs: 7, Instructions: 69
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDialogParamA.USER32(?,00000065,00000000,Function_00004EE0,00000000), ref: 00D459B6
ShowWindow.USER32(00000000,00000005), ref: 00D459C1
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00D459D7
IsDialogMessage.USER32(00000000,?), ref: 00D459ED
TranslateMessage.USER32(?), ref: 00D459F7
DispatchMessageA.USER32(?), ref: 00D45A01
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 00D45A11

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: Message$Dialog$CallbackCreateDispatchDispatcherParamShowTranslateUserWindow
String ID:
API String ID: 4262919457-0
Opcode ID: 22a2ff6ce7f0cfd977826c38b736a59853e4af16f6af7ff037698402aefcb474
Instruction ID: 6eb90516d1abcb94b05d63657c57a72ab2ad5b657579e413dc396f83ba89939f
Opcode Fuzzy Hash: 22a2ff6ce7f0cfd977826c38b736a59853e4af16f6af7ff037698402aefcb474
Instruction Fuzzy Hash: 4C11B9726407087FD710DBA9ED49FDE73A8AB58B21F100255F604F61C0EB71AD498BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D43DF0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcpy_s.LIBCMT ref: 00D43E1C
SendMessageA.USER32(?,00001100,00000000,?), ref: 00D43E50

Strings

#, xrefs: 00D43E40

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: MessageSend_strcpy_s
String ID: #
API String ID: 2660681648-1885708031
Opcode ID: f9bd8f4727bc9bd603b79ca7249d1fdb80517a72b7c6bf354e961b71d9c02f52
Instruction ID: 35b7ebd5314b92247e5916009b778e3bf141663b934b744bc05d2c878e802d19
Opcode Fuzzy Hash: f9bd8f4727bc9bd603b79ca7249d1fdb80517a72b7c6bf354e961b71d9c02f52
Instruction Fuzzy Hash: 0C0171B1E00204ABDB10DF6DEC45A9EB7B8EB48350F004525F949E7340D771AD658BE5

Uniqueness

Uniqueness Score: -1.00%

Function 00E41DF0, Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(?,00E41EE5,?,?,?,?,00D4AA42,?,00000000,745D48C0,E739FF75,?,?,745D48C0), ref: 00E41DFD
GetLastError.KERNEL32(?,?,00D4AA42,?,00000000,745D48C0,E739FF75,?,?,745D48C0), ref: 00E41E14

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: 3dc73f6c60a09fcbc29a45417d31f725170d7863238388c3585a763d29e063bb
Instruction ID: df128c1f497a458203701c391fd2154abfdb6aed9a79403181aac2641750841d
Opcode Fuzzy Hash: 3dc73f6c60a09fcbc29a45417d31f725170d7863238388c3585a763d29e063bb
Instruction Fuzzy Hash: 41213C781013409FDB15CF18E5946197BE1EF86328F689A9DE858EB374C335DC85DB42

Uniqueness

Uniqueness Score: -1.00%

Function 00E665C2, Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 00E66605

Part of subcall function 00E5956D: __getptd_noexit.LIBCMT ref: 00E5956D

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: b5232c625d7299e74a5f7ead9df79c9965749dbce68c35472b816f64868195e2
Instruction ID: a446037070ba31ef60acf71faebcb53b62023d3d3a85a01326ab3878531d781a
Opcode Fuzzy Hash: b5232c625d7299e74a5f7ead9df79c9965749dbce68c35472b816f64868195e2
Instruction Fuzzy Hash: BE01D4312A12159FEF259F25FC15B6B3794AB917A8F04A92DF816FB1A0DB70DC108690

Uniqueness

Uniqueness Score: -1.00%

Function 00E57D80, Relevance: 1.5, APIs: 1, Instructions: 14
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E58B49: __lock.LIBCMT ref: 00E58B4B

__onexit_nolock.LIBCMT ref: 00E57D98

Part of subcall function 00E57C99: RtlDecodePointer.NTDLL(00EEA720), ref: 00E57CAE
Part of subcall function 00E57C99: RtlDecodePointer.NTDLL ref: 00E57CBB
Part of subcall function 00E57C99: __realloc_crt.LIBCMT ref: 00E57CF8
Part of subcall function 00E57C99: __realloc_crt.LIBCMT ref: 00E57D0E
Part of subcall function 00E57C99: RtlEncodePointer.NTDLL(00000000), ref: 00E57D20
Part of subcall function 00E57C99: RtlEncodePointer.NTDLL(?), ref: 00E57D34
Part of subcall function 00E57C99: RtlEncodePointer.NTDLL(-00000004), ref: 00E57D3C

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: Pointer$Encode$Decode__realloc_crt$__lock__onexit_nolock
String ID:
API String ID: 3536590627-0
Opcode ID: ed7a07745cc843eddc849db346ad83210d747eef20666cd0c4b112f7e42ea4ae
Instruction ID: 87f23a592822e79b7183ad68689e6ed3754420b55674752f0e400b4ab26dbba2
Opcode Fuzzy Hash: ed7a07745cc843eddc849db346ad83210d747eef20666cd0c4b112f7e42ea4ae
Instruction Fuzzy Hash: A1D05E71946B09EBCB90FFA4E90BB9CBBF0AF05312F606548F5587A1E2CE750A459B10

Uniqueness

Uniqueness Score: -1.00%

Function 00E645CD, Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 00E645CF

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 031def122dd370b9f5f1adc438ef1b6ebdeec698d80859f6b5e1c05d8edce38e
Instruction ID: ffcf974bf3ca2d0e36724c479143aaf3f66c12cacc3239d19ab8d11e106b34eb
Opcode Fuzzy Hash: 031def122dd370b9f5f1adc438ef1b6ebdeec698d80859f6b5e1c05d8edce38e
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00D7A795, Relevance: 153.6, APIs: 14, Strings: 73, Instructions: 1395COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00D7AAFF
_sprintf.LIBCMT ref: 00D7AB6B
_strlen.LIBCMT ref: 00D7AB77
_sprintf.LIBCMT ref: 00D7ABD0
_sprintf.LIBCMT ref: 00D7ABF2
_strlen.LIBCMT ref: 00D7ABFE
_sprintf.LIBCMT ref: 00D7AC4A
_strlen.LIBCMT ref: 00D7AC56
_sprintf.LIBCMT ref: 00D7AE34
_sprintf.LIBCMT ref: 00D7AE7C
_strlen.LIBCMT ref: 00D7B052
_strlen.LIBCMT ref: 00D7B0AC
_strlen.LIBCMT ref: 00D7B42E
_strlen.LIBCMT ref: 00D7B660

Part of subcall function 00D7BC7E: _sprintf.LIBCMT ref: 00D7BC9F

Part of subcall function 00D7BB2C: _sprintf.LIBCMT ref: 00D7BB7B

Part of subcall function 00D7BB2C: _sprintf.LIBCMT ref: 00D7BC25

Part of subcall function 00D7BB2C: _sprintf.LIBCMT ref: 00D7BC46

Strings

HOST_BASED, xrefs: 00D7B33C
PACKAGE, xrefs: 00D7AE26
HOSTID, xrefs: 00D7B1A8
SERVER, xrefs: 00D7AB5D
06.0, xrefs: 00D7AD16
vendor_info, xrefs: 00D7B832
w_queue, xrefs: 00D7B7BB
SUPERSEDE, xrefs: 00D7B6AC
MINIMUM, xrefs: 00D7B382
%s %s %s %s, xrefs: 00D7AB62
COMPONENTS, xrefs: 00D7B170
sort, xrefs: 00D7B235
DUP_GROUP, xrefs: 00D7B70F
LINGER, xrefs: 00D7B6D7
SUITE, xrefs: 00D7B548
SUPERSEDE, xrefs: 00D7B5F6
1-jul-2004, xrefs: 00D7B914
SUBLIC, xrefs: 00D7B9C2
06.0, xrefs: 00D7A86D
OPTIONS, xrefs: 00D7B56B
%s %s, xrefs: 00D7ABE9
USER_BASED, xrefs: 00D7B2E8
DAEMON, xrefs: 00D7ABE4
PREREQ, xrefs: 00D7B9A7
1-jan-0, xrefs: 00D7ACF3
1-jan-0, xrefs: 00D7AF52
ISSUED, xrefs: 00D7B8F2
asset_info, xrefs: 00D7B883
first, xrefs: 00D7B23A
DIST_CONSTRAINT, xrefs: 00D7B9DD
1-jan-0, xrefs: 00D7ACFC
OPTIONS, xrefs: 00D7B543
SUITE_DUP_GROUP, xrefs: 00D7B744
VENDOR, xrefs: 00D7ABC2
dist_info, xrefs: 00D7B84D
USER_BASED, xrefs: 00D7B2CB
VENDOR_STRING, xrefs: 00D7B18D
CAPACITY, xrefs: 00D7B294
SUITE_RESERVED, xrefs: 00D7B570
ISSUER, xrefs: 00D7B89E
permanent, xrefs: 00D7AF9E
06.0, xrefs: 00D7AB8C
ISSUED, xrefs: 00D7B90F
METERED, xrefs: 00D7B35F
w_binary, xrefs: 00D7B772
NOTICE, xrefs: 00D7B98C
user_info, xrefs: 00D7B868
%s %s, xrefs: 00D7ABC7
sort, xrefs: 00D7B20D
02.0, xrefs: 00D7A8D1
sort, xrefs: 00D7B24D
1-jan-0, xrefs: 00D7AF49
w_term_signal, xrefs: 00D7B7E9
UPGRADE, xrefs: 00D7AC3C
(, xrefs: 00D7AB2B
02.0, xrefs: 00D7A8DA
TS_OK, xrefs: 00D7BA7C
HOST_BASED, xrefs: 00D7B31F
last, xrefs: 00D7B212
W_LIC_LOSS, xrefs: 00D7B817
06.0, xrefs: 00D7AF6D
BORROW, xrefs: 00D7B979
%s %s %s %s %s, xrefs: 00D7AE73
PACKAGE, xrefs: 00D7AE6E
w_argv, xrefs: 00D7B78D
FLOAT_OK, xrefs: 00D7B4D6
START, xrefs: 00D7BA4F
%s %s %s %s, xrefs: 00D7AE2B
06.0, xrefs: 00D7A893
PLATFORMS, xrefs: 00D7B47A
OVERDRAFT, xrefs: 00D7B1D0
permanent, xrefs: 00D7AD46
BORROW, xrefs: 00D7B95C

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _sprintf$_strlen
String ID: %s %s$%s %s$%s %s %s %s$%s %s %s %s$%s %s %s %s %s$($02.0$02.0$06.0$06.0$06.0$06.0$06.0$1-jan-0$1-jan-0$1-jan-0$1-jan-0$1-jul-2004$BORROW$BORROW$CAPACITY$COMPONENTS$DAEMON$DIST_CONSTRAINT$DUP_GROUP$FLOAT_OK$HOSTID$HOST_BASED$HOST_BASED$ISSUED$ISSUED$ISSUER$LINGER$METERED$MINIMUM$NOTICE$OPTIONS$OPTIONS$OVERDRAFT$PACKAGE$PACKAGE$PLATFORMS$PREREQ$SERVER$START$SUBLIC$SUITE$SUITE_DUP_GROUP$SUITE_RESERVED$SUPERSEDE$SUPERSEDE$TS_OK$UPGRADE$USER_BASED$USER_BASED$VENDOR$VENDOR_STRING$W_LIC_LOSS$asset_info$dist_info$first$last$permanent$permanent$sort$sort$sort$user_info$vendor_info$w_argv$w_binary$w_queue$w_term_signal
API String ID: 4048706883-2062855575
Opcode ID: 4695187c5112dd348b78e62fa2943d48cc5e4091593283a91a13c07810425d91
Instruction ID: 9b7938752c0f26c56dc934714638c9f540c51401363b23e9b4dd99e3b99b1168
Opcode Fuzzy Hash: 4695187c5112dd348b78e62fa2943d48cc5e4091593283a91a13c07810425d91
Instruction Fuzzy Hash: A9C24C75A00208AFDB14DF54C885BAE73B5EF88315F18C2A9F91D9B342E731EA45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00D8C710, Relevance: 51.4, APIs: 15, Strings: 14, Instructions: 669COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D8C769
_sprintf.LIBCMT ref: 00D8C8DC
_strlen.LIBCMT ref: 00D8C9C3
_strlen.LIBCMT ref: 00D8CA09
__time32.LIBCMT ref: 00D8CCE9
_sprintf.LIBCMT ref: 00D8CE22
_strlen.LIBCMT ref: 00D8CE31
_sprintf.LIBCMT ref: 00D8CE9B
_strlen.LIBCMT ref: 00D8CEC6
_memset.LIBCMT ref: 00D8CEDF
_memmove.LIBCMT ref: 00D8CF0A

Strings

-+#-, xrefs: 00D8C9AA
%04x%08lx, xrefs: 00D8D0BF
|\, xrefs: 00D8CD67
%s=%s, xrefs: 00D8D086
-+!-, xrefs: 00D8CDDA
-+!-, xrefs: 00D8CDF2
%lx%s%x%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00D8CE16
-+#-, xrefs: 00D8C9BE
x\, xrefs: 00D8CDB7, 00D8CDBD
-+!-, xrefs: 00D8CE0A
borrow-%s-%s, xrefs: 00D8D03D
-+!-, xrefs: 00D8CDFE
%d > %d, xrefs: 00D8C8D0
-+!-, xrefs: 00D8CDE6

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _strlen$_sprintf$_memset$__time32_memmove
String ID: %04x%08lx$%d > %d$%lx%s%x%s%s%s%s%s%s%s%s%s%s%s%s$%s=%s$-+!-$-+!-$-+!-$-+!-$-+!-$-+#-$-+#-$borrow-%s-%s$x\$|\
API String ID: 3017877299-2855894329
Opcode ID: 1d878416ce6508a8b9374e44533d8e549be0c36ea303a3510a3d9d451d864daf
Instruction ID: ee69c0b8eb390f5071919599f3dbaedb590ddae3f11103c228e5fef38e69eccd
Opcode Fuzzy Hash: 1d878416ce6508a8b9374e44533d8e549be0c36ea303a3510a3d9d451d864daf
Instruction Fuzzy Hash: 1A5265B5A10214ABEB28EF14CC45FE97375BF48700F5485A9FA0D6B2C1DB71AA84CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00DA9340, Relevance: 39.6, APIs: 12, Strings: 10, Instructions: 1117COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00DA9498
_strlen.LIBCMT ref: 00DA94A4
_memset.LIBCMT ref: 00DA94C2
_strlen.LIBCMT ref: 00DA9516
_strlen.LIBCMT ref: 00DA9530
_swscanf.LIBCMT ref: 00DA95EB
_swscanf.LIBCMT ref: 00DA9806
_swscanf.LIBCMT ref: 00DA98ED

Part of subcall function 00D70BF7: _strncpy.LIBCMT ref: 00D70C18

_swscanf.LIBCMT ref: 00DA9872
_strlen.LIBCMT ref: 00DA9C07
_swscanf.LIBCMT ref: 00DA9C7A

Part of subcall function 00DAADDD: _strlen.LIBCMT ref: 00DAAE67
Part of subcall function 00DAADDD: _strlen.LIBCMT ref: 00DAAF4B

Strings

%d-%[^-]-%d, xrefs: 00DA9FFA
%lx, xrefs: 00DA97FA
JAN, xrefs: 00DA9613
C201, xrefs: 00DA9C46
%lx, xrefs: 00DA9866
%s%c%s%c, xrefs: 00DA948F
%lx, xrefs: 00DA98E1
C201, xrefs: 00DA9C4F
JAN, xrefs: 00DA961C
%d-%[^-]-%d, xrefs: 00DA95DD

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _strlen$_swscanf$_memset_sprintf_strncpy
String ID: %d-%[^-]-%d$%d-%[^-]-%d$%lx$%lx$%lx$%s%c%s%c$C201$C201$JAN$JAN
API String ID: 1078417849-572994088
Opcode ID: 7325f617562674d9ee007fc6eadee0ace5f28fe73e17536591a4ce0f6ad0c62d
Instruction ID: 3a1a930779f295baaeed8159c4c35c0ed359e662ed4316cf8c23af444075442c
Opcode Fuzzy Hash: 7325f617562674d9ee007fc6eadee0ace5f28fe73e17536591a4ce0f6ad0c62d
Instruction Fuzzy Hash: 01A230B1901218ABDB15DF54CCA5FEBB379FB48300F0886E9E9199B281D7719B84CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00D6B20C, Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 89libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(IBFS32.DLL), ref: 00D6B26C
GetProcAddress.KERNEL32(00000000,TMExtendedStartSession), ref: 00D6B28E
GetProcAddress.KERNEL32(00000000,TMEndSession), ref: 00D6B2A5
GetProcAddress.KERNEL32(00000000,TMFirst), ref: 00D6B2BC
GetProcAddress.KERNEL32(00000000,TMNext), ref: 00D6B2D3
GetProcAddress.KERNEL32(00000000,TMRom), ref: 00D6B2EA
GetProcAddress.KERNEL32(00000000,TMSetup), ref: 00D6B301
GetProcAddress.KERNEL32(00000000,TMTouchByte), ref: 00D6B318

Strings

TMNext, xrefs: 00D6B2C8
TMTouchByte, xrefs: 00D6B30D
TMSetup, xrefs: 00D6B2F6
TMFirst, xrefs: 00D6B2B1
TMExtendedStartSession, xrefs: 00D6B283
TMRom, xrefs: 00D6B2DF
TMEndSession, xrefs: 00D6B29A
IBFS32.DLL, xrefs: 00D6B267

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: IBFS32.DLL$TMEndSession$TMExtendedStartSession$TMFirst$TMNext$TMRom$TMSetup$TMTouchByte
API String ID: 2238633743-2864274381
Opcode ID: 2625256e7c1daa7596f866554edf813dd1452e9cc65d581e647168c8381ebbf8
Instruction ID: efd5cfb18b6e5a327a99959a3bdd0f07d393b4e6bb7e9e1fa1356beb791c15ca
Opcode Fuzzy Hash: 2625256e7c1daa7596f866554edf813dd1452e9cc65d581e647168c8381ebbf8
Instruction Fuzzy Hash: 7B41FA74A00308EFDB04DF94C588AADBFB1FB49310F5485A9E849AB390D7759AC2CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00E4F720, Relevance: 21.5, APIs: 4, Strings: 8, Instructions: 500COMMON

Download Yara Rule

APIs

Part of subcall function 00E583E9: _malloc.LIBCMT ref: 00E58403

std::exception::exception.LIBCMT ref: 00E4F7BC
__CxxThrowException@8.LIBCMT ref: 00E4F7D3
std::exception::exception.LIBCMT ref: 00E4F7E5
__CxxThrowException@8.LIBCMT ref: 00E4F7FC

Part of subcall function 00E583E9: std::exception::exception.LIBCMT ref: 00E58438
Part of subcall function 00E583E9: __CxxThrowException@8.LIBCMT ref: 00E58463
Part of subcall function 00E583E9: __FF_MSGBANNER.LIBCMT ref: 00E58477
Part of subcall function 00E583E9: __NMSG_WRITE.LIBCMT ref: 00E5847F

Strings

Invalid octal escape sequence., xrefs: 00E4FC51
ASCII escape sequence terminated prematurely., xrefs: 00E4F961
Escape sequence terminated prematurely., xrefs: 00E4F863
Hexadecimal escape sequence was invalid., xrefs: 00E4FB03
Hexadecimal escape sequence terminated prematurely., xrefs: 00E4F9E3
Octal escape sequence is invalid., xrefs: 00E4FCE1
Missing } in hexadecimal escape sequence., xrefs: 00E4FA65
Escape sequence did not encode a valid character., xrefs: 00E4FBA2

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$_malloc
String ID: ASCII escape sequence terminated prematurely.$Escape sequence did not encode a valid character.$Escape sequence terminated prematurely.$Hexadecimal escape sequence terminated prematurely.$Hexadecimal escape sequence was invalid.$Invalid octal escape sequence.$Missing } in hexadecimal escape sequence.$Octal escape sequence is invalid.
API String ID: 3153320871-4010590958
Opcode ID: c32a7e33ada4ba8ef6f25faff0a32b4616499596a89ed77243b6cc4de14ddfd7
Instruction ID: eecc01ed483307f2347ecc613e89629f38d63d71dd64d361855f5495077fff2b
Opcode Fuzzy Hash: c32a7e33ada4ba8ef6f25faff0a32b4616499596a89ed77243b6cc4de14ddfd7
Instruction Fuzzy Hash: DF124670108381AFC724CF24D891BA6FBE5FF8A704F14596DE5DA97392D731A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00D58336, Relevance: 14.9, APIs: 6, Strings: 2, Instructions: 877COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00D5873D
_memset.LIBCMT ref: 00D5878B
_malloc.LIBCMT ref: 00D58BAF
_malloc.LIBCMT ref: 00D58BED

Part of subcall function 00E59BEE: __FF_MSGBANNER.LIBCMT ref: 00E59C07
Part of subcall function 00E59BEE: __NMSG_WRITE.LIBCMT ref: 00E59C0E
Part of subcall function 00E59BEE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 00E59C33

_memset.LIBCMT ref: 00D58C25
_memmove.LIBCMT ref: 00D58C3C

Strings

%02X, xrefs: 00D58731
demo, xrefs: 00D583E5

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _malloc_memset$AllocateHeap_memmove_sprintf
String ID: %02X$demo
API String ID: 236341444-3083089830
Opcode ID: 9ef84a07b1c9a1a25527f9e0b3f301a10ce0c54ae4e9bb4ac3780f06ae0899bd
Instruction ID: 223cf2198e64a3cea2a743d33245663edbaeeddb228e07812bda0f9f25c55a17
Opcode Fuzzy Hash: 9ef84a07b1c9a1a25527f9e0b3f301a10ce0c54ae4e9bb4ac3780f06ae0899bd
Instruction Fuzzy Hash: 6BA21A74900258DFDB24CF14CC94BEAB7B1BB49309F1481E9D94D6B381DB76AA89CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00D867D9, Relevance: 14.9, APIs: 6, Strings: 2, Instructions: 877COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00D86BE0
_memset.LIBCMT ref: 00D86C2E
_malloc.LIBCMT ref: 00D87052
_malloc.LIBCMT ref: 00D87090

Part of subcall function 00E59BEE: __FF_MSGBANNER.LIBCMT ref: 00E59C07
Part of subcall function 00E59BEE: __NMSG_WRITE.LIBCMT ref: 00E59C0E
Part of subcall function 00E59BEE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 00E59C33

_memset.LIBCMT ref: 00D870C8
_memmove.LIBCMT ref: 00D870DF

Strings

%02X, xrefs: 00D86BD4
demo, xrefs: 00D86888

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _malloc_memset$AllocateHeap_memmove_sprintf
String ID: %02X$demo
API String ID: 236341444-3083089830
Opcode ID: c174b548bbf2c94957611fc3229de29f50975a66e0cd46d1de632a2e61610046
Instruction ID: 3af164d2546b9585a1ccc5f5c2faa82ebb877304ef41db72174e3f7250d1d414
Opcode Fuzzy Hash: c174b548bbf2c94957611fc3229de29f50975a66e0cd46d1de632a2e61610046
Instruction Fuzzy Hash: 6EA23874904258DFDB24DF14CC94BEABBB1BB49308F1481E8D94D6B381DB76AA85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00D424E0, Relevance: 9.6, Strings: 7, Instructions: 810COMMON

Download Yara Rule

Strings

TYPE=Module, xrefs: 00D429ED
LABEL=(.+?)( [A-Z]{3,}=|"), xrefs: 00D427B8
VERSION_STRING=([0-9]+), xrefs: 00D42A7F
^INCREMENT ([a-zA-Z0-9]+)[^ ]+ ([^ ]+) ([^ ]+) ([^ ]+), xrefs: 00D4256B
([0-9]+).([0-9]{2})([0-9]{2}), xrefs: 00D42B80
TYPE=Toolkit, xrefs: 00D4295B
HOSTID=(DEMO|"DEMO"), xrefs: 00D428B9

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: std::exception::exception
String ID: ([0-9]+).([0-9]{2})([0-9]{2})$HOSTID=(DEMO|"DEMO")$LABEL=(.+?)( [A-Z]{3,}=|")$TYPE=Module$TYPE=Toolkit$VERSION_STRING=([0-9]+)$^INCREMENT ([a-zA-Z0-9]+)[^ ]+ ([^ ]+) ([^ ]+) ([^ ]+)
API String ID: 2807920213-2389355231
Opcode ID: da2e83b2d828ad6921fd7107c2c28b934e95ec7ad7954bf6331854831856fe5f
Instruction ID: 80d30bb2b49f109e3dc1789e7a1f5c0ae57e21920ab72d43dcd4e925b8b82fad
Opcode Fuzzy Hash: da2e83b2d828ad6921fd7107c2c28b934e95ec7ad7954bf6331854831856fe5f
Instruction Fuzzy Hash: 4E62C271A002189FDF28DB68CC41BEEB7B5AF95300F684599F545A7282DB70AE44CFB1

Uniqueness

Uniqueness Score: -1.00%

Function 00E6C5ED, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00000000,00000002,?,?,00E6CC2A,?,00E5FCC4,?,000000BC,?,00000001,00000000,00000000), ref: 00E6C62C
GetLocaleInfoW.KERNEL32(?,20001004,00000000,00000002,?,?,00E6CC2A,?,00E5FCC4,?,000000BC,?,00000001,00000000,00000000), ref: 00E6C655
GetACP.KERNEL32(?,?,00E6CC2A,?,00E5FCC4,?,000000BC,?,00000001,00000000), ref: 00E6C669

Strings

OCP, xrefs: 00E6C60D
ACP, xrefs: 00E6C5FC

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 01f87b6759de2b94ecc64039e2a508c6fe97cc920a39136b6a2b2460eaa03607
Instruction ID: 3c3c048bb6109ecc1bf7c584b99e2b99b89be6d68a2a82efd9153cf6ab02d49e
Opcode Fuzzy Hash: 01f87b6759de2b94ecc64039e2a508c6fe97cc920a39136b6a2b2460eaa03607
Instruction Fuzzy Hash: 39012830581606BAE7219B21FC09BAE37A8AB10B99F307455F549F1092EB60CE41C69C

Uniqueness

Uniqueness Score: -1.00%

Function 00D5A634, Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 513COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D5A6C1

Strings

a001, xrefs: 00D5A95B, 00D5A96A

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _memset
String ID: a001
API String ID: 2102423945-137206819
Opcode ID: b8d4ecda7a35de1505d3360d58cf572c2f3e3857602e5771ba00c13dc8597344
Instruction ID: 4bd2f19ce10f5320530ce3494ea68f05870fe671bc50c4d4068c2eb58fc92733
Opcode Fuzzy Hash: b8d4ecda7a35de1505d3360d58cf572c2f3e3857602e5771ba00c13dc8597344
Instruction Fuzzy Hash: 91323B38A102059FDF14CF48C495BE9B7B2BF84315F2882B9ED095F385DB31A986CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00DA553F, Relevance: 4.6, APIs: 3, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00DA55AD
Sleep.KERNEL32(0000000A), ref: 00DA55D8
GetTickCount.KERNEL32 ref: 00DA55EE

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 4369dd6c40f7828998d4f1728900f894e49b1195d46a841f3eab7f51011c165b
Instruction ID: a035175734fd053e695bd3e730dc3a1564708d9c0dfb4ca8a9abf2d6f43d7d49
Opcode Fuzzy Hash: 4369dd6c40f7828998d4f1728900f894e49b1195d46a841f3eab7f51011c165b
Instruction Fuzzy Hash: 74211778901608EFDB04CF85E1587E9BBB2FB05305F18C2AAE9095B684C7759AC9CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00DB50D4, Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9C800: _memset.LIBCMT ref: 00D9C820
Part of subcall function 00D9C800: GetVersionExA.KERNEL32(00000094), ref: 00D9C839

FindFirstFileA.KERNEL32(00000000,00000000), ref: 00DB5138

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: FileFindFirstVersion_memset
String ID:
API String ID: 693731853-0
Opcode ID: fb76e35311ecf77bb7aedab521c8de713d8873be1fbf2dcfab0f729f8fe0dd8e
Instruction ID: 562f486d7b3ab5e63ad001750f1accb58d4ac2ba3cfa784afb15628c582759fb
Opcode Fuzzy Hash: fb76e35311ecf77bb7aedab521c8de713d8873be1fbf2dcfab0f729f8fe0dd8e
Instruction Fuzzy Hash: 59314AB4D00709EFDB14DF98D949BEEBBB0EB04311F248268E41A6B284D7349A44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DBD280, Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(?,0022001C,?,?,?,?,?,00000000), ref: 00DBD2AF

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: a89a7ec463c28671e5158a4406bd24f652b4da5ba34b9a237eac1a5d623f68ec
Instruction ID: 28ec629d315b1fa090a8f8f9fad90c4fc6e8b3541d540980bba67e9383801b76
Opcode Fuzzy Hash: a89a7ec463c28671e5158a4406bd24f652b4da5ba34b9a237eac1a5d623f68ec
Instruction Fuzzy Hash: 5CE0A065420711B5E620EBA89C02EE7F2ECEF09700F009809F59AA2950E260F805C7B6

Uniqueness

Uniqueness Score: -1.00%

Function 00D9E208, Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

5/(, xrefs: 00D9E23F

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID:
String ID: 5/(
API String ID: 0-4199051006
Opcode ID: 0ec0d84a77dcd29c9a8f17e0435ab86158752167acdedd9f19be57db621a15f9
Instruction ID: b976c2781850b10373321bab0d94cb2ebc5d564d8fb3e5a1d1dae6ac6d5a6b78
Opcode Fuzzy Hash: 0ec0d84a77dcd29c9a8f17e0435ab86158752167acdedd9f19be57db621a15f9
Instruction Fuzzy Hash: 59514866D192CAAADF16CBE8C8617FEFF728F56200F0890E8C0946B783D5354705DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00D621BB, Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b732c9c24f4cf8bfc09fa9a8e79abd019c07797d91d34323c2150e14af440d9
Instruction ID: df7b5db98a539d28ea0becb843ef4e5b4bce9af749ff1c121c98d0e34737989c
Opcode Fuzzy Hash: 2b732c9c24f4cf8bfc09fa9a8e79abd019c07797d91d34323c2150e14af440d9
Instruction Fuzzy Hash: C05130749046899FDB04CFA8C8A4AFFBBB1FF89304F188599D854AB341C735DA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00E25400, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f4d9b5897f84f59395c3ebc9e24cc29d59beca06564966eb5cf5215bf26c78e
Instruction ID: d0c409fe654a236446a5d3fddaefb04859a9854d7bd38d206e5c170d977c840c
Opcode Fuzzy Hash: 0f4d9b5897f84f59395c3ebc9e24cc29d59beca06564966eb5cf5215bf26c78e
Instruction Fuzzy Hash: 0931B436604BC08FC329CA2D9450297BFE69FA6204B444A6CD4C787B86D974E90ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 00E577B0, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: de947ca9978d942ad9f10e503e6d33f37ac7de740c2512b8d8b734718164d8c6
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 2611527720806143D50D863DF8FC5B69796EBC931B72C6B7AD8C16B754D122D56CD500

Uniqueness

Uniqueness Score: -1.00%

Function 00D73260, Relevance: 65.2, APIs: 17, Strings: 20, Instructions: 493
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__setjmp3.LIBCMT ref: 00D732C8

Strings

, xrefs: 00D73872
%-15s%s, xrefs: 00D734CA
For further information, refer to the FLEXnet Licensing End User Guide,available at "www.macrovision.com"., xrefs: 00D73A43
%-15s%d,%d. System Error: %d "%s", xrefs: 00D7392A
- , xrefs: 00D73886
%s:, xrefs: 00D7353D
[...], xrefs: 00D736B7
%-15s, xrefs: 00D73600
(%d,%d:%d "%s"), xrefs: 00D7397B
%-15s %s, xrefs: 00D73562
- , xrefs: 00D7377C
(%d,%d), xrefs: 00D73A13
License path:, xrefs: 00D735FB
D, xrefs: 00D73869
INVALID error code, xrefs: 00D73435
FLEXnet Licensing error:, xrefs: 00D739D1
%-15s%d,%d, xrefs: 00D739D6
Feature:, xrefs: 00D734C5
FLEXnet Licensing error:, xrefs: 00D73925
- , xrefs: 00D73790

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: __setjmp3
String ID: $%-15s$%-15s%d,%d$%-15s%d,%d. System Error: %d "%s"$%-15s%s$%s:$For further information, refer to the FLEXnet Licensing End User Guide,available at "www.macrovision.com".$ (%d,%d)$ (%d,%d:%d "%s")$ - $ - $ - $%-15s %s$D$FLEXnet Licensing error:$FLEXnet Licensing error:$Feature:$INVALID error code$License path:$[...]
API String ID: 3396615879-3035847534
Opcode ID: 72a3794e03af8652b6b4cf98d9444bf92635941e653c11f8a0dac95d10539191
Instruction ID: a118927738ffb791cfec7d14bcfeb8606791921ca601d517626599fae4590fda
Opcode Fuzzy Hash: 72a3794e03af8652b6b4cf98d9444bf92635941e653c11f8a0dac95d10539191
Instruction Fuzzy Hash: 29221DB5900218DBEB18DF18C991F99B7B1BF48304F14C6E9E84D6B642EB719B84DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00D69034, Relevance: 42.4, APIs: 16, Strings: 8, Instructions: 359COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00D6909E
_strlen.LIBCMT ref: 00D690AF
_strlen.LIBCMT ref: 00D690D4
__wgetenv.LIBCMT ref: 00D6914A
__wgetenv.LIBCMT ref: 00D691FF
_strlen.LIBCMT ref: 00D69214
_strlen.LIBCMT ref: 00D69254
_calloc.LIBCMT ref: 00D69292
_sprintf.LIBCMT ref: 00D692C1
_sprintf.LIBCMT ref: 00D69329

Strings

I, xrefs: 00D6922B
LM_LICENSE_FILE, xrefs: 00D6907C
LM_BORROW, xrefs: 00D69163
LM_LICENSE_FILE, xrefs: 00D69073
%s%s%s, xrefs: 00D6931A
_LICENSE_FILE, xrefs: 00D690C2
%s%s%s, xrefs: 00D694AC
_LICENSE_FILE, xrefs: 00D690CB

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _strlen$__wgetenv_sprintf$_calloc
String ID: %s%s%s$%s%s%s$LM_BORROW$LM_LICENSE_FILE$LM_LICENSE_FILE$_LICENSE_FILE$_LICENSE_FILE$I
API String ID: 2160952428-2015368932
Opcode ID: e910f22645685f5116ffba2d2a9c5ec70a0e6211aa39111673f06af6b7670b30
Instruction ID: 3e840589331221877cc6f8411002244b083fd28fbbdf7395c60909cf712141f3
Opcode Fuzzy Hash: e910f22645685f5116ffba2d2a9c5ec70a0e6211aa39111673f06af6b7670b30
Instruction Fuzzy Hash: 0CE1C3B1D00209EFDF04DF94C855BEEB7B9AB48304F148529E8096B281E775EB49CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D7C6F0, Relevance: 37.1, APIs: 3, Strings: 18, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00D59F32: _memset.LIBCMT ref: 00D59F74

__setjmp3.LIBCMT ref: 00D7C742

Strings

ISSUED Invalid date format, xrefs: 00D7CB34
FLOAT_OK only valid with node-locked license, xrefs: 00D7C90B
Illegal char in feature name: only alpha-num and '_' allowed, xrefs: 00D7C9C2
DUP_GROUP not valid with uncounted license, xrefs: 00D7C778
The FLOAT_OK=hostid should be the Server's permanent hostid, xrefs: 00D7C89F
PACKAGE and COMPONENT name can't be identical, xrefs: 00D7CAE5
lm_chk_conf.c, xrefs: 00D7CB83
Can't combine USER_BASED and HOST_BASED, xrefs: 00D7CA86
ISSUED Can't have year 0, xrefs: 00D7CB51
08.0, xrefs: 00D7C92A
%d-%[^-]-%d, xrefs: 00D7CB14
Do not use same hostid for FLOAT_OK=hostid as HOSTID=, xrefs: 00D7C88A
FLOAT_OK only valid with node-locked license, xrefs: 00D7C83A
Hostid required for uncounted feature, xrefs: 00D7C7A4
lm_chk_conf.c, xrefs: 00D7C720
HOST or USER BASED licenses must be counted, xrefs: 00D7C8E4
SUPERSEDE missing START= or ISSUED=, xrefs: 00D7CA51
SUITE only applies to PACKAGE lines, xrefs: 00D7C9F6

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: __setjmp3_memset
String ID: %d-%[^-]-%d$08.0$Can't combine USER_BASED and HOST_BASED$DUP_GROUP not valid with uncounted license$Do not use same hostid for FLOAT_OK=hostid as HOSTID=$FLOAT_OK only valid with node-locked license$FLOAT_OK only valid with node-locked license$HOST or USER BASED licenses must be counted$Hostid required for uncounted feature$ISSUED Can't have year 0$ISSUED Invalid date format$Illegal char in feature name: only alpha-num and '_' allowed$PACKAGE and COMPONENT name can't be identical$SUITE only applies to PACKAGE lines$SUPERSEDE missing START= or ISSUED=$The FLOAT_OK=hostid should be the Server's permanent hostid$lm_chk_conf.c$lm_chk_conf.c
API String ID: 1597570620-3540758302
Opcode ID: 6b1589d248973e905987dfd023062e08aa75560d086ade7bfae468d55db6d3f0
Instruction ID: a8797a27b8a4a9153ee96852ee01b46721fff045d908fb1b2fe550ddeea3eccf
Opcode Fuzzy Hash: 6b1589d248973e905987dfd023062e08aa75560d086ade7bfae468d55db6d3f0
Instruction Fuzzy Hash: 3CE15CB5A10208AFDB14DF54C882AAA73B5EF48305F18D16DFD1DAB245F731EA41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D562B2, Relevance: 35.3, APIs: 8, Strings: 12, Instructions: 286COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00D563BE
_memset.LIBCMT ref: 00D56488
_sprintf.LIBCMT ref: 00D56529
_sprintf.LIBCMT ref: 00D56566
_strlen.LIBCMT ref: 00D565A4
_strlen.LIBCMT ref: 00D565B7
_swscanf.LIBCMT ref: 00D56699
_sprintf.LIBCMT ref: 00D566C8

Strings

%s %d, xrefs: 00D563AF
06.0, xrefs: 00D56369
VENDOR, xrefs: 00D565B2
VENDOR, xrefs: 00D56621
DAEMON, xrefs: 00D56605
DAEMON, xrefs: 00D5659F
06.0, xrefs: 00D5664E
%s %s %s, xrefs: 00D5668A
%s %s %s, xrefs: 00D566B9
SERVER %s %s, xrefs: 00D5651A
%s %d, xrefs: 00D56557
DAEMON, xrefs: 00D566B4

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _sprintf$_strlen$_memset_swscanf
String ID: %s %d$%s %d$%s %s %s$%s %s %s$06.0$06.0$DAEMON$DAEMON$DAEMON$SERVER %s %s$VENDOR$VENDOR
API String ID: 609576402-790908284
Opcode ID: 962584680677f1a9455c7a6302807c169d6d00cf801ab597643aabd6fc62effc
Instruction ID: c8dc99b9530e18d65ea0682de8b5d7270306a4b01c907cb3fe012a13224b52fa
Opcode Fuzzy Hash: 962584680677f1a9455c7a6302807c169d6d00cf801ab597643aabd6fc62effc
Instruction Fuzzy Hash: CFC153F5A012149BCB14DB14DD81FD9B3B9AB88315F4485D8FA0DA7242EB31EE85CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00DB17BF, Relevance: 33.3, APIs: 1, Strings: 18, Instructions: 78COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00DB18CE

Strings

t, xrefs: 00DB183D
3, xrefs: 00DB185D
t, xrefs: 00DB1839
6, xrefs: 00DB17E9
`, xrefs: 00DB1871
b, xrefs: 00DB1851
', xrefs: 00DB186D
8, xrefs: 00DB18A5
R, xrefs: 00DB17C9
6, xrefs: 00DB17F9
), xrefs: 00DB1845
R, xrefs: 00DB1821
h, xrefs: 00DB17E1
r, xrefs: 00DB184D
j, xrefs: 00DB1855
U, xrefs: 00DB1805
k, xrefs: 00DB1891
+, xrefs: 00DB1869

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _memmove
String ID: '$)$+$3$6$6$8$R$R$U$`$b$h$j$k$r$t$t
API String ID: 4104443479-45658433
Opcode ID: cf13eaae6cda7ecd0ae346cdb1c594b4afbe6fcc02a8ae7106516b45f081c09d
Instruction ID: 129b157337a1bc69a8621b318e92e1b0bb1d5fe2b2cd0ec9b9ddd2b7b7f85cc8
Opcode Fuzzy Hash: cf13eaae6cda7ecd0ae346cdb1c594b4afbe6fcc02a8ae7106516b45f081c09d
Instruction Fuzzy Hash: 95417710D08BCED9DB22C6BC99486DEBF615B27234F084388E4F43B2D2D7A50616C7B6

Uniqueness

Uniqueness Score: -1.00%

Function 00D9F0C2, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 221networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9F54A: closesocket.WS2_32(E8AE843D), ref: 00D9F55D

inet_addr.WS2_32(00000000), ref: 00D9F0FC
getprotobyname.WS2_32(tcp), ref: 00D9F121
_memset.LIBCMT ref: 00D9F131
htons.WS2_32(00000000), ref: 00D9F13E
_memmove.LIBCMT ref: 00D9F157
socket.WS2_32(00000002,00000001,00000000), ref: 00D9F16B

Part of subcall function 00D9F4C6: WSAGetLastError.WS2_32(?,00D9BF48), ref: 00D9F4C9

Strings

3', xrefs: 00D9F21E
@, xrefs: 00D9F235
tcp, xrefs: 00D9F11C

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: ErrorLast_memmove_memsetclosesocketgetprotobynamehtonsinet_addrsocket
String ID: 3'$@$tcp
API String ID: 2930924231-3267961393
Opcode ID: 53af9e3dabe81118a0d40c9e589d4952d412d88977ffeb2f29dcf6def532f1cb
Instruction ID: c4712e27c979bb940e75efefee0071e378efa9135589ad3b730b41cfc76c47fb
Opcode Fuzzy Hash: 53af9e3dabe81118a0d40c9e589d4952d412d88977ffeb2f29dcf6def532f1cb
Instruction Fuzzy Hash: ACA12B74900209DFDF14DF64C885BDEBBB1EF48314F1485A9E909EB281D7759A81CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D56711, Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 144COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00D56786
_strlen.LIBCMT ref: 00D56794
_strlen.LIBCMT ref: 00D567A5
_strlen.LIBCMT ref: 00D567B3
_sprintf.LIBCMT ref: 00D567E8
_sprintf.LIBCMT ref: 00D5682D

Strings

%s%s:line %d: %s%s, xrefs: 00D56824
%s%s:%s, xrefs: 00D568A0
%s%s:line %d:%s, xrefs: 00D5687E
%s%s: %s%s, xrefs: 00D5684A
%s, xrefs: 00D567DF

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _strlen$_sprintf
String ID: %s$%s%s: %s%s$%s%s:%s$%s%s:line %d: %s%s$%s%s:line %d:%s
API String ID: 3136941662-4244557989
Opcode ID: 4305aab765b7c306d87d86921de830e870aba176f3888911fd2a6242056dc901
Instruction ID: 9e1d1ce04640c3ea86205d3f9f097ea3c9d3e90974b84541781974068983c7d1
Opcode Fuzzy Hash: 4305aab765b7c306d87d86921de830e870aba176f3888911fd2a6242056dc901
Instruction Fuzzy Hash: 11518EB5D00208EFDB50EF98DC85AAE77F9AB48301F548559FD19A7291D330FA48CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5E022, Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 133COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00D5E09A
_strlen.LIBCMT ref: 00D5E0A6
_sprintf.LIBCMT ref: 00D5E0DE
_strlen.LIBCMT ref: 00D5E0EA
_sprintf.LIBCMT ref: 00D5E11A
_strlen.LIBCMT ref: 00D5E126
_sprintf.LIBCMT ref: 00D5E14F
_strlen.LIBCMT ref: 00D5E15B
_sprintf.LIBCMT ref: 00D5E18B

Strings

build %lu, xrefs: 00D5E146
Beta release %d, xrefs: 00D5E182
.%u, xrefs: 00D5E111
v%u.%u.%u, xrefs: 00D5E0D5
v%u.%u.%s, xrefs: 00D5E091

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _sprintf$_strlen
String ID: Beta release %d$ build %lu$.%u$v%u.%u.%s$v%u.%u.%u
API String ID: 4048706883-2252101716
Opcode ID: 6859e000b54d51ab3fa563c5da6b271c5f3e8f70401ce18164fa4b01249ef8ed
Instruction ID: aeb90744b683b1e8939ff2e3b2e344e1c3e2079f538540798bafb44e43053888
Opcode Fuzzy Hash: 6859e000b54d51ab3fa563c5da6b271c5f3e8f70401ce18164fa4b01249ef8ed
Instruction Fuzzy Hash: E74154B5E00204EBDF08EF98D841AAEB7F5EF48701F5885A9E809AB341E631DF55DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00D9C096, Relevance: 21.3, APIs: 2, Strings: 10, Instructions: 263COMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000000), ref: 00D9C0AE
_memmove.LIBCMT ref: 00D9C3D0

Strings

000, xrefs: 00D9C2F9
255, xrefs: 00D9C347
000, xrefs: 00D9C187
000, xrefs: 00D9C1AF
000, xrefs: 00D9C323
255, xrefs: 00D9C386
255, xrefs: 00D9C371
000, xrefs: 00D9C30E
000, xrefs: 00D9C2E4
255, xrefs: 00D9C35C

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _memmoveinet_addr
String ID: 000$000$000$000$000$000$255$255$255$255
API String ID: 3098433320-4144259334
Opcode ID: c3b311f260c13fd895372a9db8d4949fe0b53597ba09652c17a561c5057408cd
Instruction ID: fcb23de9b11cbe7de3aa8c34454a20409c72498491b5c98bf05056bf6b854de9
Opcode Fuzzy Hash: c3b311f260c13fd895372a9db8d4949fe0b53597ba09652c17a561c5057408cd
Instruction Fuzzy Hash: 12A181B5D10309EBCF14EFE0D881BEEBBB4AF14309F14A52AE91576242E3759648CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00DB6480, Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 105registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows NT\CurrentVersion\NetworkCards,00000000,00020019,?), ref: 00DB64A8
RegEnumKeyExA.ADVAPI32(?,?,?,00000104,00000000,00000000,00000000,00000000), ref: 00DB6502
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 00DB6529
RegQueryValueExA.ADVAPI32(?,ServiceName,00000000,00DB669A,00000000,00000000), ref: 00DB655E
_malloc.LIBCMT ref: 00DB6571
RegQueryValueExA.ADVAPI32(?,ServiceName,00000000,00DB669A,00000000,00000000), ref: 00DB6596
_free.LIBCMT ref: 00DB65B9
RegCloseKey.ADVAPI32(?), ref: 00DB65C5
RegCloseKey.ADVAPI32(?), ref: 00DB65E1

Strings

ServiceName, xrefs: 00DB6555
ServiceName, xrefs: 00DB658D
Software\Microsoft\Windows NT\CurrentVersion\NetworkCards, xrefs: 00DB649E

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: CloseOpenQueryValue$Enum_free_malloc
String ID: ServiceName$ServiceName$Software\Microsoft\Windows NT\CurrentVersion\NetworkCards
API String ID: 2809444472-3770772933
Opcode ID: 8626e4b2231f78053aeb354071c2dbc82cd2665ff0450b039329a7a13638fc6b
Instruction ID: 7f507c50ea47d1332077954339a225e96b267e75c3a24e3180409a09c83dd148
Opcode Fuzzy Hash: 8626e4b2231f78053aeb354071c2dbc82cd2665ff0450b039329a7a13638fc6b
Instruction Fuzzy Hash: E64111B1D40218EFDB24DFA5DD49FEEB7B8BB08700F104598E609B6281DB749A58CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00D5D487, Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 416COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00D5D596
_strlen.LIBCMT ref: 00D5D6E9
_strlen.LIBCMT ref: 00D5D70D
_strlen.LIBCMT ref: 00D5D737
_strlen.LIBCMT ref: 00D5D762
_sprintf.LIBCMT ref: 00D5D7BD
_sprintf.LIBCMT ref: 00D5D869

Strings

8, xrefs: 00D5D8CD
LM_LICENSE_FILE, xrefs: 00D5D51A
%s_LICENSE_FILE, xrefs: 00D5D58A
%s%s%s%s%s, xrefs: 00D5D857

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _strlen$_sprintf
String ID: %s%s%s%s%s$%s_LICENSE_FILE$8$LM_LICENSE_FILE
API String ID: 3136941662-996450542
Opcode ID: 0bd1fac67796e13a4f2994af4669e4337866e99e82c72d848b399cab86d3db26
Instruction ID: d7687377a33208693b0695acde2392d3e1501fc1cc185630b0381018805d5bcd
Opcode Fuzzy Hash: 0bd1fac67796e13a4f2994af4669e4337866e99e82c72d848b399cab86d3db26
Instruction Fuzzy Hash: D6123D74900309DBDF24CF54C849BAAB7B1BF48305F1482A9EC4D6B382D7759A89CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D92232, Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 00D6A77F: __time32.LIBCMT ref: 00D6A787
Part of subcall function 00D6A77F: __localtime64.LIBCMT ref: 00D6A7A0

_sprintf.LIBCMT ref: 00D9227F
_sprintf.LIBCMT ref: 00D92299
__findfirst64i32.LIBCMT ref: 00D922AF
__findnext64i32.LIBCMT ref: 00D922CE
_sprintf.LIBCMT ref: 00D92319
_sprintf.LIBCMT ref: 00D9233A
__stat32.LIBCMT ref: 00D92350

Strings

%s*.*, xrefs: 00D9228D
%s\%s, xrefs: 00D9230D
%s%s, xrefs: 00D9232E
%s\*.*, xrefs: 00D92273

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _sprintf$__findfirst64i32__findnext64i32__localtime64__stat32__time32
String ID: %s%s$%s*.*$%s\%s$%s\*.*
API String ID: 1530504666-4043038045
Opcode ID: afc7439d22d216798eee21841f47915f14a681b2ab0a79c61d2c2e7280fda21b
Instruction ID: 95bf3d7b9ac0b97123f1125f2a393161a3207e851d994b9320b14303c7041d66
Opcode Fuzzy Hash: afc7439d22d216798eee21841f47915f14a681b2ab0a79c61d2c2e7280fda21b
Instruction Fuzzy Hash: 284170B5D00209BBCF10EF94CC45BFE73B8AB44311F1485A9E9196A281E7749B48CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DA8620, Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 353COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DA864E
_swscanf.LIBCMT ref: 00DA867D
_swscanf.LIBCMT ref: 00DA87EF
_strncpy.LIBCMT ref: 00DA89E0
_strncpy.LIBCMT ref: 00DA89FE

Strings

ANYVER, xrefs: 00DA87C9
%s %s %s %[^], xrefs: 00DA8674
start, xrefs: 00DA88BA
1-jan-0, xrefs: 00DA8A78
%[^ ], xrefs: 00DA87E6

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _strncpy_swscanf$_memset
String ID: %[^ ]$%s %s %s %[^]$1-jan-0$ANYVER$start
API String ID: 1255566270-975841356
Opcode ID: 27e84df39595fd10fa7831687540cdcea0204730e4526bcce9137534209f81b9
Instruction ID: 05fed61f1409ce849a3a1bab91c014027b455859ed51b45606ade0b37c0cafd8
Opcode Fuzzy Hash: 27e84df39595fd10fa7831687540cdcea0204730e4526bcce9137534209f81b9
Instruction Fuzzy Hash: 63E14DB4A00348DBDB24CF14C889BAA77B5BF45304F1885E9EC49AB342D735DA94DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00D527EA, Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 226COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 00D5283D
_fprintf.LIBCMT ref: 00D5284F
_calloc.LIBCMT ref: 00D52890
_memset.LIBCMT ref: 00D528CF
_calloc.LIBCMT ref: 00D528DD
_memset.LIBCMT ref: 00D5290C
_memmove.LIBCMT ref: 00D529F6

Strings

LM_STRENGTH in lm_code.h has invalid value %d, xrefs: 00D52833
Use only LM_STRENGTH_[113|163|239]BIT, LM_STRENGTH_DEFAULT, OR LM_STRENGTH_LICENSE_KEY, exiting, xrefs: 00D52845
, xrefs: 00D528F6

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _calloc_fprintf_memset$_memmove
String ID: $LM_STRENGTH in lm_code.h has invalid value %d$Use only LM_STRENGTH_[113|163|239]BIT, LM_STRENGTH_DEFAULT, OR LM_STRENGTH_LICENSE_KEY, exiting
API String ID: 2404368895-3520366028
Opcode ID: 4d317d99b481c8bc7a811a7d20bc7058be4150225e8bcfeddbf122133fd2c9dd
Instruction ID: 7a44e9b92780aba3ff09721584cd183fbd6dd33c642f8511fac13862afe0414e
Opcode Fuzzy Hash: 4d317d99b481c8bc7a811a7d20bc7058be4150225e8bcfeddbf122133fd2c9dd
Instruction Fuzzy Hash: 3E916AB5E00218EBDF04DFD4D846BBEB7B5AF44305F148918E9197B282D7719A48CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DA26AB, Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 220COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00DA289E
_sprintf.LIBCMT ref: 00DA293D
_strlen.LIBCMT ref: 00DA2955

Strings

0, xrefs: 00DA27F5
(, xrefs: 00DA2923, 00DA2926
%02x%0x2%08x, xrefs: 00DA2895
%02x%02x%-30s%s%03d%c%c%01d%01d%c%21.21s%08lx%08x, xrefs: 00DA2934
2, xrefs: 00DA2747
2, xrefs: 00DA275D
$, xrefs: 00DA28E4

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _sprintf$_strlen
String ID: $$%02x%02x%-30s%s%03d%c%c%01d%01d%c%21.21s%08lx%08x$%02x%0x2%08x$($0$2$2
API String ID: 4048706883-2496067447
Opcode ID: f107f802d6318c0306bf240cf4319b95cd0182adf03b9d279374fa6e626431f8
Instruction ID: 25c43cac760a09d6a93d46e812cac7bc711c3a257c087bcb2a900e6e85040db6
Opcode Fuzzy Hash: f107f802d6318c0306bf240cf4319b95cd0182adf03b9d279374fa6e626431f8
Instruction Fuzzy Hash: AD917F75904248EFCB04DF99C884BEEB7F5AF49310F28C169F859AB241D735EA45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00D6820C, Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 207COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00D6831E

Strings

%s_LICENSE_FILE, xrefs: 00D68315
05.1, xrefs: 00D682D8
%s%c%s, xrefs: 00D68433
LM_LICENSE_FILE, xrefs: 00D682FE
LM_LICENSE_FILE, xrefs: 00D68353
05.1, xrefs: 00D682CF

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _sprintf
String ID: %s%c%s$%s_LICENSE_FILE$05.1$05.1$LM_LICENSE_FILE$LM_LICENSE_FILE
API String ID: 1467051239-2637433318
Opcode ID: e5c8aa0d2cdf7d9b3db79dc218ee4318195b09fc65daf4dcebcc531ae2f2d882
Instruction ID: 6a5dbfdad35ede10efab93a80c8371afbca5a7bcf8aa6c80ad758511f42b97ef
Opcode Fuzzy Hash: e5c8aa0d2cdf7d9b3db79dc218ee4318195b09fc65daf4dcebcc531ae2f2d882
Instruction Fuzzy Hash: C571A5B5A00204BBDB10DB94DC51FEE7375AF48710F188628FD0AAB281EB71E944DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D41620, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 00D41632

Part of subcall function 00E5F249: RaiseException.KERNEL32(00D411EF,E739FF75,00000000,00E7D34C,00D411EF,E739FF75,00E85AA0,?,00000000), ref: 00E5F28B

std::exception::exception.LIBCMT ref: 00D4165B
__CxxThrowException@8.LIBCMT ref: 00D41676
std::exception::exception.LIBCMT ref: 00D41694
__CxxThrowException@8.LIBCMT ref: 00D416AF
std::exception::exception.LIBCMT ref: 00D416C9
__CxxThrowException@8.LIBCMT ref: 00D416E4

Strings

ios_base::badbit set, xrefs: 00D41654
ios_base::failbit set, xrefs: 00D4168D
ios_base::eofbit set, xrefs: 00D416C2

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: Exception@8Throw$std::exception::exception$ExceptionRaise
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4237746311-1866435925
Opcode ID: edc055db0190db1d3da3fad4d05dc6d8e891f574d0210545d9cbe18b4894b386
Instruction ID: d4db27e68d5638017f31df474feb69eb4ba93657224f884e641e36e047c8479d
Opcode Fuzzy Hash: edc055db0190db1d3da3fad4d05dc6d8e891f574d0210545d9cbe18b4894b386
Instruction Fuzzy Hash: 1E2181B5800208AACF04EF98C586BDEBBF8AF84340F249159E909B7141DBF05B49CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D8D134, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 110COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D8D14F
_memset.LIBCMT ref: 00D8D1A5
_memmove.LIBCMT ref: 00D8D217
__ld12tod.LIBCMTD ref: 00D8D24A
_memmove.LIBCMT ref: 00D8D29B
_memmove.LIBCMT ref: 00D8D2CA

Strings

x, xrefs: 00D8D1B4
x, xrefs: 00D8D1CB
u, xrefs: 00D8D1AD

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _memmove$_memset$__ld12tod
String ID: u$x$x
API String ID: 3291720140-764707211
Opcode ID: 52d986a9c2341da4d2b53a7e8e5a2798d0a606a4de06298c2e4ca76dce8dbc66
Instruction ID: 9d45559cc94433d52114999a3bf9e37ca7dfe8f8911e2828b80d8ee89f776784
Opcode Fuzzy Hash: 52d986a9c2341da4d2b53a7e8e5a2798d0a606a4de06298c2e4ca76dce8dbc66
Instruction Fuzzy Hash: 9F4192B6D04158EBCB20DF54DC85AD973B9AB48300F048599F94CA7281E7B4DBC48FB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D43370, Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 262COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D43445
_memmove.LIBCMT ref: 00D434DA
_memmove.LIBCMT ref: 00D43662

Strings

08.0, xrefs: 00D433BB
nilm, xrefs: 00D43523
(, xrefs: 00D434DF
\r\n, xrefs: 00D43618
%O9M, xrefs: 00D4345D

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _memmove$_memset
String ID: %O9M$($08.0$\r\n$nilm
API String ID: 1357608183-470343974
Opcode ID: 3200f5d3a005bccdbbd2a10bc7748d41cf581b1b2d67d20eefd22ec739acb052
Instruction ID: 8ee72bec7bee013d895a1423e1f35639b6aa9f87cc916fd9b16a93abc4b45eb7
Opcode Fuzzy Hash: 3200f5d3a005bccdbbd2a10bc7748d41cf581b1b2d67d20eefd22ec739acb052
Instruction Fuzzy Hash: DDB18EB19012159FDB24DF18D888A9EB7B5FF48300F1446AEE85DA7351E731AE85CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D6246F, Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00D59F32: _memset.LIBCMT ref: 00D59F74

__setjmp3.LIBCMT ref: 00D624BD

Strings

lm_ckout.c, xrefs: 00D62738
lm_ckout.c, xrefs: 00D626DF
lm_ckout.c, xrefs: 00D62619
lm_ckout.c, xrefs: 00D6255C
lm_ckout.c, xrefs: 00D62682
lm_ckout.c, xrefs: 00D6249B
lm_ckout.c, xrefs: 00D6276F

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: __setjmp3_memset
String ID: lm_ckout.c$lm_ckout.c$lm_ckout.c$lm_ckout.c$lm_ckout.c$lm_ckout.c$lm_ckout.c
API String ID: 1597570620-52609489
Opcode ID: efba74e41b702f3e030cf721c87102ee07e76ebdae470619de182e3e464b1c1d
Instruction ID: ed729313036cc47ccd4e0093ab984183a8bd6d961296e7a4674321d5faa73c0d
Opcode Fuzzy Hash: efba74e41b702f3e030cf721c87102ee07e76ebdae470619de182e3e464b1c1d
Instruction Fuzzy Hash: D1911779A00609ABDB14CF54C895FE977B1BB48360F188278FD599F381D731EA45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D93695, Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 218COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D93768
_memset.LIBCMT ref: 00D9377E
_strncpy.LIBCMT ref: 00D9379D
_sprintf.LIBCMT ref: 00D937DF

Part of subcall function 00D92C66: __ld12tod.LIBCMTD ref: 00D92C76

_strncpy.LIBCMT ref: 00D937FB

Strings

P=%s, xrefs: 00D937D3
PORT_AT_HOST_PLUS , xrefs: 00D937A5
k, xrefs: 00D93786

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _memset_strncpy$__ld12tod_sprintf
String ID: P=%s$PORT_AT_HOST_PLUS $k
API String ID: 1419126824-3810665741
Opcode ID: 703ad03c6fcec927b33ce0a95697be463dc16a35675e0dc6961e50ad369c0a9e
Instruction ID: b8d43d69f2292cd99c5eac74eb23f33e5224fb10a27fb1f25b592c5f7795c0df
Opcode Fuzzy Hash: 703ad03c6fcec927b33ce0a95697be463dc16a35675e0dc6961e50ad369c0a9e
Instruction Fuzzy Hash: 8691CFB5900258ABDF24DB54CC85BEA73B5AB08305F0885E9E94DAB241E7B49BC4CF71

Uniqueness

Uniqueness Score: -1.00%

Function 00DB65F6, Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB6680
_free.LIBCMT ref: 00DB6950
_free.LIBCMT ref: 00DB696C

Part of subcall function 00DB6480: RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows NT\CurrentVersion\NetworkCards,00000000,00020019,?), ref: 00DB64A8
Part of subcall function 00DB6480: RegEnumKeyExA.ADVAPI32(?,?,?,00000104,00000000,00000000,00000000,00000000), ref: 00DB6502
Part of subcall function 00DB6480: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 00DB6529
Part of subcall function 00DB6480: RegQueryValueExA.ADVAPI32(?,ServiceName,00000000,00DB669A,00000000,00000000), ref: 00DB655E
Part of subcall function 00DB6480: _malloc.LIBCMT ref: 00DB6571
Part of subcall function 00DB6480: RegQueryValueExA.ADVAPI32(?,ServiceName,00000000,00DB669A,00000000,00000000), ref: 00DB6596
Part of subcall function 00DB6480: _free.LIBCMT ref: 00DB65B9
Part of subcall function 00DB6480: RegCloseKey.ADVAPI32(?), ref: 00DB65C5
Part of subcall function 00DB6480: RegCloseKey.ADVAPI32(?), ref: 00DB65E1

Strings

Microsoft Loopback Adapter, xrefs: 00DB688B
o, xrefs: 00DB67B9
MS LoopBack Driver, xrefs: 00DB686D

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _free$CloseOpenQueryValue$Enum_malloc_memset
String ID: MS LoopBack Driver$Microsoft Loopback Adapter$o
API String ID: 815590091-1132655155
Opcode ID: 4e86e2d0275099b2181ebdff8b3faa109860765375478d346066c7c0e7e6db06
Instruction ID: 57d3f973a0120d41727b5a58983cc19e8ebcf2838795d0c4a4a5b85db43f2fc6
Opcode Fuzzy Hash: 4e86e2d0275099b2181ebdff8b3faa109860765375478d346066c7c0e7e6db06
Instruction Fuzzy Hash: E0A134B4C05228DFDF24CF50C849BE9B7B0FB08309F0445E9D54A6B281D779AA98CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D4A3F0, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00D4A41C
std::_Lockit::_Lockit.LIBCPMT ref: 00D4A43F
std::bad_exception::bad_exception.LIBCMT ref: 00D4A4C0
__CxxThrowException@8.LIBCMT ref: 00D4A4CE
std::_Lockit::_Lockit.LIBCPMT ref: 00D4A4E1
std::locale::facet::_Facet_Register.LIBCPMT ref: 00D4A4FB

Strings

P!, xrefs: 00D4A404
bad cast, xrefs: 00D4A4B8

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: P!$bad cast
API String ID: 2427920155-342360549
Opcode ID: c5fd1fcd5a6d7b696abbd93e4c5448d1e1dac59aec7b308af138a40e243933c0
Instruction ID: 82aa604d3fce547e6a562ce881a278126096a0d4171b164ffd6003271008ad5f
Opcode Fuzzy Hash: c5fd1fcd5a6d7b696abbd93e4c5448d1e1dac59aec7b308af138a40e243933c0
Instruction Fuzzy Hash: 6431B3719402558FCF14DF68E985BAE73B4EB14320F140269F92ABB2D1DB706D48CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D53268, Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 00D53293
_fprintf.LIBCMT ref: 00D532A9

Part of subcall function 00E589FA: __lock_file.LIBCMT ref: 00E58A41
Part of subcall function 00E589FA: __stbuf.LIBCMT ref: 00E58AC5
Part of subcall function 00E589FA: __output_l.LIBCMT ref: 00E58AD5
Part of subcall function 00E589FA: __ftbuf.LIBCMT ref: 00E58ADF

_fprintf.LIBCMT ref: 00D532BD
_fprintf.LIBCMT ref: 00D532D7

Strings

Terminated due to a fatal error., xrefs: 00D532B3
Terminated due to a fatal error., xrefs: 00D53289
Security Builder error status %d, message:%s., xrefs: 00D532CD
Security Builder sb_errorMessage() error status: %d., xrefs: 00D5329F

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _fprintf$__ftbuf__lock_file__output_l__stbuf
String ID: Terminated due to a fatal error.$Terminated due to a fatal error.$Security Builder error status %d, message:%s.$Security Builder sb_errorMessage() error status: %d.
API String ID: 868309879-345378047
Opcode ID: 6fbafe957534dc30568343a99f9bbb67448a1da5d89caa18eaf124c437ac58c0
Instruction ID: aab5ddf4799758dc2419fc0e1f2567a7a4f17e41a9112cad87de6473f2596feb
Opcode Fuzzy Hash: 6fbafe957534dc30568343a99f9bbb67448a1da5d89caa18eaf124c437ac58c0
Instruction Fuzzy Hash: 0EF044B2E40314F6CA09EA909D03D7D72A88754705F086A14FE0D72383F9619F1887A7

Uniqueness

Uniqueness Score: -1.00%

Function 00D9C663, Relevance: 13.6, APIs: 9, Instructions: 87COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00D9C669

Part of subcall function 00E59BEE: __FF_MSGBANNER.LIBCMT ref: 00E59C07
Part of subcall function 00E59BEE: __NMSG_WRITE.LIBCMT ref: 00E59C0E
Part of subcall function 00E59BEE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 00E59C33

_memset.LIBCMT ref: 00D9C689
_strlen.LIBCMT ref: 00D9C6A4
_malloc.LIBCMT ref: 00D9C6B0
_strlen.LIBCMT ref: 00D9C6D9
_malloc.LIBCMT ref: 00D9C6E5
_strlen.LIBCMT ref: 00D9C710
_strlen.LIBCMT ref: 00D9C720
_malloc.LIBCMT ref: 00D9C72C

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _malloc_strlen$AllocateHeap_memset
String ID:
API String ID: 2192146556-0
Opcode ID: 0c334b7aefc9d640d7b863b75f6f5bce27293a76bb8e3c0b08bc5dc54e720562
Instruction ID: e61f693334dff1cfd009467d30635e15d5ae68b36e79e9e44da4d8c5013e4d74
Opcode Fuzzy Hash: 0c334b7aefc9d640d7b863b75f6f5bce27293a76bb8e3c0b08bc5dc54e720562
Instruction Fuzzy Hash: A03173F5D10204EBDF00EFA4D946A9E73E5AB58301F149464FD09A7342E732EE18DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00D6A3C9, Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 00D59F32: _memset.LIBCMT ref: 00D59F74

__setjmp3.LIBCMT ref: 00D6A417

Strings

l_date.c, xrefs: 00D6A3F5
l_date.c, xrefs: 00D6A4AD
l_date.c, xrefs: 00D6A516
l_date.c, xrefs: 00D6A5F2
l_date.c, xrefs: 00D6A5B4

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: __setjmp3_memset
String ID: l_date.c$l_date.c$l_date.c$l_date.c$l_date.c
API String ID: 1597570620-2913811202
Opcode ID: 9ff89faccf8e6539b8f51b42a361c824803354e989fcd97691d75f4df16b4a26
Instruction ID: 35da12ca432214c7b379dae793e6403add669522c89001697205a361f78b3afe
Opcode Fuzzy Hash: 9ff89faccf8e6539b8f51b42a361c824803354e989fcd97691d75f4df16b4a26
Instruction Fuzzy Hash: B3614D74A00209EBDB14DF58C986BE977B1BB44360F148268FD596F3C1EB70EA41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D4B7A0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00D4B7CC
std::_Lockit::_Lockit.LIBCPMT ref: 00D4B7EF
std::bad_exception::bad_exception.LIBCMT ref: 00D4B870
__CxxThrowException@8.LIBCMT ref: 00D4B87E
std::_Lockit::_Lockit.LIBCPMT ref: 00D4B891
std::locale::facet::_Facet_Register.LIBCPMT ref: 00D4B8AB

Strings

bad cast, xrefs: 00D4B868

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: fe1b6c064aa1ee60a8485ee20d09a0d55f95868330ffdb1f7952b849c2a761fb
Instruction ID: a443ab6a06136c190334c5cee28c3dd27a5a53acfd73c7717eb25afa1dc9324e
Opcode Fuzzy Hash: fe1b6c064aa1ee60a8485ee20d09a0d55f95868330ffdb1f7952b849c2a761fb
Instruction Fuzzy Hash: 48318475D002458FDF18DF55D881BAA77B8FB28734F14025AE826772D1DB30AD44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D55236, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094), ref: 00D5531C

Strings

stdout, xrefs: 00D55281
flex%i.log, xrefs: 00D552DA
FLEXLM_DIAGNOSTICS, xrefs: 00D5524D
stderr, xrefs: 00D552A2

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: Version
String ID: FLEXLM_DIAGNOSTICS$flex%i.log$stderr$stdout
API String ID: 1889659487-2597289574
Opcode ID: 0cc90ecd27330961ec36314c3a1a11183b76d6441d3bb0ed04cbb974aac8b21f
Instruction ID: 163a09a25fac7add730cf7df7ee8fe381f92390941c5ad79516aeab031e104de
Opcode Fuzzy Hash: 0cc90ecd27330961ec36314c3a1a11183b76d6441d3bb0ed04cbb974aac8b21f
Instruction Fuzzy Hash: 7121F5B1C00304EBDF14EB60ED96BAE77B89744302F0444A8EE0D76242E7B45A8CCBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D74391, Relevance: 12.1, APIs: 8, Instructions: 117COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00D743C4
_strncmp.LIBCMT ref: 00D743E0
_strncmp.LIBCMT ref: 00D74401
_strncpy.LIBCMT ref: 00D74442
_strncpy.LIBCMT ref: 00D7445A
_strncmp.LIBCMT ref: 00D74484
_strncmp.LIBCMT ref: 00D7449A
_strncmp.LIBCMT ref: 00D744B6

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _strncmp$_strncpy
String ID:
API String ID: 4170286768-0
Opcode ID: 44e7a7a5d35bbd56998dead6b557ec4197fd49068f7fd5c0658508a832126f85
Instruction ID: 4b87c4a5395a7f4d47bfe5f1b9f3ee384ce34bba05ec5073379786d09028cb89
Opcode Fuzzy Hash: 44e7a7a5d35bbd56998dead6b557ec4197fd49068f7fd5c0658508a832126f85
Instruction Fuzzy Hash: 46419FB5A40208BBDF04DF64DC42BAA37A8EF04309F08C524FE1DDA282E775D614CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DAD0C0, Relevance: 12.1, APIs: 8, Instructions: 85timeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DAD0D2
_memset.LIBCMT ref: 00DAD0E2
GetCurrentProcess.KERNEL32(?,?,?,?,?,?), ref: 00DAD0F3
GetProcessTimes.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00DAD110
_sprintf.LIBCMT ref: 00DAD15A
_sprintf.LIBCMT ref: 00DAD172

Part of subcall function 00E5700E: __output_l.LIBCMT ref: 00E57069

_sprintf.LIBCMT ref: 00DAD18A

Part of subcall function 00E5700E: __flsbuf.LIBCMT ref: 00E57084

_sprintf.LIBCMT ref: 00DAD1A2

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _sprintf$Process_memset$CurrentTimes__flsbuf__output_l
String ID:
API String ID: 3617345755-0
Opcode ID: 43c14fe3274b2d88364d7394fe56df70be7cfe22cf211fe5e6c098141dea7063
Instruction ID: bfd2dd578a9bd06d187ca70b3a0b26006cf2bd52e545e53daa892278a0bdce22
Opcode Fuzzy Hash: 43c14fe3274b2d88364d7394fe56df70be7cfe22cf211fe5e6c098141dea7063
Instruction Fuzzy Hash: 48219CB1E001086BCB08EB98DC51EEF77B9DF88314F04C569F909BB381D975D9148B94

Uniqueness

Uniqueness Score: -1.00%

Function 00D79105, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 350COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D791EF
_malloc.LIBCMT ref: 00D79613
_malloc.LIBCMT ref: 00D79651

Part of subcall function 00E59BEE: __FF_MSGBANNER.LIBCMT ref: 00E59C07
Part of subcall function 00E59BEE: __NMSG_WRITE.LIBCMT ref: 00E59C0E
Part of subcall function 00E59BEE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 00E59C33

_memset.LIBCMT ref: 00D7968A
_memmove.LIBCMT ref: 00D796A1

Strings

demo, xrefs: 00D791B2

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _malloc_memset$AllocateHeap_memmove
String ID: demo
API String ID: 1287286150-3594706848
Opcode ID: da75401f97a994871838fd0d795f9382748c4949835e4d802a070e90b148b6c4
Instruction ID: ea83797d1170fed36775812ebee285664b9763370d7a55f46ffada9c80e7c70e
Opcode Fuzzy Hash: da75401f97a994871838fd0d795f9382748c4949835e4d802a070e90b148b6c4
Instruction Fuzzy Hash: DB022BB1900259CFEB24CF54CC58BDDBBB1BB49309F1481A8D94C6B381D7B69A89CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00DAA640, Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 257COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00DAA658
_swscanf.LIBCMT ref: 00DAA721
_swscanf.LIBCMT ref: 00DAA747

Strings

%ld, xrefs: 00DAA73E
, xrefs: 00DAA841
%lx, xrefs: 00DAA718

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _swscanf$_strlen
String ID: $%ld$%lx
API String ID: 4858752-293966833
Opcode ID: 77bb3f3343f4f0d664f8d2dc0dc1562e92dacab76f0203f505a70a88810e680d
Instruction ID: c16607d01586b2f1ca557214ac8f5c30e67494a6a6ff815696937b0c13db5cb1
Opcode Fuzzy Hash: 77bb3f3343f4f0d664f8d2dc0dc1562e92dacab76f0203f505a70a88810e680d
Instruction Fuzzy Hash: F8A14CB5D002099BEF04CF98C981BBFB7B5EF45305F288159E815AB241E7799E41CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00D43730, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 242COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D4377E
_memset.LIBCMT ref: 00D43859

Part of subcall function 00D47940: _memmove.LIBCMT ref: 00D4797D

Strings

08.0, xrefs: 00D437C8
nilm, xrefs: 00D4386F
([=_a-zA-Z0-9]+), xrefs: 00D43923
HOSTID=ERROR, xrefs: 00D43788

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _memset$_memmove
String ID: ([=_a-zA-Z0-9]+)$08.0$HOSTID=ERROR$nilm
API String ID: 2532777613-4137177851
Opcode ID: 8a17b99befdae9c83ebe77c8653060fd9ac69400e92645f0b0f2fde6beac5a6d
Instruction ID: 1ad7cf3db9ed65a396d868eae1e0cfe431fefde836eb0020d04a3316090eb676
Opcode Fuzzy Hash: 8a17b99befdae9c83ebe77c8653060fd9ac69400e92645f0b0f2fde6beac5a6d
Instruction Fuzzy Hash: FEB178B19042989BDB24DF58C891AEDB7B5AF04300F4445EEE59DA3281D7B49FD8CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D722C0, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

APIs

Part of subcall function 00D59F32: _memset.LIBCMT ref: 00D59F74

__setjmp3.LIBCMT ref: 00D7230E

Strings

l_master_lis.c, xrefs: 00D72356
l_master_lis.c, xrefs: 00D7239D
l_master_lis.c, xrefs: 00D725D6
l_master_lis.c, xrefs: 00D722EC

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: __setjmp3_memset
String ID: l_master_lis.c$l_master_lis.c$l_master_lis.c$l_master_lis.c
API String ID: 1597570620-1955162629
Opcode ID: 429a4c662f47e67b7c78329a40b9f8fd17cbfa38ec2ee2e7568abd1757a78bba
Instruction ID: 4674c88650b5ea9c271ce84ac94bf3abbd2e836d0b3a53394e0810857f19d79d
Opcode Fuzzy Hash: 429a4c662f47e67b7c78329a40b9f8fd17cbfa38ec2ee2e7568abd1757a78bba
Instruction Fuzzy Hash: E5910EB5A00208ABDB04DF54C895BE977B5BB44355F18C2B8EE4C5F382D771EA85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB4372, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 00D70BF7: _strncpy.LIBCMT ref: 00D70C18

_strlen.LIBCMT ref: 00DB43C0
_strlen.LIBCMT ref: 00DB43DC
_memset.LIBCMT ref: 00DB4473
_strlen.LIBCMT ref: 00DB4482
_swscanf.LIBCMT ref: 00DB44E8

Strings

%05d, xrefs: 00DB44DC

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _strlen$_memset_strncpy_swscanf
String ID: %05d
API String ID: 2924102989-2049770103
Opcode ID: 466b54d42737e7f31f7f51d11588c0e19e9dab777c5660437aafe71e78036042
Instruction ID: a0396987b8404e9579ee68c21a3a7a71a90623d8266152cc7c082980d37414b0
Opcode Fuzzy Hash: 466b54d42737e7f31f7f51d11588c0e19e9dab777c5660437aafe71e78036042
Instruction Fuzzy Hash: 05717A74900299DBDB31CF14CC90BE977B1AF09301F1881E9E989AB382D7B59AC4DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00D6959F, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 116COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00D69617
_strncmp.LIBCMT ref: 00D69661

Strings

START_LICENSE, xrefs: 00D6960E
END_LICENSE, xrefs: 00D69658
START_LICENSE, xrefs: 00D69601
END_LICENSE, xrefs: 00D6964B

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _strncmp
String ID: END_LICENSE$END_LICENSE$START_LICENSE$START_LICENSE
API String ID: 909875538-1394126991
Opcode ID: e81839782f3c4b789370dc413d66e87c3267028d60ca3de3b2dc617d5267a96b
Instruction ID: e0ba73a5e94fcfdee3d678d4eaffa24a48de71a0f2f6d04a5abbba4a09c153da
Opcode Fuzzy Hash: e81839782f3c4b789370dc413d66e87c3267028d60ca3de3b2dc617d5267a96b
Instruction Fuzzy Hash: 06416D70A05248EBDB18CF94C1F06BEBBBAAF42345F288099EC465F215D235DF41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00D7C259, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 107COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00D7C2BF
_sprintf.LIBCMT ref: 00D7C2D7
_strncpy.LIBCMT ref: 00D7C2FD

Strings

SIGN, xrefs: 00D7C2B1
%s%d, xrefs: 00D7C2B6
SIGN, xrefs: 00D7C2C9

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _sprintf$_strncpy
String ID: %s%d$SIGN$SIGN
API String ID: 1849356164-3430300620
Opcode ID: 333bb5cd7ac8ab7ce3da80988352eef84fd8142c4c7f88f3a8e57280ba4d35bb
Instruction ID: 525acb8cdc9fa4eae70bbbfa2a03edfdab4bed70b6e370d0e37e7d5f0de48c77
Opcode Fuzzy Hash: 333bb5cd7ac8ab7ce3da80988352eef84fd8142c4c7f88f3a8e57280ba4d35bb
Instruction Fuzzy Hash: 16413BB5A10209AFDB14EF94C885EAEB3B5BB48304F18D51DFC096B281E731DA45CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D49270, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D49286

Part of subcall function 00E417A7: std::exception::exception.LIBCMT ref: 00E417BC
Part of subcall function 00E417A7: __CxxThrowException@8.LIBCMT ref: 00E417D1

std::_Xinvalid_argument.LIBCPMT ref: 00D4929C
std::_Xinvalid_argument.LIBCPMT ref: 00D492B7
_memmove.LIBCMT ref: 00D49322

Strings

invalid string position, xrefs: 00D49281
string too long, xrefs: 00D49297, 00D492B2

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Exception@8Throw_memmovestd::exception::exception
String ID: invalid string position$string too long
API String ID: 1253240057-4289949731
Opcode ID: e946b9393916e267bf8e60ca89f0d5922bec4409a55e11ca799f97ed7661ecd4
Instruction ID: 1527abd4e5812ce08a87f2591c35825dc0575016b5c5eaf58c0d5c4cbdaf1c9e
Opcode Fuzzy Hash: e946b9393916e267bf8e60ca89f0d5922bec4409a55e11ca799f97ed7661ecd4
Instruction Fuzzy Hash: 5631D7323042005FD7249E5DE8A5E6FF3EAEB96760B144A2EF495D76D1C7B1AC4083B4

Uniqueness

Uniqueness Score: -1.00%

Function 00E583E9, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00E58403

Part of subcall function 00E59BEE: __FF_MSGBANNER.LIBCMT ref: 00E59C07
Part of subcall function 00E59BEE: __NMSG_WRITE.LIBCMT ref: 00E59C0E
Part of subcall function 00E59BEE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 00E59C33

std::exception::exception.LIBCMT ref: 00E58438
__CxxThrowException@8.LIBCMT ref: 00E58463
__FF_MSGBANNER.LIBCMT ref: 00E58477
__NMSG_WRITE.LIBCMT ref: 00E5847F

Strings

bad allocation, xrefs: 00E58431

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 1264268182-2104205924
Opcode ID: 95ded3885d560f316b29cc0e436808671962d3ac7eb827cd0d749259f48f6f2a
Instruction ID: cc58534aba95e93b9a88b0dd2ebbca655ad49b5655d3f582263bbbb8f873333b
Opcode Fuzzy Hash: 95ded3885d560f316b29cc0e436808671962d3ac7eb827cd0d749259f48f6f2a
Instruction Fuzzy Hash: 30012B75404349AACF00FB61ED4796E3BF9EF40365F146429FC187A1A1DFB0A90E8766

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E465, Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 490COMMON

Download Yara Rule

APIs

_fgetc.LIBCMT ref: 00D6E575
_fgets.LIBCMT ref: 00D6E69E
_fgetc.LIBCMT ref: 00D6E6E1

Strings

#, xrefs: 00D6E8A0
USE_SERVER, xrefs: 00D6E74B

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _fgetc$_fgets
String ID: #$USE_SERVER
API String ID: 3774966629-2573919625
Opcode ID: 275af112aa75366a14760bd1255bdb51a6e5eb761af085b56a1127e51dc59c92
Instruction ID: 79f9285237ceb48728546fba3bc8cd03c74161835c235a7a526e29d44d0f733b
Opcode Fuzzy Hash: 275af112aa75366a14760bd1255bdb51a6e5eb761af085b56a1127e51dc59c92
Instruction Fuzzy Hash: E92247B8D00209DFCF14CF98D495AAEBBB1BF49305F288199E855AB341D335EA45CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00D546A3, Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 331COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D5473B
_memmove.LIBCMT ref: 00D548E5
_memmove.LIBCMT ref: 00D54A0E

Strings

demo, xrefs: 00D549C3
demo, xrefs: 00D549BA

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _memmove
String ID: demo$demo
API String ID: 4104443479-2936632075
Opcode ID: bbc9f4402c9ebf1113053bf8121f95b3e0f7d98fd3c8e6afc4271d510a64d4f6
Instruction ID: f02b968bf715e0f0988814661c5052d74a6aaeb99355cfabfb1c2b5d15e84457
Opcode Fuzzy Hash: bbc9f4402c9ebf1113053bf8121f95b3e0f7d98fd3c8e6afc4271d510a64d4f6
Instruction Fuzzy Hash: 8ED18074A00205ABDF24DF14CC46BAA7771BF8471AF188268FD599F2C1DB71D988CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6D151, Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 244COMMONLIBRARYCODE

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D6D415

Part of subcall function 00D6DD11: _memmove.LIBCMT ref: 00D6DD6C

Strings

(K, xrefs: 00D6D233
(K, xrefs: 00D6D39C
,K, xrefs: 00D6D257

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _memmove
String ID: (K$(K$,K
API String ID: 4104443479-4180014700
Opcode ID: 4ed0b849540ddd17141a3a602e017efee4ed3f797176ae9543a3cb02332b0f8a
Instruction ID: 04a6a3c8bc6a78d5593110dd03b01fa52d582af4579f14a2cd4b9f3190fc4f3c
Opcode Fuzzy Hash: 4ed0b849540ddd17141a3a602e017efee4ed3f797176ae9543a3cb02332b0f8a
Instruction Fuzzy Hash: 3DB159B4F0020ADFDB14CF54D881BAE77B2BF89300F148668E9196B391D775E945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D92020, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 142COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00D92089

Strings

FLEXLM_%c%c%sADDATE, xrefs: 00D9207D
/var, xrefs: 00D921C4, 00D921CA
BUG_B, xrefs: 00D92074

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _sprintf
String ID: /var$BUG_B$FLEXLM_%c%c%sADDATE
API String ID: 1467051239-2776383463
Opcode ID: 1443a0806f0867b8daeb30b0d1618856aeba27697c9b84ec16af9c2000990849
Instruction ID: 3b1cdb212052548ce546c3ba6bab98c35f4527297133ffe4cc740dd471a3a233
Opcode Fuzzy Hash: 1443a0806f0867b8daeb30b0d1618856aeba27697c9b84ec16af9c2000990849
Instruction Fuzzy Hash: 15517174A00308EBEF24DB54D949BE977B4AF54300F1881E8E95C6F282D775AF84DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00DB41CD, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB4226
_sprintf.LIBCMT ref: 00DB4316
_sprintf.LIBCMT ref: 00DB4335

Part of subcall function 00DB4660: _strlen.LIBCMT ref: 00DB466A
Part of subcall function 00DB4660: _sprintf.LIBCMT ref: 00DB46AC

_strlen.LIBCMT ref: 00DB4341

Strings

%05d%c, xrefs: 00DB432C

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _sprintf$_strlen$_memset
String ID: %05d%c
API String ID: 689995866-4091610826
Opcode ID: 0aaed0b91f19614bd1e14997665999f381649e7ed602b61bf001d7261d77019d
Instruction ID: 1eaebc7499d94fdd5bb96508826e7d1babfbb08eafbb03330aa6784d2f38bc7f
Opcode Fuzzy Hash: 0aaed0b91f19614bd1e14997665999f381649e7ed602b61bf001d7261d77019d
Instruction Fuzzy Hash: 02518DB4904249EFDB04CF98C851BEE77B2FF44318F18C199E8665B382D335AA45DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00E5804B, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E580E6
__flush.LIBCMT ref: 00E58104
__write.LIBCMT ref: 00E5812B
__flsbuf.LIBCMT ref: 00E58156

Part of subcall function 00E5956D: __getptd_noexit.LIBCMT ref: 00E5956D

Strings

ement, xrefs: 00E58055

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID: ement
API String ID: 2782032738-3166100025
Opcode ID: be126c5fe6c887d414ff3e5d4eca79ad10c003f48fc8a9333ce4407635996b6a
Instruction ID: 8649b4d1c078a0c1768938fbdd7c8c696577875e9d07f78ce535c146a4932d2c
Opcode Fuzzy Hash: be126c5fe6c887d414ff3e5d4eca79ad10c003f48fc8a9333ce4407635996b6a
Instruction Fuzzy Hash: E141D631A01A04DBEB24DF658B4469FB7B5AF80366F28AD2CEC55B7190DB70DD49CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00D58140, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 00D59F32: _memset.LIBCMT ref: 00D59F74

__setjmp3.LIBCMT ref: 00D5818E

Strings

lm_crstr.c, xrefs: 00D58294
, xrefs: 00D581AE
lm_crstr.c, xrefs: 00D5823E
lm_crstr.c, xrefs: 00D5816C

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: __setjmp3_memset
String ID: $lm_crstr.c$lm_crstr.c$lm_crstr.c
API String ID: 1597570620-3072814489
Opcode ID: fce89e0577845af9ae07e6c6e7ea116431271c90c7b465e5b64ac7e91efaa805
Instruction ID: 1bb257df1bacb09d42a1767014ca80e0d2d289841b56cf6d53a931a49aeedaea
Opcode Fuzzy Hash: fce89e0577845af9ae07e6c6e7ea116431271c90c7b465e5b64ac7e91efaa805
Instruction Fuzzy Hash: 39412B74A40309ABDF04DF54C886FAA7BA5BB44351F148268FD486F381DB70EA45CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00D49590, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Mutex::_Mutex.LIBCPMT ref: 00D495C2

Part of subcall function 00E583E9: _malloc.LIBCMT ref: 00E58403

std::locale::_Init.LIBCPMT ref: 00D495DE

Part of subcall function 00E416C6: __EH_prolog3.LIBCMT ref: 00E416CD
Part of subcall function 00E416C6: std::_Lockit::_Lockit.LIBCPMT ref: 00E416E3
Part of subcall function 00E416C6: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00E41705
Part of subcall function 00E416C6: std::locale::_Setgloballocale.LIBCPMT ref: 00E4170F
Part of subcall function 00E416C6: _Yarn.LIBCPMT ref: 00E41725

std::_Lockit::_Lockit.LIBCPMT ref: 00D495F1

Strings

P!, xrefs: 00D495B6
P!, xrefs: 00D495A2

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: std::_std::locale::_$LockitLockit::_$H_prolog3InitLocimpLocimp::_MutexMutex::_SetgloballocaleYarn_malloc
String ID: P!$P!
API String ID: 3906141431-3503163932
Opcode ID: 54b14adb91f0a5170695444270e6ed3fa90a144aa09db0eae95577a30ab3262d
Instruction ID: a4a34e6f4063bf68101501a0babd444e5bdf11d2296d9d1cf9df52987a1ba57d
Opcode Fuzzy Hash: 54b14adb91f0a5170695444270e6ed3fa90a144aa09db0eae95577a30ab3262d
Instruction Fuzzy Hash: 743124B5500B008FD724CF65C991B96B7F4FB48720F104A6EE8969BB90EB75B904CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00D41170, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00D4119F
std::exception::exception.LIBCMT ref: 00D411D5

Part of subcall function 00E56F20: std::exception::_Copy_str.LIBCMT ref: 00E56F3B

__CxxThrowException@8.LIBCMT ref: 00D411EA

Part of subcall function 00E5F249: RaiseException.KERNEL32(00D411EF,E739FF75,00000000,00E7D34C,00D411EF,E739FF75,00E85AA0,?,00000000), ref: 00E5F28B

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00D411F1

Strings

bad locale name, xrefs: 00D411CE

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: std::_$Copy_strExceptionException@8Locinfo::_Locinfo_ctorLockitLockit::_RaiseThrowstd::exception::_std::exception::exception
String ID: bad locale name
API String ID: 73090415-1405518554
Opcode ID: ee0b2e8d241c8593ed3db9ae61d6a9ca611c649b03e752c66cd8309328a0545e
Instruction ID: ba0cad9722f87ff273bffea5a1036a8ff13a2701f59fb7e491e810b2102d88f7
Opcode Fuzzy Hash: ee0b2e8d241c8593ed3db9ae61d6a9ca611c649b03e752c66cd8309328a0545e
Instruction Fuzzy Hash: F91194B2D047449FCB11DF99C881A9EFBF8FB19710F80866EE45AA3641D7346608CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D6A6CD, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

_swscanf.LIBCMT ref: 00D6A6EF
_memset.LIBCMT ref: 00D6A724

Strings

;, xrefs: 00D6A72C
%d-%[^-]-%d, xrefs: 00D6A6E6
;, xrefs: 00D6A733

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _memset_swscanf
String ID: %d-%[^-]-%d$;$;
API String ID: 2826912138-516639765
Opcode ID: 2c1d2b7717b8e9d9cb89a61464b21059c1b49dc1b5cfa6833612ce4e488eeec1
Instruction ID: 67615dffe96a1c5bfcebc33b7c34fa3ae305439a583ee5ce5ba892b795c60338
Opcode Fuzzy Hash: 2c1d2b7717b8e9d9cb89a61464b21059c1b49dc1b5cfa6833612ce4e488eeec1
Instruction Fuzzy Hash: 9E1121B1C00208EFDF14DFD8E985AEEB7B4AB44304F144619F52577291EB755908CF66

Uniqueness

Uniqueness Score: -1.00%

Function 00D7E21A, Relevance: 7.9, APIs: 5, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _longjmp$_calloc_free_memmove
String ID:
API String ID: 874153074-0
Opcode ID: 23829ef7e638839252cdd9ca996eb8c6a06ef071355e06efb35f9b8b0320c1de
Instruction ID: a1c95fd9aa2d96120c7b8a180bcc32a1351413a21412d2f4668b50dbce0a5cd4
Opcode Fuzzy Hash: 23829ef7e638839252cdd9ca996eb8c6a06ef071355e06efb35f9b8b0320c1de
Instruction Fuzzy Hash: 26E161B5900209EFDB04CF94C895BAEB7B5FF48305F1485A8E9196B381E735DA45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DBE2F0, Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 00DBE327
_fseek.LIBCMT ref: 00DBE346

Part of subcall function 00E5B60D: __lock_file.LIBCMT ref: 00E5B64E

_malloc.LIBCMT ref: 00DBE355

Part of subcall function 00E59BEE: __FF_MSGBANNER.LIBCMT ref: 00E59C07
Part of subcall function 00E59BEE: __NMSG_WRITE.LIBCMT ref: 00E59C0E
Part of subcall function 00E59BEE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 00E59C33

_memset.LIBCMT ref: 00DBE377
__fread_nolock.LIBCMT ref: 00DBE38D

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _fseek$AllocateHeap__fread_nolock__lock_file_malloc_memset
String ID:
API String ID: 1358338167-0
Opcode ID: 7a08a81df77f7f8b18567731d9759521cd10e769e44648f13c3069c3a88c41db
Instruction ID: ee301c0aeb43a316c00450c62d89b02f6f57ce85a8a1ae75f80f619b6b89d171
Opcode Fuzzy Hash: 7a08a81df77f7f8b18567731d9759521cd10e769e44648f13c3069c3a88c41db
Instruction Fuzzy Hash: 7E613174E04209EFDB14DF98C891BEEB7B1BF48701F288568E9556B381D731DA44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00E5D7CB, Relevance: 7.7, APIs: 5, Instructions: 160COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E5D826
_memcpy_s.LIBCMT ref: 00E5D897
__read.LIBCMT ref: 00E5D8FA
__filbuf.LIBCMT ref: 00E5D916

Part of subcall function 00E5956D: __getptd_noexit.LIBCMT ref: 00E5956D

_memset.LIBCMT ref: 00E5D957

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_memcpy_s
String ID:
API String ID: 4048096073-0
Opcode ID: ec079c8bebdf166df128c25d3f390c4613e318406321532cca97712e8ae1f553
Instruction ID: 043f07963b6247d73d7c88f3327b50e1545d40179f6927fd3df8ade4ba95d9c9
Opcode Fuzzy Hash: ec079c8bebdf166df128c25d3f390c4613e318406321532cca97712e8ae1f553
Instruction Fuzzy Hash: 43510931E04309EBCB35DFA9CC4469EB7B1EF80325F249A69EC24B6191D3709D58DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00D820AD, Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 00D82117
_swscanf.LIBCMT ref: 00D8213D
_strlen.LIBCMT ref: 00D82181
_swscanf.LIBCMT ref: 00D821D1
_strlen.LIBCMT ref: 00D821E5

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _strlen_swscanf$_strncpy
String ID:
API String ID: 3771623585-0
Opcode ID: 32f8281004efb0e334984ba3cafcd8ce46802f6439783721c4d1756866b93dd8
Instruction ID: bc31cffd73ffaed00054b93f37229a750791280be03907dd0db457dca6984ad3
Opcode Fuzzy Hash: 32f8281004efb0e334984ba3cafcd8ce46802f6439783721c4d1756866b93dd8
Instruction Fuzzy Hash: 6A5126B590030ADFDB04DFA4C886BBEBBB1FF45304F244559E905AB341E775AA44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D65150, Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 00D651BA
_swscanf.LIBCMT ref: 00D651E0
_strlen.LIBCMT ref: 00D65224
_swscanf.LIBCMT ref: 00D65274
_strlen.LIBCMT ref: 00D65288

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _strlen_swscanf$_strncpy
String ID:
API String ID: 3771623585-0
Opcode ID: 54025fbebd383032c9f7fb2115dc328e4cc24464757fa174ba46e0eea269bd14
Instruction ID: 2e77f6f0cbd790df692b6f63e214ebac7fde4d6ec71f41e43cfe2615eea09147
Opcode Fuzzy Hash: 54025fbebd383032c9f7fb2115dc328e4cc24464757fa174ba46e0eea269bd14
Instruction Fuzzy Hash: 3B5149B5D0020ADFDB04CFA4D896BEEBBB1FF48304F244459E905AB345D375AA84CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D863E8, Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 00D86452
_swscanf.LIBCMT ref: 00D86478
_strlen.LIBCMT ref: 00D864BC
_swscanf.LIBCMT ref: 00D8650C
_strlen.LIBCMT ref: 00D86520

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _strlen_swscanf$_strncpy
String ID:
API String ID: 3771623585-0
Opcode ID: 8ebeaf1e4f16554bd729ced51d4bada5492dad9283c18386b851167c521ed9c2
Instruction ID: c25d28d3953bf9a87dd9b1f609ed25af00b69c43fa362ce0dfc575762bcd7bf9
Opcode Fuzzy Hash: 8ebeaf1e4f16554bd729ced51d4bada5492dad9283c18386b851167c521ed9c2
Instruction Fuzzy Hash: 8A5139B5D0020ADFDB04DFA4C882BEEBBB1FF45304F244559E905AB341D775AA44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D41210, Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00D4123F

Part of subcall function 00E41563: _setlocale.LIBCMT ref: 00E41575

_free.LIBCMT ref: 00D41251

Part of subcall function 00E57411: HeapFree.KERNEL32(00000000,00000000,?,00E56F15,?,?,00D41021), ref: 00E57427
Part of subcall function 00E57411: GetLastError.KERNEL32(?,?,00E56F15,?,?,00D41021), ref: 00E57439

_free.LIBCMT ref: 00D41264
_free.LIBCMT ref: 00D41277
_free.LIBCMT ref: 00D4128A

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLastLocinfo::_Locinfo_dtor_setlocalestd::_
String ID:
API String ID: 3515823920-0
Opcode ID: a2d864c1da95a8e944b2a326c8aa7bce4dc54b592904bf9aa07f07349100cff0
Instruction ID: e93d6ad31efbb051d042bb521089c5f625fa94255d4fdc5013280710b935a5c4
Opcode Fuzzy Hash: a2d864c1da95a8e944b2a326c8aa7bce4dc54b592904bf9aa07f07349100cff0
Instruction Fuzzy Hash: 6411E7F1D046409BCB20DF59DC42A5BF7ECEF40B10F188A2AE466D3740E771E9048B91

Uniqueness

Uniqueness Score: -1.00%

Function 00E64554, Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00E64560

Part of subcall function 00E647BA: __getptd_noexit.LIBCMT ref: 00E647BD
Part of subcall function 00E647BA: __amsg_exit.LIBCMT ref: 00E647CA

__getptd.LIBCMT ref: 00E64577
__amsg_exit.LIBCMT ref: 00E64585
__lock.LIBCMT ref: 00E64595
__updatetlocinfoEx_nolock.LIBCMT ref: 00E645A9

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 39d7c955d22f1706589bf39e0d355fea4d1deb40a369a487513fb58d5772d3d4
Instruction ID: f70c924f46b027287b602cb3cd411e164a8a7770a594b276d1ff4b59c5b8b0bc
Opcode Fuzzy Hash: 39d7c955d22f1706589bf39e0d355fea4d1deb40a369a487513fb58d5772d3d4
Instruction Fuzzy Hash: 3EF0F0B29C4700DBD721BB74B807B4D36E0AF047A0F10610BF505762C2CF205A018A41

Uniqueness

Uniqueness Score: -1.00%

Function 00D49700, Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 480COMMON

Download Yara Rule

APIs

Part of subcall function 00D416F0: std::_Lockit::_Lockit.LIBCPMT ref: 00D41701

Part of subcall function 00D4BA80: std::_Lockit::_Lockit.LIBCPMT ref: 00D4BAAC
Part of subcall function 00D4BA80: std::_Lockit::_Lockit.LIBCPMT ref: 00D4BACF

std::_Lockit::_Lockit.LIBCPMT ref: 00D49782
_localeconv.LIBCMT ref: 00D497F8
_strcspn.LIBCMT ref: 00D4990D

Strings

e, xrefs: 00D4980B

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: LockitLockit::_std::_$_localeconv_strcspn
String ID: e
API String ID: 331173946-4024072794
Opcode ID: 94117feef72ae9e7b3f4c2ec43620d345da1a7b2a2fa1196c2daa7d46f604d51
Instruction ID: b1af47921d8a4125620f899feb77176f7225e833cabac91f74dad33a02cd4397
Opcode Fuzzy Hash: 94117feef72ae9e7b3f4c2ec43620d345da1a7b2a2fa1196c2daa7d46f604d51
Instruction Fuzzy Hash: A9123A75E002489FDB14CFA9C891AEEBBF5FF89304F158259E809AB355D770AD05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DA5189, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DA52F6

Part of subcall function 00DA553F: GetTickCount.KERNEL32 ref: 00DA55AD
Part of subcall function 00DA553F: Sleep.KERNEL32(0000000A), ref: 00DA55D8
Part of subcall function 00DA553F: GetTickCount.KERNEL32 ref: 00DA55EE

_sprintf.LIBCMT ref: 00DA541B
_memmove.LIBCMT ref: 00DA549F

Strings

%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X, xrefs: 00DA540F

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: CountTick$Sleep_memmove_memset_sprintf
String ID: %2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
API String ID: 3210233218-3754946579
Opcode ID: 5ba8f0b94500ccf6c321868f48ee51aa072c98aa86142701d373f77ff4cbd177
Instruction ID: e4d7f1cd398c365c36188b8090f0d6d7eb1c3e4fddd5f1f2b712171f9ca6b6e6
Opcode Fuzzy Hash: 5ba8f0b94500ccf6c321868f48ee51aa072c98aa86142701d373f77ff4cbd177
Instruction Fuzzy Hash: DBB11574900618DFCB25CF04E898BEAB3B5BB49315F1881E9E80C5B295D775AEC1CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D49090, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D4910C
std::_Xinvalid_argument.LIBCPMT ref: 00D49126
_memmove.LIBCMT ref: 00D4917C

Part of subcall function 00D48FA0: std::_Xinvalid_argument.LIBCPMT ref: 00D48FB9
Part of subcall function 00D48FA0: std::_Xinvalid_argument.LIBCPMT ref: 00D48FDA
Part of subcall function 00D48FA0: std::_Xinvalid_argument.LIBCPMT ref: 00D48FF5
Part of subcall function 00D48FA0: _memmove.LIBCMT ref: 00D4905D

Strings

string too long, xrefs: 00D49107, 00D49121

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 4cc8db290c6e9147fa02fe245b5b94a126dab2ac041e51f26c45a2c3d032eb71
Instruction ID: 7e5a50fc897eae76d0aedf5722fdbac01b3689d9c7516eeef4f7952b5d1d0e5f
Opcode Fuzzy Hash: 4cc8db290c6e9147fa02fe245b5b94a126dab2ac041e51f26c45a2c3d032eb71
Instruction Fuzzy Hash: 803108323003104BDB24AE6EE8A496FF7EAEFE5760724492FF49687685C7719C4483B5

Uniqueness

Uniqueness Score: -1.00%

Function 00DA2314, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00DA241D
_strlen.LIBCMT ref: 00DA2429

Strings

%d%s, xrefs: 00DA2414
xi, xrefs: 00DA2320

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _sprintf_strlen
String ID: %d%s$xi
API String ID: 3493289842-267120433
Opcode ID: 73373c087667124e7ef04eefd25a2d433cec1f8cc786779f25d2a17eba7fea5f
Instruction ID: 1f92bc5d32d0d43568845e68bbf452286494874170b86668bd9b431f2dad5ac4
Opcode Fuzzy Hash: 73373c087667124e7ef04eefd25a2d433cec1f8cc786779f25d2a17eba7fea5f
Instruction Fuzzy Hash: A351FA74600208EFCB04CF49C594BED7BB2BF89314F6882A9E9499F345C775AE81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00DA3660, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 00DA36A2
_strncpy.LIBCMT ref: 00DA3709
_strncpy.LIBCMT ref: 00DA3780

Strings

Unknown, xrefs: 00DA3731

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _strncpy
String ID: Unknown
API String ID: 2961919466-1654365787
Opcode ID: 2336d8a6b39a60020327d0541a81ed8d6e253a9dee6b16fc99096735a8756990
Instruction ID: 9d4421182688ac89057f6f1fba067095d969cd5833ab10d25f982ec45578dd6a
Opcode Fuzzy Hash: 2336d8a6b39a60020327d0541a81ed8d6e253a9dee6b16fc99096735a8756990
Instruction Fuzzy Hash: DD31C6B4600204ABDB14DF18C855BE937B6AF45349F0881B9FF4C6B382DA35DA81CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D65035, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00D65070
_memset.LIBCMT ref: 00D650E3
_strlen.LIBCMT ref: 00D65110

Strings

%s=%s, xrefs: 00D65067

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _memset_sprintf_strlen
String ID: %s=%s
API String ID: 751656446-3150307001
Opcode ID: 57830770b648a87bf6172c5c059724c26110dcfdbf89e626f73db5a226fa0d50
Instruction ID: 40a93561bf16b8ec3d20cddc4b015cdae2e43e938c9056d530b0c1ff45b98652
Opcode Fuzzy Hash: 57830770b648a87bf6172c5c059724c26110dcfdbf89e626f73db5a226fa0d50
Instruction Fuzzy Hash: 553173B5900209ABDF04DF94E951BAE7BB5EF45305F288098FC05AB345D631DA54CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D862CD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00D86308
_memset.LIBCMT ref: 00D8637B
_strlen.LIBCMT ref: 00D863A8

Strings

%s=%s, xrefs: 00D862FF

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _memset_sprintf_strlen
String ID: %s=%s
API String ID: 751656446-3150307001
Opcode ID: 9f15f09851739c62c725ea873cc39a1e09d236d3db32a81a5096ecf26d0ccafe
Instruction ID: c7e7d10c79971af901429129ff45d0430722d5587de6aa38966968a2775a1317
Opcode Fuzzy Hash: 9f15f09851739c62c725ea873cc39a1e09d236d3db32a81a5096ecf26d0ccafe
Instruction Fuzzy Hash: CE3164B5A00208EBDF04EF94D991AAE7BB5EF44315F188098FD45AB342E631DE14DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00D491B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D491C4

Part of subcall function 00E4175A: std::exception::exception.LIBCMT ref: 00E4176F
Part of subcall function 00E4175A: __CxxThrowException@8.LIBCMT ref: 00E41784

std::_Xinvalid_argument.LIBCPMT ref: 00D491D3

Strings

string too long, xrefs: 00D491BF, 00D491CE

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Exception@8Throwstd::exception::exception
String ID: string too long
API String ID: 3336028256-2556327735
Opcode ID: d48c21238c177523a47e045221e561a22130925ac11e4ae69be313c7f146c77c
Instruction ID: e3c25733d128684ddfa8faa39bf6755917e1ea58e7b63b9940c3128706650935
Opcode Fuzzy Hash: d48c21238c177523a47e045221e561a22130925ac11e4ae69be313c7f146c77c
Instruction Fuzzy Hash: 96210732304350ABC7319A9DA45066BFBE8DBA3720F54495BF8D4DB651C3B1D840C3B5

Uniqueness

Uniqueness Score: -1.00%

Function 00D7C160, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00D7C219
_sprintf.LIBCMT ref: 00D7C239

Strings

uncounted, xrefs: 00D7C1D5
06.0, xrefs: 00D7C1A4

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _sprintf
String ID: 06.0$uncounted
API String ID: 1467051239-2514625941
Opcode ID: 52c4ef5e4e7b4160b7c9bd23478cfd59e4d03b7d2e71c10daf8c472c64c529e8
Instruction ID: 151228d12bfd931d3b37b1beaf8ed31b67475d4548fb1e85dd1d32e13961bad1
Opcode Fuzzy Hash: 52c4ef5e4e7b4160b7c9bd23478cfd59e4d03b7d2e71c10daf8c472c64c529e8
Instruction Fuzzy Hash: FB219671A10204AFCB14DB54DC41BE973A9FB44312F14D16AFD4D5B242E771DA84C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB4660, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00DB466A
_sprintf.LIBCMT ref: 00DB46AC
_sprintf.LIBCMT ref: 00DB46C9

Strings

%c%c, xrefs: 00DB46A0

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _sprintf$_strlen
String ID: %c%c
API String ID: 4048706883-3228636524
Opcode ID: db58ebbafb35278771885aff6ab4a942761112f3ba94a80743358b87ad439424
Instruction ID: c08cb0465eefa8815e0d1256e1d4a83c68b14431009f8cb2c473529d2670acea
Opcode Fuzzy Hash: db58ebbafb35278771885aff6ab4a942761112f3ba94a80743358b87ad439424
Instruction Fuzzy Hash: 6001A2B5D00208FBDB00EF98DC82EED7BB59F45305F548085F909BB342E630EA6087A5

Uniqueness

Uniqueness Score: -1.00%

Function 00D704EC, Relevance: 6.4, APIs: 4, Instructions: 399COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D705BB
_memmove.LIBCMT ref: 00D70618

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 71ffb3c24d37b0a1be897bfa299314dc7706556a770e1ee71792d250c253318b
Instruction ID: 6da090874a5ec758806cef41a3a9686a09946d6e1c84385fd44570bcb6accdc6
Opcode Fuzzy Hash: 71ffb3c24d37b0a1be897bfa299314dc7706556a770e1ee71792d250c253318b
Instruction Fuzzy Hash: EE021A74A00209EBDB08CF54C485BEE7BB1BF44314F28C168E9595F382E775AA85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D744D3, Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05914e61c1eb54c328204a4bcb427b53644a0436a79c3af5d8f414878bc5bcb4
Instruction ID: fbe24292a6b1e6b58af1f1ffa133ac1e0b1113057ce59c147b1f7c4267aeffc4
Opcode Fuzzy Hash: 05914e61c1eb54c328204a4bcb427b53644a0436a79c3af5d8f414878bc5bcb4
Instruction Fuzzy Hash: 46619F75A006089FDB14CF14DC99FAA77B5AF45305F18C2A8F94C6B381EB30A985CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D914E7, Relevance: 6.1, APIs: 4, Instructions: 76windowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00D9150A
_memset.LIBCMT ref: 00D91521
GetFocus.USER32 ref: 00D91577
GetFocus.USER32 ref: 00D91587

Part of subcall function 00D915F4: 6FA4DB20.COMCTL32(?,?,00D91593,00000000), ref: 00D915F8

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: Focus$HandleModule_memset
String ID:
API String ID: 3672089127-0
Opcode ID: fdd59131237ace7cb676576735c863b7d87acaba6d257005bb3fa54343ba7c87
Instruction ID: dbe3f6e5761c7dcae3e91cc0801121889fa27d8b15b54d140e85c7f405400dce
Opcode Fuzzy Hash: fdd59131237ace7cb676576735c863b7d87acaba6d257005bb3fa54343ba7c87
Instruction Fuzzy Hash: C13181B8D04249EFDF64CF90D945BEDBBB4AF45301F05809AEC09A6241E7748B88CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00E6F43A, Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(00000000,00E681D5,00000000,00000000,73B75970,?,00E59EFD,00000000,00000000), ref: 00E6F43D
__malloc_crt.LIBCMT ref: 00E6F46C
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,00000000,?,00E59EFD,00000000,00000000), ref: 00E6F479

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: EnvironmentStrings$Free__malloc_crt
String ID:
API String ID: 237123855-0
Opcode ID: 20e83074cff0d6f989a9847d6e84e38a78ab65294c52e4776ab36b1e5292ef47
Instruction ID: 30a7217475dfdd724e4ebd90c94764212e987c5ede5b383f4565f78696cc83c7
Opcode Fuzzy Hash: 20e83074cff0d6f989a9847d6e84e38a78ab65294c52e4776ab36b1e5292ef47
Instruction Fuzzy Hash: EBF027779841105A8F31BB34BC498AB3778DBD53FA31A6876F415F3522FE208D8982A1

Uniqueness

Uniqueness Score: -1.00%

Function 00DAF297, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

c, xrefs: 00DAF348

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID:
String ID: c
API String ID: 0-112844655
Opcode ID: 455024906d53280087e75ad28170ca8b2d97e5affd777337145f3e675c286f90
Instruction ID: 86f088c64a3fddc075371acd5ea0d6c52fdd797d21ec1c6055cdaba7c2c4550e
Opcode Fuzzy Hash: 455024906d53280087e75ad28170ca8b2d97e5affd777337145f3e675c286f90
Instruction Fuzzy Hash: 00F12B74900209EFDB14DFD8C885BEEB7B1FF49310F288269E855AB291D7749985CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DAE1A9, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 326COMMON

Download Yara Rule

Strings

+, xrefs: 00DAE310

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: a4705092296038480248b21052b4d5ddab0b2d0c57f3bc00b63388a6e24329d1
Instruction ID: 0ea934b4a6bccbd67eb65861123602015b73f76e773d3ee843132b1c136d38ac
Opcode Fuzzy Hash: a4705092296038480248b21052b4d5ddab0b2d0c57f3bc00b63388a6e24329d1
Instruction Fuzzy Hash: 0DD12AB5A00309EBDB44CF58C884BAB77B5FF88300F248568F9599B381D730EA51CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D532E3, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

, xrefs: 00D533AD

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 776d39961a0b294f3e1b2ee46ab5c0f0125f25da16939bf7c6f6649df8ac4c80
Instruction ID: d78d1184cca8301d5e497ffb82890d503a9fac648b9e8ff12edcda07fb207999
Opcode Fuzzy Hash: 776d39961a0b294f3e1b2ee46ab5c0f0125f25da16939bf7c6f6649df8ac4c80
Instruction Fuzzy Hash: 95716AB1D00208EBDF04DFD8D849BEEB7B5EF44301F148528E9156B281E7759B48DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D68520, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 174registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,00000001,00000000), ref: 00D68628
RegCloseKey.ADVAPI32(00000000), ref: 00D686A8

Strings

LM_APP_DISABLE_CACHE_READ, xrefs: 00D68558

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: CloseOpen
String ID: LM_APP_DISABLE_CACHE_READ
API String ID: 47109696-2625039047
Opcode ID: ba219e5fa75eb781df870f6970c9c41381db2994a9fef38241a68f7929e498a5
Instruction ID: 63b7537f000df0f2574843b3b61da333e419f3d5b273ecaaf56a7f14d73b311b
Opcode Fuzzy Hash: ba219e5fa75eb781df870f6970c9c41381db2994a9fef38241a68f7929e498a5
Instruction Fuzzy Hash: 03712DB5A40209DFEF14CF54C899BEE77B1FB44304F288269E8095B380DB75DA84DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D9628C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D962C0

Part of subcall function 00D70B74: _sprintf.LIBCMT ref: 00D70B84

_memcmp.LIBCMT ref: 00D9637C

Strings

a, xrefs: 00D962FA

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _memcmp_memset_sprintf
String ID: a
API String ID: 3165542541-3904355907
Opcode ID: 7fccb8edd5f1724ab453790c957ed32badfb6d9aa823bf40f1ab4345ed0f068f
Instruction ID: f2e6439024c6be4b9ba0fc27f13469dc8089d80c300973d7e80622f88d0fd9b9
Opcode Fuzzy Hash: 7fccb8edd5f1724ab453790c957ed32badfb6d9aa823bf40f1ab4345ed0f068f
Instruction Fuzzy Hash: B3516F74A0030AEBDF14DF68CC45FAA7761BB44714F588268F9599F2C1E771D941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D7C39F, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00D7C4A4

Strings

AUTH={ , xrefs: 00D7C3D8
%s=%s, xrefs: 00D7C498

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _sprintf
String ID: AUTH={ $%s=%s
API String ID: 1467051239-2637525124
Opcode ID: ee75dbc16a05040297f7d710d2a56c996dac7c8b18d3fd50db45794f50c6dd55
Instruction ID: 08311829691f8d664d946063a461390850ee4d8653ade014eabbd595fa070fc7
Opcode Fuzzy Hash: ee75dbc16a05040297f7d710d2a56c996dac7c8b18d3fd50db45794f50c6dd55
Instruction Fuzzy Hash: A8515FB5A10204EFDB04DF54DC81EAA73A5AB48305F14D55CF91D9B342E671EA50CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6D61E, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

,K, xrefs: 00D6D696
0K, xrefs: 00D6D742

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID:
String ID: ,K$0K
API String ID: 0-798637755
Opcode ID: afb7c29d73fcfbd27efd2290eb8f9abd42c01104b327eae96a5d70fd1b667fb2
Instruction ID: 4798254be61130f72eac638f9c08ee9cb7e0c866f4387626eab7823ec03a3a42
Opcode Fuzzy Hash: afb7c29d73fcfbd27efd2290eb8f9abd42c01104b327eae96a5d70fd1b667fb2
Instruction Fuzzy Hash: C951FAB4E00208EFCB04DF95E885BADB7B2FF99304F248599D4166B390D775AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5E1A0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00D59F32: _memset.LIBCMT ref: 00D59F74

__setjmp3.LIBCMT ref: 00D5E1F5

Strings

lm_ckout.c, xrefs: 00D5E2CC
lm_ckout.c, xrefs: 00D5E1D3

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: __setjmp3_memset
String ID: lm_ckout.c$lm_ckout.c
API String ID: 1597570620-4068308431
Opcode ID: 31d6a0225950658c9d7bc1b17adc7cfcc8734964571c4fb8736892f78614888f
Instruction ID: 3410d0f362a318a420545e04b4e937d9a1ae44f6c3d137a2abcddfa36fcc3c55
Opcode Fuzzy Hash: 31d6a0225950658c9d7bc1b17adc7cfcc8734964571c4fb8736892f78614888f
Instruction Fuzzy Hash: 03413CB5A00208AFDF04DF94C881FDA77B9AF88341F188168FD0C9B385D635EA55CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D652D2, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D65301
_swscanf.LIBCMT ref: 00D6531E

Strings

%ld-%[^-]-%ld, xrefs: 00D65315

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _memset_swscanf
String ID: %ld-%[^-]-%ld
API String ID: 2826912138-4058720049
Opcode ID: 8671dd9e6e329a677653c55a32fd3c3d38a34649bcfc35889e65cc295b53560c
Instruction ID: 0514348678245a9f616e7920dfbe8c69a2cded09f157894302067859fefdf213
Opcode Fuzzy Hash: 8671dd9e6e329a677653c55a32fd3c3d38a34649bcfc35889e65cc295b53560c
Instruction Fuzzy Hash: 094173B5C04288AFDB05DFA4C851AEE7BB49F55310F08C4A9E969AB342E635D704CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00D8222F, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D8225E
_swscanf.LIBCMT ref: 00D8227B

Strings

%ld-%[^-]-%ld, xrefs: 00D82272

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _memset_swscanf
String ID: %ld-%[^-]-%ld
API String ID: 2826912138-4058720049
Opcode ID: 3e4a3383e8137410f3647ef25d5271f82a42f8bd5f69ccc5af597b8b7990c8af
Instruction ID: 9b408157b98dee35f88a1f16e74eab38e32d5385d0d4512b111321089a266a09
Opcode Fuzzy Hash: 3e4a3383e8137410f3647ef25d5271f82a42f8bd5f69ccc5af597b8b7990c8af
Instruction Fuzzy Hash: EA4173B5C04288AEDB05DFA88851BEE7BB49F55310F08C499FD59AB342E635D704CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00D8656A, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D86599
_swscanf.LIBCMT ref: 00D865B6

Strings

%ld-%[^-]-%ld, xrefs: 00D865AD

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _memset_swscanf
String ID: %ld-%[^-]-%ld
API String ID: 2826912138-4058720049
Opcode ID: d0de84d4b1878ae0ff6c26597aaa74a83570b7ecad4cc7632f5aeea40104f20a
Instruction ID: 5304e4614f95ee9ed323c40fd0588287302f26c20140253ddebdf6b125fed9bb
Opcode Fuzzy Hash: d0de84d4b1878ae0ff6c26597aaa74a83570b7ecad4cc7632f5aeea40104f20a
Instruction Fuzzy Hash: 544173B5C04288AEDB05DFA48841AEE7BB49F55310F08C499E959A7342E635D704CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00D4C770, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00D4CA30: std::_Lockit::_Lockit.LIBCPMT ref: 00D4CA41

Part of subcall function 00D4B8E0: std::_Lockit::_Lockit.LIBCPMT ref: 00D4B90C
Part of subcall function 00D4B8E0: std::_Lockit::_Lockit.LIBCPMT ref: 00D4B92F

std::_Lockit::_Lockit.LIBCPMT ref: 00D4C7F6

Strings

P!, xrefs: 00D4C782
P!, xrefs: 00D4C7A2, 00D4C7C4, 00D4C7EA, 00D4C7A7

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: LockitLockit::_std::_
String ID: P!$P!
API String ID: 3382485803-3503163932
Opcode ID: 651e03b41d413e214e74bf4df9611124c274000350ff80b965fe957dc74babee
Instruction ID: 120819e283adf561a327b972751d2dff0c1c7500a574c89fdf50ea8b7ec161a8
Opcode Fuzzy Hash: 651e03b41d413e214e74bf4df9611124c274000350ff80b965fe957dc74babee
Instruction Fuzzy Hash: 7321C772B102049FDB14DF58D881BAAB7E4EB84720F14466AE919DB3C1DB35E90087A4

Uniqueness

Uniqueness Score: -1.00%

Function 00D4A340, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00D416F0: std::_Lockit::_Lockit.LIBCPMT ref: 00D41701

Part of subcall function 00D4A3F0: std::_Lockit::_Lockit.LIBCPMT ref: 00D4A41C
Part of subcall function 00D4A3F0: std::_Lockit::_Lockit.LIBCPMT ref: 00D4A43F

std::_Lockit::_Lockit.LIBCPMT ref: 00D4A394

Strings

P!, xrefs: 00D4A352
P!, xrefs: 00D4A366, 00D4A369, 00D4A386

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: LockitLockit::_std::_
String ID: P!$P!
API String ID: 3382485803-3503163932
Opcode ID: 48fee2e408af2f4192cf12fe26bac5ba746edb584b864da4526b0926b6bf8fa0
Instruction ID: 85df635c22e5f859ee08af16bca26515ea8338107d2796c768bcba96c07d4574
Opcode Fuzzy Hash: 48fee2e408af2f4192cf12fe26bac5ba746edb584b864da4526b0926b6bf8fa0
Instruction Fuzzy Hash: 8B118E72640A14AFDB10DF9CCC41B9AB3A4FB49720F114729E929EB2D1EB31A904CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00D543EC, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00D59F32: _memset.LIBCMT ref: 00D59F74

__setjmp3.LIBCMT ref: 00D54437

Strings

lm_init.c, xrefs: 00D54415
lm_init.c, xrefs: 00D54483

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: __setjmp3_memset
String ID: lm_init.c$lm_init.c
API String ID: 1597570620-1128194275
Opcode ID: dbbf2d98960b62e7248fcf8254fe2003e51b04b788095275d164351023c16361
Instruction ID: f00b1912ae703978eea9212c50278ad8dd5542deffa42adc2ccf04bdcb0ee9fe
Opcode Fuzzy Hash: dbbf2d98960b62e7248fcf8254fe2003e51b04b788095275d164351023c16361
Instruction Fuzzy Hash: 1E114FB5640308ABDB04DF54DC82FDA37A9AB44754F048164BE4C5F382E675FA94CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D68470, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00D59F32: _memset.LIBCMT ref: 00D59F74

__setjmp3.LIBCMT ref: 00D684BC

Strings

l_getenv.c, xrefs: 00D68508
l_getenv.c, xrefs: 00D6849A

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: __setjmp3_memset
String ID: l_getenv.c$l_getenv.c
API String ID: 1597570620-2811871314
Opcode ID: 3c606ee285b99247350b7015b12bca221cff057716250ea3ea087ea0c73bf841
Instruction ID: 741a8df5ec991640c5180da0c89f7f23b9bc46c8caf967fb485d7106391d2e19
Opcode Fuzzy Hash: 3c606ee285b99247350b7015b12bca221cff057716250ea3ea087ea0c73bf841
Instruction Fuzzy Hash: 5D1133B5600208ABDB04DF54D852FDA77A5AB84351F148168FE4C5F381D631EA41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D68778, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00D59F32: _memset.LIBCMT ref: 00D59F74

__setjmp3.LIBCMT ref: 00D687C4

Strings

l_getenv.c, xrefs: 00D68810
l_getenv.c, xrefs: 00D687A2

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: __setjmp3_memset
String ID: l_getenv.c$l_getenv.c
API String ID: 1597570620-2811871314
Opcode ID: 970fb81a446f38cabed5374597726e5b48f8444649d94319617d35a9ad8d70d3
Instruction ID: 542dfd82931922accfed8bff9e22559811f9b951522b0257d25cadcfd0e8ea37
Opcode Fuzzy Hash: 970fb81a446f38cabed5374597726e5b48f8444649d94319617d35a9ad8d70d3
Instruction Fuzzy Hash: A0116DB5640208ABDB04DF54D882FDA77A5EF84354F148268FD4C9F382E632EA45CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00D68061, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00D59F32: _memset.LIBCMT ref: 00D59F74

__setjmp3.LIBCMT ref: 00D680AD

Strings

l_getenv.c, xrefs: 00D6808B
l_getenv.c, xrefs: 00D680F5

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: __setjmp3_memset
String ID: l_getenv.c$l_getenv.c
API String ID: 1597570620-2811871314
Opcode ID: 5cd280c26a6f885512fa05855d3fde6d682c3aa1733bd65a7d649303521f2401
Instruction ID: 720fe865e6c58abbc6952537a0133d05cb94e9da07291e797d7b9dbdb3b76eea
Opcode Fuzzy Hash: 5cd280c26a6f885512fa05855d3fde6d682c3aa1733bd65a7d649303521f2401
Instruction Fuzzy Hash: 4A111FB5A00208EBDB04DF54D892ED977A5EF44350F148268FD4C9F381EA36EA55CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D752E4, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00D59F32: _memset.LIBCMT ref: 00D59F74

__setjmp3.LIBCMT ref: 00D75330

Strings

l_cvd.c, xrefs: 00D75373
l_cvd.c, xrefs: 00D7530E

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: __setjmp3_memset
String ID: l_cvd.c$l_cvd.c
API String ID: 1597570620-3253219655
Opcode ID: 7c1350e906002d01a3e9ffe575c1b2190bda8e2c8a8674ba93d52855a34bc5bb
Instruction ID: d99b6fdf5de3de5acf155b740f9b84c3820213c499c946b04781d71c647ac47c
Opcode Fuzzy Hash: 7c1350e906002d01a3e9ffe575c1b2190bda8e2c8a8674ba93d52855a34bc5bb
Instruction Fuzzy Hash: 071170B5A00208ABDB04DF64DC82EEA37A5AB44351F048264FE0C9F381E671EA44CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00D7523D, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00D59F32: _memset.LIBCMT ref: 00D59F74

__setjmp3.LIBCMT ref: 00D75289

Strings

l_cvd.c, xrefs: 00D752CC
l_cvd.c, xrefs: 00D75267

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: __setjmp3_memset
String ID: l_cvd.c$l_cvd.c
API String ID: 1597570620-3253219655
Opcode ID: eeeb0f9728df2de77f7094d68b05df72df9ca936b4bb0113ed095a2859a96bdc
Instruction ID: f0290a6879e89d2dc6f7f9dafa42b50444a04ac04afb98de1b7afa738f18e3e2
Opcode Fuzzy Hash: eeeb0f9728df2de77f7094d68b05df72df9ca936b4bb0113ed095a2859a96bdc
Instruction Fuzzy Hash: 8B1156B5A40209ABDF04DF64DC82EDA37A5EF44350F048664FD4C9F381E671EA54CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D5B380, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00D59F32: _memset.LIBCMT ref: 00D59F74

__setjmp3.LIBCMT ref: 00D5B3C9

Strings

lm_set_attr.c, xrefs: 00D5B3A7
lm_set_attr.c, xrefs: 00D5B40E

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: __setjmp3_memset
String ID: lm_set_attr.c$lm_set_attr.c
API String ID: 1597570620-3623871419
Opcode ID: 91784006f23ec07c47a06ad38802f93c014c83a15b598469390d84d69422a426
Instruction ID: 72a8cd1f0e1e68f7a840c322a6b61fae4cb5da74b8c8b5a8d90750e92e84d3ee
Opcode Fuzzy Hash: 91784006f23ec07c47a06ad38802f93c014c83a15b598469390d84d69422a426
Instruction Fuzzy Hash: 88116DB5600208ABDB04DF54C882EEA77A5AB44354F048168FD4C9F382E635EA44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D7538B, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00D59F32: _memset.LIBCMT ref: 00D59F74

__setjmp3.LIBCMT ref: 00D753E7

Strings

l_cvd.c, xrefs: 00D75423
l_cvd.c, xrefs: 00D753C5

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: __setjmp3_memset
String ID: l_cvd.c$l_cvd.c
API String ID: 1597570620-3253219655
Opcode ID: 6bd8597e1ca491e7295e669bc8b5692047fe6b3f9944ffc429564342fea41583
Instruction ID: 4adc9564f00b920ccdb4267de5626e66d5e2a652b9daae914878e4c96bf2d08f
Opcode Fuzzy Hash: 6bd8597e1ca491e7295e669bc8b5692047fe6b3f9944ffc429564342fea41583
Instruction Fuzzy Hash: 891170B5A00208ABDB04DF50DC82FDA37A5AF84355F048168FD4C5F3C1E676EA54CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6F76C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00D59F32: _memset.LIBCMT ref: 00D59F74

__setjmp3.LIBCMT ref: 00D6F7CB

Strings

lm_config.c, xrefs: 00D6F803
lm_config.c, xrefs: 00D6F7A9

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: __setjmp3_memset
String ID: lm_config.c$lm_config.c
API String ID: 1597570620-658273362
Opcode ID: 2d5b17352a98c0d6491f4997b7b2b5169040bae8da101eeac27d073b8b2cfaa3
Instruction ID: fa268ad6f131e8f214d9c81b3cca32eadbd003e131bcb8c9bffd89ed71e2e00b
Opcode Fuzzy Hash: 2d5b17352a98c0d6491f4997b7b2b5169040bae8da101eeac27d073b8b2cfaa3
Instruction Fuzzy Hash: 58113CB5A00208ABDB04DF54E896BEA37A5AB84355F048274BE4C5F391D635EA84CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5769F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

_swscanf.LIBCMT ref: 00D576CA

Strings

%s %s %s, xrefs: 00D576C1
FEATURESET, xrefs: 00D576E1

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _swscanf
String ID: %s %s %s$FEATURESET
API String ID: 2748852333-3138149660
Opcode ID: b2aa085c8ca630f1fdc28b2313c9fb752935f9a19009406fbd17f6975751038c
Instruction ID: 4bea6d39404d06b945ae2051e6b447bce50a97b1a3100a278e00ac6035234357
Opcode Fuzzy Hash: b2aa085c8ca630f1fdc28b2313c9fb752935f9a19009406fbd17f6975751038c
Instruction Fuzzy Hash: 700175B691021897DF11EA54DC85EDA73ACAB08301F044995BD1CE3142F771DA98CF70

Uniqueness

Uniqueness Score: -1.00%

Function 00D49680, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D49693

Part of subcall function 00E4175A: std::exception::exception.LIBCMT ref: 00E4176F
Part of subcall function 00E4175A: __CxxThrowException@8.LIBCMT ref: 00E41784

_memmove.LIBCMT ref: 00D496BE

Strings

vector<T> too long, xrefs: 00D4968E

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argument_memmovestd::_std::exception::exception
String ID: vector<T> too long
API String ID: 22950630-3788999226
Opcode ID: 1949831ddadda3e0bd00ac57b819b959a346e3d4b2141d694f642e97f42c422e
Instruction ID: 35a028d0ce8cdfc3cb93095b07ff410b626767bd365622de5988d389259bca7f
Opcode Fuzzy Hash: 1949831ddadda3e0bd00ac57b819b959a346e3d4b2141d694f642e97f42c422e
Instruction Fuzzy Hash: F301A2B16042098FDB24DF69DCE286BB3D8EB54300718492DE89AC3744EA70F801CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00D57735, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00D5779E

Strings

%s %s %s, xrefs: 00D57792
FEATURESET, xrefs: 00D5778D

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _sprintf
String ID: %s %s %s$FEATURESET
API String ID: 1467051239-2251578402
Opcode ID: 33c59f476b831bfed09639560ea8a747d8babd80520c816e9050ab67a93b65cf
Instruction ID: 0761f1e31c50bd7e748a510053d23925a1fa037026ef1d7d6aad2cba25e87f40
Opcode Fuzzy Hash: 33c59f476b831bfed09639560ea8a747d8babd80520c816e9050ab67a93b65cf
Instruction Fuzzy Hash: 1E011BB9A04108FFCB04DF98D980DAEB7B6AF89301F248198ED09A7341D631EE55DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00DA37A0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?), ref: 00DA37D3
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 00DA3802

Strings

A:\, xrefs: 00DA37A6

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: DriveInformationTypeVolume
String ID: A:\
API String ID: 3149825354-3379428675
Opcode ID: d847bdd7aaca07f1faa0a4c1df0f6c620546833f079d64a289b92b454654d264
Instruction ID: 25cbeac043c3b52a003985652015acfe575f07227916278469e6d91591872af7
Opcode Fuzzy Hash: d847bdd7aaca07f1faa0a4c1df0f6c620546833f079d64a289b92b454654d264
Instruction Fuzzy Hash: 08014BB5D00209ABCB04CBE4CE85BFEB7B9AB19704F600449E90176181D676AA49CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 00E46380, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00E463A0

Part of subcall function 00E4175A: std::exception::exception.LIBCMT ref: 00E4176F
Part of subcall function 00E4175A: __CxxThrowException@8.LIBCMT ref: 00E41784

Strings

vector<T> too long, xrefs: 00E4639B
<, xrefs: 00E46383

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_std::exception::exception
String ID: <$vector<T> too long
API String ID: 2884196479-1140003367
Opcode ID: 09a6d3a2ad3dfa1979fc8a6db7301aa83881bced9d6a2598c1ab99841635a8fe
Instruction ID: 45096025e9b7e1b48c76fca7266d0e13d753d411b1f29bb8558e6eca0e7fc79b
Opcode Fuzzy Hash: 09a6d3a2ad3dfa1979fc8a6db7301aa83881bced9d6a2598c1ab99841635a8fe
Instruction Fuzzy Hash: DEF0BE33B001214B4704987CED0405E7683A7EA72573AEB76E428E72C8F9319C475281

Uniqueness

Uniqueness Score: -1.00%

Function 00DAD003, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00DAD036
SetLastError.KERNEL32(00000716), ref: 00DAD061

Strings

intrsrc%d, xrefs: 00DAD02A

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: ErrorLast_sprintf
String ID: intrsrc%d
API String ID: 2964052951-446446589
Opcode ID: 6979657341826630313b1ba3e444f597454abd30ab5a8c25b9708d44431c0194
Instruction ID: 4b9f7cdbf86c6c881c005e68100033d3559e19eeeab715384c692c9e53a70a0b
Opcode Fuzzy Hash: 6979657341826630313b1ba3e444f597454abd30ab5a8c25b9708d44431c0194
Instruction Fuzzy Hash: 5FF090F5910209ABEB20EF64D982BB837B5DF54300F144178ED4997680E6B4DA98DA90

Uniqueness

Uniqueness Score: -1.00%

Function 00D8207E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00D82092
_strlen.LIBCMT ref: 00D8209E

Strings

%s=%d, xrefs: 00D82089

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _sprintf_strlen
String ID: %s=%d
API String ID: 3493289842-940989310
Opcode ID: 33cdef038a4e940da97ef622a687dfeefa0110f2da5fb415d3cb3af04664f95d
Instruction ID: 2a80e1de27d50a315584149bda4a8c35d9ee1e297029decd50c0c2a25b915737
Opcode Fuzzy Hash: 33cdef038a4e940da97ef622a687dfeefa0110f2da5fb415d3cb3af04664f95d
Instruction Fuzzy Hash: 0DD012F66043496BDB04EF98DC42CAB339DAB48611B445818FD2D97342E571F9208791

Uniqueness

Uniqueness Score: -1.00%

Function 00D65121, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00D65135
_strlen.LIBCMT ref: 00D65141

Strings

%s=%d, xrefs: 00D6512C

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _sprintf_strlen
String ID: %s=%d
API String ID: 3493289842-940989310
Opcode ID: 51dc508e6b5571a16e6203841e7870c5e8af9b8d956bed699eb113fec145391d
Instruction ID: 7cad48dabeefa7239c71d9223fc3f67e783e637bf9a0723ac7e9c38a30851fa7
Opcode Fuzzy Hash: 51dc508e6b5571a16e6203841e7870c5e8af9b8d956bed699eb113fec145391d
Instruction Fuzzy Hash: EFD012F66043486BDB04EF98DC42CAB33EDAB48611B485819BD1D97242E571F9208791

Uniqueness

Uniqueness Score: -1.00%

Function 00D863B9, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00D863CD
_strlen.LIBCMT ref: 00D863D9

Strings

%s=%d, xrefs: 00D863C4

Memory Dump Source

Source File: 00000000.00000002.924484479.0000000000D41000.00000040.00020000.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.924475745.0000000000D40000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.924702740.0000000000E89000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924715971.0000000000E95000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924721930.0000000000E9A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924730975.0000000000EEA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924737120.0000000000EEF000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924745111.0000000000EF7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924750026.0000000000F07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.924758734.0000000000F0F000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.924766064.0000000000F10000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_NI License Activator 1.jbxd

Similarity

API ID: _sprintf_strlen
String ID: %s=%d
API String ID: 3493289842-940989310
Opcode ID: 5ea47597d81a3663f832d1a28ffecac0d1bc99cdd51a361210bf6c73fe96d4fd
Instruction ID: 53352c505996741c3875b474ea21dd8dfc18441dbf97e5a527286974b7a6f41a
Opcode Fuzzy Hash: 5ea47597d81a3663f832d1a28ffecac0d1bc99cdd51a361210bf6c73fe96d4fd
Instruction Fuzzy Hash: 4DD017F6614349ABDF04FF98DC82CAB33ADAB48A11B445818BD2D97342E671F920C791

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report NI License Activator 1.1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Jbx Signature Overview

Compliance:

Spreading:

Networking:

System Summary:

Data Obfuscation:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

UDP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: NI License Activator 1.1.exe PID: 5380 Parent PID: 6480

General

File Activities

File Opened

File Read

File Attributes Queried

Volume Information Queried

Device IO

Section Activities

Function 00D44EE0, Relevance: 88.0, APIs: 36, Strings: 14, Instructions: 459
COMMON

Function 00D45980, Relevance: 10.6, APIs: 7, Instructions: 69
windowCOMMON

Function 00D43DF0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
windowCOMMON

Function 00E41DF0, Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00E665C2, Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMONLIBRARYCODE

Function 00E57D80, Relevance: 1.5, APIs: 1, Instructions: 14
COMMONLIBRARYCODE

Function 00E645CD, Relevance: 1.5, APIs: 1, Instructions: 3
COMMON