Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe

Overview

General Information

Sample name:SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe
Analysis ID:1417027
MD5:adcc598af7caec5a2b261c869bf784b0
SHA1:55eb16719270a3bf2755f1d3435b09078838c49c
SHA256:7d623dcdebf0992732101afeb5c3821ca95e297b2992aef9c16ebb44aa6c47b0
Tags:exe
Infos:

Detection

Njrat
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Njrat
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
C2 URLs / IPs found in malware configuration
Changes the view of files in windows explorer (hidden files and folders)
Contains functionality to log keystrokes (.Net Source)
Contains functionality to spread to USB devices (.Net source)
Creates autostart registry keys with suspicious names
Disables zone checking for all users
Drops PE files to the startup folder
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the windows firewall
Opens the same file many times (likely Sandbox evasion)
PE file has nameless sections
Uses dynamic DNS services
Uses netsh to modify the Windows network and firewall settings
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
May infect USB drives
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Startup Folder File Write
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe (PID: 6944 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe" MD5: ADCC598AF7CAEC5A2B261C869BF784B0)
    • WindowsUpdate.exe (PID: 6352 cmdline: "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" MD5: ADCC598AF7CAEC5A2B261C869BF784B0)
      • netsh.exe (PID: 5844 cmdline: netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" "WindowsUpdate.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)
        • conhost.exe (PID: 3620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • WindowsUpdate.exe (PID: 4456 cmdline: "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" .. MD5: ADCC598AF7CAEC5A2B261C869BF784B0)
  • WindowsUpdate.exe (PID: 3684 cmdline: "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" .. MD5: ADCC598AF7CAEC5A2B261C869BF784B0)
  • WindowsUpdate.exe (PID: 7064 cmdline: "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" .. MD5: ADCC598AF7CAEC5A2B261C869BF784B0)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
NjRATRedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.
  • AQUATIC PANDA
  • Earth Lusca
  • Operation C-Major
  • The Gorgon Group
https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Host": "127.0.0.1:7777,157.245.191.173:6554,supphost.ddns.net:6554,", "Install Name": "WindowsUpdate.exe", "Install Dir": "AppData", "Startup": "software\\Microsoft\\Windows\\CurrentVersion\\Run", "Registry Name": "5a3391652b95668e76de4bdcdda5a9dd", "Campaign ID": "Ta4ka", "Version": "0.11G", "Network Seprator": "|'|'|"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_NjratYara detected NjratJoe Security
    00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Njrat_30f3c220unknownunknown
    • 0x1cf8f:$a1: get_Registry
    • 0x3245f:$a1: get_Registry
    • 0x3a46b:$a1: get_Registry
    • 0x1dd91:$a2: SEE_MASK_NOZONECHECKS
    • 0x33261:$a2: SEE_MASK_NOZONECHECKS
    • 0x3b26d:$a2: SEE_MASK_NOZONECHECKS
    • 0x1dead:$a4: cmd.exe /c ping 0 -n 2 & del "
    • 0x3337d:$a4: cmd.exe /c ping 0 -n 2 & del "
    • 0x3b389:$a4: cmd.exe /c ping 0 -n 2 & del "
    • 0x1de4d:$a5: netsh firewall delete allowedprogram "
    • 0x3331d:$a5: netsh firewall delete allowedprogram "
    • 0x3b329:$a5: netsh firewall delete allowedprogram "
    00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmpnjrat1Identify njRatBrian Wallace @botnet_hunter
    • 0x1ddc1:$a1: netsh firewall add allowedprogram
    • 0x33291:$a1: netsh firewall add allowedprogram
    • 0x3b29d:$a1: netsh firewall add allowedprogram
    • 0x1dd91:$a2: SEE_MASK_NOZONECHECKS
    • 0x33261:$a2: SEE_MASK_NOZONECHECKS
    • 0x3b26d:$a2: SEE_MASK_NOZONECHECKS
    • 0x1dfb1:$b1: [TAP]
    • 0x33481:$b1: [TAP]
    • 0x3b48d:$b1: [TAP]
    • 0x1dead:$c3: cmd.exe /c ping
    • 0x3337d:$c3: cmd.exe /c ping
    • 0x3b389:$c3: cmd.exe /c ping
    00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmpNjratdetect njRAT in memoryJPCERT/CC Incident Response Group
    • 0x1dd91:$reg: SEE_MASK_NOZONECHECKS
    • 0x33261:$reg: SEE_MASK_NOZONECHECKS
    • 0x3b26d:$reg: SEE_MASK_NOZONECHECKS
    • 0x1da92:$msg: Execute ERROR
    • 0x1db2c:$msg: Execute ERROR
    • 0x32f62:$msg: Execute ERROR
    • 0x32ffc:$msg: Execute ERROR
    • 0x3af6e:$msg: Execute ERROR
    • 0x3b008:$msg: Execute ERROR
    • 0x1dead:$ping: cmd.exe /c ping 0 -n 2 & del
    • 0x3337d:$ping: cmd.exe /c ping 0 -n 2 & del
    • 0x3b389:$ping: cmd.exe /c ping 0 -n 2 & del
    00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmpJoeSecurity_NjratYara detected NjratJoe Security
      Click to see the 12 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpackJoeSecurity_NjratYara detected NjratJoe Security
        0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpackWindows_Trojan_Njrat_30f3c220unknownunknown
        • 0x59fb:$a1: get_Registry
        • 0x67fd:$a2: SEE_MASK_NOZONECHECKS
        • 0x6919:$a4: cmd.exe /c ping 0 -n 2 & del "
        • 0x68b9:$a5: netsh firewall delete allowedprogram "
        0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpackCN_disclosed_20180208_cDetects malware from disclosed CN malware setFlorian Roth
        • 0x6919:$x1: cmd.exe /c ping 0 -n 2 & del "
        • 0x655e:$s3: Executed As
        0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpacknjrat1Identify njRatBrian Wallace @botnet_hunter
        • 0x682d:$a1: netsh firewall add allowedprogram
        • 0x67fd:$a2: SEE_MASK_NOZONECHECKS
        • 0x6a1d:$b1: [TAP]
        • 0x6919:$c3: cmd.exe /c ping
        0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpackNjratdetect njRAT in memoryJPCERT/CC Incident Response Group
        • 0x67fd:$reg: SEE_MASK_NOZONECHECKS
        • 0x64fe:$msg: Execute ERROR
        • 0x6598:$msg: Execute ERROR
        • 0x6919:$ping: cmd.exe /c ping 0 -n 2 & del
        Click to see the 49 entries

        Sigma Signatures

        System Summary

        barindex
        Sigma detected: CurrentVersion Autorun Keys Modification
        Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\WindowsUpdate.exe, ProcessId: 6352, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5a3391652b95668e76de4bdcdda5a9dd
        Sigma detected: Startup Folder File Write
        Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\WindowsUpdate.exe, ProcessId: 6352, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5a3391652b95668e76de4bdcdda5a9dd.exe
        Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
        Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\WindowsUpdate.exe, ProcessId: 6352, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5a3391652b95668e76de4bdcdda5a9dd

        Snort Signatures

        ⊘No Snort rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Antivirus / Scanner detection for submitted sample
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeAvira: detected
        Antivirus detection for dropped file
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeAvira: detection malicious, Label: HEUR/AGEN.1308810
        Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5a3391652b95668e76de4bdcdda5a9dd.exeAvira: detection malicious, Label: HEUR/AGEN.1308810
        Found malware configuration
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.raw.unpackMalware Configuration Extractor: Njrat {"Host": "127.0.0.1:7777,157.245.191.173:6554,supphost.ddns.net:6554,", "Install Name": "WindowsUpdate.exe", "Install Dir": "AppData", "Startup": "software\\Microsoft\\Windows\\CurrentVersion\\Run", "Registry Name": "5a3391652b95668e76de4bdcdda5a9dd", "Campaign ID": "Ta4ka", "Version": "0.11G", "Network Seprator": "|'|'|"}
        Multi AV Scanner detection for dropped file
        Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5a3391652b95668e76de4bdcdda5a9dd.exeReversingLabs: Detection: 81%
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeReversingLabs: Detection: 81%
        Multi AV Scanner detection for submitted file
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeReversingLabs: Detection: 81%
        Yara detected Njrat
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 5.2.WindowsUpdate.exe.3818594.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 5.2.WindowsUpdate.exe.3818594.0.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 5.2.WindowsUpdate.exe.3825b10.1.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 5.2.WindowsUpdate.exe.3825c1c.2.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5c50.4.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5d5c.5.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.1701121550.00000000038B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe PID: 6944, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: WindowsUpdate.exe PID: 6352, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: WindowsUpdate.exe PID: 4456, type: MEMORYSTR
        Machine Learning detection for dropped file
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeJoe Sandbox ML: detected
        Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5a3391652b95668e76de4bdcdda5a9dd.exeJoe Sandbox ML: detected
        Machine Learning detection for sample
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeJoe Sandbox ML: detected

        Compliance

        barindex
        Detected unpacking (overwrites its own PE header)
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeUnpacked PE file: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.670000.0.unpack
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dllJump to behavior

        Spreading

        barindex
        Contains functionality to spread to USB devices (.Net source)
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.raw.unpack, OK.cs.Net Code: USBspr
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpack, OK.cs.Net Code: USBspr
        Source: 5.2.WindowsUpdate.exe.3818594.0.raw.unpack, OK.cs.Net Code: USBspr
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1701121550.00000000038B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: autorun.inf![autorun]
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1701121550.00000000038B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: autorun.inf![autorun]
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmpBinary or memory string: autorun.inf![autorun]
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmpBinary or memory string: autorun.inf![autorun]
        Source: WindowsUpdate.exe, 00000001.00000002.4075366771.0000000003781000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: autorun.inf
        Source: WindowsUpdate.exe, 00000001.00000002.4075366771.0000000003781000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: [autorun]
        Source: WindowsUpdate.exe, 00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: autorun.inf![autorun]
        Source: WindowsUpdate.exe, 00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: autorun.inf![autorun]

        Networking

        barindex
        C2 URLs / IPs found in malware configuration
        Source: Malware configuration extractorURLs: 127.0.0.1:7777,157.245.191.173:6554,supphost.ddns.net:6554,
        Uses dynamic DNS services
        Source: unknownDNS query: name: supphost.ddns.net
        Source: global trafficTCP traffic: 192.168.2.4:49730 -> 157.245.191.173:6554
        Source: Joe Sandbox ViewASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownTCP traffic detected without corresponding DNS query: 157.245.191.173
        Source: unknownDNS traffic detected: queries for: supphost.ddns.net
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1699455955.000000000068A000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1699455955.00000000007EB000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://www.enigmaprotector.com/
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1699455955.000000000068A000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://www.enigmaprotector.com/openU

        Key, Mouse, Clipboard, Microphone and Screen Capturing

        barindex
        Contains functionality to log keystrokes (.Net Source)
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.raw.unpack, kl.cs.Net Code: VKCodeToUnicode
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpack, kl.cs.Net Code: VKCodeToUnicode
        Source: 5.2.WindowsUpdate.exe.3818594.0.raw.unpack, kl.cs.Net Code: VKCodeToUnicode

        E-Banking Fraud

        barindex
        Yara detected Njrat
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 5.2.WindowsUpdate.exe.3818594.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 5.2.WindowsUpdate.exe.3818594.0.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 5.2.WindowsUpdate.exe.3825b10.1.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 5.2.WindowsUpdate.exe.3825c1c.2.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5c50.4.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5d5c.5.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.1701121550.00000000038B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe PID: 6944, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: WindowsUpdate.exe PID: 6352, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: WindowsUpdate.exe PID: 4456, type: MEMORYSTR

        System Summary

        barindex
        Malicious sample detected (through community Yara rule)
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects malware from disclosed CN malware set Author: Florian Roth
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpack, type: UNPACKEDPEMatched rule: Identify njRat Author: Brian Wallace @botnet_hunter
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpack, type: UNPACKEDPEMatched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects NjRAT / Bladabindi Author: ditekSHen
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.unpack, type: UNPACKEDPEMatched rule: Detects malware from disclosed CN malware set Author: Florian Roth
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.unpack, type: UNPACKEDPEMatched rule: Identify njRat Author: Brian Wallace @botnet_hunter
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.unpack, type: UNPACKEDPEMatched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.unpack, type: UNPACKEDPEMatched rule: Detects NjRAT / Bladabindi Author: ditekSHen
        Source: 5.2.WindowsUpdate.exe.3818594.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
        Source: 5.2.WindowsUpdate.exe.3818594.0.unpack, type: UNPACKEDPEMatched rule: Detects malware from disclosed CN malware set Author: Florian Roth
        Source: 5.2.WindowsUpdate.exe.3818594.0.unpack, type: UNPACKEDPEMatched rule: Identify njRat Author: Brian Wallace @botnet_hunter
        Source: 5.2.WindowsUpdate.exe.3818594.0.unpack, type: UNPACKEDPEMatched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
        Source: 5.2.WindowsUpdate.exe.3818594.0.unpack, type: UNPACKEDPEMatched rule: Detects NjRAT / Bladabindi Author: ditekSHen
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.unpack, type: UNPACKEDPEMatched rule: Detects malware from disclosed CN malware set Author: Florian Roth
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.unpack, type: UNPACKEDPEMatched rule: Identify njRat Author: Brian Wallace @botnet_hunter
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.unpack, type: UNPACKEDPEMatched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.unpack, type: UNPACKEDPEMatched rule: Detects NjRAT / Bladabindi Author: ditekSHen
        Source: 5.2.WindowsUpdate.exe.3818594.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
        Source: 5.2.WindowsUpdate.exe.3818594.0.raw.unpack, type: UNPACKEDPEMatched rule: Identify njRat Author: Brian Wallace @botnet_hunter
        Source: 5.2.WindowsUpdate.exe.3818594.0.raw.unpack, type: UNPACKEDPEMatched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
        Source: 5.2.WindowsUpdate.exe.3818594.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects NjRAT / Bladabindi Author: ditekSHen
        Source: 5.2.WindowsUpdate.exe.3825b10.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
        Source: 5.2.WindowsUpdate.exe.3825b10.1.raw.unpack, type: UNPACKEDPEMatched rule: Identify njRat Author: Brian Wallace @botnet_hunter
        Source: 5.2.WindowsUpdate.exe.3825b10.1.raw.unpack, type: UNPACKEDPEMatched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
        Source: 5.2.WindowsUpdate.exe.3825b10.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects NjRAT / Bladabindi Author: ditekSHen
        Source: 5.2.WindowsUpdate.exe.3825c1c.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
        Source: 5.2.WindowsUpdate.exe.3825c1c.2.raw.unpack, type: UNPACKEDPEMatched rule: Identify njRat Author: Brian Wallace @botnet_hunter
        Source: 5.2.WindowsUpdate.exe.3825c1c.2.raw.unpack, type: UNPACKEDPEMatched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
        Source: 5.2.WindowsUpdate.exe.3825c1c.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects NjRAT / Bladabindi Author: ditekSHen
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5c50.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5c50.4.raw.unpack, type: UNPACKEDPEMatched rule: Identify njRat Author: Brian Wallace @botnet_hunter
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5c50.4.raw.unpack, type: UNPACKEDPEMatched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5c50.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects NjRAT / Bladabindi Author: ditekSHen
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.raw.unpack, type: UNPACKEDPEMatched rule: Identify njRat Author: Brian Wallace @botnet_hunter
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.raw.unpack, type: UNPACKEDPEMatched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects NjRAT / Bladabindi Author: ditekSHen
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5d5c.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5d5c.5.raw.unpack, type: UNPACKEDPEMatched rule: Identify njRat Author: Brian Wallace @botnet_hunter
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5d5c.5.raw.unpack, type: UNPACKEDPEMatched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5d5c.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects NjRAT / Bladabindi Author: ditekSHen
        Source: 00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
        Source: 00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Identify njRat Author: Brian Wallace @botnet_hunter
        Source: 00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
        Source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
        Source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects malware from disclosed CN malware set Author: Florian Roth
        Source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Identify njRat Author: Brian Wallace @botnet_hunter
        Source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
        Source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NjRAT / Bladabindi Author: ditekSHen
        Source: 00000000.00000002.1701121550.00000000038B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
        Source: 00000000.00000002.1701121550.00000000038B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Identify njRat Author: Brian Wallace @botnet_hunter
        Source: 00000000.00000002.1701121550.00000000038B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
        PE file has nameless sections
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeStatic PE information: section name:
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeStatic PE information: section name:
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeStatic PE information: section name:
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeStatic PE information: section name:
        Source: WindowsUpdate.exe.0.drStatic PE information: section name:
        Source: WindowsUpdate.exe.0.drStatic PE information: section name:
        Source: WindowsUpdate.exe.0.drStatic PE information: section name:
        Source: WindowsUpdate.exe.0.drStatic PE information: section name:
        Source: 5a3391652b95668e76de4bdcdda5a9dd.exe.1.drStatic PE information: section name:
        Source: 5a3391652b95668e76de4bdcdda5a9dd.exe.1.drStatic PE information: section name:
        Source: 5a3391652b95668e76de4bdcdda5a9dd.exe.1.drStatic PE information: section name:
        Source: 5a3391652b95668e76de4bdcdda5a9dd.exe.1.drStatic PE information: section name:
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess Stats: CPU usage > 49%
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeCode function: 1_2_05FC223E NtQuerySystemInformation,1_2_05FC223E
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeCode function: 1_2_05FC2203 NtQuerySystemInformation,1_2_05FC2203
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_032300060_2_03230006
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeCode function: 1_2_02E829771_2_02E82977
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeCode function: 1_2_02E800061_2_02E80006
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeCode function: 8_2_030800078_2_03080007
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeCode function: 9_2_02AD00069_2_02AD0006
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: String function: 0068E264 appears 51 times
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1700012370.0000000000FEE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameli.exe8 vs SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1700012370.0000000000F4E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemscorwks.dllT vs SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1701121550.00000000038B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamek.exe4 vs SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamek.exe4 vs SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000000.1603482376.0000000000688000.00000080.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameli.exe8 vs SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeBinary or memory string: OriginalFilenameli.exe8 vs SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: apphelp.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: version.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: shfolder.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: mswsock.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: dnsapi.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: rasadhlp.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: edputil.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: windows.staterepositoryps.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: wintypes.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: appresolver.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: bcp47langs.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: slc.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: sppc.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: onecorecommonproxystub.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: apphelp.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: version.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: shfolder.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: mswsock.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: dnsapi.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: rasadhlp.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: ntmarta.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ifmon.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasmontr.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasapi32.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpuclnt.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mfc42u.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: authfwcfg.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpolicyiomgr.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: firewallapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dnsapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwbase.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcmonitor.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3cfg.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3api.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: onex.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappcfg.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ncrypt.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappprxy.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ntasn1.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwcfg.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: hnetmon.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netshell.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nlaapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netsetupapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netiohlp.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcsvc.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winnsi.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshhttp.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: httpapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshipsec.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: activeds.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: polstore.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winipsec.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: adsldpc.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshwfp.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cabinet.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2pnetsh.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2p.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rpcnsh.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: whhelper.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winhttp.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlancfg.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlanapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wshelper.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wevtapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mswsock.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: peerdistsh.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wcmapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rmclient.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mobilenetworking.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: slc.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: sppc.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ktmw32.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprmsg.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: version.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: shfolder.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: mswsock.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: dnsapi.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: rasadhlp.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: version.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: shfolder.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: mswsock.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: dnsapi.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: rasadhlp.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: version.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: shfolder.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: mswsock.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: dnsapi.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: rasadhlp.dllJump to behavior
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpack, type: UNPACKEDPEMatched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpack, type: UNPACKEDPEMatched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpack, type: UNPACKEDPEMatched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.unpack, type: UNPACKEDPEMatched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.unpack, type: UNPACKEDPEMatched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.unpack, type: UNPACKEDPEMatched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
        Source: 5.2.WindowsUpdate.exe.3818594.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
        Source: 5.2.WindowsUpdate.exe.3818594.0.unpack, type: UNPACKEDPEMatched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
        Source: 5.2.WindowsUpdate.exe.3818594.0.unpack, type: UNPACKEDPEMatched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
        Source: 5.2.WindowsUpdate.exe.3818594.0.unpack, type: UNPACKEDPEMatched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
        Source: 5.2.WindowsUpdate.exe.3818594.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.unpack, type: UNPACKEDPEMatched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.unpack, type: UNPACKEDPEMatched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.unpack, type: UNPACKEDPEMatched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
        Source: 5.2.WindowsUpdate.exe.3818594.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
        Source: 5.2.WindowsUpdate.exe.3818594.0.raw.unpack, type: UNPACKEDPEMatched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
        Source: 5.2.WindowsUpdate.exe.3818594.0.raw.unpack, type: UNPACKEDPEMatched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
        Source: 5.2.WindowsUpdate.exe.3818594.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
        Source: 5.2.WindowsUpdate.exe.3825b10.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
        Source: 5.2.WindowsUpdate.exe.3825b10.1.raw.unpack, type: UNPACKEDPEMatched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
        Source: 5.2.WindowsUpdate.exe.3825b10.1.raw.unpack, type: UNPACKEDPEMatched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
        Source: 5.2.WindowsUpdate.exe.3825b10.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
        Source: 5.2.WindowsUpdate.exe.3825c1c.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
        Source: 5.2.WindowsUpdate.exe.3825c1c.2.raw.unpack, type: UNPACKEDPEMatched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
        Source: 5.2.WindowsUpdate.exe.3825c1c.2.raw.unpack, type: UNPACKEDPEMatched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
        Source: 5.2.WindowsUpdate.exe.3825c1c.2.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5c50.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5c50.4.raw.unpack, type: UNPACKEDPEMatched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5c50.4.raw.unpack, type: UNPACKEDPEMatched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5c50.4.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.raw.unpack, type: UNPACKEDPEMatched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.raw.unpack, type: UNPACKEDPEMatched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5d5c.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5d5c.5.raw.unpack, type: UNPACKEDPEMatched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5d5c.5.raw.unpack, type: UNPACKEDPEMatched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5d5c.5.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
        Source: 00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
        Source: 00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
        Source: 00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
        Source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
        Source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
        Source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
        Source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
        Source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
        Source: 00000000.00000002.1701121550.00000000038B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
        Source: 00000000.00000002.1701121550.00000000038B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
        Source: 00000000.00000002.1701121550.00000000038B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeStatic PE information: Section: ZLIB complexity 0.9941681338028169
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeStatic PE information: Section: .data ZLIB complexity 0.9967838470005503
        Source: WindowsUpdate.exe.0.drStatic PE information: Section: ZLIB complexity 0.9941681338028169
        Source: WindowsUpdate.exe.0.drStatic PE information: Section: .data ZLIB complexity 0.9967838470005503
        Source: 5a3391652b95668e76de4bdcdda5a9dd.exe.1.drStatic PE information: Section: ZLIB complexity 0.9941681338028169
        Source: 5a3391652b95668e76de4bdcdda5a9dd.exe.1.drStatic PE information: Section: .data ZLIB complexity 0.9967838470005503
        Source: classification engineClassification label: mal100.spre.phis.troj.adwa.spyw.evad.winEXE@9/5@47/2
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeCode function: 1_2_05FC13AA AdjustTokenPrivileges,1_2_05FC13AA
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeCode function: 1_2_05FC1373 AdjustTokenPrivileges,1_2_05FC1373
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_007F796C GetDiskFreeSpaceExA,0_2_007F796C
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeFile created: C:\Users\user\AppData\Roaming\WindowsUpdate.exeJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeMutant created: NULL
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeMutant created: \Sessions\1\BaseNamedObjects\5a3391652b95668e76de4bdcdda5a9ddVGE0a2E=
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3620:120:WilError_03
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeReversingLabs: Detection: 81%
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeFile read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeJump to behavior
        Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe"
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess created: C:\Users\user\AppData\Roaming\WindowsUpdate.exe "C:\Users\user\AppData\Roaming\WindowsUpdate.exe"
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" "WindowsUpdate.exe" ENABLE
        Source: C:\Windows\SysWOW64\netsh.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: unknownProcess created: C:\Users\user\AppData\Roaming\WindowsUpdate.exe "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" ..
        Source: unknownProcess created: C:\Users\user\AppData\Roaming\WindowsUpdate.exe "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" ..
        Source: unknownProcess created: C:\Users\user\AppData\Roaming\WindowsUpdate.exe "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" ..
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess created: C:\Users\user\AppData\Roaming\WindowsUpdate.exe "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" Jump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" "WindowsUpdate.exe" ENABLEJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dllJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dllJump to behavior

        Data Obfuscation

        barindex
        Detected unpacking (changes PE section rights)
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeUnpacked PE file: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.670000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;.rsrc:EW;Unknown_Section4:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;.rsrc:ER;Unknown_Section4:ER;.data:ER;
        Detected unpacking (overwrites its own PE header)
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeUnpacked PE file: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.670000.0.unpack
        .NET source code contains potential unpacker
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.raw.unpack, OK.cs.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpack, OK.cs.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
        Source: 5.2.WindowsUpdate.exe.3818594.0.raw.unpack, OK.cs.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeStatic PE information: section name:
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeStatic PE information: section name:
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeStatic PE information: section name:
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeStatic PE information: section name:
        Source: WindowsUpdate.exe.0.drStatic PE information: section name:
        Source: WindowsUpdate.exe.0.drStatic PE information: section name:
        Source: WindowsUpdate.exe.0.drStatic PE information: section name:
        Source: WindowsUpdate.exe.0.drStatic PE information: section name:
        Source: 5a3391652b95668e76de4bdcdda5a9dd.exe.1.drStatic PE information: section name:
        Source: 5a3391652b95668e76de4bdcdda5a9dd.exe.1.drStatic PE information: section name:
        Source: 5a3391652b95668e76de4bdcdda5a9dd.exe.1.drStatic PE information: section name:
        Source: 5a3391652b95668e76de4bdcdda5a9dd.exe.1.drStatic PE information: section name:
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_006A6104 push ecx; mov dword ptr [esp], edx0_2_006A6109
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_0069A2B5 push 0069A6D8h; ret 0_2_0069A6D0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_006A632C push ecx; mov dword ptr [esp], edx0_2_006A6331
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_006923EA push 00692418h; ret 0_2_00692410
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_006A33A0 push 006A3400h; ret 0_2_006A33F8
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_006A6448 push ecx; mov dword ptr [esp], edx0_2_006A644D
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_0069245C push 00692488h; ret 0_2_00692480
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_006A4454 push 006A44A1h; ret 0_2_006A4499
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_00692424 push 00692450h; ret 0_2_00692448
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_0069A424 push 0069A6D8h; ret 0_2_0069A6D0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_006924F8 push 0069252Ch; ret 0_2_00692524
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_0069A4D7 push 0069A6D8h; ret 0_2_0069A6D0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_0069A4B5 push 0069A6D8h; ret 0_2_0069A6D0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_0069A48F push 0069A6D8h; ret 0_2_0069A6D0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_006A648C push ecx; mov dword ptr [esp], edx0_2_006A6491
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_00692494 push 006924C0h; ret 0_2_006924B8
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_006A3550 push 006A35A4h; ret 0_2_006A359C
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_0069A538 push 0069A6D8h; ret 0_2_0069A6D0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_006A2536 push 006A25B5h; ret 0_2_006A25AD
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_0069A500 push 0069A6D8h; ret 0_2_0069A6D0
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_006905F0 push 00690641h; ret 0_2_00690639
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_006A162C push 006A16A2h; ret 0_2_006A169A
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_0069A6DA push 0069A74Bh; ret 0_2_0069A743
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_006A16A4 push 006A174Ch; ret 0_2_006A1744
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_006A3684 push ecx; mov dword ptr [esp], ecx0_2_006A3687
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_006A174E push 006A179Ch; ret 0_2_006A1794
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_00692738 push 0069285Ch; ret 0_2_00692854
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_0069A85E push 0069A88Ch; ret 0_2_0069A884
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_006A2804 push 006A2830h; ret 0_2_006A2828
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_006A38F4 push ecx; mov dword ptr [esp], ecx0_2_006A38F6
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeCode function: 0_2_006908AA push 006908D8h; ret 0_2_006908D0
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeStatic PE information: section name: entropy: 7.9865995559744665
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeStatic PE information: section name: .data entropy: 7.982307056298474
        Source: WindowsUpdate.exe.0.drStatic PE information: section name: entropy: 7.9865995559744665
        Source: WindowsUpdate.exe.0.drStatic PE information: section name: .data entropy: 7.982307056298474
        Source: 5a3391652b95668e76de4bdcdda5a9dd.exe.1.drStatic PE information: section name: entropy: 7.9865995559744665
        Source: 5a3391652b95668e76de4bdcdda5a9dd.exe.1.drStatic PE information: section name: .data entropy: 7.982307056298474
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5a3391652b95668e76de4bdcdda5a9dd.exeJump to dropped file
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeFile created: C:\Users\user\AppData\Roaming\WindowsUpdate.exeJump to dropped file

        Boot Survival

        barindex
        Creates autostart registry keys with suspicious names
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5a3391652b95668e76de4bdcdda5a9ddJump to behavior
        Drops PE files to the startup folder
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5a3391652b95668e76de4bdcdda5a9dd.exeJump to dropped file
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5a3391652b95668e76de4bdcdda5a9dd.exeJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5a3391652b95668e76de4bdcdda5a9dd.exeJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5a3391652b95668e76de4bdcdda5a9ddJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5a3391652b95668e76de4bdcdda5a9ddJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 5a3391652b95668e76de4bdcdda5a9ddJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 5a3391652b95668e76de4bdcdda5a9ddJump to behavior

        Hooking and other Techniques for Hiding and Protection

        barindex
        Changes the view of files in windows explorer (hidden files and folders)
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced HiddenJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

        Malware Analysis System Evasion

        barindex
        Opens the same file many times (likely Sandbox evasion)
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeFile opened: \Device\RasAcd count: 31368Jump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeMemory allocated: 30B0000 memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeMemory allocated: 38B0000 memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeMemory allocated: 3610000 memory commit | memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeMemory allocated: 2DF0000 memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeMemory allocated: 3760000 memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeMemory allocated: 5760000 memory commit | memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeMemory allocated: 2D30000 memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeMemory allocated: 3800000 memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeMemory allocated: 2D90000 memory commit | memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeMemory allocated: 2E50000 memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeMemory allocated: 3720000 memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeMemory allocated: 5720000 memory commit | memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeMemory allocated: 29B0000 memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeMemory allocated: 3460000 memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeMemory allocated: 2A10000 memory commit | memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeWindow / User API: threadDelayed 676Jump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeWindow / User API: threadDelayed 1778Jump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeWindow / User API: threadDelayed 3015Jump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeWindow / User API: threadDelayed 2313Jump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeWindow / User API: threadDelayed 1003Jump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeWindow / User API: foregroundWindowGot 1642Jump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeWindow / User API: threadDelayed 452Jump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe TID: 6936Thread sleep count: 676 > 30Jump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe TID: 7128Thread sleep time: -922337203685477s >= -30000sJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe TID: 4504Thread sleep time: -1778000s >= -30000sJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe TID: 5572Thread sleep time: -166000s >= -30000sJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe TID: 7120Thread sleep time: -2313000s >= -30000sJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe TID: 7120Thread sleep time: -1003000s >= -30000sJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe TID: 4916Thread sleep count: 452 > 30Jump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe TID: 4412Thread sleep time: -922337203685477s >= -30000sJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe TID: 7152Thread sleep count: 65 > 30Jump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe TID: 2228Thread sleep time: -1844674407370954s >= -30000sJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe TID: 6200Thread sleep count: 64 > 30Jump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe TID: 5672Thread sleep time: -922337203685477s >= -30000sJump to behavior
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1700012370.0000000000FCC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWw
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1699455955.000000000068A000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: VBoxService.exe
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1700012370.0000000000FCC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
        Source: WindowsUpdate.exe, 00000008.00000002.2047287114.0000000001112000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlln
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1699455955.00000000007D0000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: ~VirtualMachineTypes
        Source: WindowsUpdate.exe, 00000009.00000002.2133883432.00000000004DE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllCulture=neutral, PublicKeyToken=31bf3856ad364e35"/>
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1699455955.00000000007D0000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: ]DLL_Loader_VirtualMachine
        Source: WindowsUpdate.exe, 00000005.00000002.1964106695.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp, WindowsUpdate.exe, 00000008.00000002.2047287114.0000000001112000.00000004.00000020.00020000.00000000.sdmp, WindowsUpdate.exe, 00000009.00000002.2133883432.00000000004DE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1699455955.000000000068A000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: VMWare
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1699455955.00000000007D0000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1699455955.000000000068A000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: &VBoxService.exe
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1700012370.0000000000FCC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\ye
        Source: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1700012370.0000000000FCC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
        Source: WindowsUpdate.exe, 00000001.00000002.4073317835.0000000001092000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000002.00000003.1789309952.0000000003711000.00000004.00000020.00020000.00000000.sdmp, WindowsUpdate.exe, 00000005.00000002.1964106695.0000000000DF1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information queried: ProcessInformationJump to behavior

        Anti Debugging

        barindex
        Hides threads from debuggers
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeThread information set: HideFromDebuggerJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeThread information set: HideFromDebuggerJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeThread information set: HideFromDebuggerJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeThread information set: HideFromDebuggerJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeThread information set: HideFromDebuggerJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeThread information set: HideFromDebuggerJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeThread information set: HideFromDebuggerJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeThread information set: HideFromDebuggerJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeThread information set: HideFromDebuggerJump to behavior
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeMemory allocated: page read and write | page guardJump to behavior

        HIPS / PFW / Operating System Protection Evasion

        barindex
        .NET source code references suspicious native API functions
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.raw.unpack, kl.csReference to suspicious API methods: MapVirtualKey(VKCode, 0u)
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.raw.unpack, kl.csReference to suspicious API methods: GetAsyncKeyState(num2)
        Source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.raw.unpack, OK.csReference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeProcess created: C:\Users\user\AppData\Roaming\WindowsUpdate.exe "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" Jump to behavior
        Source: WindowsUpdate.exe, 00000001.00000002.4075366771.0000000003781000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager
        Source: WindowsUpdate.exe, 00000001.00000002.4075366771.0000000003781000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager@9
        Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

        Lowering of HIPS / PFW / Operating System Security Settings

        barindex
        Disables zone checking for all users
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeRegistry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKSJump to behavior
        Modifies the windows firewall
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" "WindowsUpdate.exe" ENABLE
        Uses netsh to modify the Windows network and firewall settings
        Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" "WindowsUpdate.exe" ENABLE

        Stealing of Sensitive Information

        barindex
        Yara detected Njrat
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 5.2.WindowsUpdate.exe.3818594.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 5.2.WindowsUpdate.exe.3818594.0.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 5.2.WindowsUpdate.exe.3825b10.1.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 5.2.WindowsUpdate.exe.3825c1c.2.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5c50.4.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5d5c.5.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.1701121550.00000000038B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe PID: 6944, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: WindowsUpdate.exe PID: 6352, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: WindowsUpdate.exe PID: 4456, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Yara detected Njrat
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 5.2.WindowsUpdate.exe.3818594.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.3730000.3.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 5.2.WindowsUpdate.exe.3818594.0.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 5.2.WindowsUpdate.exe.3825b10.1.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 5.2.WindowsUpdate.exe.3825c1c.2.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5c50.4.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38c86d4.6.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.38d5d5c.5.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.1701121550.00000000038B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe PID: 6944, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: WindowsUpdate.exe PID: 6352, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: WindowsUpdate.exe PID: 4456, type: MEMORYSTR

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire Infrastructure11
        Replication Through Removable Media        		1
        Native API        		1
        DLL Side-Loading        		1
        DLL Side-Loading        		31
        Disable or Modify Tools        		1
        Input Capture        		1
        Peripheral Device Discovery        		Remote Services1
        Archive Collected Data        		1
        Encrypted Channel        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/Job221
        Registry Run Keys / Startup Folder        		1
        Access Token Manipulation        		1
        Deobfuscate/Decode Files or Information        		LSASS Memory1
        File and Directory Discovery        		Remote Desktop Protocol1
        Input Capture        		1
        Non-Standard Port        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)12
        Process Injection        		3
        Obfuscated Files or Information        		Security Account Manager13
        System Information Discovery        		SMB/Windows Admin SharesData from Network Shared Drive1
        Non-Application Layer Protocol        		Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook221
        Registry Run Keys / Startup Folder        		32
        Software Packing        		NTDS21
        Security Software Discovery        		Distributed Component Object ModelInput Capture21
        Application Layer Protocol        		Traffic DuplicationData Destruction
        Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
        DLL Side-Loading        		LSA Secrets2
        Process Discovery        		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
        Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
        Masquerading        		Cached Domain Credentials231
        Virtualization/Sandbox Evasion        		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
        DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items231
        Virtualization/Sandbox Evasion        		DCSync1
        Application Window Discovery        		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
        Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
        Access Token Manipulation        		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
        Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt12
        Process Injection        		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
        IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
        Hidden Files and Directories        		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1417027 Sample: SecuriteInfo.com.Trojan.Sig... Startdate: 28/03/2024 Architecture: WINDOWS Score: 100 33 supphost.ddns.net 2->33 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 Antivirus detection for dropped file 2->43 47 12 other signatures 2->47 9 SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe 3 7 2->9         started        14 WindowsUpdate.exe 5 2->14         started        16 WindowsUpdate.exe 4 2->16         started        18 WindowsUpdate.exe 4 2->18         started        signatures3 45 Uses dynamic DNS services 33->45 process4 dnsIp5 37 157.245.191.173, 6554 DIGITALOCEAN-ASNUS United States 9->37 31 C:\Users\user\AppData\...\WindowsUpdate.exe, PE32 9->31 dropped 57 Detected unpacking (changes PE section rights) 9->57 59 Detected unpacking (overwrites its own PE header) 9->59 61 Hides threads from debuggers 9->61 20 WindowsUpdate.exe 4 5 9->20         started        file6 signatures7 process8 dnsIp9 35 127.0.0.1 unknown unknown 20->35 29 C:\...\5a3391652b95668e76de4bdcdda5a9dd.exe, PE32 20->29 dropped 49 Antivirus detection for dropped file 20->49 51 Multi AV Scanner detection for dropped file 20->51 53 Machine Learning detection for dropped file 20->53 55 8 other signatures 20->55 25 netsh.exe 2 20->25         started        file10 signatures11 process12 process13 27 conhost.exe 25->27         started       

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe82%ReversingLabsWin32.Trojan.FormBook
        SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe100%AviraHEUR/AGEN.1308810
        SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe100%Joe Sandbox ML

        Dropped Files

        SourceDetectionScannerLabelLink
        C:\Users\user\AppData\Roaming\WindowsUpdate.exe100%AviraHEUR/AGEN.1308810
        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5a3391652b95668e76de4bdcdda5a9dd.exe100%AviraHEUR/AGEN.1308810
        C:\Users\user\AppData\Roaming\WindowsUpdate.exe100%Joe Sandbox ML
        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5a3391652b95668e76de4bdcdda5a9dd.exe100%Joe Sandbox ML
        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5a3391652b95668e76de4bdcdda5a9dd.exe82%ReversingLabsWin32.Trojan.FormBook
        C:\Users\user\AppData\Roaming\WindowsUpdate.exe82%ReversingLabsWin32.Trojan.FormBook

        Unpacked PE Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        127.0.0.1:7777,157.245.191.173:6554,supphost.ddns.net:6554,0%Avira URL Cloudsafe
        http://www.enigmaprotector.com/0%Avira URL Cloudsafe
        http://www.enigmaprotector.com/openU0%Avira URL Cloudsafe

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        supphost.ddns.net
        		unknown
        		unknowntrue
          		unknown

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          127.0.0.1:7777,157.245.191.173:6554,supphost.ddns.net:6554,true
          • Avira URL Cloud: safe
          		unknown

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          http://www.enigmaprotector.com/SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1699455955.000000000068A000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1699455955.00000000007EB000.00000040.00000001.01000000.00000003.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://www.enigmaprotector.com/openUSecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe, 00000000.00000002.1699455955.000000000068A000.00000040.00000001.01000000.00000003.sdmpfalse
          • Avira URL Cloud: safe
          		unknown

          World Map of Contacted IPs

          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs

          Public IPs

          IPDomainCountryFlagASNASN NameMalicious
          157.245.191.173
          		unknownUnited States
          		14061DIGITALOCEAN-ASNUStrue

          Private

          IP
          127.0.0.1

          General Information

          Joe Sandbox version:40.0.0 Tourmaline
          Analysis ID:1417027
          Start date and time:2024-03-28 14:29:10 +01:00
          Joe Sandbox product:CloudBasic
          Overall analysis duration:0h 9m 6s
          Hypervisor based Inspection enabled:false
          Report type:full
          Cookbook file name:default.jbs
          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
          Number of analysed new started processes analysed:11
          Number of new started drivers analysed:0
          Number of existing processes analysed:0
          Number of existing drivers analysed:0
          Number of injected processes analysed:0
          Technologies:
          • HCA enabled
          • EGA enabled
          • AMSI enabled
          Analysis Mode:default
          Analysis stop reason:Timeout
          Sample name:SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe
          Detection:MAL
          Classification:mal100.spre.phis.troj.adwa.spyw.evad.winEXE@9/5@47/2
          EGA Information:
          • Successful, ratio: 100%
          HCA Information:
          • Successful, ratio: 68%
          • Number of executed functions: 376
          • Number of non-executed functions: 1
          Cookbook Comments:
          • Found application associated with file extension: .exe
          • Override analysis time to 240000 for current running targets taking high CPU consumption

          Warnings

          • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
          • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
          • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
          • Not all processes where analyzed, report is missing behavior information
          • Report size exceeded maximum capacity and may have missing behavior information.
          • Report size getting too big, too many NtOpenKeyEx calls found.
          • Report size getting too big, too many NtQueryValueKey calls found.
          • VT rate limit hit for: SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe

          Simulations

          Behavior and APIs

          TimeTypeDescription
          13:30:11AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 5a3391652b95668e76de4bdcdda5a9dd "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" ..
          13:30:20AutostartRun: HKLM\Software\Microsoft\Windows\CurrentVersion\Run 5a3391652b95668e76de4bdcdda5a9dd "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" ..
          13:30:30AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 5a3391652b95668e76de4bdcdda5a9dd "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" ..
          13:30:38AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5a3391652b95668e76de4bdcdda5a9dd.exe
          14:30:36API Interceptor2594046x Sleep call for process: WindowsUpdate.exe modified

          Joe Sandbox View / Context

          IPs

          ⊘No context

          Domains

          ⊘No context

          ASNs

          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          DIGITALOCEAN-ASNUSSecuriteInfo.com.FileRepMalware.20494.7181.exeGet hashmaliciousXmrigBrowse
          • 178.128.242.134
          f699.jsGet hashmaliciousUnknownBrowse
          • 164.90.149.198
          AhbJkpk3Z8.elfGet hashmaliciousUnknownBrowse
          • 134.209.44.115
          https://bafkreiakypngf5p2vusgmzt3htrul7f7hmhpylofrop6cg6waka2djtzz4.ipfs.dweb.link/#katja.lundberg-rand@daiichi-sankyo.euGet hashmaliciousUnknownBrowse
          • 134.122.57.34
          Mauqes.exeGet hashmaliciousNovaSentinelBrowse
          • 45.55.107.24
          https://hiwagaschoolofaesthetics.com/min/ax/i?ax988=tracy.gazdag@globalresourcedesign.com&utm=email.cx.beehiiv.com/e/c/eyJlbWFpbF9pZCI6ImRnVGYtd1lCQVBfN0hmNzdIUUdPYmVxNE53MjltRmU4MkJxTVIxMD0iLCJocmVmIjoiaHR0cHM6Ly93d3cuYmVlaGlpdi5jb20vY291cnNlcy9uZXdzbGV0dGVyLXhwP29mZmVyX2lkPXdlbGNvbWUyMFx1MDAyNnV0bV9=Get hashmaliciousHTMLPhisherBrowse
          • 178.128.193.79
          WRbiXjr77v.exeGet hashmaliciousPureLog Stealer, Xmrig, zgRATBrowse
          • 159.203.162.18
          https://48227f1df9cc685b88b4cfbd9e51bd84.serveo.net/login.htmlIP:Get hashmaliciousUnknownBrowse
          • 138.68.79.95
          https://crm.mr.bet/track/click/c95d3si4y/c6561686462716b65686f62737c6569704564657e23756c6b69627b6e23616?target=https%3A%2F%2Fcrm.mr.bet%2Funsubscribe%2Findex%2FeyJtYWlsIjoibGVhaGRyYWtlaG9yc2xleUBlZHUuc2Vsa2lyay5jYSIsInByb2plY3QiOjMsImJ1bGsiOjYzNjg3MjIsInNpZ24iOiJDQVRQRjhRdzRRcXBpK2tcL2RFckprVmY4N0hrPSJ9Get hashmaliciousUnknownBrowse
          • 157.245.28.47
          gIzj2ZdSYV.elfGet hashmaliciousMirai, MoobotBrowse
          • 128.199.139.145

          JA3 Fingerprints

          ⊘No context

          Dropped Files

          ⊘No context

          Created / dropped Files

          C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe.log

          Download File
          Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe
          File Type:ASCII text, with CRLF line terminators
          Category:dropped
          Size (bytes):777
          Entropy (8bit):5.254617046361875
          Encrypted:false
          SSDEEP:12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk70U26K9tHHK9yi0U2+Z:MLF2CpI3zffup29Iz52VM26KTnKoO2+Z
          MD5:F528B2AC8F22473AC0B6D977C46CE907
          SHA1:C3E0B48A2919F686EDB73177777766951ECC9141
          SHA-256:D64BF82E09F40141E72DE3884E4B126BD8BDA4B8072E4850104EB9196554E127
          SHA-512:9EE4FA6A5237F72F4C652D1D26AC4D93920D59D39621E8E4AF97B26C47C18F6CF3BCF6546726E4A37F144D187ECBD33C0C01D682632E0B520358A8955F28B962
          Malicious:false
          Reputation:low
          Preview:1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\53992d421e2c7ecf6609c62b3510a6f0\System.Configuration.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\74774597e319a738b792e6a6c06d3559\System.Xml.ni.dll",0..

          C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\WindowsUpdate.exe.log

          Download File
          Process:C:\Users\user\AppData\Roaming\WindowsUpdate.exe
          File Type:ASCII text, with CRLF line terminators
          Category:dropped
          Size (bytes):777
          Entropy (8bit):5.254617046361875
          Encrypted:false
          SSDEEP:12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk70U26K9tHHK9yi0U2+Z:MLF2CpI3zffup29Iz52VM26KTnKoO2+Z
          MD5:F528B2AC8F22473AC0B6D977C46CE907
          SHA1:C3E0B48A2919F686EDB73177777766951ECC9141
          SHA-256:D64BF82E09F40141E72DE3884E4B126BD8BDA4B8072E4850104EB9196554E127
          SHA-512:9EE4FA6A5237F72F4C652D1D26AC4D93920D59D39621E8E4AF97B26C47C18F6CF3BCF6546726E4A37F144D187ECBD33C0C01D682632E0B520358A8955F28B962
          Malicious:false
          Reputation:low
          Preview:1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\53992d421e2c7ecf6609c62b3510a6f0\System.Configuration.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\74774597e319a738b792e6a6c06d3559\System.Xml.ni.dll",0..

          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5a3391652b95668e76de4bdcdda5a9dd.exe

          Download File
          Process:C:\Users\user\AppData\Roaming\WindowsUpdate.exe
          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
          Category:dropped
          Size (bytes):970752
          Entropy (8bit):7.980406734632561
          Encrypted:false
          SSDEEP:24576:n3qKdgSMzbbnNEvizbKZiiwt3Tggzbsye5HMPKZ2W0gXKXJ:naKNMDNqizCeegPsye+PKOZX
          MD5:ADCC598AF7CAEC5A2B261C869BF784B0
          SHA1:55EB16719270A3BF2755F1D3435B09078838C49C
          SHA-256:7D623DCDEBF0992732101AFEB5C3821CA95E297B2992AEF9C16EBB44AA6C47B0
          SHA-512:BBFCDDD524E5F654290BD30919ED7AAD61E64AE3919AF202457D74C34B1314B7BB288C1DD8414D02BB8F61A207C8BD9E8FCC98347B9B128E414A72258ECFDD7F
          Malicious:true
          Antivirus:
          • Antivirus: Avira, Detection: 100%
          • Antivirus: Joe Sandbox ML, Detection: 100%
          • Antivirus: ReversingLabs, Detection: 82%
          Reputation:low
          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....F_................................. ........@.. ........................7...........@................................. .)...............................).............................................................................................. ... ......................@............ ...@......................@............ ...`......................@....rsrc.... ..........................@.............'.........................@....data....@....)..2..................@......................................................y[.>........................................................................................................................................................................................................................................................................................................................................

          C:\Users\user\AppData\Roaming\WindowsUpdate.exe

          Download File
          Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe
          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
          Category:dropped
          Size (bytes):970752
          Entropy (8bit):7.980406734632561
          Encrypted:false
          SSDEEP:24576:n3qKdgSMzbbnNEvizbKZiiwt3Tggzbsye5HMPKZ2W0gXKXJ:naKNMDNqizCeegPsye+PKOZX
          MD5:ADCC598AF7CAEC5A2B261C869BF784B0
          SHA1:55EB16719270A3BF2755F1D3435B09078838C49C
          SHA-256:7D623DCDEBF0992732101AFEB5C3821CA95E297B2992AEF9C16EBB44AA6C47B0
          SHA-512:BBFCDDD524E5F654290BD30919ED7AAD61E64AE3919AF202457D74C34B1314B7BB288C1DD8414D02BB8F61A207C8BD9E8FCC98347B9B128E414A72258ECFDD7F
          Malicious:true
          Antivirus:
          • Antivirus: Avira, Detection: 100%
          • Antivirus: Joe Sandbox ML, Detection: 100%
          • Antivirus: ReversingLabs, Detection: 82%
          Reputation:low
          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....F_................................. ........@.. ........................7...........@................................. .)...............................).............................................................................................. ... ......................@............ ...@......................@............ ...`......................@....rsrc.... ..........................@.............'.........................@....data....@....)..2..................@......................................................y[.>........................................................................................................................................................................................................................................................................................................................................

          \Device\ConDrv

          Download File
          Process:C:\Windows\SysWOW64\netsh.exe
          File Type:ASCII text, with CRLF line terminators
          Category:dropped
          Size (bytes):313
          Entropy (8bit):4.971939296804078
          Encrypted:false
          SSDEEP:6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
          MD5:689E2126A85BF55121488295EE068FA1
          SHA1:09BAAA253A49D80C18326DFBCA106551EBF22DD6
          SHA-256:D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
          SHA-512:C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
          Malicious:false
          Reputation:high, very likely benign file
          Preview:..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

          Static File Info

          General

          File type:PE32 executable (GUI) Intel 80386, for MS Windows
          Entropy (8bit):7.980406734632561
          TrID:
          • Win32 Executable (generic) a (10002005/4) 99.94%
          • Win16/32 Executable Delphi generic (2074/23) 0.02%
          • Generic Win/DOS Executable (2004/3) 0.02%
          • DOS Executable Generic (2002/1) 0.02%
          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
          File name:SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe
          File size:970'752 bytes
          MD5:adcc598af7caec5a2b261c869bf784b0
          SHA1:55eb16719270a3bf2755f1d3435b09078838c49c
          SHA256:7d623dcdebf0992732101afeb5c3821ca95e297b2992aef9c16ebb44aa6c47b0
          SHA512:bbfcddd524e5f654290bd30919ed7aad61e64ae3919af202457d74c34b1314b7bb288c1dd8414d02bb8f61a207c8bd9e8fcc98347b9b128e414a72258ecfdd7f
          SSDEEP:24576:n3qKdgSMzbbnNEvizbKZiiwt3Tggzbsye5HMPKZ2W0gXKXJ:naKNMDNqizCeegPsye+PKOZX
          TLSH:F5253377F832E86ECA60CC38632764EE7F2F298055E9F0B52D607566CD725029DBAC14
          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....F_................................. ........@.. ........................7...........@................................

          File Icon

          Icon Hash:498a80a2a2808241

          Static PE Info

          General

          Entrypoint:0x4082b7
          Entrypoint Section:
          Digitally signed:false
          Imagebase:0x400000
          Subsystem:windows gui
          Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
          DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
          Time Stamp:0x5F4691B0 [Wed Aug 26 16:45:36 2020 UTC]
          TLS Callbacks:
          CLR (.Net) Version:
          OS Version Major:4
          OS Version Minor:0
          File Version Major:4
          File Version Minor:0
          Subsystem Version Major:4
          Subsystem Version Minor:0
          Import Hash:2e5467cba76f44a088d39f78c5e807b6

          Entrypoint Preview

          Instruction
          call 00007FBAC07E35D6h
          jmp 00007FBAC07E33EEh
          push 0044BB60h
          push dword ptr fs:[00000000h]
          mov eax, dword ptr [esp+10h]
          mov dword ptr [esp+10h], ebp
          lea ebp, dword ptr [esp+10h]
          sub esp, eax
          push ebx
          push esi
          push edi
          mov eax, dword ptr [00466ECCh]
          xor dword ptr [ebp-04h], eax
          xor eax, ebp
          push eax
          mov dword ptr [ebp-18h], esp
          push dword ptr [ebp-08h]
          mov eax, dword ptr [ebp-04h]
          mov dword ptr [ebp-04h], FFFFFFFEh
          mov dword ptr [ebp-08h], eax
          lea eax, dword ptr [ebp-10h]
          mov dword ptr fs:[00000000h], eax
          ret
          mov ecx, dword ptr [ebp-10h]
          mov dword ptr fs:[00000000h], ecx
          pop ecx
          pop edi
          pop edi
          pop esi
          pop ebx
          mov esp, ebp
          pop ebp
          push ecx
          ret
          int3
          int3
          int3
          add esp, 04h
          jmp 00007FBAC0B54DD4h
          or ebx, dword ptr [esi-4Dh]
          shr dword ptr [ecx+4AE248ADh], 1
          xchg eax, esi
          sbb eax, ebp
          push ecx
          mov esi, 3789298Eh
          add ah, bh
          das
          jecxz 00007FBAC07E35E4h
          cmp dword ptr [ebp-3Dh], esp
          cld
          sar dword ptr [ecx+63h], 1
          push es
          daa
          xor eax, 7Eh
          push ss
          xor eax, 4EA30499h
          jmp 00007FBAC07E3534h

          Data Directories

          NameVirtual AddressVirtual Size Is in Section
          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
          IMAGE_DIRECTORY_ENTRY_IMPORT0x2980200x210.data
          IMAGE_DIRECTORY_ENTRY_RESOURCE0x180000x9e0.rsrc
          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
          IMAGE_DIRECTORY_ENTRY_BASERELOC0x2980000xc.data
          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
          IMAGE_DIRECTORY_ENTRY_IAT0x00x0
          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

          Sections

          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
          0x20000x120000x8e00f076a6b5a9837b08bf513800de89fc2fFalse0.9941681338028169data7.9865995559744665IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
          0x140000x20000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
          0x160000x20000x20028a2b3ffe563bb441d75bc0ee1cf40fbFalse0.0546875data0.29750055731160896IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
          .rsrc0x180000x20000xa0096b5536dabb7b74009768f994f5854e9False0.32265625data4.042330027099598IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
          0x1a0000x27e0000x0d41d8cd98f00b204e9800998ecf8427eunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
          .data0x2980000xe40000xe3200a479e5b08512cc7bb93a7e331c117b19False0.9967838470005503data7.982307056298474IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

          Resources

          NameRVASizeTypeLanguageCountryZLIB Complexity
          RT_ICON0x181600x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 6400.15994623655913978
          RT_ICON0x184480x128Device independent bitmap graphic, 16 x 32 x 4, image size 1920.3344594594594595
          RT_GROUP_ICON0x185700x22data1.0294117647058822
          RT_VERSION0x185940x260data0.4720394736842105
          RT_MANIFEST0x187f40x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5469387755102041

          Imports

          DLLImport
          kernel32.dllGetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
          user32.dllMessageBoxA
          advapi32.dllRegCloseKey
          oleaut32.dllSysFreeString
          gdi32.dllCreateFontA
          shell32.dllShellExecuteA
          version.dllGetFileVersionInfoA
          mscoree.dll_CorExeMain

          Network Behavior

          Network Port Distribution

          TCP Packets

          TimestampSource PortDest PortSource IPDest IP
          Mar 28, 2024 14:30:00.117222071 CET497306554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:01.131691933 CET497306554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:03.149399996 CET497306554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:08.076390028 CET497316554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:09.084794044 CET497316554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:11.100424051 CET497316554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:15.100430012 CET497316554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:23.116075993 CET497316554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:25.644798040 CET497416554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:26.647320986 CET497416554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:31.134041071 CET497436554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:32.131700993 CET497436554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:34.131685019 CET497436554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:35.399194956 CET497456554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:36.412921906 CET497456554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:38.147317886 CET497436554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:43.873281002 CET497496554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:44.881680965 CET497496554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:46.148534060 CET497436554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:54.179997921 CET497526554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:55.194382906 CET497526554192.168.2.4157.245.191.173
          Mar 28, 2024 14:30:57.194349051 CET497526554192.168.2.4157.245.191.173
          Mar 28, 2024 14:31:01.194305897 CET497526554192.168.2.4157.245.191.173
          Mar 28, 2024 14:31:09.194238901 CET497526554192.168.2.4157.245.191.173
          Mar 28, 2024 14:31:17.210418940 CET497596554192.168.2.4157.245.191.173
          Mar 28, 2024 14:31:18.350471973 CET497596554192.168.2.4157.245.191.173
          Mar 28, 2024 14:31:20.444233894 CET497596554192.168.2.4157.245.191.173
          Mar 28, 2024 14:31:24.459831953 CET497596554192.168.2.4157.245.191.173
          Mar 28, 2024 14:31:32.459824085 CET497596554192.168.2.4157.245.191.173
          Mar 28, 2024 14:31:40.475764036 CET497666554192.168.2.4157.245.191.173
          Mar 28, 2024 14:31:41.647377014 CET497666554192.168.2.4157.245.191.173
          Mar 28, 2024 14:31:43.647330046 CET497666554192.168.2.4157.245.191.173
          Mar 28, 2024 14:31:47.756731987 CET497666554192.168.2.4157.245.191.173
          Mar 28, 2024 14:31:55.850470066 CET497666554192.168.2.4157.245.191.173
          Mar 28, 2024 14:32:03.881987095 CET497736554192.168.2.4157.245.191.173
          Mar 28, 2024 14:32:04.959903002 CET497736554192.168.2.4157.245.191.173
          Mar 28, 2024 14:32:07.053610086 CET497736554192.168.2.4157.245.191.173
          Mar 28, 2024 14:32:11.053621054 CET497736554192.168.2.4157.245.191.173
          Mar 28, 2024 14:32:19.147366047 CET497736554192.168.2.4157.245.191.173
          Mar 28, 2024 14:32:27.163204908 CET497826554192.168.2.4157.245.191.173
          Mar 28, 2024 14:32:28.319233894 CET497826554192.168.2.4157.245.191.173
          Mar 28, 2024 14:32:30.319237947 CET497826554192.168.2.4157.245.191.173
          Mar 28, 2024 14:32:34.319222927 CET497826554192.168.2.4157.245.191.173
          Mar 28, 2024 14:32:42.319324017 CET497826554192.168.2.4157.245.191.173
          Mar 28, 2024 14:32:50.335172892 CET497916554192.168.2.4157.245.191.173
          Mar 28, 2024 14:32:51.459861994 CET497916554192.168.2.4157.245.191.173
          Mar 28, 2024 14:32:53.459852934 CET497916554192.168.2.4157.245.191.173
          Mar 28, 2024 14:32:57.459860086 CET497916554192.168.2.4157.245.191.173
          Mar 28, 2024 14:33:05.553632975 CET497916554192.168.2.4157.245.191.173
          Mar 28, 2024 14:33:13.570007086 CET498016554192.168.2.4157.245.191.173
          Mar 28, 2024 14:33:14.647363901 CET498016554192.168.2.4157.245.191.173
          Mar 28, 2024 14:33:16.756769896 CET498016554192.168.2.4157.245.191.173
          Mar 28, 2024 14:33:20.756762028 CET498016554192.168.2.4157.245.191.173
          Mar 28, 2024 14:33:28.756763935 CET498016554192.168.2.4157.245.191.173
          Mar 28, 2024 14:33:36.866703033 CET498126554192.168.2.4157.245.191.173
          Mar 28, 2024 14:33:38.022376060 CET498126554192.168.2.4157.245.191.173
          Mar 28, 2024 14:33:40.022505999 CET498126554192.168.2.4157.245.191.173
          Mar 28, 2024 14:33:44.022488117 CET498126554192.168.2.4157.245.191.173
          Mar 28, 2024 14:33:52.022459030 CET498126554192.168.2.4157.245.191.173
          Mar 28, 2024 14:34:00.132100105 CET498236554192.168.2.4157.245.191.173
          Mar 28, 2024 14:34:01.210041046 CET498236554192.168.2.4157.245.191.173
          Mar 28, 2024 14:34:03.209907055 CET498236554192.168.2.4157.245.191.173
          Mar 28, 2024 14:34:07.210083008 CET498236554192.168.2.4157.245.191.173

          UDP Packets

          TimestampSource PortDest PortSource IPDest IP
          Mar 28, 2024 14:30:00.118366957 CET5341053192.168.2.41.1.1.1
          Mar 28, 2024 14:30:00.219301939 CET53534101.1.1.1192.168.2.4
          Mar 28, 2024 14:30:08.080620050 CET6119653192.168.2.41.1.1.1
          Mar 28, 2024 14:30:08.178322077 CET53611961.1.1.1192.168.2.4
          Mar 28, 2024 14:30:14.226399899 CET6427453192.168.2.41.1.1.1
          Mar 28, 2024 14:30:14.325596094 CET53642741.1.1.1192.168.2.4
          Mar 28, 2024 14:30:20.406949043 CET5484853192.168.2.41.1.1.1
          Mar 28, 2024 14:30:20.504885912 CET53548481.1.1.1192.168.2.4
          Mar 28, 2024 14:30:25.650706053 CET5377553192.168.2.41.1.1.1
          Mar 28, 2024 14:30:25.748123884 CET53537751.1.1.1192.168.2.4
          Mar 28, 2024 14:30:31.026072025 CET5444853192.168.2.41.1.1.1
          Mar 28, 2024 14:30:31.124527931 CET53544481.1.1.1192.168.2.4
          Mar 28, 2024 14:30:37.163780928 CET5487053192.168.2.41.1.1.1
          Mar 28, 2024 14:30:37.262696981 CET53548701.1.1.1192.168.2.4
          Mar 28, 2024 14:30:43.179624081 CET5110553192.168.2.41.1.1.1
          Mar 28, 2024 14:30:43.277383089 CET53511051.1.1.1192.168.2.4
          Mar 28, 2024 14:30:48.195214987 CET6167153192.168.2.41.1.1.1
          Mar 28, 2024 14:30:48.294157028 CET53616711.1.1.1192.168.2.4
          Mar 28, 2024 14:30:52.913810968 CET5185253192.168.2.41.1.1.1
          Mar 28, 2024 14:30:53.016027927 CET53518521.1.1.1192.168.2.4
          Mar 28, 2024 14:30:58.117125988 CET5124253192.168.2.41.1.1.1
          Mar 28, 2024 14:30:58.215733051 CET53512421.1.1.1192.168.2.4
          Mar 28, 2024 14:31:02.944967985 CET6093353192.168.2.41.1.1.1
          Mar 28, 2024 14:31:03.043205976 CET53609331.1.1.1192.168.2.4
          Mar 28, 2024 14:31:08.124337912 CET6125053192.168.2.41.1.1.1
          Mar 28, 2024 14:31:08.223036051 CET53612501.1.1.1192.168.2.4
          Mar 28, 2024 14:31:12.898262978 CET5577053192.168.2.41.1.1.1
          Mar 28, 2024 14:31:12.995831013 CET53557701.1.1.1192.168.2.4
          Mar 28, 2024 14:31:17.898015976 CET5489153192.168.2.41.1.1.1
          Mar 28, 2024 14:31:18.006067991 CET53548911.1.1.1192.168.2.4
          Mar 28, 2024 14:31:22.897609949 CET6540253192.168.2.41.1.1.1
          Mar 28, 2024 14:31:22.996562004 CET53654021.1.1.1192.168.2.4
          Mar 28, 2024 14:31:27.897945881 CET4966953192.168.2.41.1.1.1
          Mar 28, 2024 14:31:27.995032072 CET53496691.1.1.1192.168.2.4
          Mar 28, 2024 14:31:32.897944927 CET5945353192.168.2.41.1.1.1
          Mar 28, 2024 14:31:32.995445013 CET53594531.1.1.1192.168.2.4
          Mar 28, 2024 14:31:37.897738934 CET5235653192.168.2.41.1.1.1
          Mar 28, 2024 14:31:37.995085955 CET53523561.1.1.1192.168.2.4
          Mar 28, 2024 14:31:43.839931965 CET5164853192.168.2.41.1.1.1
          Mar 28, 2024 14:31:43.939243078 CET53516481.1.1.1192.168.2.4
          Mar 28, 2024 14:31:48.898013115 CET6076253192.168.2.41.1.1.1
          Mar 28, 2024 14:31:48.995874882 CET53607621.1.1.1192.168.2.4
          Mar 28, 2024 14:31:53.899535894 CET6287053192.168.2.41.1.1.1
          Mar 28, 2024 14:31:54.000106096 CET53628701.1.1.1192.168.2.4
          Mar 28, 2024 14:31:58.898852110 CET5899953192.168.2.41.1.1.1
          Mar 28, 2024 14:31:58.997164011 CET53589991.1.1.1192.168.2.4
          Mar 28, 2024 14:32:03.897886992 CET6406553192.168.2.41.1.1.1
          Mar 28, 2024 14:32:04.004128933 CET53640651.1.1.1192.168.2.4
          Mar 28, 2024 14:32:08.917509079 CET5753053192.168.2.41.1.1.1
          Mar 28, 2024 14:32:09.023304939 CET53575301.1.1.1192.168.2.4
          Mar 28, 2024 14:32:13.908051014 CET6443253192.168.2.41.1.1.1
          Mar 28, 2024 14:32:14.005251884 CET53644321.1.1.1192.168.2.4
          Mar 28, 2024 14:32:19.277532101 CET6550453192.168.2.41.1.1.1
          Mar 28, 2024 14:32:19.375566959 CET53655041.1.1.1192.168.2.4
          Mar 28, 2024 14:32:23.901221991 CET5603553192.168.2.41.1.1.1
          Mar 28, 2024 14:32:23.998996973 CET53560351.1.1.1192.168.2.4
          Mar 28, 2024 14:32:28.898041964 CET5759053192.168.2.41.1.1.1
          Mar 28, 2024 14:32:28.998330116 CET53575901.1.1.1192.168.2.4
          Mar 28, 2024 14:32:33.898106098 CET6130353192.168.2.41.1.1.1
          Mar 28, 2024 14:32:33.995793104 CET53613031.1.1.1192.168.2.4
          Mar 28, 2024 14:32:38.898107052 CET5405653192.168.2.41.1.1.1
          Mar 28, 2024 14:32:38.993721008 CET53540561.1.1.1192.168.2.4
          Mar 28, 2024 14:32:43.897857904 CET5261253192.168.2.41.1.1.1
          Mar 28, 2024 14:32:43.996081114 CET53526121.1.1.1192.168.2.4
          Mar 28, 2024 14:32:48.898027897 CET5312953192.168.2.41.1.1.1
          Mar 28, 2024 14:32:48.994381905 CET53531291.1.1.1192.168.2.4
          Mar 28, 2024 14:32:54.052932978 CET5720453192.168.2.41.1.1.1
          Mar 28, 2024 14:32:54.149172068 CET53572041.1.1.1192.168.2.4
          Mar 28, 2024 14:32:59.898586035 CET4947153192.168.2.41.1.1.1
          Mar 28, 2024 14:32:59.996196032 CET53494711.1.1.1192.168.2.4
          Mar 28, 2024 14:33:04.897964954 CET6289553192.168.2.41.1.1.1
          Mar 28, 2024 14:33:04.996256113 CET53628951.1.1.1192.168.2.4
          Mar 28, 2024 14:33:09.897728920 CET5512753192.168.2.41.1.1.1
          Mar 28, 2024 14:33:09.994817972 CET53551271.1.1.1192.168.2.4
          Mar 28, 2024 14:33:14.898310900 CET5964253192.168.2.41.1.1.1
          Mar 28, 2024 14:33:14.994333029 CET53596421.1.1.1192.168.2.4
          Mar 28, 2024 14:33:19.897918940 CET5355953192.168.2.41.1.1.1
          Mar 28, 2024 14:33:19.997360945 CET53535591.1.1.1192.168.2.4
          Mar 28, 2024 14:33:24.898011923 CET6529753192.168.2.41.1.1.1
          Mar 28, 2024 14:33:24.993937969 CET53652971.1.1.1192.168.2.4
          Mar 28, 2024 14:33:30.078243017 CET5023153192.168.2.41.1.1.1
          Mar 28, 2024 14:33:30.177017927 CET53502311.1.1.1192.168.2.4
          Mar 28, 2024 14:33:34.898313046 CET6092353192.168.2.41.1.1.1
          Mar 28, 2024 14:33:34.996119022 CET53609231.1.1.1192.168.2.4
          Mar 28, 2024 14:33:39.897845030 CET5831753192.168.2.41.1.1.1
          Mar 28, 2024 14:33:39.996402025 CET53583171.1.1.1192.168.2.4
          Mar 28, 2024 14:33:44.898359060 CET5664053192.168.2.41.1.1.1
          Mar 28, 2024 14:33:44.997591972 CET53566401.1.1.1192.168.2.4
          Mar 28, 2024 14:33:49.898433924 CET4968453192.168.2.41.1.1.1
          Mar 28, 2024 14:33:49.995937109 CET53496841.1.1.1192.168.2.4
          Mar 28, 2024 14:33:54.897917032 CET5787553192.168.2.41.1.1.1
          Mar 28, 2024 14:33:54.995714903 CET53578751.1.1.1192.168.2.4
          Mar 28, 2024 14:33:59.899404049 CET6026353192.168.2.41.1.1.1
          Mar 28, 2024 14:33:59.997062922 CET53602631.1.1.1192.168.2.4

          DNS Queries

          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
          Mar 28, 2024 14:30:00.118366957 CET192.168.2.41.1.1.10x6fdfStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:30:08.080620050 CET192.168.2.41.1.1.10x3935Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:30:14.226399899 CET192.168.2.41.1.1.10xdebdStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:30:20.406949043 CET192.168.2.41.1.1.10x3626Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:30:25.650706053 CET192.168.2.41.1.1.10xe8a2Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:30:31.026072025 CET192.168.2.41.1.1.10x8998Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:30:37.163780928 CET192.168.2.41.1.1.10xd1c4Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:30:43.179624081 CET192.168.2.41.1.1.10x6a8fStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:30:48.195214987 CET192.168.2.41.1.1.10x1e5fStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:30:52.913810968 CET192.168.2.41.1.1.10x1161Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:30:58.117125988 CET192.168.2.41.1.1.10x337bStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:31:02.944967985 CET192.168.2.41.1.1.10x8fabStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:31:08.124337912 CET192.168.2.41.1.1.10x2077Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:31:12.898262978 CET192.168.2.41.1.1.10xedd5Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:31:17.898015976 CET192.168.2.41.1.1.10x3e32Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:31:22.897609949 CET192.168.2.41.1.1.10xde1fStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:31:27.897945881 CET192.168.2.41.1.1.10x5c2dStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:31:32.897944927 CET192.168.2.41.1.1.10xc688Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:31:37.897738934 CET192.168.2.41.1.1.10xe8b7Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:31:43.839931965 CET192.168.2.41.1.1.10x656bStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:31:48.898013115 CET192.168.2.41.1.1.10xd965Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:31:53.899535894 CET192.168.2.41.1.1.10x6c99Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:31:58.898852110 CET192.168.2.41.1.1.10x651bStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:32:03.897886992 CET192.168.2.41.1.1.10xbdafStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:32:08.917509079 CET192.168.2.41.1.1.10x39edStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:32:13.908051014 CET192.168.2.41.1.1.10x329eStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:32:19.277532101 CET192.168.2.41.1.1.10xa43bStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:32:23.901221991 CET192.168.2.41.1.1.10x1284Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:32:28.898041964 CET192.168.2.41.1.1.10x6d1aStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:32:33.898106098 CET192.168.2.41.1.1.10x8a40Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:32:38.898107052 CET192.168.2.41.1.1.10x69aeStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:32:43.897857904 CET192.168.2.41.1.1.10xbe2fStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:32:48.898027897 CET192.168.2.41.1.1.10xfb63Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:32:54.052932978 CET192.168.2.41.1.1.10x1b37Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:32:59.898586035 CET192.168.2.41.1.1.10x3436Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:33:04.897964954 CET192.168.2.41.1.1.10x953eStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:33:09.897728920 CET192.168.2.41.1.1.10x13a2Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:33:14.898310900 CET192.168.2.41.1.1.10xd81eStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:33:19.897918940 CET192.168.2.41.1.1.10xa99fStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:33:24.898011923 CET192.168.2.41.1.1.10xe140Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:33:30.078243017 CET192.168.2.41.1.1.10x39b8Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:33:34.898313046 CET192.168.2.41.1.1.10x97ccStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:33:39.897845030 CET192.168.2.41.1.1.10x50e4Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:33:44.898359060 CET192.168.2.41.1.1.10x6adbStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:33:49.898433924 CET192.168.2.41.1.1.10xc0faStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:33:54.897917032 CET192.168.2.41.1.1.10xeb4dStandard query (0)supphost.ddns.netA (IP address)IN (0x0001)false
          Mar 28, 2024 14:33:59.899404049 CET192.168.2.41.1.1.10xcc3Standard query (0)supphost.ddns.netA (IP address)IN (0x0001)false

          Statistics

          CPU Usage

          Click to jump to process

          Memory Usage

          Click to jump to process

          High Level Behavior Distribution

          Click to dive into process behavior distribution

          Behavior

          Click to jump to process

          System Behavior

          General

          Target ID:0
          Start time:14:29:53
          Start date:28/03/2024
          Path:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe
          Wow64 process (32bit):true
          Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe"
          Imagebase:0x670000
          File size:970'752 bytes
          MD5 hash:ADCC598AF7CAEC5A2B261C869BF784B0
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:Borland Delphi
          Yara matches:
          • Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security
          • Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
          • Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, Author: Florian Roth
          • Rule: njrat1, Description: Identify njRat, Source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, Author: Brian Wallace @botnet_hunter
          • Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
          • Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: 00000000.00000002.1701045268.0000000003730000.00000004.10000000.00040000.00000000.sdmp, Author: ditekSHen
          • Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.1701121550.00000000038B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
          • Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000002.1701121550.00000000038B1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
          • Rule: njrat1, Description: Identify njRat, Source: 00000000.00000002.1701121550.00000000038B1000.00000004.00000800.00020000.00000000.sdmp, Author: Brian Wallace @botnet_hunter
          • Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000002.1701121550.00000000038B1000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
          Reputation:low
          Has exited:true

          General

          Target ID:1
          Start time:14:30:02
          Start date:28/03/2024
          Path:C:\Users\user\AppData\Roaming\WindowsUpdate.exe
          Wow64 process (32bit):true
          Commandline:"C:\Users\user\AppData\Roaming\WindowsUpdate.exe"
          Imagebase:0x670000
          File size:970'752 bytes
          MD5 hash:ADCC598AF7CAEC5A2B261C869BF784B0
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:Borland Delphi
          Antivirus matches:
          • Detection: 100%, Avira
          • Detection: 100%, Joe Sandbox ML
          • Detection: 82%, ReversingLabs
          Reputation:low
          Has exited:false

          General

          Target ID:2
          Start time:14:30:11
          Start date:28/03/2024
          Path:C:\Windows\SysWOW64\netsh.exe
          Wow64 process (32bit):true
          Commandline:netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\WindowsUpdate.exe" "WindowsUpdate.exe" ENABLE
          Imagebase:0x1560000
          File size:82'432 bytes
          MD5 hash:4E89A1A088BE715D6C946E55AB07C7DF
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:moderate
          Has exited:true

          General

          Target ID:3
          Start time:14:30:11
          Start date:28/03/2024
          Path:C:\Windows\System32\conhost.exe
          Wow64 process (32bit):false
          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Imagebase:0x7ff7699e0000
          File size:862'208 bytes
          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:high
          Has exited:true

          General

          Target ID:5
          Start time:14:30:20
          Start date:28/03/2024
          Path:C:\Users\user\AppData\Roaming\WindowsUpdate.exe
          Wow64 process (32bit):true
          Commandline:"C:\Users\user\AppData\Roaming\WindowsUpdate.exe" ..
          Imagebase:0x670000
          File size:970'752 bytes
          MD5 hash:ADCC598AF7CAEC5A2B261C869BF784B0
          Has elevated privileges:false
          Has administrator privileges:false
          Programmed in:Borland Delphi
          Yara matches:
          • Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
          • Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
          • Rule: njrat1, Description: Identify njRat, Source: 00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmp, Author: Brian Wallace @botnet_hunter
          • Rule: Njrat, Description: detect njRAT in memory, Source: 00000005.00000002.1969185248.0000000003801000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
          Reputation:low
          Has exited:true

          General

          Target ID:8
          Start time:14:30:28
          Start date:28/03/2024
          Path:C:\Users\user\AppData\Roaming\WindowsUpdate.exe
          Wow64 process (32bit):true
          Commandline:"C:\Users\user\AppData\Roaming\WindowsUpdate.exe" ..
          Imagebase:0x670000
          File size:970'752 bytes
          MD5 hash:ADCC598AF7CAEC5A2B261C869BF784B0
          Has elevated privileges:false
          Has administrator privileges:false
          Programmed in:Borland Delphi
          Reputation:low
          Has exited:true

          General

          Target ID:9
          Start time:14:30:38
          Start date:28/03/2024
          Path:C:\Users\user\AppData\Roaming\WindowsUpdate.exe
          Wow64 process (32bit):true
          Commandline:"C:\Users\user\AppData\Roaming\WindowsUpdate.exe" ..
          Imagebase:0x670000
          File size:970'752 bytes
          MD5 hash:ADCC598AF7CAEC5A2B261C869BF784B0
          Has elevated privileges:false
          Has administrator privileges:false
          Programmed in:Borland Delphi
          Reputation:low
          Has exited:true

          Disassembly

          Reset < >

            Execution Graph

            Execution Coverage:7.1%
            Dynamic/Decrypted Code Coverage:97%
            Signature Coverage:0%
            Total number of Nodes:67
            Total number of Limit Nodes:3
            execution_graph 18184 3230460 18185 323046e 18184->18185 18188 3230628 KiUserExceptionDispatcher 18185->18188 18186 3230480 18189 3230684 18188->18189 18189->18186 18229 2b9a55a 18230 2b9a592 RegCreateKeyExW 18229->18230 18232 2b9a604 18230->18232 18233 2b9b75a 18234 2b9b792 ConvertStringSecurityDescriptorToSecurityDescriptorW 18233->18234 18236 2b9b7d3 18234->18236 18190 6020886 18192 60208ac ShellExecuteExW 18190->18192 18193 60208c8 18192->18193 18194 2b9a2fe 18195 2b9a32a SetErrorMode 18194->18195 18196 2b9a353 18194->18196 18197 2b9a33f 18195->18197 18196->18195 18237 2b9a85e 18238 2b9a8c9 18237->18238 18239 2b9a88a FindCloseChangeNotification 18237->18239 18238->18239 18240 2b9a898 18239->18240 18241 7f7598 18242 7f75a5 VirtualAlloc 18241->18242 18244 602012a 18246 602015f GetProcessTimes 18244->18246 18247 6020191 18246->18247 18248 2b9a392 18249 2b9a3ca RegOpenKeyExW 18248->18249 18251 2b9a420 18249->18251 18198 2b9a776 18199 2b9a7ab RegSetValueExW 18198->18199 18201 2b9a7f7 18199->18201 18202 60205d2 18203 6020622 FormatMessageW 18202->18203 18204 602062a 18203->18204 18205 2b9aaaa 18206 2b9aae2 CreateFileW 18205->18206 18208 2b9ab31 18206->18208 18209 2b9b0ea 18212 2b9b122 WSASocketW 18209->18212 18211 2b9b15e 18212->18211 18252 2b9b90a 18254 2b9b942 MapViewOfFile 18252->18254 18255 2b9b991 18254->18255 18213 6020216 18214 6020251 getaddrinfo 18213->18214 18216 60202c3 18214->18216 18221 2b9b1ee 18222 2b9b25e 18221->18222 18223 2b9b226 setsockopt 18221->18223 18222->18223 18224 2b9b234 18223->18224 18225 60204da 18226 602050f WSAConnect 18225->18226 18228 602052e 18226->18228 18259 2b9a682 18260 2b9a6b7 RegQueryValueExW 18259->18260 18262 2b9a70b 18260->18262 18263 2b9ae82 18265 2b9aeb7 WriteFile 18263->18265 18266 2b9aee9 18265->18266 18267 2b9abc2 18268 2b9abf7 GetFileType 18267->18268 18270 2b9ac24 18268->18270 18271 2b9bc86 18272 2b9bcbe CreateMutexW 18271->18272 18274 2b9bd01 18272->18274

            Executed Functions

            Function 03230006 Relevance: .2, Instructions: 202COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000000.00000002.1700861658.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_3230000_SecuriteInfo.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 5500d98ac8f8ac17fad333503c9bb15beb2bb122f36eee91d91365fca6e8a6ff
            • Instruction ID: 3254fd04fef02520134f462efd00fec3ddbf7d0d0055e485c4bf7a7f39844e4c
            • Opcode Fuzzy Hash: 5500d98ac8f8ac17fad333503c9bb15beb2bb122f36eee91d91365fca6e8a6ff
            • Instruction Fuzzy Hash: 64810470E052889FCB05DFA5D990A9DBBF2EF8A300F2481AAC444AB366DB395D45CF51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03230628 Relevance: 1.6, APIs: 1, Instructions: 138COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 59 3230628-3230694 KiUserExceptionDispatcher 63 3230696-32306d2 59->63 64 32306da-32306fd 59->64 63->64 67 3230703 64->67 68 32307a1-32307d1 64->68 70 3230706-323070c 67->70 97 32307d4 call 3230c21 68->97 98 32307d4 call 3230a20 68->98 99 32307d4 call 3230997 68->99 100 32307d4 call 3230bc4 68->100 101 32307d4 call 3230cd4 68->101 102 32307d4 call 32309a8 68->102 103 32307d4 call 3230d3f 68->103 104 32307d4 call 3230d8d 68->104 71 3230778-323079f 70->71 72 323070e-3230723 70->72 88 32307da-32307e1 71->88 79 3230725-323073c call 3230498 72->79 80 3230759-323075f 72->80 92 323074e-3230751 79->92 93 323073e-3230741 79->93 82 3230773 80->82 83 3230761-3230767 80->83 82->71 83->82 86 3230769-323076f 83->86 86->70 90 3230771 86->90 90->68 107 3230753 call 3230891 92->107 108 3230753 call 32308a0 92->108 105 3230746 call 3230891 93->105 106 3230746 call 32308a0 93->106 95 323074c 95->80 97->88 98->88 99->88 100->88 101->88 102->88 103->88 104->88 105->95 106->95 107->80 108->80
            APIs
            • KiUserExceptionDispatcher.NTDLL ref: 0323066F
            Memory Dump Source
            • Source File: 00000000.00000002.1700861658.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_3230000_SecuriteInfo.jbxd
            Similarity
            • API ID: DispatcherExceptionUser
            • String ID:
            • API String ID: 6842923-0
            • Opcode ID: c1254fa2a17ee11dc09b30c2971f0c4ba7e27a076e5bafc8cffcb51fde0a913d
            • Instruction ID: 16ec3be836ce3f02d30c3f7bc82a50e324632448124b6acbf381bdc955a22628
            • Opcode Fuzzy Hash: c1254fa2a17ee11dc09b30c2971f0c4ba7e27a076e5bafc8cffcb51fde0a913d
            • Instruction Fuzzy Hash: BC518B74B11104DFCB04EBB8D998A9DB7F6EF89300F148569E406AB394DB39AC45CFA0
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9A523 Relevance: 1.6, APIs: 1, Instructions: 108registryCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 109 2b9a523-2b9a5b2 113 2b9a5b4 109->113 114 2b9a5b7-2b9a5c3 109->114 113->114 115 2b9a5c8-2b9a5d1 114->115 116 2b9a5c5 114->116 117 2b9a5d3 115->117 118 2b9a5d6-2b9a5ed 115->118 116->115 117->118 120 2b9a62f-2b9a634 118->120 121 2b9a5ef-2b9a602 RegCreateKeyExW 118->121 120->121 122 2b9a604-2b9a62c 121->122 123 2b9a636-2b9a63b 121->123 123->122
            APIs
            • RegCreateKeyExW.KERNEL32(?,00000E90), ref: 02B9A5F5
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: Create
            • String ID:
            • API String ID: 2289755597-0
            • Opcode ID: de867cab2929e7ec427877ed0fbd911ad2737ed5f8dc6175e705f2127707d8d7
            • Instruction ID: 801da1889a048b514a92f3fa5bd653518e5883675f1ef948f69c2dee490f3b75
            • Opcode Fuzzy Hash: de867cab2929e7ec427877ed0fbd911ad2737ed5f8dc6175e705f2127707d8d7
            • Instruction Fuzzy Hash: D5316EB2504384AFEB228B25CC44FA7BFBCEF05614F08849AE985DB652D361E509CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9AA6A Relevance: 1.6, APIs: 1, Instructions: 103fileCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 128 2b9aa6a-2b9ab02 132 2b9ab04 128->132 133 2b9ab07-2b9ab13 128->133 132->133 134 2b9ab18-2b9ab21 133->134 135 2b9ab15 133->135 136 2b9ab23-2b9ab47 CreateFileW 134->136 137 2b9ab72-2b9ab77 134->137 135->134 140 2b9ab79-2b9ab7e 136->140 141 2b9ab49-2b9ab6f 136->141 137->136 140->141
            APIs
            • CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 02B9AB29
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: CreateFile
            • String ID:
            • API String ID: 823142352-0
            • Opcode ID: dbb78386eff207b0446f86b8f319a6cf4bbcd35452a13d7450f4809c4a3caca7
            • Instruction ID: ec09cf52ad55abe14d436b90c3093638d9e6adbb4dba1e26a0484426fc9203f3
            • Opcode Fuzzy Hash: dbb78386eff207b0446f86b8f319a6cf4bbcd35452a13d7450f4809c4a3caca7
            • Instruction Fuzzy Hash: 2531C3715053806FEB12CF25CC44BA2BFF8EF06314F0884EAE9848B652D375A909C771
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9AFD7 Relevance: 1.6, APIs: 1, Instructions: 98registryCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 144 2b9afd7-2b9aff7 145 2b9b019-2b9b04b 144->145 146 2b9aff9-2b9b018 144->146 150 2b9b04e-2b9b0a6 RegQueryValueExW 145->150 146->145 152 2b9b0ac-2b9b0c2 150->152
            APIs
            • RegQueryValueExW.KERNEL32(?,00000E90,?,?), ref: 02B9B09E
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 6fefa3403f986f1e878bf81b6fb710196cc6e8342eee6f381860d7946e2d4cb3
            • Instruction ID: 0b077f17b8822f684cb4ea81925022879ef76b2ee304a294838c3667df5940a6
            • Opcode Fuzzy Hash: 6fefa3403f986f1e878bf81b6fb710196cc6e8342eee6f381860d7946e2d4cb3
            • Instruction Fuzzy Hash: 5A318B6510E3C06FD3138B258C61A61BF74EF47614F0E85CBE8C48B6A3D229A919D7B2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 060201F4 Relevance: 1.6, APIs: 1, Instructions: 93COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 153 60201f4-60202b3 159 6020305-602030a 153->159 160 60202b5-60202bd getaddrinfo 153->160 159->160 161 60202c3-60202d5 160->161 163 60202d7-6020302 161->163 164 602030c-6020311 161->164 164->163
            APIs
            • getaddrinfo.WS2_32(?,00000E90), ref: 060202BB
            Memory Dump Source
            • Source File: 00000000.00000002.1701921662.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_6020000_SecuriteInfo.jbxd
            Similarity
            • API ID: getaddrinfo
            • String ID:
            • API String ID: 300660673-0
            • Opcode ID: 06c54baeed537a77c3e18afdc115a12c10802a19aa2083c35708a486aef17925
            • Instruction ID: 195f777390800722cd4532f5c3935d2cec8f79b19e1a4249a7af7cb67e1bf41c
            • Opcode Fuzzy Hash: 06c54baeed537a77c3e18afdc115a12c10802a19aa2083c35708a486aef17925
            • Instruction Fuzzy Hash: E931A471504344AFE721CB61CC84FABFBACEF04314F04489AFA899B692D375A949CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 06020566 Relevance: 1.6, APIs: 1, Instructions: 91windowCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 168 6020566-60205cf 170 60205d2-6020624 FormatMessageW 168->170 172 602062a-6020653 170->172
            APIs
            • FormatMessageW.KERNEL32(?,00000E90,?,?), ref: 06020622
            Memory Dump Source
            • Source File: 00000000.00000002.1701921662.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_6020000_SecuriteInfo.jbxd
            Similarity
            • API ID: FormatMessage
            • String ID:
            • API String ID: 1306739567-0
            • Opcode ID: 8082a44bbb4042ef85b08dc3fd330415065c42d68ff057da17bffff66fabd16b
            • Instruction ID: 8d3b5c580c68f051d37f4adeba040756a9b3a41c3cd40e184bf26b69345fe56e
            • Opcode Fuzzy Hash: 8082a44bbb4042ef85b08dc3fd330415065c42d68ff057da17bffff66fabd16b
            • Instruction Fuzzy Hash: C6318D7250D3C05FD7038B658C61AA6BFB4EF47610F1D84CBD8C49F2A3D6246919C7A2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9A63D Relevance: 1.6, APIs: 1, Instructions: 90registryCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 189 2b9a63d-2b9a6bf 192 2b9a6c1 189->192 193 2b9a6c4-2b9a6cd 189->193 192->193 194 2b9a6cf 193->194 195 2b9a6d2-2b9a6d8 193->195 194->195 196 2b9a6da 195->196 197 2b9a6dd-2b9a6f4 195->197 196->197 199 2b9a72b-2b9a730 197->199 200 2b9a6f6-2b9a709 RegQueryValueExW 197->200 199->200 201 2b9a70b-2b9a728 200->201 202 2b9a732-2b9a737 200->202 202->201
            APIs
            • RegQueryValueExW.KERNEL32(?,00000E90,53A479D2,00000000,00000000,00000000,00000000), ref: 02B9A6FC
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 91d1bc335f2a80f55ad55ca945bdd29e5d2d2dff20de8e970cc6df52ed6fac63
            • Instruction ID: 6ecff755057cf6ec750021c45b03cf755faf7bfb29580a60fc738f2061d09d7f
            • Opcode Fuzzy Hash: 91d1bc335f2a80f55ad55ca945bdd29e5d2d2dff20de8e970cc6df52ed6fac63
            • Instruction Fuzzy Hash: 6B31B5755097805FDB22CB25CC95F97BFB8EF06214F0884DAE9858B653D325E908C771
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9A361 Relevance: 1.6, APIs: 1, Instructions: 90registryCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 174 2b9a361-2b9a3ed 178 2b9a3ef 174->178 179 2b9a3f2-2b9a409 174->179 178->179 181 2b9a44b-2b9a450 179->181 182 2b9a40b-2b9a41e RegOpenKeyExW 179->182 181->182 183 2b9a420-2b9a448 182->183 184 2b9a452-2b9a457 182->184 184->183
            APIs
            • RegOpenKeyExW.KERNEL32(?,00000E90), ref: 02B9A411
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: Open
            • String ID:
            • API String ID: 71445658-0
            • Opcode ID: d04b6065aebb496a4355c4d5b51a8fd876394e2cdc043e6c28be84d1cdfe6650
            • Instruction ID: fc4b67477e8ea7e8be392fd1ccba8db9298c72fddd4b3cba1b9613d92bfe3547
            • Opcode Fuzzy Hash: d04b6065aebb496a4355c4d5b51a8fd876394e2cdc043e6c28be84d1cdfe6650
            • Instruction Fuzzy Hash: 2831A471408380AFE722CF51CC44F96BFBCEF06214F08849BE9858B652D324A94DCB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9B734 Relevance: 1.6, APIs: 1, Instructions: 89COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 206 2b9b734-2b9b7b5 210 2b9b7ba-2b9b7c3 206->210 211 2b9b7b7 206->211 212 2b9b81b-2b9b820 210->212 213 2b9b7c5-2b9b7cd ConvertStringSecurityDescriptorToSecurityDescriptorW 210->213 211->210 212->213 214 2b9b7d3-2b9b7e5 213->214 216 2b9b822-2b9b827 214->216 217 2b9b7e7-2b9b818 214->217 216->217
            APIs
            • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E90), ref: 02B9B7CB
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: DescriptorSecurity$ConvertString
            • String ID:
            • API String ID: 3907675253-0
            • Opcode ID: 995d9c5e1ca834452cef6261c4cbcf1ca7625517d398f90e8cbfeedbe97d9734
            • Instruction ID: ba40da5199a4f536bd8571b2ecd58060062806fcf4ef6deda33a4af236bf3a21
            • Opcode Fuzzy Hash: 995d9c5e1ca834452cef6261c4cbcf1ca7625517d398f90e8cbfeedbe97d9734
            • Instruction Fuzzy Hash: 0D31C371504384AFEB21CB64DC44FABBFBCEF05214F0884AAE984DB652D364E908CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 060200EC Relevance: 1.6, APIs: 1, Instructions: 89timeCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 221 60200ec-6020181 226 6020183-602018b GetProcessTimes 221->226 227 60201ce-60201d3 221->227 229 6020191-60201a3 226->229 227->226 230 60201d5-60201da 229->230 231 60201a5-60201cb 229->231 230->231
            APIs
            • GetProcessTimes.KERNEL32(?,00000E90,53A479D2,00000000,00000000,00000000,00000000), ref: 06020189
            Memory Dump Source
            • Source File: 00000000.00000002.1701921662.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_6020000_SecuriteInfo.jbxd
            Similarity
            • API ID: ProcessTimes
            • String ID:
            • API String ID: 1995159646-0
            • Opcode ID: 0497cf24b8d33f52434cad5587028e3a0cbf2015826a2280e685011073d0d4e5
            • Instruction ID: 8f8f16f21f2dfc3f5efeffabdb28b2e02c968eb6cbf6b4181b2bd800fef554d7
            • Opcode Fuzzy Hash: 0497cf24b8d33f52434cad5587028e3a0cbf2015826a2280e685011073d0d4e5
            • Instruction Fuzzy Hash: F831E3725093806FEB12CF20DC45B96BFB8EF06324F08849AE985CB153D221A948C7B5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9A55A Relevance: 1.6, APIs: 1, Instructions: 86registryCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 234 2b9a55a-2b9a5b2 237 2b9a5b4 234->237 238 2b9a5b7-2b9a5c3 234->238 237->238 239 2b9a5c8-2b9a5d1 238->239 240 2b9a5c5 238->240 241 2b9a5d3 239->241 242 2b9a5d6-2b9a5ed 239->242 240->239 241->242 244 2b9a62f-2b9a634 242->244 245 2b9a5ef-2b9a602 RegCreateKeyExW 242->245 244->245 246 2b9a604-2b9a62c 245->246 247 2b9a636-2b9a63b 245->247 247->246
            APIs
            • RegCreateKeyExW.KERNEL32(?,00000E90), ref: 02B9A5F5
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: Create
            • String ID:
            • API String ID: 2289755597-0
            • Opcode ID: a8356e8de89784fc6aabd08ee1a626d5f110d9cc94ad2dd1e7918ab34174465d
            • Instruction ID: 5097930b9bcc759f2ec48753c0752c2bd8d4131db540563ab8e95d82c054988a
            • Opcode Fuzzy Hash: a8356e8de89784fc6aabd08ee1a626d5f110d9cc94ad2dd1e7918ab34174465d
            • Instruction Fuzzy Hash: 2D218D72600704AFEB31DF65CC44FABBBECEF08614F04846AE949D6652E720E549CA71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9BC59 Relevance: 1.6, APIs: 1, Instructions: 85synchronizationCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 252 2b9bc59-2b9bcd5 256 2b9bcda-2b9bce3 252->256 257 2b9bcd7 252->257 258 2b9bce8-2b9bcf1 256->258 259 2b9bce5 256->259 257->256 260 2b9bcf3-2b9bd17 CreateMutexW 258->260 261 2b9bd42-2b9bd47 258->261 259->258 264 2b9bd49-2b9bd4e 260->264 265 2b9bd19-2b9bd3f 260->265 261->260 264->265
            APIs
            • CreateMutexW.KERNEL32(?,?), ref: 02B9BCF9
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: CreateMutex
            • String ID:
            • API String ID: 1964310414-0
            • Opcode ID: 5982ae0cfdffee02cf2ba8fdb18995a90e1d231b31eacdb45f321da3ed5f9b2b
            • Instruction ID: 8171e39b02eb2c12e98bc1f7a179af8bd6127ba9cdf2daa45a4ece0d95da926c
            • Opcode Fuzzy Hash: 5982ae0cfdffee02cf2ba8fdb18995a90e1d231b31eacdb45f321da3ed5f9b2b
            • Instruction Fuzzy Hash: 4C318471505380AFE711CB25DC45B96FFB8EF05214F0884AAE988CB292D365E908CB75
            Uniqueness

            Uniqueness Score: -1.00%

            Function 06020216 Relevance: 1.6, APIs: 1, Instructions: 84COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 268 6020216-60202b3 273 6020305-602030a 268->273 274 60202b5-60202bd getaddrinfo 268->274 273->274 275 60202c3-60202d5 274->275 277 60202d7-6020302 275->277 278 602030c-6020311 275->278 278->277
            APIs
            • getaddrinfo.WS2_32(?,00000E90), ref: 060202BB
            Memory Dump Source
            • Source File: 00000000.00000002.1701921662.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_6020000_SecuriteInfo.jbxd
            Similarity
            • API ID: getaddrinfo
            • String ID:
            • API String ID: 300660673-0
            • Opcode ID: 8c6eca8f0ba0c4bd72e2c9bf4f879a890b1ceb3e75a54e47e8d0aa5239d84f82
            • Instruction ID: ecef4b065bcd7f9888d1fd231cc409e46d844c42c8a9e0ee5dba3db0c7bd0016
            • Opcode Fuzzy Hash: 8c6eca8f0ba0c4bd72e2c9bf4f879a890b1ceb3e75a54e47e8d0aa5239d84f82
            • Instruction Fuzzy Hash: 4121A371500344AEFB21DF60CC84FAAFBACEF04714F04485AFA499A681D7B5A54D8B71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9AB80 Relevance: 1.6, APIs: 1, Instructions: 80COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 282 2b9ab80-2b9ac0d 286 2b9ac0f-2b9ac22 GetFileType 282->286 287 2b9ac42-2b9ac47 282->287 288 2b9ac49-2b9ac4e 286->288 289 2b9ac24-2b9ac41 286->289 287->286 288->289
            APIs
            • GetFileType.KERNEL32(?,00000E90,53A479D2,00000000,00000000,00000000,00000000), ref: 02B9AC15
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: FileType
            • String ID:
            • API String ID: 3081899298-0
            • Opcode ID: 5d1687a83d9e057cd1eedde988f17740f8a813803c7ce8f1df5a0115539ce6ea
            • Instruction ID: d4ccbd8f58f000d4cc9abc11b36e1306fd578f9de8b59c45926760199110ff93
            • Opcode Fuzzy Hash: 5d1687a83d9e057cd1eedde988f17740f8a813803c7ce8f1df5a0115539ce6ea
            • Instruction Fuzzy Hash: 212128754093806FE7128B21DC45BA2BFBCEF07324F0880D6E9848F253D264A909C775
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9B8EA Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON
            Download Yara Rule
            APIs
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: FileView
            • String ID:
            • API String ID: 3314676101-0
            • Opcode ID: 601d7a020fa087a34d11f1e215e920baace5b0d58ef2d0d716e8c81eeee2535c
            • Instruction ID: c719621658dc4e0dd4bffb7ed2185f1ab9f148122dd31cc0352bd4aefbd62623
            • Opcode Fuzzy Hash: 601d7a020fa087a34d11f1e215e920baace5b0d58ef2d0d716e8c81eeee2535c
            • Instruction Fuzzy Hash: B121B171405380AFE722CF15DC44F96FFF8EF05214F04849EE9898B252D365A508CB65
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9A752 Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON
            Download Yara Rule
            APIs
            • RegSetValueExW.KERNEL32(?,00000E90,53A479D2,00000000,00000000,00000000,00000000), ref: 02B9A7E8
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: Value
            • String ID:
            • API String ID: 3702945584-0
            • Opcode ID: b94029dccb92147ef99976d05c94ca7242e92588cce8d9a2b1e051d8771dc828
            • Instruction ID: 3f166ea74143959ba738129bb6f27e4ae96c8ef7b6b2dec449f875b9966c6597
            • Opcode Fuzzy Hash: b94029dccb92147ef99976d05c94ca7242e92588cce8d9a2b1e051d8771dc828
            • Instruction Fuzzy Hash: 4121C1725043806FDB22CB11CC44FA7BFB8EF06614F08849AE985CB652D365E848C7B1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9B0CA Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON
            Download Yara Rule
            APIs
            • WSASocketW.WS2_32(?,?,?,?,?), ref: 02B9B156
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: Socket
            • String ID:
            • API String ID: 38366605-0
            • Opcode ID: a2cc178c09ae68d2e7abc588b83024002d563981c82fe24389b7ce1061ae4742
            • Instruction ID: e7797333fc0710154e60988a33a84b6d2e5262825b3c64e6a415fed90f69f281
            • Opcode Fuzzy Hash: a2cc178c09ae68d2e7abc588b83024002d563981c82fe24389b7ce1061ae4742
            • Instruction Fuzzy Hash: 8E21D371505380AFEB22CF65DC44F96FFB8EF05214F08889EE9898B652D375A418CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9AAAA Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON
            Download Yara Rule
            APIs
            • CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 02B9AB29
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: CreateFile
            • String ID:
            • API String ID: 823142352-0
            • Opcode ID: ca285b58a7eeb8894cc853e5a3ac5837bb7c7582fb3241b482a4f2c0dfc8dd70
            • Instruction ID: c76c0a1e468f7b4b9f00ee472809ac11161d9f58b34637fdb3d60985a569ca0d
            • Opcode Fuzzy Hash: ca285b58a7eeb8894cc853e5a3ac5837bb7c7582fb3241b482a4f2c0dfc8dd70
            • Instruction Fuzzy Hash: A7219071600244AFEB21CF65CD85FA6FBE8FF08324F0484AAE9899B651D371E518CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9B75A Relevance: 1.6, APIs: 1, Instructions: 76COMMON
            Download Yara Rule
            APIs
            • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E90), ref: 02B9B7CB
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: DescriptorSecurity$ConvertString
            • String ID:
            • API String ID: 3907675253-0
            • Opcode ID: 85f241f807c671da8d28f389035c9c528ba32e549e2d5b018f53245453caaebe
            • Instruction ID: 4c12bf146d49440970741448eafbbe580c6733b4b66bd7815a72187657ade50a
            • Opcode Fuzzy Hash: 85f241f807c671da8d28f389035c9c528ba32e549e2d5b018f53245453caaebe
            • Instruction Fuzzy Hash: 9D21F372600244AFEB20DF65DC85FAAFBACEF04614F0488AAE944DB741D775E508CBB1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9B64E Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNEL32(?,00000E90,53A479D2,00000000,00000000,00000000,00000000), ref: 02B9B6E0
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 8384197fea62a85058d6a3ada05e2a181ff4cea6db0d14b9fc503febfef8819f
            • Instruction ID: b567990c4845047ccd05238a78a340f535ceea9d2575006e023ac4ebb4e9e98e
            • Opcode Fuzzy Hash: 8384197fea62a85058d6a3ada05e2a181ff4cea6db0d14b9fc503febfef8819f
            • Instruction Fuzzy Hash: 3221BD72504380AFDB22CF11DC84F96FFB8EF05214F08849AE9858B252D325E908CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9A392 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON
            Download Yara Rule
            APIs
            • RegOpenKeyExW.KERNEL32(?,00000E90), ref: 02B9A411
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: Open
            • String ID:
            • API String ID: 71445658-0
            • Opcode ID: 7086834f199e84bd427fdb127df226fe405119a7889d41271cd34e34ecc09f42
            • Instruction ID: 34d5260b5427d2ad95d897b886a46212cc182d317b26fcccb78d15c5eef8bfaf
            • Opcode Fuzzy Hash: 7086834f199e84bd427fdb127df226fe405119a7889d41271cd34e34ecc09f42
            • Instruction Fuzzy Hash: 8D21D172500204AFEB20DF55CC48FABFBECEF04214F08846AEE459B741D360E94D8AB2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9AE62 Relevance: 1.6, APIs: 1, Instructions: 73fileCOMMON
            Download Yara Rule
            APIs
            • WriteFile.KERNEL32(?,00000E90,53A479D2,00000000,00000000,00000000,00000000), ref: 02B9AEE1
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: FileWrite
            • String ID:
            • API String ID: 3934441357-0
            • Opcode ID: 6a9678dc10b77f56f84f0734ed681ac575e5587333deaee17cbd59684a5bcc43
            • Instruction ID: 36be7b94e50bcebcfa25edbdad463a644bf84f7045b1b55d7847ed8b70a54b2c
            • Opcode Fuzzy Hash: 6a9678dc10b77f56f84f0734ed681ac575e5587333deaee17cbd59684a5bcc43
            • Instruction Fuzzy Hash: 9021D1B2504340AFEB22CF51DC44FA7BFB8EF45324F04849AF9858B652C365A908CBB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9BC86 Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON
            Download Yara Rule
            APIs
            • CreateMutexW.KERNEL32(?,?), ref: 02B9BCF9
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: CreateMutex
            • String ID:
            • API String ID: 1964310414-0
            • Opcode ID: d9c0c10bcbbd667c88c035f71ffa8a6a9a465909e6e26bc8fefc7c450e222b86
            • Instruction ID: 04eae4c9224d1aa96e785d6341286929beefe3f4e3a37746bc8a09c7653a39eb
            • Opcode Fuzzy Hash: d9c0c10bcbbd667c88c035f71ffa8a6a9a465909e6e26bc8fefc7c450e222b86
            • Instruction Fuzzy Hash: 3421A171600244AFEB20CF29DD45BA6FBE8EF04228F0484AAED48DF741D775E909CA75
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9A682 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNEL32(?,00000E90,53A479D2,00000000,00000000,00000000,00000000), ref: 02B9A6FC
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: ac107025168d406f8bdbed9f6a582033de58bda7650c65f00f3a56265cddd23a
            • Instruction ID: 430bac9c85180dd80a56b3194d58248773c4cdcd6b570ce6d778bcc8f2da63f1
            • Opcode Fuzzy Hash: ac107025168d406f8bdbed9f6a582033de58bda7650c65f00f3a56265cddd23a
            • Instruction Fuzzy Hash: 4321C075200204AFEB20CF15CC84FA6B7ECEF04614F0484AAE945CB751D325E948CAB1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9B1AF Relevance: 1.6, APIs: 1, Instructions: 68COMMON
            Download Yara Rule
            APIs
            • setsockopt.WS2_32(?,?,?,?,?), ref: 02B9B22C
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: setsockopt
            • String ID:
            • API String ID: 3981526788-0
            • Opcode ID: 5b44f1a4f8a7361dc772e7c71a3ecfc4d8e894b9df92f5f5ca689cc73f006bed
            • Instruction ID: 99269f2e9b7b591ad754e58899f1bb73c3d4e7ae23f2f45102575c6d63179dd7
            • Opcode Fuzzy Hash: 5b44f1a4f8a7361dc772e7c71a3ecfc4d8e894b9df92f5f5ca689cc73f006bed
            • Instruction Fuzzy Hash: 6021AC310093C09FDB22CF65DC45AA6BFB4EF07320F0984DAE9C48F563C225A959DBA1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 060204A7 Relevance: 1.6, APIs: 1, Instructions: 68networkCOMMON
            Download Yara Rule
            APIs
            • WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 06020526
            Memory Dump Source
            • Source File: 00000000.00000002.1701921662.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_6020000_SecuriteInfo.jbxd
            Similarity
            • API ID: Connect
            • String ID:
            • API String ID: 3144859779-0
            • Opcode ID: 120e0aafcd6623ed229daa9fbb6e5f10c24b4ffc52addf6126f3928c260c675e
            • Instruction ID: af88b1ab673d497c830ed88d20316e7cec5b91a84a214a966e239c308b62a9c8
            • Opcode Fuzzy Hash: 120e0aafcd6623ed229daa9fbb6e5f10c24b4ffc52addf6126f3928c260c675e
            • Instruction Fuzzy Hash: 8121BE71409380AFDB62CF64CC84A92BFF4EF06310F0984DAE9858F563D375A819DB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9B90A Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON
            Download Yara Rule
            APIs
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: FileView
            • String ID:
            • API String ID: 3314676101-0
            • Opcode ID: 0571aa8267f8a03e383dbbe05c55eb2d5350e930adf9e70fbcf1aa11aa231290
            • Instruction ID: 6b37e37a817eeee7010640bedc57db3ba188e0f4d7bd4ee7d6022f88810dd4d4
            • Opcode Fuzzy Hash: 0571aa8267f8a03e383dbbe05c55eb2d5350e930adf9e70fbcf1aa11aa231290
            • Instruction Fuzzy Hash: D821C671500244AFEB21CF15DC85F9AFBE8EF08218F048499EA898B751D375E45CCB75
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9B0EA Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON
            Download Yara Rule
            APIs
            • WSASocketW.WS2_32(?,?,?,?,?), ref: 02B9B156
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: Socket
            • String ID:
            • API String ID: 38366605-0
            • Opcode ID: ce7ef6ecda1a3f1c371ba37b761adc7a94b4613535cd9652443372c814cdc831
            • Instruction ID: 0572c2951b3b6cb4579abd1420b4c5b27fbd1bac313dfcf789a2d97e4b8f5185
            • Opcode Fuzzy Hash: ce7ef6ecda1a3f1c371ba37b761adc7a94b4613535cd9652443372c814cdc831
            • Instruction Fuzzy Hash: 4521A471500244AFEB21CF55DD45FA6FBA4EF04314F0488AEE9458B751D375A458CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9A776 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON
            Download Yara Rule
            APIs
            • RegSetValueExW.KERNEL32(?,00000E90,53A479D2,00000000,00000000,00000000,00000000), ref: 02B9A7E8
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: Value
            • String ID:
            • API String ID: 3702945584-0
            • Opcode ID: 94dab4451aa2ca64ce09dead8884b50d774969876229a60dd6b1d24f4e72e66c
            • Instruction ID: cf7706dade7a31a014dff49373cb9c151994309e808a3ccdc4b18959aa50e317
            • Opcode Fuzzy Hash: 94dab4451aa2ca64ce09dead8884b50d774969876229a60dd6b1d24f4e72e66c
            • Instruction Fuzzy Hash: A111BE72600204AFEB218F15CC81FA6BBBCEF04614F0484AAE9458A652D365E848CAB6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9B66E Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNEL32(?,00000E90,53A479D2,00000000,00000000,00000000,00000000), ref: 02B9B6E0
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: f699399492d615dc43458665eb9edd356960e3b9882cc541efb59caa0c7e3ea3
            • Instruction ID: ab7643629a37c1d1729253dbbc3f4a626de18e146e7ff3b6fac6d35a747bd5c5
            • Opcode Fuzzy Hash: f699399492d615dc43458665eb9edd356960e3b9882cc541efb59caa0c7e3ea3
            • Instruction Fuzzy Hash: 2A11D372600204AFEB21CF15DC84FA6FBECEF04718F0485AAEA458B651D365F448CBB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 0602012A Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON
            Download Yara Rule
            APIs
            • GetProcessTimes.KERNEL32(?,00000E90,53A479D2,00000000,00000000,00000000,00000000), ref: 06020189
            Memory Dump Source
            • Source File: 00000000.00000002.1701921662.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_6020000_SecuriteInfo.jbxd
            Similarity
            • API ID: ProcessTimes
            • String ID:
            • API String ID: 1995159646-0
            • Opcode ID: 114da7109e702a653603876b99dc8544dbb995707613da70ba0c706a6b158a2b
            • Instruction ID: 5af4c3148aa417a227d9fded4fd0f1b740bc5f3100145eb97a8711e0e0dea772
            • Opcode Fuzzy Hash: 114da7109e702a653603876b99dc8544dbb995707613da70ba0c706a6b158a2b
            • Instruction Fuzzy Hash: E311D072600340AFFB61CF55DC44BAABBA8EF04324F04846AE9498A651D375E5888BB6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9AE82 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON
            Download Yara Rule
            APIs
            • WriteFile.KERNEL32(?,00000E90,53A479D2,00000000,00000000,00000000,00000000), ref: 02B9AEE1
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: FileWrite
            • String ID:
            • API String ID: 3934441357-0
            • Opcode ID: 2455175c8b649d36921467b6b829f8dd0aca4d1230727a93a85fba2ca28823d2
            • Instruction ID: 56d84368fca7c7f95769a367de20f66ad348229255f6add597855f2c6d126b2e
            • Opcode Fuzzy Hash: 2455175c8b649d36921467b6b829f8dd0aca4d1230727a93a85fba2ca28823d2
            • Instruction Fuzzy Hash: 27112772500200AFEB21CF50CC44FAAFBE8EF04314F0484AAED499B641C375A548CBB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 06020864 Relevance: 1.6, APIs: 1, Instructions: 60COMMON
            Download Yara Rule
            APIs
            • ShellExecuteExW.SHELL32(?), ref: 060208C0
            Memory Dump Source
            • Source File: 00000000.00000002.1701921662.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_6020000_SecuriteInfo.jbxd
            Similarity
            • API ID: ExecuteShell
            • String ID:
            • API String ID: 587946157-0
            • Opcode ID: a3bd1246a61ccea15b6b08efd142a7a5523fd11a858b6670cdfb54078de8a202
            • Instruction ID: 5c28068670ee7f24d331185e0f50c6615e9cf4130413ffca9ecd999515419ba4
            • Opcode Fuzzy Hash: a3bd1246a61ccea15b6b08efd142a7a5523fd11a858b6670cdfb54078de8a202
            • Instruction Fuzzy Hash: 981193715493809FDB52CB25DC84B52BFA8EF46210F0884EBED85CB652D265E508C761
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9A830 Relevance: 1.6, APIs: 1, Instructions: 59COMMON
            Download Yara Rule
            APIs
            • FindCloseChangeNotification.KERNEL32(?,53A479D2,00000000,?,?,?,?,?,?,?,?,6CAC3C58), ref: 02B9A890
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: ChangeCloseFindNotification
            • String ID:
            • API String ID: 2591292051-0
            • Opcode ID: f6f74358049a2eee0e0b668ee033604f2d7a4e43c14dee6752430f5cb42e89d1
            • Instruction ID: a5adb172dca920b213ebd105b93c95eeebaae7e310fe9e10f09c51d9fd0baa09
            • Opcode Fuzzy Hash: f6f74358049a2eee0e0b668ee033604f2d7a4e43c14dee6752430f5cb42e89d1
            • Instruction Fuzzy Hash: E81182715093C09FDB12CB25DC95792BFB8EF42220F0884EBED858F652D276A519CB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9A2D2 Relevance: 1.6, APIs: 1, Instructions: 53COMMON
            Download Yara Rule
            APIs
            • SetErrorMode.KERNEL32(?,53A479D2,00000000,?,?,?,?,?,?,?,?,6CAC3C58), ref: 02B9A330
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: ErrorMode
            • String ID:
            • API String ID: 2340568224-0
            • Opcode ID: d1381a3649fa3f4142d368a99e598e8272e339a1563a70c85be3f6fef4981232
            • Instruction ID: 9c1878c03968d93ec290102da446713f563deb18b7d04f6517206aab9673190c
            • Opcode Fuzzy Hash: d1381a3649fa3f4142d368a99e598e8272e339a1563a70c85be3f6fef4981232
            • Instruction Fuzzy Hash: F9118F758093C09FDB128B25DC54B52BFB4EF07224F0980DBDD858F163D265A808CB62
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9ABC2 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
            Download Yara Rule
            APIs
            • GetFileType.KERNEL32(?,00000E90,53A479D2,00000000,00000000,00000000,00000000), ref: 02B9AC15
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: FileType
            • String ID:
            • API String ID: 3081899298-0
            • Opcode ID: 5b52970e5fa66f5f460f44d53242cbe32b43c37648d97abe3d0c6a1274a32b4f
            • Instruction ID: 54c8954ed8ad81dcbbc5a13bd932b752a240aed403decc022c4f5b835f606fc1
            • Opcode Fuzzy Hash: 5b52970e5fa66f5f460f44d53242cbe32b43c37648d97abe3d0c6a1274a32b4f
            • Instruction Fuzzy Hash: A501D671600244AFEB10CB15DD45BA6FBACEF04724F04C0A6ED489F741D365E54CCABA
            Uniqueness

            Uniqueness Score: -1.00%

            Function 060204DA Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON
            Download Yara Rule
            APIs
            • WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 06020526
            Memory Dump Source
            • Source File: 00000000.00000002.1701921662.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_6020000_SecuriteInfo.jbxd
            Similarity
            • API ID: Connect
            • String ID:
            • API String ID: 3144859779-0
            • Opcode ID: b4d93c1e9e985208938af0eefc0e23dca2c0b30dfd79559437ca3f34fe46ab97
            • Instruction ID: 1f8bc7ff064adb826a479064d73b2c21e7ea6124414522edd6df51e9a7c979f2
            • Opcode Fuzzy Hash: b4d93c1e9e985208938af0eefc0e23dca2c0b30dfd79559437ca3f34fe46ab97
            • Instruction Fuzzy Hash: 0D1170315007549FEB60CF55D844B66FFE4EF04310F08849ADD4A8B612D335E458DF61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 06020886 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
            Download Yara Rule
            APIs
            • ShellExecuteExW.SHELL32(?), ref: 060208C0
            Memory Dump Source
            • Source File: 00000000.00000002.1701921662.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_6020000_SecuriteInfo.jbxd
            Similarity
            • API ID: ExecuteShell
            • String ID:
            • API String ID: 587946157-0
            • Opcode ID: 516635bcd7ce199ccd6bf6a674faee512022c7e18b072be0a6d5ff81b48a0a97
            • Instruction ID: 2d6db1c0ae6ca02acf93a4bbc61cf8377585237bf7472143971187f3a8c6f44a
            • Opcode Fuzzy Hash: 516635bcd7ce199ccd6bf6a674faee512022c7e18b072be0a6d5ff81b48a0a97
            • Instruction Fuzzy Hash: 51018031A403558FEB90CF29D985766BBD4EF04220F08C4AADD8ACB642D275E448CBA1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 060205D2 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
            Download Yara Rule
            APIs
            • FormatMessageW.KERNEL32(?,00000E90,?,?), ref: 06020622
            Memory Dump Source
            • Source File: 00000000.00000002.1701921662.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_6020000_SecuriteInfo.jbxd
            Similarity
            • API ID: FormatMessage
            • String ID:
            • API String ID: 1306739567-0
            • Opcode ID: 321e6604387235e0e7dedd9633641f50a8753edbdf1f20d5c8db29fe904ef57f
            • Instruction ID: da5e3b31f2476fc57ad954fd8f90be09627b17c6c42299736b5f2dfbcf1c8af7
            • Opcode Fuzzy Hash: 321e6604387235e0e7dedd9633641f50a8753edbdf1f20d5c8db29fe904ef57f
            • Instruction Fuzzy Hash: 6201B171600200AFD310DF16CC45B66FBA8FF88A20F14811AEC089BB42D731F515CBE5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9B1EE Relevance: 1.5, APIs: 1, Instructions: 43COMMON
            Download Yara Rule
            APIs
            • setsockopt.WS2_32(?,?,?,?,?), ref: 02B9B22C
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: setsockopt
            • String ID:
            • API String ID: 3981526788-0
            • Opcode ID: 430164de773961d14205907dc55a5847827edb8cbcc0b40fc46457bd0376eb88
            • Instruction ID: 105e333c83966c7692de360847f1a74f59d01a78187a4d64f9cf05adae306618
            • Opcode Fuzzy Hash: 430164de773961d14205907dc55a5847827edb8cbcc0b40fc46457bd0376eb88
            • Instruction Fuzzy Hash: 38019E32500244DFDF21CF55E984B66FFA0EF04324F08C4AADE898B616C376E458CBA2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9A85E Relevance: 1.5, APIs: 1, Instructions: 43COMMON
            Download Yara Rule
            APIs
            • FindCloseChangeNotification.KERNEL32(?,53A479D2,00000000,?,?,?,?,?,?,?,?,6CAC3C58), ref: 02B9A890
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: ChangeCloseFindNotification
            • String ID:
            • API String ID: 2591292051-0
            • Opcode ID: ea67a834b78fe245ec8757575ff18a21551a6e4b739da77b36c0709fd250fc2a
            • Instruction ID: 83e692c6a1f02d77c833b73275c1e5c1e2395b524af323b660309cfa9e1a5935
            • Opcode Fuzzy Hash: ea67a834b78fe245ec8757575ff18a21551a6e4b739da77b36c0709fd250fc2a
            • Instruction Fuzzy Hash: 29018B71A002449FEB10CF69D9857A6FBA4EF05220F08C4EBDD498B656D379E458CEA2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9B04E Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNEL32(?,00000E90,?,?), ref: 02B9B09E
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: d2e4ee3714116860e8442a31e0c84dc607aba41f27cb635c8d0bb9422920b2a7
            • Instruction ID: 29387e73c05049630a450267bb5af39be2c972d1e1a8fbb0c03a8c76ca153a52
            • Opcode Fuzzy Hash: d2e4ee3714116860e8442a31e0c84dc607aba41f27cb635c8d0bb9422920b2a7
            • Instruction Fuzzy Hash: 7601A271500600AFD210DF16CC46B66FBA4FF88A20F14811AEC089BB42D771F525CBE5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B9A2FE Relevance: 1.5, APIs: 1, Instructions: 35COMMON
            Download Yara Rule
            APIs
            • SetErrorMode.KERNEL32(?,53A479D2,00000000,?,?,?,?,?,?,?,?,6CAC3C58), ref: 02B9A330
            Memory Dump Source
            • Source File: 00000000.00000002.1700410816.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b9a000_SecuriteInfo.jbxd
            Similarity
            • API ID: ErrorMode
            • String ID:
            • API String ID: 2340568224-0
            • Opcode ID: aba0f592c6c48d2cea37eb19d9734a1e20756cf4a2cd0c7492a8eab2768a134b
            • Instruction ID: bc4435ebfaca82164a87506e7929620906bc76836cc8cbdbdaef5b8c67d9eef1
            • Opcode Fuzzy Hash: aba0f592c6c48d2cea37eb19d9734a1e20756cf4a2cd0c7492a8eab2768a134b
            • Instruction Fuzzy Hash: 17F0AF35908244DFDB10CF19D984761FFA0EF04724F48C0EADD494B752D375E458CAA2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 007F7598 Relevance: 1.3, APIs: 1, Instructions: 21memoryCOMMON
            Download Yara Rule
            APIs
            • VirtualAlloc.KERNEL32(?,?,?,?), ref: 007F75C3
            Memory Dump Source
            • Source File: 00000000.00000002.1699455955.00000000007EB000.00000040.00000001.01000000.00000003.sdmp, Offset: 0068A000, based on PE: true
            • Associated: 00000000.00000002.1699455955.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
            • Associated: 00000000.00000002.1699455955.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
            • Associated: 00000000.00000002.1699455955.00000000007D0000.00000040.00000001.01000000.00000003.sdmpDownload File
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_670000_SecuriteInfo.jbxd
            Similarity
            • API ID: AllocVirtual
            • String ID:
            • API String ID: 4275171209-0
            • Opcode ID: e8a47d6897eea0bea155c997ddd50567f53c02cb72ff55de462b73a436089ae8
            • Instruction ID: 79af53c548a94752cd6cb2542ac4907676afbff9e6da4a32b51ea899590a6e8e
            • Opcode Fuzzy Hash: e8a47d6897eea0bea155c997ddd50567f53c02cb72ff55de462b73a436089ae8
            • Instruction Fuzzy Hash: 1CE02DB660420CABDB54CA9CD984FBA339EE798710F148421FA09D7745C638EC60DB65
            Uniqueness

            Uniqueness Score: -1.00%

            Function 036D05DF Relevance: .0, Instructions: 46COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000000.00000002.1701031864.00000000036D0000.00000040.00000020.00020000.00000000.sdmp, Offset: 036D0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_36d0000_SecuriteInfo.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 87cd0efe15c0391e1d54db2029e22b1fee55885764961d9cba1e2ec2680fe2da
            • Instruction ID: 85bacc4872529be8062061e25fdd1ad1c6d5fdd10cd2f87a838a0cb2598c4ac2
            • Opcode Fuzzy Hash: 87cd0efe15c0391e1d54db2029e22b1fee55885764961d9cba1e2ec2680fe2da
            • Instruction Fuzzy Hash: 0A018B765097906FD7128B15AC40862FFB8EF46620749C4DFEC498B652D125B909C772
            Uniqueness

            Uniqueness Score: -1.00%

            Function 036D0606 Relevance: .0, Instructions: 27COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000000.00000002.1701031864.00000000036D0000.00000040.00000020.00020000.00000000.sdmp, Offset: 036D0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_36d0000_SecuriteInfo.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: a2dafeac508cffe2e659e5bbfaf404072269e4b9017395f4402d76a1d44e8265
            • Instruction ID: 83cbc2c124ff6cb8dcff45c4b827204050e4396a93b2a778a46560b883f5fb5a
            • Opcode Fuzzy Hash: a2dafeac508cffe2e659e5bbfaf404072269e4b9017395f4402d76a1d44e8265
            • Instruction Fuzzy Hash: 49E092766006444FD650CF0AEC41452F794EB84630B48C07FDC1D8BB11D236F518CAA5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B923F4 Relevance: .0, Instructions: 15COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000000.00000002.1700399296.0000000002B92000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B92000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b92000_SecuriteInfo.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: c3ed2f73d53f6f10332720fe6241224d8453f2ff5f8dba652da1970aa5dd93fd
            • Instruction ID: 55752d5194b83bcaaeecd14a253f623941296cab59c1f111b880229e7bc380e6
            • Opcode Fuzzy Hash: c3ed2f73d53f6f10332720fe6241224d8453f2ff5f8dba652da1970aa5dd93fd
            • Instruction Fuzzy Hash: 72D05EB96046C15FE7168A1CC2A9F9537D4AB6270CF4A84F9EC408B7A3C768D986D240
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B923BC Relevance: .0, Instructions: 14COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000000.00000002.1700399296.0000000002B92000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B92000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_2b92000_SecuriteInfo.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 08253222e3c029aea7cc43c6a3cba1f0aa3a2e5f2beb165ecc56f767b851e6ca
            • Instruction ID: d83fad2a0e0ddc142c94242a279db2dcef98e20117f183ea2a255b8ab08d46ad
            • Opcode Fuzzy Hash: 08253222e3c029aea7cc43c6a3cba1f0aa3a2e5f2beb165ecc56f767b851e6ca
            • Instruction Fuzzy Hash: ACD05E346045814FDB15CA0CC2D4F5937D4AB40708F1684F8BC108B762C3B4D8C5CA00
            Uniqueness

            Uniqueness Score: -1.00%

            Non-executed Functions

            Function 007F796C Relevance: 2.3, Strings: 1, Instructions: 1095COMMON
            Download Yara Rule
            Strings
            Memory Dump Source
            • Source File: 00000000.00000002.1699455955.00000000007EB000.00000040.00000001.01000000.00000003.sdmp, Offset: 0068A000, based on PE: true
            • Associated: 00000000.00000002.1699455955.000000000068A000.00000040.00000001.01000000.00000003.sdmpDownload File
            • Associated: 00000000.00000002.1699455955.00000000007CB000.00000040.00000001.01000000.00000003.sdmpDownload File
            • Associated: 00000000.00000002.1699455955.00000000007D0000.00000040.00000001.01000000.00000003.sdmpDownload File
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_0_2_670000_SecuriteInfo.jbxd
            Similarity
            • API ID:
            • String ID: ~
            • API String ID: 0-2274147217
            • Opcode ID: 335ff83732763563f1e9f54d04d575c2aa99fb59dec411d53d59069cf5080a5e
            • Instruction ID: 25fed37d96da35cf1b62f67ef358925c7a67cef9a2e6fe6d1df303481907dcbf
            • Opcode Fuzzy Hash: 335ff83732763563f1e9f54d04d575c2aa99fb59dec411d53d59069cf5080a5e
            • Instruction Fuzzy Hash: 2391449290D2C84FC7A34B684DA62B53F709E63201B5A06DBC681CF7A3D91D9D1BC367
            Uniqueness

            Uniqueness Score: -1.00%

            Execution Graph

            Execution Coverage:27.9%
            Dynamic/Decrypted Code Coverage:100%
            Signature Coverage:5.3%
            Total number of Nodes:247
            Total number of Limit Nodes:7
            execution_graph 4896 2daa459 4898 2daa49a RegQueryValueExW 4896->4898 4899 2daa523 4898->4899 4613 2dabb5e 4616 2dabb96 CreateMutexW 4613->4616 4615 2dabbd9 4616->4615 4629 2e80460 4630 2e8046e 4629->4630 4633 2e80628 4630->4633 4634 2e80675 4633->4634 4635 2e80480 4634->4635 4645 2e809f0 4634->4645 4668 2e80d1c 4634->4668 4672 2e80c0c 4634->4672 4676 2e80c69 4634->4676 4680 2e80a68 4634->4680 4692 2e80d87 4634->4692 4696 2e80dd5 4634->4696 4700 2e80c45 4634->4700 4704 2e809e2 4634->4704 4646 2e80a1e 4645->4646 4647 2e80e46 4645->4647 4658 2e80a68 2 API calls 4646->4658 4659 2e80c69 2 API calls 4646->4659 4660 2e80c0c 2 API calls 4646->4660 4661 2e80d1c 2 API calls 4646->4661 4662 2e809f0 2 API calls 4646->4662 4663 2e809e2 2 API calls 4646->4663 4664 2e80c45 2 API calls 4646->4664 4665 2e80dd5 2 API calls 4646->4665 4666 2e80d87 2 API calls 4646->4666 4648 2e80a35 4650 2e80ad7 4648->4650 4727 2e81aec 4648->4727 4731 2e819b1 4648->4731 4735 2e819dc 4648->4735 4739 2e81bf4 4648->4739 4743 2e81a77 4648->4743 4747 2e817c8 4648->4747 4751 2e81b54 4648->4751 4649 2e80edf 4649->4635 4650->4649 4755 2e81eef 4650->4755 4658->4648 4659->4648 4660->4648 4661->4648 4662->4648 4663->4648 4664->4648 4665->4648 4666->4648 4669 2e80c1d 4668->4669 4670 2e80edf 4669->4670 4671 2e81eef 2 API calls 4669->4671 4670->4635 4671->4669 4674 2e80c13 4672->4674 4673 2e80edf 4673->4635 4674->4673 4675 2e81eef 2 API calls 4674->4675 4675->4674 4677 2e80c1d 4676->4677 4678 2e80edf 4677->4678 4679 2e81eef 2 API calls 4677->4679 4678->4635 4679->4677 4681 2e80a6f 4680->4681 4683 2e80ad7 4681->4683 4685 2e817c8 2 API calls 4681->4685 4686 2e81aec 2 API calls 4681->4686 4687 2e819dc 2 API calls 4681->4687 4688 2e819b1 2 API calls 4681->4688 4689 2e81b54 2 API calls 4681->4689 4690 2e81bf4 2 API calls 4681->4690 4691 2e81a77 2 API calls 4681->4691 4682 2e80edf 4682->4635 4683->4682 4684 2e81eef 2 API calls 4683->4684 4684->4683 4685->4683 4686->4683 4687->4683 4688->4683 4689->4683 4690->4683 4691->4683 4694 2e80c1d 4692->4694 4693 2e80edf 4693->4635 4694->4693 4695 2e81eef 2 API calls 4694->4695 4695->4694 4697 2e80c1d 4696->4697 4698 2e80edf 4697->4698 4699 2e81eef 2 API calls 4697->4699 4698->4635 4699->4697 4702 2e80c1d 4700->4702 4701 2e80edf 4701->4635 4702->4701 4703 2e81eef 2 API calls 4702->4703 4703->4702 4705 2e809f0 4704->4705 4706 2e80e46 4705->4706 4710 2e80a68 2 API calls 4705->4710 4711 2e80c69 2 API calls 4705->4711 4712 2e80c0c 2 API calls 4705->4712 4713 2e80d1c 2 API calls 4705->4713 4714 2e809f0 2 API calls 4705->4714 4715 2e809e2 2 API calls 4705->4715 4716 2e80c45 2 API calls 4705->4716 4717 2e80dd5 2 API calls 4705->4717 4718 2e80d87 2 API calls 4705->4718 4707 2e80a35 4708 2e80ad7 4707->4708 4720 2e817c8 2 API calls 4707->4720 4721 2e81aec 2 API calls 4707->4721 4722 2e819dc 2 API calls 4707->4722 4723 2e819b1 2 API calls 4707->4723 4724 2e81b54 2 API calls 4707->4724 4725 2e81bf4 2 API calls 4707->4725 4726 2e81a77 2 API calls 4707->4726 4709 2e80edf 4708->4709 4719 2e81eef 2 API calls 4708->4719 4709->4635 4710->4707 4711->4707 4712->4707 4713->4707 4714->4707 4715->4707 4716->4707 4717->4707 4718->4707 4719->4708 4720->4708 4721->4708 4722->4708 4723->4708 4724->4708 4725->4708 4726->4708 4728 2e81af3 4727->4728 4729 2e81c1c 4728->4729 4730 2e81eef 2 API calls 4728->4730 4729->4650 4730->4729 4733 2e819b8 4731->4733 4732 2e81c1c 4732->4650 4733->4732 4734 2e81eef 2 API calls 4733->4734 4734->4732 4736 2e819e3 4735->4736 4737 2e81c1c 4736->4737 4738 2e81eef 2 API calls 4736->4738 4737->4650 4738->4737 4740 2e81bfb 4739->4740 4741 2e81c1c 4740->4741 4742 2e81eef 2 API calls 4740->4742 4741->4650 4742->4741 4745 2e81a7e 4743->4745 4744 2e81c1c 4744->4650 4745->4744 4746 2e81eef 2 API calls 4745->4746 4746->4744 4749 2e81801 4747->4749 4748 2e81c1c 4748->4650 4749->4748 4750 2e81eef 2 API calls 4749->4750 4750->4748 4753 2e81b5b 4751->4753 4752 2e81c1c 4752->4650 4753->4752 4754 2e81eef 2 API calls 4753->4754 4754->4752 4756 2e820ff 4755->4756 4757 2e81f2a 4755->4757 4756->4650 4757->4756 4760 5fc0aba 4757->4760 4764 5fc0a96 4757->4764 4763 5fc0ae0 GetDriveTypeW 4760->4763 4762 5fc0afc 4762->4757 4763->4762 4765 5fc0aba GetDriveTypeW 4764->4765 4767 5fc0afc 4765->4767 4767->4757 4864 2daa2d2 4865 2daa2d6 SetErrorMode 4864->4865 4867 2daa33f 4865->4867 4936 5fc14f5 4937 5fc1526 GetExitCodeProcess 4936->4937 4939 5fc1584 4937->4939 4940 5fc08f0 4942 5fc0912 CopyFileW 4940->4942 4943 5fc0962 4942->4943 4900 5fc1373 4901 5fc137d AdjustTokenPrivileges 4900->4901 4903 5fc13fb 4901->4903 4956 5fc2073 4957 5fc2096 SetProcessWorkingSetSize 4956->4957 4959 5fc20f7 4957->4959 4868 5fc11ef 4870 5fc122a LookupPrivilegeValueW 4868->4870 4871 5fc127a 4870->4871 4944 2dab7c2 4945 2dab7e2 MapViewOfFile 4944->4945 4947 2dab869 4945->4947 4803 5fc0b66 4804 5fc0b8f SetFileAttributesW 4803->4804 4806 5fc0bab 4804->4806 4811 2daaa46 4812 2daaa7e CreateFileW 4811->4812 4814 2daaacd 4812->4814 4827 2daa2fe 4828 2daa32a SetErrorMode 4827->4828 4829 2daa353 4827->4829 4830 2daa33f 4828->4830 4829->4828 4948 2daadfe 4949 2daae1e ReadFile 4948->4949 4951 2daae85 4949->4951 4839 2daa172 EnumWindows 4840 2daa1c4 4839->4840 4960 2daaf73 4961 2daaf95 WSASocketW 4960->4961 4963 2dab036 4961->4963 4872 2dabef0 4873 2dabf0e GetProcessTimes 4872->4873 4875 2dabf95 4873->4875 4876 5fc19c4 4878 5fc1a02 DuplicateHandle 4876->4878 4879 5fc1a4e 4878->4879 4952 5fc02c6 4954 5fc02f6 WSAConnect 4952->4954 4955 5fc034a 4954->4955 4968 2daa361 4969 2daa392 RegOpenKeyExW 4968->4969 4971 2daa420 4969->4971 4908 5fc0542 4909 5fc0562 SendMessageTimeoutA 4908->4909 4911 5fc05e5 4909->4911 4912 5fc2142 4915 5fc217a K32EnumProcesses 4912->4915 4914 5fc21c2 4915->4914 4605 5fc223e 4606 5fc2273 NtQuerySystemInformation 4605->4606 4608 5fc229e 4605->4608 4607 5fc2288 4606->4607 4608->4606 4609 2daae1e 4611 2daae53 ReadFile 4609->4611 4612 2daae85 4611->4612 4972 2daab1c 4974 2daab5e GetFileType 4972->4974 4975 2daabc0 4974->4975 4916 5fc0b32 4917 5fc0b66 SetFileAttributesW 4916->4917 4919 5fc0bab 4917->4919 4920 2daaa0f 4922 2daaa46 CreateFileW 4920->4922 4923 2daaacd 4922->4923 4787 5fc13aa 4789 5fc13d9 AdjustTokenPrivileges 4787->4789 4790 5fc13fb 4789->4790 4924 2dab60c 4926 2dab632 ConvertStringSecurityDescriptorToSecurityDescriptorW 4924->4926 4927 2dab6ab 4926->4927 4976 2daa70c 4977 2daa73a FindCloseChangeNotification 4976->4977 4979 2daa774 4977->4979 4799 5fc07a6 4800 5fc080b 4799->4800 4801 5fc07d5 WaitForInputIdle 4799->4801 4800->4801 4802 5fc07e3 4801->4802 4823 2daa73a 4824 2daa766 FindCloseChangeNotification 4823->4824 4825 2daa7a5 4823->4825 4826 2daa774 4824->4826 4825->4824 4928 2daa632 4930 2daa652 RegSetValueExW 4928->4930 4931 2daa6d3 4930->4931 4980 2dabb31 4981 2dabb5e CreateMutexW 4980->4981 4983 2dabbd9 4981->4983 4848 5fc0912 4851 5fc093b CopyFileW 4848->4851 4850 5fc0962 4851->4850 4932 2e80006 4933 2e8000b 4932->4933 4934 2e80c45 2 API calls 4933->4934 4935 2e80043 4934->4935 4884 5fc1f8b 4886 5fc1fb2 GetProcessWorkingSetSize 4884->4886 4887 5fc2013 4886->4887 4888 5fc0784 4891 5fc07a6 WaitForInputIdle 4888->4891 4890 5fc07e3 4891->4890 4984 5fc0006 4986 5fc0032 getaddrinfo 4984->4986 4987 5fc00df 4986->4987 4988 2daa120 4989 2daa172 EnumWindows 4988->4989 4990 2daa1c4 4989->4990 4860 5fc1a02 4861 5fc1a78 4860->4861 4862 5fc1a40 DuplicateHandle 4860->4862 4861->4862 4863 5fc1a4e 4862->4863 4892 5fc0382 4893 5fc03bc FormatMessageW 4892->4893 4895 5fc0446 4893->4895 4995 5fc2203 4998 5fc2215 NtQuerySystemInformation 4995->4998 4997 5fc2288 4998->4997

            Executed Functions

            Function 05FC1373 Relevance: 1.6, APIs: 1, Instructions: 75COMMON
            Download Yara Rule
            APIs
            • AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 05FC13F3
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: AdjustPrivilegesToken
            • String ID:
            • API String ID: 2874748243-0
            • Opcode ID: d2d82933b563af830420563992d1ca868bc063dce8234178a8e7357c09096a65
            • Instruction ID: 69ba343e7e86e2f8160963cd1301a12918ff6004f221775c7e72e5b544bc7da1
            • Opcode Fuzzy Hash: d2d82933b563af830420563992d1ca868bc063dce8234178a8e7357c09096a65
            • Instruction Fuzzy Hash: D721D1755097809FDB228F25DC40F62BFB4FF06310F0884EAE9858F563D2759918CB62
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC2203 Relevance: 1.6, APIs: 1, Instructions: 64nativeCOMMON
            Download Yara Rule
            APIs
            • NtQuerySystemInformation.NTDLL ref: 05FC2279
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: InformationQuerySystem
            • String ID:
            • API String ID: 3562636166-0
            • Opcode ID: 90ae42a282cd97be743e5330a9ab269876ed7c4c431b08a88b38870aa9661d21
            • Instruction ID: 9f80244862dd81e0a5b0b6aaaaf2fc25a90cb9d1e0878f92962300f76b12dc67
            • Opcode Fuzzy Hash: 90ae42a282cd97be743e5330a9ab269876ed7c4c431b08a88b38870aa9661d21
            • Instruction Fuzzy Hash: 5D21A1754097C0AFDB238B21DC45A52FFB0FF07314F0984DBE9854B163D265A519DB62
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC13AA Relevance: 1.6, APIs: 1, Instructions: 52COMMON
            Download Yara Rule
            APIs
            • AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 05FC13F3
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: AdjustPrivilegesToken
            • String ID:
            • API String ID: 2874748243-0
            • Opcode ID: a6e69857f73b24ebd389d4daa5a5dc74f752b893eb77425ae086cb6073b53bd2
            • Instruction ID: ebe08567da551502f641aef15afacec044e6dc8f7a5aaa017f714b29a53b7301
            • Opcode Fuzzy Hash: a6e69857f73b24ebd389d4daa5a5dc74f752b893eb77425ae086cb6073b53bd2
            • Instruction Fuzzy Hash: F3119E36A003049FDB20CF55D984F66FBE4FF04620F0884AEDD498BA12D375E458CB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC223E Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON
            Download Yara Rule
            APIs
            • NtQuerySystemInformation.NTDLL ref: 05FC2279
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: InformationQuerySystem
            • String ID:
            • API String ID: 3562636166-0
            • Opcode ID: 4b38669d12023936d8ed48497bc8e32ba176b4a8fa96c4c3b313a905dee1d05f
            • Instruction ID: 6898bc7f7d5b9aa6f96c1efa8c10fbf5760e41804c11467c94bedf765e498c5b
            • Opcode Fuzzy Hash: 4b38669d12023936d8ed48497bc8e32ba176b4a8fa96c4c3b313a905dee1d05f
            • Instruction Fuzzy Hash: FF018F369007449FEB20CF05D944BA1FFA5FF05724F08C4AEDE8A0A616D375E458CB62
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E82977 Relevance: .2, Instructions: 193COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: ed8359168496172cc1fb21204ce0bfb9f869a942134df49783ad18d570f3d7aa
            • Instruction ID: dfd0f59ccb4850522e8375af8bf50ba879a5783ceefa90ff68f69580c03f3351
            • Opcode Fuzzy Hash: ed8359168496172cc1fb21204ce0bfb9f869a942134df49783ad18d570f3d7aa
            • Instruction Fuzzy Hash: 81514471B002049BDB58EBB59866BAEB7E3EF88304F148435D509EB394DF349C158B95
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E80006 Relevance: .2, Instructions: 191COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 0706677995e15e90c67b6a5a23b7fb511e9adb601dd3d18fff9c28c35a011cea
            • Instruction ID: ff78aa50b5e411654b7b9a5f86e6e44f4f1a61bb61296df40f5e17ec83cbd5a8
            • Opcode Fuzzy Hash: 0706677995e15e90c67b6a5a23b7fb511e9adb601dd3d18fff9c28c35a011cea
            • Instruction Fuzzy Hash: 818102B0D05248DFCB45DFA5D990ADDBBB2EF8A304F2480AAC449AB365DB355D09CF50
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAAA0F Relevance: 1.6, APIs: 1, Instructions: 98fileCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 0 2daaa0f-2daaa9e 4 2daaaa3-2daaaaf 0->4 5 2daaaa0 0->5 6 2daaab1 4->6 7 2daaab4-2daaabd 4->7 5->4 6->7 8 2daab0e-2daab13 7->8 9 2daaabf-2daaae3 CreateFileW 7->9 8->9 12 2daab15-2daab1a 9->12 13 2daaae5-2daab0b 9->13 12->13
            APIs
            • CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 02DAAAC5
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: CreateFile
            • String ID:
            • API String ID: 823142352-0
            • Opcode ID: b475675e7f82648166e898fdb72f529e582ca732db9805b2e86646db78f41fdb
            • Instruction ID: b27ec96271352cf0f82ee4feee8a59ff5931a8290a7438c9553bdcfefd02d8db
            • Opcode Fuzzy Hash: b475675e7f82648166e898fdb72f529e582ca732db9805b2e86646db78f41fdb
            • Instruction Fuzzy Hash: 6031A4715053806FE722CF25DC44FA6BFF8EF06214F08859AE9858B652D375E909CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC0006 Relevance: 1.6, APIs: 1, Instructions: 97COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 16 5fc0006-5fc0067 18 5fc006d-5fc0081 16->18 19 5fc0087-5fc00cf 18->19 22 5fc0121-5fc0126 19->22 23 5fc00d1-5fc00d9 getaddrinfo 19->23 22->23 25 5fc00df-5fc00f1 23->25 26 5fc0128-5fc012d 25->26 27 5fc00f3-5fc011e 25->27 26->27
            APIs
            • getaddrinfo.WS2_32(?,00000E90), ref: 05FC00D7
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: getaddrinfo
            • String ID:
            • API String ID: 300660673-0
            • Opcode ID: 8a5e44a9fff7b80d2750835a6ce6a7eecdc6fa60b086473a37031167f759fbbc
            • Instruction ID: b6ad675176d0671a0e3738fa49d567aab29396f81aca0301f95c481ceff981ec
            • Opcode Fuzzy Hash: 8a5e44a9fff7b80d2750835a6ce6a7eecdc6fa60b086473a37031167f759fbbc
            • Instruction Fuzzy Hash: 1931D571504340AFE721CF60CC44FAAFBACEF05714F04449AF9889B292D3B5A949CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAAF73 Relevance: 1.6, APIs: 1, Instructions: 96networkCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 31 2daaf73-2daaf93 32 2daafb5-2daaff4 31->32 33 2daaf95-2daafb2 31->33 36 2daaffa-2dab006 32->36 33->32 37 2dab00c-2dab026 36->37 38 2dab028-2dab030 WSASocketW 37->38 39 2dab077-2dab07c 37->39 40 2dab036-2dab04c 38->40 39->38 42 2dab07e-2dab083 40->42 43 2dab04e-2dab074 40->43 42->43
            APIs
            • WSASocketW.WS2_32(?,?,?,?,?), ref: 02DAB02E
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: Socket
            • String ID:
            • API String ID: 38366605-0
            • Opcode ID: b3e505bcc1f672be12815e3b429071bb636cb6b77b6ed6a7d3e5cea2c0d83016
            • Instruction ID: 8d792c4f6ae0828b362c210738572144452aeee5bfa87502742ccb49d347a2ed
            • Opcode Fuzzy Hash: b3e505bcc1f672be12815e3b429071bb636cb6b77b6ed6a7d3e5cea2c0d83016
            • Instruction Fuzzy Hash: 4E31A3710097C09FE7128B61CC55B56BFB4EF07214F0988DBE9858F2A3C365A809CB72
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC0382 Relevance: 1.6, APIs: 1, Instructions: 91windowCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 46 5fc0382-5fc03eb 48 5fc03ee-5fc0440 FormatMessageW 46->48 50 5fc0446-5fc046f 48->50
            APIs
            • FormatMessageW.KERNELBASE(?,00000E90,?,?), ref: 05FC043E
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: FormatMessage
            • String ID:
            • API String ID: 1306739567-0
            • Opcode ID: f70bfccab04151e4695e650feada282dbf04f6cbbc3df611abd552e3dbeb51c3
            • Instruction ID: d01ef83f9c8cc532982c7c6e2c27454439a4ff34187689c66fe0e1228aa9fce1
            • Opcode Fuzzy Hash: f70bfccab04151e4695e650feada282dbf04f6cbbc3df611abd552e3dbeb51c3
            • Instruction Fuzzy Hash: 7F317C7254D3C05FD7038B618C61AA6BFB4EF47610F1984CBD8C48F2A3D624A919C7A2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAA361 Relevance: 1.6, APIs: 1, Instructions: 90registryCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 52 2daa361-2daa3ed 56 2daa3ef 52->56 57 2daa3f2-2daa409 52->57 56->57 59 2daa44b-2daa450 57->59 60 2daa40b-2daa41e RegOpenKeyExW 57->60 59->60 61 2daa452-2daa457 60->61 62 2daa420-2daa448 60->62 61->62
            APIs
            • RegOpenKeyExW.KERNELBASE(?,00000E90), ref: 02DAA411
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: Open
            • String ID:
            • API String ID: 71445658-0
            • Opcode ID: fb3af9f0d38961f934f39e5a25fce295ff63281c6fd0e55f1909b438cd171818
            • Instruction ID: 63c68d40437ec80874734a0b5277bfdf0f086b080ced0c15716806d445891205
            • Opcode Fuzzy Hash: fb3af9f0d38961f934f39e5a25fce295ff63281c6fd0e55f1909b438cd171818
            • Instruction Fuzzy Hash: 1431A471509380AFE7218F51CC44FAABFBCEF05214F04859BE9858B652D364E94DCB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAA459 Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 67 2daa459-2daa4d7 70 2daa4d9 67->70 71 2daa4dc-2daa4e5 67->71 70->71 72 2daa4ea-2daa4f0 71->72 73 2daa4e7 71->73 74 2daa4f2 72->74 75 2daa4f5-2daa50c 72->75 73->72 74->75 77 2daa50e-2daa521 RegQueryValueExW 75->77 78 2daa543-2daa548 75->78 79 2daa54a-2daa54f 77->79 80 2daa523-2daa540 77->80 78->77 79->80
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 02DAA514
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 622e249f358cb4379519b164c81a2e137d905fc127df1c2a4681d0b38f27c69c
            • Instruction ID: aed6e8458104e8dee8926f46a086416525e3ea02b837180de1134b96429784c2
            • Opcode Fuzzy Hash: 622e249f358cb4379519b164c81a2e137d905fc127df1c2a4681d0b38f27c69c
            • Instruction Fuzzy Hash: D13191765093805FD722CF21CC54FA6BFB8EF06614F08859AE9898B252D364E948CB75
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DABEF0 Relevance: 1.6, APIs: 1, Instructions: 89timeCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 99 2dabef0-2dabf85 104 2dabfd2-2dabfd7 99->104 105 2dabf87-2dabf8f GetProcessTimes 99->105 104->105 107 2dabf95-2dabfa7 105->107 108 2dabfd9-2dabfde 107->108 109 2dabfa9-2dabfcf 107->109 108->109
            APIs
            • GetProcessTimes.KERNELBASE(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 02DABF8D
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: ProcessTimes
            • String ID:
            • API String ID: 1995159646-0
            • Opcode ID: 5733a9bb1dfc8fdf81473cce4df58808b9bc1adea5c49e26cf4d300e40dea728
            • Instruction ID: 0c9acad0643ad3cdb1d2cac949a773e3aff994bca5341320be5631677c184e5a
            • Opcode Fuzzy Hash: 5733a9bb1dfc8fdf81473cce4df58808b9bc1adea5c49e26cf4d300e40dea728
            • Instruction Fuzzy Hash: AC31C5725097806FDB128F60DC45F96BFB8EF06314F0884DAE9858B193D325A909CB75
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAB60C Relevance: 1.6, APIs: 1, Instructions: 89COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 84 2dab60c-2dab68d 88 2dab68f 84->88 89 2dab692-2dab69b 84->89 88->89 90 2dab69d-2dab6a5 ConvertStringSecurityDescriptorToSecurityDescriptorW 89->90 91 2dab6f3-2dab6f8 89->91 93 2dab6ab-2dab6bd 90->93 91->90 94 2dab6fa-2dab6ff 93->94 95 2dab6bf-2dab6f0 93->95 94->95
            APIs
            • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E90), ref: 02DAB6A3
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: DescriptorSecurity$ConvertString
            • String ID:
            • API String ID: 3907675253-0
            • Opcode ID: 2fecb8d5bcd2539fd4144b1223d61dd9867316c539b1d3106b8e42a31fd5e0e8
            • Instruction ID: 1ac1905d233d237c7bab93eeeaa7f265165f0a4a69bd4cf9791e866a561c7b65
            • Opcode Fuzzy Hash: 2fecb8d5bcd2539fd4144b1223d61dd9867316c539b1d3106b8e42a31fd5e0e8
            • Instruction Fuzzy Hash: 0D31BF71504380AFEB21CB65DC45FAABFB8EF06214F08849AE984CB652D364E909CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DABB31 Relevance: 1.6, APIs: 1, Instructions: 85synchronizationCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 112 2dabb31-2dabbad 116 2dabbaf 112->116 117 2dabbb2-2dabbbb 112->117 116->117 118 2dabbbd 117->118 119 2dabbc0-2dabbc9 117->119 118->119 120 2dabc1a-2dabc1f 119->120 121 2dabbcb-2dabbef CreateMutexW 119->121 120->121 124 2dabc21-2dabc26 121->124 125 2dabbf1-2dabc17 121->125 124->125
            APIs
            • CreateMutexW.KERNELBASE(?,?), ref: 02DABBD1
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: CreateMutex
            • String ID:
            • API String ID: 1964310414-0
            • Opcode ID: f425b4665cb0f5049c03659c408f1f05fe7560ac9ffc40c7345f223787d5847b
            • Instruction ID: d2f15665896eb6b0f4ce6370335fba8607045a7dca94185c88cc3db4c64674c4
            • Opcode Fuzzy Hash: f425b4665cb0f5049c03659c408f1f05fe7560ac9ffc40c7345f223787d5847b
            • Instruction Fuzzy Hash: D93184B1505380AFE711CF25CC55FA6FFB8EF05214F08849AE988CB252D365E949CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC0032 Relevance: 1.6, APIs: 1, Instructions: 84COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 128 5fc0032-5fc00cf 133 5fc0121-5fc0126 128->133 134 5fc00d1-5fc00d9 getaddrinfo 128->134 133->134 136 5fc00df-5fc00f1 134->136 137 5fc0128-5fc012d 136->137 138 5fc00f3-5fc011e 136->138 137->138
            APIs
            • getaddrinfo.WS2_32(?,00000E90), ref: 05FC00D7
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: getaddrinfo
            • String ID:
            • API String ID: 300660673-0
            • Opcode ID: b33fd024e154c91e361b037a5a6467f0045b6a855818bc9232bd8fc7d6690c2b
            • Instruction ID: 0a8a2fd8a90a2d5aa83d8392e1abd7e13852def26621be7c3a08b4140034c550
            • Opcode Fuzzy Hash: b33fd024e154c91e361b037a5a6467f0045b6a855818bc9232bd8fc7d6690c2b
            • Instruction Fuzzy Hash: CF21D371600305AEEB20DF60CD84FBAFBACEF04714F04489AFA489B681D7B5A5498B71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAA120 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 142 2daa120-2daa16f 143 2daa172-2daa1bd EnumWindows 142->143 144 2daa1c4-2daa1f3 143->144
            APIs
            • EnumWindows.USER32(?,00000E90,?,?), ref: 02DAA1BD
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: EnumWindows
            • String ID:
            • API String ID: 1129996299-0
            • Opcode ID: b3d650b6d4acca49fbc08281ac212f766922baaf21b7488dfb27edcb04a4df7d
            • Instruction ID: 10bbac3b58ddd9a9210a63108e88db68d61e429917edb9720241eb911a1b3431
            • Opcode Fuzzy Hash: b3d650b6d4acca49fbc08281ac212f766922baaf21b7488dfb27edcb04a4df7d
            • Instruction Fuzzy Hash: 3921A37150D3C05FD3028B258C61BA6BFB4EF87610F1985DBD8C4DF693D225A919C7A2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAAB1C Relevance: 1.6, APIs: 1, Instructions: 80COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 147 2daab1c-2daaba9 151 2daabab-2daabbe GetFileType 147->151 152 2daabde-2daabe3 147->152 153 2daabc0-2daabdd 151->153 154 2daabe5-2daabea 151->154 152->151 154->153
            APIs
            • GetFileType.KERNELBASE(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 02DAABB1
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileType
            • String ID:
            • API String ID: 3081899298-0
            • Opcode ID: faef0dab827cbeb70e94a945032332f1b77994ee2831fbd52b0b78b93c62bb94
            • Instruction ID: 3c15c1a4e09c34dfba95c7bde35bd686673abfe69c2262a57f4418075efa715f
            • Opcode Fuzzy Hash: faef0dab827cbeb70e94a945032332f1b77994ee2831fbd52b0b78b93c62bb94
            • Instruction Fuzzy Hash: 9A2128755093806FD7128B21DC45BA2BFBCEF47724F0881D6E9848B253D264A909C775
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC14F5 Relevance: 1.6, APIs: 1, Instructions: 79COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 158 5fc14f5-5fc1574 162 5fc15bf-5fc15c4 158->162 163 5fc1576-5fc157e GetExitCodeProcess 158->163 162->163 164 5fc1584-5fc1596 163->164 166 5fc1598-5fc15be 164->166 167 5fc15c6-5fc15cb 164->167 167->166
            APIs
            • GetExitCodeProcess.KERNELBASE(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 05FC157C
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: CodeExitProcess
            • String ID:
            • API String ID: 3861947596-0
            • Opcode ID: 11a828eeedc291d4b68c5e476a4c8f1825c565e6853cf63002955cebae825ea8
            • Instruction ID: e0427e116918d1495191728b087cdac1d23587e7912e882af2e8e12e5492a66d
            • Opcode Fuzzy Hash: 11a828eeedc291d4b68c5e476a4c8f1825c565e6853cf63002955cebae825ea8
            • Instruction Fuzzy Hash: 8F2192715093806FE712CB25DC45FA6BFA8EF46314F0884EAE985DB293D264A908C775
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAB7C2 Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 174 2dab7c2-2dab84e 179 2dab892-2dab897 174->179 180 2dab850-2dab867 MapViewOfFile 174->180 179->180 181 2dab899-2dab89e 180->181 182 2dab869-2dab88f 180->182 181->182
            APIs
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileView
            • String ID:
            • API String ID: 3314676101-0
            • Opcode ID: 018a59fe2a8e28f074aebfc0de6cb8d75a8fe18a26b09b8cf0dbe9425fe49884
            • Instruction ID: fa40a484686b80a6e9f74b841373548f6a5a9df3d45e15c5a3a2ed3a73941eb1
            • Opcode Fuzzy Hash: 018a59fe2a8e28f074aebfc0de6cb8d75a8fe18a26b09b8cf0dbe9425fe49884
            • Instruction Fuzzy Hash: 2221A071405380AFE722CF15CC44F96FFB8EF05214F04889AE9898B252D365E508CB65
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAA56A Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 170 2daa56a-2daa5b3 171 2daa5b6-2daa60e RegQueryValueExW 170->171 173 2daa614-2daa62a 171->173
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,?,?), ref: 02DAA606
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 6e41d3606dfd7ef86d383700a9a25a779871da69a6277e2cdf9cc01f3509b074
            • Instruction ID: 3edc0fc824e212965ce72189e9cecde65032af262d5908c6ef8547df2139e42a
            • Opcode Fuzzy Hash: 6e41d3606dfd7ef86d383700a9a25a779871da69a6277e2cdf9cc01f3509b074
            • Instruction Fuzzy Hash: 5921F8755093C06FC3138B25CC51B72BFB4EF87A10F0981CBE8888B653D225A919C7B2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC11EF Relevance: 1.6, APIs: 1, Instructions: 76COMMON
            Download Yara Rule
            APIs
            • LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 05FC1272
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: LookupPrivilegeValue
            • String ID:
            • API String ID: 3899507212-0
            • Opcode ID: 37228f1625a6ef3ede77f3c646841f332188a190a12b263612167ee994c9f4d7
            • Instruction ID: 01f764d203acd73839b1f69aae5148a4e0f075c930983804e88b382a264980cd
            • Opcode Fuzzy Hash: 37228f1625a6ef3ede77f3c646841f332188a190a12b263612167ee994c9f4d7
            • Instruction Fuzzy Hash: B72160759093C15FDB128F25DC50BA2BFB8EF47624F0884EAE885CB253D265A418C771
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC0542 Relevance: 1.6, APIs: 1, Instructions: 76windowtimeCOMMON
            Download Yara Rule
            APIs
            • SendMessageTimeoutA.USER32(?,00000E90), ref: 05FC05DD
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: MessageSendTimeout
            • String ID:
            • API String ID: 1599653421-0
            • Opcode ID: 4137399c5a95ca61cb606b1895597eb440345226405d0167035f0aa40e82fbb1
            • Instruction ID: 0fad976e0714ee45b8719caa9e496aef7397d12df1cde9c7599568f4a2bb44d8
            • Opcode Fuzzy Hash: 4137399c5a95ca61cb606b1895597eb440345226405d0167035f0aa40e82fbb1
            • Instruction Fuzzy Hash: 7521E071504380AFEB228F51CC44FAAFFB8EF45310F08889AE9898A652D375A508CB75
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAAA46 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON
            Download Yara Rule
            APIs
            • CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 02DAAAC5
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: CreateFile
            • String ID:
            • API String ID: 823142352-0
            • Opcode ID: 1e09d281de4f02529e7732a27a6467a26121223a1876bf09489b22c383a96606
            • Instruction ID: 8615fac6af8b60263fa5f5dbbd67a55e35c19c60e92003a3dc2fc0c6fca3610a
            • Opcode Fuzzy Hash: 1e09d281de4f02529e7732a27a6467a26121223a1876bf09489b22c383a96606
            • Instruction Fuzzy Hash: 5721AE71604240AFEB20CF25DD45FA6FBF8EF08614F08895AE9898B751D371E808CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAB632 Relevance: 1.6, APIs: 1, Instructions: 76COMMON
            Download Yara Rule
            APIs
            • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E90), ref: 02DAB6A3
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: DescriptorSecurity$ConvertString
            • String ID:
            • API String ID: 3907675253-0
            • Opcode ID: 7c40acc7878bb7a549e39da6518f58894ffbcc0154f48529574242b5d74b8ecc
            • Instruction ID: 39c160b208f6e8dc5f5af3fdaec0129df2585d06d7d8b00f058a5b0a383feb8f
            • Opcode Fuzzy Hash: 7c40acc7878bb7a549e39da6518f58894ffbcc0154f48529574242b5d74b8ecc
            • Instruction Fuzzy Hash: 9221C271600244AFEB20CF29DC45FAABBACEF04614F08846AE945DB751D774E909CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC1F8B Relevance: 1.6, APIs: 1, Instructions: 75COMMON
            Download Yara Rule
            APIs
            • GetProcessWorkingSetSize.KERNEL32(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 05FC200B
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: ProcessSizeWorking
            • String ID:
            • API String ID: 3584180929-0
            • Opcode ID: c3d2a82dbbaa6ba06b3f012ce8edfce3415d7adee7e3e777162ceda23c2fbb7a
            • Instruction ID: 74d8ebf6aec02f5b43f8b49f6c2b342511d187275ed6f3199532e5ecdbd854dd
            • Opcode Fuzzy Hash: c3d2a82dbbaa6ba06b3f012ce8edfce3415d7adee7e3e777162ceda23c2fbb7a
            • Instruction Fuzzy Hash: CD21C5715093806FD712CB25CC44FAABFB8EF46214F0884EBE989CB152D364A508C775
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAA632 Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON
            Download Yara Rule
            APIs
            • RegSetValueExW.KERNELBASE(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 02DAA6C4
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: Value
            • String ID:
            • API String ID: 3702945584-0
            • Opcode ID: 784f405fbba017025252d68a5f6d888de01a566f4d86c567853f1b79efe7d8fd
            • Instruction ID: d6ad32b820d3458cedbf27c7706d0b65076f58fbca45a7ea7baa1d8ccad2f7c1
            • Opcode Fuzzy Hash: 784f405fbba017025252d68a5f6d888de01a566f4d86c567853f1b79efe7d8fd
            • Instruction Fuzzy Hash: DF21AF72505780AFE722CF15CC44FA7BBB8EF05614F08859AE9858B252D364E848CBB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAB526 Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 02DAB5B8
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: ce6d649359db06c20d3dc586a4aacf65b95445724c08fd9b4cd935a578490237
            • Instruction ID: 828029b09c4af7003d85d3011808f9102ec6700d213728d1b65f8c01998a9135
            • Opcode Fuzzy Hash: ce6d649359db06c20d3dc586a4aacf65b95445724c08fd9b4cd935a578490237
            • Instruction Fuzzy Hash: 5321AC72504780AFD722CF11CC44FA7BBB8EF05714F08849AE989CB652D364E948CB75
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAA392 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON
            Download Yara Rule
            APIs
            • RegOpenKeyExW.KERNELBASE(?,00000E90), ref: 02DAA411
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: Open
            • String ID:
            • API String ID: 71445658-0
            • Opcode ID: a01a0d83067f36c90f899e6f6c5e0e9575ca088bf50b0935040d3827b05d7904
            • Instruction ID: 9632f78ac0159c04d79e85692930abf2a64187e8d3ca12f62c462e61b6db14ad
            • Opcode Fuzzy Hash: a01a0d83067f36c90f899e6f6c5e0e9575ca088bf50b0935040d3827b05d7904
            • Instruction Fuzzy Hash: 92219D72600304AEEB20DF55CC44FAAFBACEF04614F04855AFA898B751D764E94DCAB6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC09B5 Relevance: 1.6, APIs: 1, Instructions: 73registryCOMMON
            Download Yara Rule
            APIs
            • RegSetValueExW.KERNELBASE(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 05FC0A44
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: Value
            • String ID:
            • API String ID: 3702945584-0
            • Opcode ID: a860646e73dca87c60b71ee0b255d3140dc9fd54aa3d815fe6ac9cb2edf3f2e7
            • Instruction ID: 041c3a1b627e8e57fecbc4b9b2a6c0e8fa510a0d7ca8c5582fa4103c981f71e9
            • Opcode Fuzzy Hash: a860646e73dca87c60b71ee0b255d3140dc9fd54aa3d815fe6ac9cb2edf3f2e7
            • Instruction Fuzzy Hash: AE21CF72509780AFD7228F11CC44FA6BFB8EF05210F08849AE9898B652C364A448C771
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC2073 Relevance: 1.6, APIs: 1, Instructions: 73COMMON
            Download Yara Rule
            APIs
            • SetProcessWorkingSetSize.KERNEL32(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 05FC20EF
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: ProcessSizeWorking
            • String ID:
            • API String ID: 3584180929-0
            • Opcode ID: 58ecf6316223414d2d2da3b245fc4fd7fa7d4a31a098481f4f71cb8acad05bc8
            • Instruction ID: dbd1d669d88c408e5185ee1b75c0fb78c6ded0ab363dde7bfae57ba1f1754367
            • Opcode Fuzzy Hash: 58ecf6316223414d2d2da3b245fc4fd7fa7d4a31a098481f4f71cb8acad05bc8
            • Instruction Fuzzy Hash: 4621D4715053806FDB11CF21CC84FAABFB8EF46214F0884AAE988CB252D364A508CB75
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DABB5E Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON
            Download Yara Rule
            APIs
            • CreateMutexW.KERNELBASE(?,?), ref: 02DABBD1
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: CreateMutex
            • String ID:
            • API String ID: 1964310414-0
            • Opcode ID: 3f942fd9281deae247f89387683377f72f606191756471723d10a0cd0e6dbc26
            • Instruction ID: 57e62f0eaf47312cce898a51098567149e0efb5310547cca368402625681c126
            • Opcode Fuzzy Hash: 3f942fd9281deae247f89387683377f72f606191756471723d10a0cd0e6dbc26
            • Instruction Fuzzy Hash: A621B0716012449FE720CF25CD85FAAFBE8EF04618F0484AAE9488B741D775E809CA75
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC2142 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
            Download Yara Rule
            APIs
            • K32EnumProcesses.KERNEL32(?,?,?,0BBB4864,00000000,?,?,?,?,?,?,?,?,6CAC3C58), ref: 05FC21BA
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: EnumProcesses
            • String ID:
            • API String ID: 84517404-0
            • Opcode ID: 11d0d1ff37ad80ec27c9e0a3dc25858eaf5b13b67445178d615c8d4e17fad82a
            • Instruction ID: 339b5f4677fa8c2458e36287b22e85ce5d52fce2ecc45f7b823e0ffb4ffebe5f
            • Opcode Fuzzy Hash: 11d0d1ff37ad80ec27c9e0a3dc25858eaf5b13b67445178d615c8d4e17fad82a
            • Instruction Fuzzy Hash: 5721B0755093809FDB12CF25DC44A96BFB8FF06310F0984EAE984CF263D2359908DB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAADFE Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON
            Download Yara Rule
            APIs
            • ReadFile.KERNELBASE(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 02DAAE7D
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileRead
            • String ID:
            • API String ID: 2738559852-0
            • Opcode ID: 3f0a853d3cd67ddeca171fb4333387d3603765a50ebcc767f329d47b8c94512a
            • Instruction ID: 52775c4b3f5c5b9cd6fd35c3d0aa79cc89adf13bd5de4c4a638f1c66a068b055
            • Opcode Fuzzy Hash: 3f0a853d3cd67ddeca171fb4333387d3603765a50ebcc767f329d47b8c94512a
            • Instruction Fuzzy Hash: DD21D171505380AFDB22CF51DC44FA7BFB8EF45310F08849AE9888B252C375A908CBB6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC19C4 Relevance: 1.6, APIs: 1, Instructions: 69COMMON
            Download Yara Rule
            APIs
            • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05FC1A46
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: DuplicateHandle
            • String ID:
            • API String ID: 3793708945-0
            • Opcode ID: 1113d9d0ed98cae60777994424a755ae824a04b1eb97c82052d59a8ab4951384
            • Instruction ID: ffb10d82d146aed4fd57d2f3bf9ab2a4f1239af1e4b531cde8823f2b2158cb33
            • Opcode Fuzzy Hash: 1113d9d0ed98cae60777994424a755ae824a04b1eb97c82052d59a8ab4951384
            • Instruction Fuzzy Hash: A321B3314093C09FDB228F61CC84A52BFB5EF4B320F0988DED9848F263D275A919CB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAA49A Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 02DAA514
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 546105e133225c72730bac7b79bddb9b64a7eb70803ead5dd5afebccb5a981f7
            • Instruction ID: e1fad2c05b0939ba0a003fcb433e4d5fb65320c1d9c4cf3025e35c532b1bdc2d
            • Opcode Fuzzy Hash: 546105e133225c72730bac7b79bddb9b64a7eb70803ead5dd5afebccb5a981f7
            • Instruction Fuzzy Hash: 8C219076600304AFEB20CF15DC44FA6B7FCEF04614F04855AED498B751D364E948CAB6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC02C6 Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON
            Download Yara Rule
            APIs
            • WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 05FC0342
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: Connect
            • String ID:
            • API String ID: 3144859779-0
            • Opcode ID: 261ece7125670c696fb8077c13b4e46f87e1b998ba94125eaed665569b4db55d
            • Instruction ID: 90f98a4794c729d5b799ce1b6490498e1eb9d27599a634e47adfc652812ef237
            • Opcode Fuzzy Hash: 261ece7125670c696fb8077c13b4e46f87e1b998ba94125eaed665569b4db55d
            • Instruction Fuzzy Hash: 17218E71508780AFDB22CF55DC44B66BFB8FF06210F0884DAE9858B263D379A419DB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAAFC2 Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON
            Download Yara Rule
            APIs
            • WSASocketW.WS2_32(?,?,?,?,?), ref: 02DAB02E
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: Socket
            • String ID:
            • API String ID: 38366605-0
            • Opcode ID: 158260dd51df31c841a6ca8913179075e39998ba2368a7381424badaf8b85049
            • Instruction ID: 13318239554f34461f21f5d2b979ee5b3475f2d9f4ad7c54bba198e945fb037a
            • Opcode Fuzzy Hash: 158260dd51df31c841a6ca8913179075e39998ba2368a7381424badaf8b85049
            • Instruction Fuzzy Hash: 9821FF71500240AFEB20CF65CC41FAAFBA8FF05324F04885AEA898B751C376E409CB76
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAB7E2 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON
            Download Yara Rule
            APIs
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileView
            • String ID:
            • API String ID: 3314676101-0
            • Opcode ID: 6b426994052e0aa8d3833d129b23df59006bc5d4f87f7d65dc6d551a930a472e
            • Instruction ID: 69217accbc28c9d2b8707ecbad51450725b5fb5daf300fc8579c2a616d4fc7ae
            • Opcode Fuzzy Hash: 6b426994052e0aa8d3833d129b23df59006bc5d4f87f7d65dc6d551a930a472e
            • Instruction Fuzzy Hash: B521A171500244AFEB21CF25CD45FAAFBE8EF08628F04845AE9898B751D375E44DCBB6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC0562 Relevance: 1.6, APIs: 1, Instructions: 66windowtimeCOMMON
            Download Yara Rule
            APIs
            • SendMessageTimeoutA.USER32(?,00000E90), ref: 05FC05DD
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: MessageSendTimeout
            • String ID:
            • API String ID: 1599653421-0
            • Opcode ID: 8a6064ce3f995b1da95f043bfc7cd0468e7fff4c4393fc66abd779c7b1093025
            • Instruction ID: 6c7275e2817e143c2848a846a0fd830abc5afb76a1c4575f39ee4b56024bb6db
            • Opcode Fuzzy Hash: 8a6064ce3f995b1da95f043bfc7cd0468e7fff4c4393fc66abd779c7b1093025
            • Instruction Fuzzy Hash: 65210272600304EFEB218F11CD44FBAFBA8EF04710F0488AAEA899A651D775A509CB75
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC0B32 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
            Download Yara Rule
            APIs
            • SetFileAttributesW.KERNELBASE(?,?), ref: 05FC0BA3
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: AttributesFile
            • String ID:
            • API String ID: 3188754299-0
            • Opcode ID: 9fa8037157c7fee2c869856cd8fdb683ad6c36b069e3acd12e362e21af5dc5a1
            • Instruction ID: ed9bb25dedc731c93aaa020cc4508b743681afaf5edccca8c0bec43f927b8c13
            • Opcode Fuzzy Hash: 9fa8037157c7fee2c869856cd8fdb683ad6c36b069e3acd12e362e21af5dc5a1
            • Instruction Fuzzy Hash: 8721C3755093809FD711CF25DC85B56BFA8EF02314F0984EAD884CF263D279A909CB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAA652 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON
            Download Yara Rule
            APIs
            • RegSetValueExW.KERNELBASE(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 02DAA6C4
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: Value
            • String ID:
            • API String ID: 3702945584-0
            • Opcode ID: e3147f6d774d5a304af7ca3e07dd2ea37f4ba925784dae5ba4dae3b277d8ba6f
            • Instruction ID: 9053cb44e2a01860d778a4bfa87d32bd5e094b06d1de16ac16c589c0454c368c
            • Opcode Fuzzy Hash: e3147f6d774d5a304af7ca3e07dd2ea37f4ba925784dae5ba4dae3b277d8ba6f
            • Instruction Fuzzy Hash: 5611BE72600B40AFEB21CF19CC44FABBBB8EF04714F08855AE9458A751D760E848CAB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAB546 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 02DAB5B8
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: ceeae7475c473aee9a81e144d6a1f03ac62d2fa07654a0220b9f266525c82741
            • Instruction ID: ae7df1611296c3b6d39ce6cf24a406d0e140cc969e646363baa46af252a81153
            • Opcode Fuzzy Hash: ceeae7475c473aee9a81e144d6a1f03ac62d2fa07654a0220b9f266525c82741
            • Instruction Fuzzy Hash: A411BE72600704AFEB21CF15CC41FAAFBE8EF04718F08845AE9498B752D360E949CBB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC08F0 Relevance: 1.6, APIs: 1, Instructions: 64fileCOMMON
            Download Yara Rule
            APIs
            • CopyFileW.KERNELBASE(?,?,?), ref: 05FC095A
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: CopyFile
            • String ID:
            • API String ID: 1304948518-0
            • Opcode ID: 73018ae08c237bf81d856c7a724656fdd1fe8cfcdcb7ea7cf1a4597af24936a4
            • Instruction ID: f505648134528308179c0e261b48c419f26cc697dad88925dd95ae573e118ce3
            • Opcode Fuzzy Hash: 73018ae08c237bf81d856c7a724656fdd1fe8cfcdcb7ea7cf1a4597af24936a4
            • Instruction Fuzzy Hash: C11175716053809FDB11CF25DC85B57BFE8EF45210F0884EEE989CF652D264D444CB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DABF2E Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON
            Download Yara Rule
            APIs
            • GetProcessTimes.KERNELBASE(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 02DABF8D
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: ProcessTimes
            • String ID:
            • API String ID: 1995159646-0
            • Opcode ID: 3388808f7be1a48668225502717bc77c9f26c3da13b90aed2de86a290c0fc2d3
            • Instruction ID: 7c244302d5601d59c2be8cd53462c1bc6116d5d3ae75fefe8580000e445d43ca
            • Opcode Fuzzy Hash: 3388808f7be1a48668225502717bc77c9f26c3da13b90aed2de86a290c0fc2d3
            • Instruction Fuzzy Hash: 14110332200200AFEB208F51DC40FAABBA8EF04718F08846AE9498A651D371E808CBB1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC1FB2 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
            Download Yara Rule
            APIs
            • GetProcessWorkingSetSize.KERNEL32(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 05FC200B
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: ProcessSizeWorking
            • String ID:
            • API String ID: 3584180929-0
            • Opcode ID: 02c4109d268334b2e30dc0b135049edea24d14eadee637a0cc8fa1fefeb4fe31
            • Instruction ID: d4dbc1191a7127e9b2fbaf6c7e494a7ea9af50574d86795c60396fd26ed4cf1a
            • Opcode Fuzzy Hash: 02c4109d268334b2e30dc0b135049edea24d14eadee637a0cc8fa1fefeb4fe31
            • Instruction Fuzzy Hash: 8F110176600240AFEB20CF15CC44FAABBACEF04724F0484ABEA49CB651D774A508CAB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC2096 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
            Download Yara Rule
            APIs
            • SetProcessWorkingSetSize.KERNEL32(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 05FC20EF
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: ProcessSizeWorking
            • String ID:
            • API String ID: 3584180929-0
            • Opcode ID: 02c4109d268334b2e30dc0b135049edea24d14eadee637a0cc8fa1fefeb4fe31
            • Instruction ID: c5c7a2c482853c0ac8f94f9131b8ace1f484ae8142ccf1d1e5dbfe328e34cf18
            • Opcode Fuzzy Hash: 02c4109d268334b2e30dc0b135049edea24d14eadee637a0cc8fa1fefeb4fe31
            • Instruction Fuzzy Hash: A011C8756002449FEB10CF15DD45FAABBA8EF44714F0484AAEA49CB641D374A548CBB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC09DA Relevance: 1.6, APIs: 1, Instructions: 61registryCOMMON
            Download Yara Rule
            APIs
            • RegSetValueExW.KERNELBASE(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 05FC0A44
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: Value
            • String ID:
            • API String ID: 3702945584-0
            • Opcode ID: c3673bc80481e62feaf1b5bfffb02c2c32a36729f952b724f92ef625869fdebb
            • Instruction ID: 789dae0e48d9f6684fb5c0489d13091c41d603e989e3a59431b58a96b1b4dade
            • Opcode Fuzzy Hash: c3673bc80481e62feaf1b5bfffb02c2c32a36729f952b724f92ef625869fdebb
            • Instruction Fuzzy Hash: C811D072600604AFEB21CF15CD44FAAFBACFF44714F0484AAEA458A751D774E449CAB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC1526 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
            Download Yara Rule
            APIs
            • GetExitCodeProcess.KERNELBASE(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 05FC157C
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: CodeExitProcess
            • String ID:
            • API String ID: 3861947596-0
            • Opcode ID: 0bd26a053fc739e2fdcc92e8240a7a8a03e6dfb756fd20f4bbaffcec614976e0
            • Instruction ID: eb1ee921527816d3c487d48207d2136c7746ce02c12b495d307a63c2990678d8
            • Opcode Fuzzy Hash: 0bd26a053fc739e2fdcc92e8240a7a8a03e6dfb756fd20f4bbaffcec614976e0
            • Instruction Fuzzy Hash: B911C471600244AFEB10CF15DD45FBABB98EF44724F0484AAE949CB642D378A548CAB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAAE1E Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON
            Download Yara Rule
            APIs
            • ReadFile.KERNELBASE(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 02DAAE7D
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileRead
            • String ID:
            • API String ID: 2738559852-0
            • Opcode ID: cd70881f7c670f608a9c6fa84e5511156cf37188a6846a37256f1accc5118c35
            • Instruction ID: dc30d0b948bb8aa6dff43ff8924a4f59b2c52f82c23522c6e4567bbcf57ac7eb
            • Opcode Fuzzy Hash: cd70881f7c670f608a9c6fa84e5511156cf37188a6846a37256f1accc5118c35
            • Instruction Fuzzy Hash: BF11E271600300AFEB21CF51DC44FAAFBA8EF04714F04845AE9888A751C375E908CBB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAA70C Relevance: 1.6, APIs: 1, Instructions: 59COMMON
            Download Yara Rule
            APIs
            • FindCloseChangeNotification.KERNELBASE(?), ref: 02DAA76C
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: ChangeCloseFindNotification
            • String ID:
            • API String ID: 2591292051-0
            • Opcode ID: d48df8733cac405ec34453d73bcf6f7a55a4a5d293865a79896b267e5222d052
            • Instruction ID: f5eddb65bb65555c5e06e7b32425f92972cadeeebe4e843d15515ecd28b42271
            • Opcode Fuzzy Hash: d48df8733cac405ec34453d73bcf6f7a55a4a5d293865a79896b267e5222d052
            • Instruction Fuzzy Hash: FE11B671609380AFDB12CF25DC54B92BFB8EF42220F0884DAED858F652D2759408CB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC0A96 Relevance: 1.6, APIs: 1, Instructions: 57COMMON
            Download Yara Rule
            APIs
            • GetDriveTypeW.KERNELBASE(?), ref: 05FC0AF4
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: DriveType
            • String ID:
            • API String ID: 338552980-0
            • Opcode ID: 6c3e7463dc75236bd98ee44645aa353221b304accd6032009c9f4cdaa8774c12
            • Instruction ID: 3b6e3e056ca7ca2b1fea0c825cb0a56d799d3efdd94a5757084cd579e7f39b41
            • Opcode Fuzzy Hash: 6c3e7463dc75236bd98ee44645aa353221b304accd6032009c9f4cdaa8774c12
            • Instruction Fuzzy Hash: 7D1160719093C09FDB12CB25DC94B56BFA8EF46724F0884DAE984CF652D269A508CB62
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAA2D2 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
            Download Yara Rule
            APIs
            • SetErrorMode.KERNELBASE(?), ref: 02DAA330
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: ErrorMode
            • String ID:
            • API String ID: 2340568224-0
            • Opcode ID: 8281ce0b22e10805c284af6f59b05f04f6fc3714059e39ae031310ae27fb8a6f
            • Instruction ID: 5d9fc1f53361a599977bf7b9fe379e8e24549798522db000e09be5bdfd13fe9b
            • Opcode Fuzzy Hash: 8281ce0b22e10805c284af6f59b05f04f6fc3714059e39ae031310ae27fb8a6f
            • Instruction Fuzzy Hash: A611A0714093C0AFDB128B15DC54B62BFB4EF43624F0C80DAED848B263D265A808DB72
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC122A Relevance: 1.6, APIs: 1, Instructions: 53COMMON
            Download Yara Rule
            APIs
            • LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 05FC1272
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: LookupPrivilegeValue
            • String ID:
            • API String ID: 3899507212-0
            • Opcode ID: 856438b72d0706ec61baeeda8e95ab7188d8aaa52f00c706f5f809b32e3ecc1c
            • Instruction ID: d9c9b71edfbb2c74a2ebb32ddd784e9f8ff81e0bccf9ab8db35a2727f881479a
            • Opcode Fuzzy Hash: 856438b72d0706ec61baeeda8e95ab7188d8aaa52f00c706f5f809b32e3ecc1c
            • Instruction Fuzzy Hash: 1B118276A042418FDB10CF25DD85FA6FBE8EF44620F0884BEDD4ACB742D275E418CA61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC0912 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON
            Download Yara Rule
            APIs
            • CopyFileW.KERNELBASE(?,?,?), ref: 05FC095A
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: CopyFile
            • String ID:
            • API String ID: 1304948518-0
            • Opcode ID: 856438b72d0706ec61baeeda8e95ab7188d8aaa52f00c706f5f809b32e3ecc1c
            • Instruction ID: a8c50412eccdf3f332667df20c99eb6f553bc1e77c923de81de5f17a9cf2fa71
            • Opcode Fuzzy Hash: 856438b72d0706ec61baeeda8e95ab7188d8aaa52f00c706f5f809b32e3ecc1c
            • Instruction Fuzzy Hash: 2F117072A002018FEB50CF25D945B6ABB9DEB04620F0884AADD49CFB42D675D449CA61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAAB5E Relevance: 1.6, APIs: 1, Instructions: 52COMMON
            Download Yara Rule
            APIs
            • GetFileType.KERNELBASE(?,00000E90,0BBB4864,00000000,00000000,00000000,00000000), ref: 02DAABB1
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileType
            • String ID:
            • API String ID: 3081899298-0
            • Opcode ID: d02b342125564d2b24188fbf62a5a7f1ce7dba65a3544e6cf17cf342e7ef5a51
            • Instruction ID: d8374785578725e31041dab2fcdf4593f278856fb1953b5e69134c97f77f8111
            • Opcode Fuzzy Hash: d02b342125564d2b24188fbf62a5a7f1ce7dba65a3544e6cf17cf342e7ef5a51
            • Instruction Fuzzy Hash: E001C071600244AFE720CF15DC85FAABBA8EF44624F04819AEE488B741D374E94CCAB6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC0784 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
            Download Yara Rule
            APIs
            • WaitForInputIdle.USER32(?,?), ref: 05FC07DB
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: IdleInputWait
            • String ID:
            • API String ID: 2200289081-0
            • Opcode ID: 16b009b10b80b0503dd659e98633d4bf408420ac1acc29ace22567640bdf045b
            • Instruction ID: e3fee42f9c4695a6245517214b0f66d617327da72dd7f6663843527a28d9a612
            • Opcode Fuzzy Hash: 16b009b10b80b0503dd659e98633d4bf408420ac1acc29ace22567640bdf045b
            • Instruction Fuzzy Hash: A01191715093809FDB11CF15DC84B66BFA4EF46220F0884EADD858B262D279A409CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC02F6 Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON
            Download Yara Rule
            APIs
            • WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 05FC0342
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: Connect
            • String ID:
            • API String ID: 3144859779-0
            • Opcode ID: d51236cd8720febfb08c8254054ab56629eab6a276634948f2f1811fdbf554f8
            • Instruction ID: 85c44e1c5b639cc6d8893016448b5044be4a1baa800c270746f3c43a8787d5d8
            • Opcode Fuzzy Hash: d51236cd8720febfb08c8254054ab56629eab6a276634948f2f1811fdbf554f8
            • Instruction Fuzzy Hash: 9B119E31500604DFDB20CF55C948B66FBE8FF08610F0884AADD898B662D775E459CB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC217A Relevance: 1.5, APIs: 1, Instructions: 49COMMON
            Download Yara Rule
            APIs
            • K32EnumProcesses.KERNEL32(?,?,?,0BBB4864,00000000,?,?,?,?,?,?,?,?,6CAC3C58), ref: 05FC21BA
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: EnumProcesses
            • String ID:
            • API String ID: 84517404-0
            • Opcode ID: 9f2f0ba7c85d0fe83ddd34e8d1606008d57a385f85d2b1eb3715c75599da71e3
            • Instruction ID: ffc01c4bf10568b433e70e69879e7e50de5c1d624cd689248a95724c3f7cc96f
            • Opcode Fuzzy Hash: 9f2f0ba7c85d0fe83ddd34e8d1606008d57a385f85d2b1eb3715c75599da71e3
            • Instruction Fuzzy Hash: 25118E756003459FDB10CF25D984B6AFBE8FF04620F08C4AADE898B651D275E548CA61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC0B66 Relevance: 1.5, APIs: 1, Instructions: 48COMMON
            Download Yara Rule
            APIs
            • SetFileAttributesW.KERNELBASE(?,?), ref: 05FC0BA3
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: AttributesFile
            • String ID:
            • API String ID: 3188754299-0
            • Opcode ID: ff1e060d532e2fbb0a6e1c46c337277caefe348206a6fc25ffa382cbc4c7caa5
            • Instruction ID: c8ecb0a8e678b927241917043dd051c82889709abccdcb514bf571b41e4fd6c9
            • Opcode Fuzzy Hash: ff1e060d532e2fbb0a6e1c46c337277caefe348206a6fc25ffa382cbc4c7caa5
            • Instruction Fuzzy Hash: 8B01C031A043058FDB10CF25D988B6AFBA8EF04724F08C4EADD49CB742D679E409CA61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC03EE Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
            Download Yara Rule
            APIs
            • FormatMessageW.KERNELBASE(?,00000E90,?,?), ref: 05FC043E
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: FormatMessage
            • String ID:
            • API String ID: 1306739567-0
            • Opcode ID: d70e1cc81abdadafd8409924cc33ab588cda384a3a2b04b6a448b1ed75ff141d
            • Instruction ID: c74bc4e39413cda49cc912bc81c11530f3260291cf5ca9362c3ac86c0767e843
            • Opcode Fuzzy Hash: d70e1cc81abdadafd8409924cc33ab588cda384a3a2b04b6a448b1ed75ff141d
            • Instruction Fuzzy Hash: 2E019E71600200ABD210DF16CC46B76FBA8FB88A20F14815AEC089BB41D771F515CBE5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAA172 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
            Download Yara Rule
            APIs
            • EnumWindows.USER32(?,00000E90,?,?), ref: 02DAA1BD
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: EnumWindows
            • String ID:
            • API String ID: 1129996299-0
            • Opcode ID: ffdbb881e5412a18e4dbaff40e18508a5f815b8b9d7e85b37f2935dc847cf3c4
            • Instruction ID: fbb61fd3674e9455b50758d0d0dc61abe849888d1d649a2c2ffacce5b2ffe160
            • Opcode Fuzzy Hash: ffdbb881e5412a18e4dbaff40e18508a5f815b8b9d7e85b37f2935dc847cf3c4
            • Instruction Fuzzy Hash: F501B171600200AFD310DF16CC46B76FBA8FB88A20F14815AEC089BB41D775F515CBE5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC1A02 Relevance: 1.5, APIs: 1, Instructions: 45COMMON
            Download Yara Rule
            APIs
            • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05FC1A46
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: DuplicateHandle
            • String ID:
            • API String ID: 3793708945-0
            • Opcode ID: 711c299dad19a257fd8d1611a7dfd366200ffdc99ed38f7f0908923e84d21cba
            • Instruction ID: 0ea172f0bbf2f8e7c3ca232c4289dd1266e6702a9f28f9790cc08632a409a5fd
            • Opcode Fuzzy Hash: 711c299dad19a257fd8d1611a7dfd366200ffdc99ed38f7f0908923e84d21cba
            • Instruction Fuzzy Hash: D5015E325007409FDB21CF55D944F66FFA5FF48710F0884AADE494A612D376E528DB62
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC0ABA Relevance: 1.5, APIs: 1, Instructions: 43COMMON
            Download Yara Rule
            APIs
            • GetDriveTypeW.KERNELBASE(?), ref: 05FC0AF4
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: DriveType
            • String ID:
            • API String ID: 338552980-0
            • Opcode ID: 397ab77dc479326d5be9aac96649252fb2c791dc36f0d6f1887540c663e31522
            • Instruction ID: eff8d1a5b9841f9afaee4b81e07331b855610b636ebb76ae389b87ad2d2d9328
            • Opcode Fuzzy Hash: 397ab77dc479326d5be9aac96649252fb2c791dc36f0d6f1887540c663e31522
            • Instruction Fuzzy Hash: 81019E71A04245DFDB10CF15D988B6AFFA8EB04724F08C4EADD48CB742D679E448CA62
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAA73A Relevance: 1.5, APIs: 1, Instructions: 43COMMON
            Download Yara Rule
            APIs
            • FindCloseChangeNotification.KERNELBASE(?), ref: 02DAA76C
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: ChangeCloseFindNotification
            • String ID:
            • API String ID: 2591292051-0
            • Opcode ID: b0f2108effd8a2fd1f1180f04d93463dae433cf46716f9b4476f237549402cb9
            • Instruction ID: 2e179bec91f00e7fac141449767f51aff11840527c0263be74705fdbf3daf466
            • Opcode Fuzzy Hash: b0f2108effd8a2fd1f1180f04d93463dae433cf46716f9b4476f237549402cb9
            • Instruction Fuzzy Hash: 2E01F271A003409FEB10CF15D894BA6FBB4EF44620F08C4AADD498F752D375E848CB62
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAA5B6 Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,?,?), ref: 02DAA606
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: e9bf4afee5e0e3b1502c206371988eef39abc15d84c7027f2cf854da82eaf4b0
            • Instruction ID: 57e0f53861a9c5be36163b42b4a6527c4659378840c0a44a95048a50d010e02f
            • Opcode Fuzzy Hash: e9bf4afee5e0e3b1502c206371988eef39abc15d84c7027f2cf854da82eaf4b0
            • Instruction Fuzzy Hash: 2201AD71640600ABD210DF16CC86B76FBA8FB88B20F14815AEC0C9BB42D771F915CBE6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05FC07A6 Relevance: 1.5, APIs: 1, Instructions: 40COMMON
            Download Yara Rule
            APIs
            • WaitForInputIdle.USER32(?,?), ref: 05FC07DB
            Memory Dump Source
            • Source File: 00000001.00000002.4078822231.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_5fc0000_WindowsUpdate.jbxd
            Similarity
            • API ID: IdleInputWait
            • String ID:
            • API String ID: 2200289081-0
            • Opcode ID: d02f9a0019c20b24b6b22d4f2fa6cd9ec4ef6e311774d5a69d0647220e713373
            • Instruction ID: b6e261261265f235fa97dc256143f687a29de0db57767f2b7e6f913d56a41b87
            • Opcode Fuzzy Hash: d02f9a0019c20b24b6b22d4f2fa6cd9ec4ef6e311774d5a69d0647220e713373
            • Instruction Fuzzy Hash: E901D431900244DFDB10CF15D988B65FFA8EF04624F08C4EADD499B652D7799009CEA2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DAA2FE Relevance: 1.5, APIs: 1, Instructions: 35COMMON
            Download Yara Rule
            APIs
            • SetErrorMode.KERNELBASE(?), ref: 02DAA330
            Memory Dump Source
            • Source File: 00000001.00000002.4074311293.0000000002DAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2daa000_WindowsUpdate.jbxd
            Similarity
            • API ID: ErrorMode
            • String ID:
            • API String ID: 2340568224-0
            • Opcode ID: d478ab766d4767d80ca0c42f6a104b319eb2a7504f89ddf3b2bf8119fc5eef60
            • Instruction ID: 81e11319d7449bb2f4cd3b30a54fd413e918a9790215d58f65f2431859772508
            • Opcode Fuzzy Hash: d478ab766d4767d80ca0c42f6a104b319eb2a7504f89ddf3b2bf8119fc5eef60
            • Instruction Fuzzy Hash: 9FF0AF35A04744DFDB10CF09D885B65FBA0EF04724F08C1DADD894B752D3B9E848CAA2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E809F0 Relevance: .4, Instructions: 376COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: c0de2094dab29771bb162178756a5bad3c2cba46a5a931b5ac7c43e6a383aaad
            • Instruction ID: 88466c7900acb141ea75c46cf2dd30866f166e1f918f5c841778ceb223523a2e
            • Opcode Fuzzy Hash: c0de2094dab29771bb162178756a5bad3c2cba46a5a931b5ac7c43e6a383aaad
            • Instruction Fuzzy Hash: 7BE13A34A01204DFCB49EBB8D554AAD77F3EF89308F2180A9E409AB361DB35ED49CB51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E817C8 Relevance: .3, Instructions: 329COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 1c2f59f8372b7ded9971ca6e3d96f8a8abaea92901840fdb7700dad27c6a3f4a
            • Instruction ID: d3a03d5a086546ad9b3af5367f54a2fc88a22aaa79573811145dca3a21bd86d6
            • Opcode Fuzzy Hash: 1c2f59f8372b7ded9971ca6e3d96f8a8abaea92901840fdb7700dad27c6a3f4a
            • Instruction Fuzzy Hash: 6FD1EC34700244DFCB48EBB8C554AED77E2EF89318F1580A8D509AB7A2DB36ED45CB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E809E2 Relevance: .3, Instructions: 288COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: a072e3cd4a523dade02b1381d01e764c9cb211fa08ecfb9463082ff66867555c
            • Instruction ID: a918d3ead280e3d0971231739dd57b01c5a1b7f982a4856bd0effa9120bf866d
            • Opcode Fuzzy Hash: a072e3cd4a523dade02b1381d01e764c9cb211fa08ecfb9463082ff66867555c
            • Instruction Fuzzy Hash: F5C12C34A01204DFCB49DFA8D594A9D77F3EF89308F2580A8E409AB7A1DB35ED49CB51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E81349 Relevance: .3, Instructions: 272COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 07a59cdfd2ee5390e6f38af7a8139c8bfa3881437a7b2453b30db70ed7b7bd21
            • Instruction ID: 20a9124cace68890388da761cacb9963b88b1e7651508ebabbb0d2a99eaa99b6
            • Opcode Fuzzy Hash: 07a59cdfd2ee5390e6f38af7a8139c8bfa3881437a7b2453b30db70ed7b7bd21
            • Instruction Fuzzy Hash: 61C11534A04244CFCB44EFB8D594AEEB7F2EB4C204B15C4A9D859AB761DB39AC45CF60
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E80F98 Relevance: .3, Instructions: 267COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 539a9875efbc4d9e0f45c6bf8dfa865a7d04f9e776dc707d394be0d10018c1b2
            • Instruction ID: e1df74a63567f0b597deab52af908fb3099f2c448bc984f1b8d6a13fb3553e61
            • Opcode Fuzzy Hash: 539a9875efbc4d9e0f45c6bf8dfa865a7d04f9e776dc707d394be0d10018c1b2
            • Instruction Fuzzy Hash: 0DB14934A00204DFCB18EFA8D484A9DB7B2AF49318F14D259E85DAF3A5DB31EC46CB51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E80A68 Relevance: .3, Instructions: 251COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: bfaf20fee40ad979a2202c5100895e3404778a8dc5ba7051fff984ed5bb09ba8
            • Instruction ID: 0586543f4d23bf0290db51b5ce7adcf0b5c08425a12f696fc9b6ce82877a9476
            • Opcode Fuzzy Hash: bfaf20fee40ad979a2202c5100895e3404778a8dc5ba7051fff984ed5bb09ba8
            • Instruction Fuzzy Hash: 94A11C34B01204DFCB49EFA8D154AAD77F3AF89308F2580A8E409AB765DB35ED49CB51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E81EEF Relevance: .2, Instructions: 220COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 0d794978fd7ecea91504307fcf6341e7389fe164daed25e6a3a0c163eef7c733
            • Instruction ID: f479e78d91513f0ae7694a1acfd7c4f919191cb5cedd8466ddc79c0c613487ca
            • Opcode Fuzzy Hash: 0d794978fd7ecea91504307fcf6341e7389fe164daed25e6a3a0c163eef7c733
            • Instruction Fuzzy Hash: 72817A307002449BCF18EFB4C890AAD73A3EF88348B15C4A9D91A9B795DB35EC45CB62
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E813B8 Relevance: .2, Instructions: 215COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: ea367bf32aa2d9763eb64c450c0161ca27b8bdb16ae747c7aac005586c6eb85c
            • Instruction ID: fd83113ccee0829d9990c4594f9dba23e4bec2d6484db66b85f3304b093fc0ec
            • Opcode Fuzzy Hash: ea367bf32aa2d9763eb64c450c0161ca27b8bdb16ae747c7aac005586c6eb85c
            • Instruction Fuzzy Hash: D8912534A04244CFCB45EFB8D550AEEB7F2EF48208B15C4A9D859AB761DB39AC45CF60
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E813D6 Relevance: .2, Instructions: 211COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 9f2b6df5bfc7176f8b30f362bce7d2da09551f1a7c12b73df9ad0f3715cdb2c2
            • Instruction ID: 23f5697a725b4d8ef3c06d574033fd82981e66b1f42ab9c753b862cf21b61ef9
            • Opcode Fuzzy Hash: 9f2b6df5bfc7176f8b30f362bce7d2da09551f1a7c12b73df9ad0f3715cdb2c2
            • Instruction Fuzzy Hash: D6912634A04244CFCB45EFB8D550AEEB7F2EF48208B15C4A9D859AB761DB39AC45CF60
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E813E9 Relevance: .2, Instructions: 210COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: db748a0a68240a681b1fd5a8971fabf66e0595e54b171f48fe9656c5a7d782d3
            • Instruction ID: c66e1120f75ef508db3154b3f721534e4966adcde0c8cb38abe925be5c22e0a3
            • Opcode Fuzzy Hash: db748a0a68240a681b1fd5a8971fabf66e0595e54b171f48fe9656c5a7d782d3
            • Instruction Fuzzy Hash: 36912634A04244CFCB45EFB8D550AEEB7F2EF48208B15C4A9D859AB761DB39AC45CF60
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E82610 Relevance: .2, Instructions: 209COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 58955e49427098e00bb482c9e6b2b1d743fc348c82224d500a2b3703460ebf5a
            • Instruction ID: 914f44681b20f0645f96dcf3e106d6bffb7432da559a883eba5a4927a04f7e26
            • Opcode Fuzzy Hash: 58955e49427098e00bb482c9e6b2b1d743fc348c82224d500a2b3703460ebf5a
            • Instruction Fuzzy Hash: 0C61D772E802608BEF2C767984547ECB2A2AB4434CF19D079CE9D77290DB359C84C7E6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E819B1 Relevance: .2, Instructions: 183COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 90c0059e1ea9016df778fdbc20c6c5f32aa7351c89f26b09b10fc6ddbd2028c0
            • Instruction ID: 13435c7459716b3cb35c499e5f00173bc3cccc3658c6804bade6f209d78570ce
            • Opcode Fuzzy Hash: 90c0059e1ea9016df778fdbc20c6c5f32aa7351c89f26b09b10fc6ddbd2028c0
            • Instruction Fuzzy Hash: 5571CA34740204DFCB49EBA4C554BED77E3EB88318F1580A8D5099B7A6DB36EC45CB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E819DC Relevance: .2, Instructions: 177COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: a2b161032cc3e7ca0406d89f1fe31e74ce4e34aa981473af7207fe3c950479ce
            • Instruction ID: b254ea3bcf40a563ae2e3933b1150024f3cc1ea829120d13de6d92413177ee5f
            • Opcode Fuzzy Hash: a2b161032cc3e7ca0406d89f1fe31e74ce4e34aa981473af7207fe3c950479ce
            • Instruction Fuzzy Hash: C361CA34700204DFCB49EBA8C554BED77E3EF88218F1580A8D5099B7A6DB36ED45CB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E80070 Relevance: .2, Instructions: 150COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: e4fb105b8d04a11460ba7cde0e559f52a31c19d1dbb3c68d66cfb905cb52cecf
            • Instruction ID: f08079948e00492757c8ac56134429cfed5a6e1ef2b9b1cabad38f5c35bb4033
            • Opcode Fuzzy Hash: e4fb105b8d04a11460ba7cde0e559f52a31c19d1dbb3c68d66cfb905cb52cecf
            • Instruction Fuzzy Hash: 9B618AB4E01208DFCB48DFA6D954AEDBBF2AF89304F208569D809AB364DB355D45CF50
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E80C45 Relevance: .1, Instructions: 149COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 1415cf2a6b9f7a353c295b0a4e8b1c5e1c1c2c4dd3adfa64d8847e165bc3bdbc
            • Instruction ID: 0123da0eab4f06eb51974d9f3bb4cb97c689050b3e9bdc3f640bbae5bb24e67d
            • Opcode Fuzzy Hash: 1415cf2a6b9f7a353c295b0a4e8b1c5e1c1c2c4dd3adfa64d8847e165bc3bdbc
            • Instruction Fuzzy Hash: 29514F34A01244DFCB49DFB8D194A9D77F3EF49308F2580A8E5499B3A2DB35AD49CB11
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E81A77 Relevance: .1, Instructions: 137COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: f98c08873d9c5f2012560b2d8ee988f2fc634542649af5ee10ea8f899479697a
            • Instruction ID: 386dc69a741960e6779a16a9e351ded8d697b813b285f36a13a4a97a650ffa4e
            • Opcode Fuzzy Hash: f98c08873d9c5f2012560b2d8ee988f2fc634542649af5ee10ea8f899479697a
            • Instruction Fuzzy Hash: 1151D734740204DFCB49EBA8C554BEC77E2EF48218F2580A8D509AB7A2DB36ED45CB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E80628 Relevance: .1, Instructions: 136COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 29efe0acccfb4616a93edf73ef354e2f780ccc6f461ece004d055ec764a1d24a
            • Instruction ID: 1774d0afdfcfaddc6585db220986987af7355d9f2a5365f75f5fb67ac6639bd9
            • Opcode Fuzzy Hash: 29efe0acccfb4616a93edf73ef354e2f780ccc6f461ece004d055ec764a1d24a
            • Instruction Fuzzy Hash: 70516C34A41214CFDB04EBB4D565AEDB7B2EF88304F218569E40AA7391DB35AC05CF90
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E823C0 Relevance: .1, Instructions: 134COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: f5ab03187f90826504cbb23c55de00902487a5d016ffb1965706d3c8aa3b495c
            • Instruction ID: 4366e91f337cb4b7813716edf9fe1c569fc797081eb1ae4c857aae942e3204b2
            • Opcode Fuzzy Hash: f5ab03187f90826504cbb23c55de00902487a5d016ffb1965706d3c8aa3b495c
            • Instruction Fuzzy Hash: F2514B30A40209CFCB04EFA8D5949DDBBF2EB88328F14D169D909AB355CB35EC45CBA1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E80C69 Relevance: .1, Instructions: 132COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: e04a5656e0ce6d312c8af2720a41d2ee10f89856b29411070cedb2a625c185ee
            • Instruction ID: 764e28b869665beb51c5e2fe1bc32bfe1eb836dbc23ab8a2449f1306b983f774
            • Opcode Fuzzy Hash: e04a5656e0ce6d312c8af2720a41d2ee10f89856b29411070cedb2a625c185ee
            • Instruction Fuzzy Hash: 4A51EC34A41204DFCB49EBB8D154AAD77F3EF89308F2584A8E50997362DB36EC45CB11
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E80DD5 Relevance: .1, Instructions: 132COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 35ced4270d42be03629f56f0092af1604627d46f7d9fdb000e6cb2f54e79717d
            • Instruction ID: 0330790133b1706605af78d2e901a838bee5e1d60b52108b344b376d426de854
            • Opcode Fuzzy Hash: 35ced4270d42be03629f56f0092af1604627d46f7d9fdb000e6cb2f54e79717d
            • Instruction Fuzzy Hash: 1F51EC34A41204DFCB49EBB8D154AAD77F3EF89308F2584A8E50997362DB36ED45CB11
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E80C0C Relevance: .1, Instructions: 132COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 317161ccbd79388af82b029901962dda67adc927fb275d219c4551f5f83c3ebf
            • Instruction ID: 9d569f92284bfc5cd59d1abc56b8a10a57da1c8eaf7c3a3e9c8c2da204a5390a
            • Opcode Fuzzy Hash: 317161ccbd79388af82b029901962dda67adc927fb275d219c4551f5f83c3ebf
            • Instruction Fuzzy Hash: E451EC34A41204DFCB49EBB8D154AAD77F3EF89308F2584A8E50997362DB36ED45CB11
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E80D87 Relevance: .1, Instructions: 132COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: d7bd2ed007047d93297bb0ac2886d81de6a917f290ac3ba8465b6ec4a5d7f5a2
            • Instruction ID: aa1effdf5e1d3006ef0f411d9ddab481955173fdb9763a05db1f4060a24e0444
            • Opcode Fuzzy Hash: d7bd2ed007047d93297bb0ac2886d81de6a917f290ac3ba8465b6ec4a5d7f5a2
            • Instruction Fuzzy Hash: C751EC34A41204DFCB49EBB8D154AAD77F3EF89308F2584A8E50997362DB36ED45CB11
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E80D1C Relevance: .1, Instructions: 132COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 78d77b8878e7f415e6e5f1fd2843257a5a28fddcdee066905161caf14eabeee6
            • Instruction ID: ff1a12b3bbb1913e110801466914d4d3a6258f6f1777789503ac666e22e1942d
            • Opcode Fuzzy Hash: 78d77b8878e7f415e6e5f1fd2843257a5a28fddcdee066905161caf14eabeee6
            • Instruction Fuzzy Hash: FD51EC34A41204DFCB49EBB8D154AAD77F3EF89308F2584A8E50997362DB36ED45CB11
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E80F88 Relevance: .1, Instructions: 129COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 7c4dcb3e63d22a5483af5cb2f20466568313841f12729bee899e8872d7eb7f2e
            • Instruction ID: 37491e3d31e972ca95e708069ed56cc4aee26913d0b9e5df56ba132b765b8ef8
            • Opcode Fuzzy Hash: 7c4dcb3e63d22a5483af5cb2f20466568313841f12729bee899e8872d7eb7f2e
            • Instruction Fuzzy Hash: 11515A30E01244DFDB18DF69D884A9DB7F2AF48314F15D5A9E859AB3A1DB31AC42CF10
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E823B1 Relevance: .1, Instructions: 126COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 0907aea2a1201d9c62e6368d7e4f687b731b1dc1c68e9df0af7533bd6daeb276
            • Instruction ID: 7a715f463333bbdbce835833a1ac46b6dea6eb7ad7ae6dd28ec2a05a9d5bb123
            • Opcode Fuzzy Hash: 0907aea2a1201d9c62e6368d7e4f687b731b1dc1c68e9df0af7533bd6daeb276
            • Instruction Fuzzy Hash: A3512B30A40205CFCB44DFA8D5949DDBBF2EB88328F19D169D849AB355DB31EC45CBA0
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E8130B Relevance: .1, Instructions: 114COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: a8920a7c0f95acc3554fb13078099c08d698ac66c549d0b5a7aabde1b4ea8782
            • Instruction ID: c537e7c51ab6304571734715e4caf9b8b208ddb655f6d36a2f781cd1e08348a1
            • Opcode Fuzzy Hash: a8920a7c0f95acc3554fb13078099c08d698ac66c549d0b5a7aabde1b4ea8782
            • Instruction Fuzzy Hash: 6C412830A01244DFDB18EF69D484A9CB7F2AF48318F55D699E859AB3A1DB35EC81CB10
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E81AEC Relevance: .1, Instructions: 106COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 87aea46cd43dc946c91b499a1808ce0f1bb38e2470bc92bc307f747d8c96e44e
            • Instruction ID: 2e46e0d1751d98fb298958566fbf353e1e096f976d81dfcae3d46efef0791f6f
            • Opcode Fuzzy Hash: 87aea46cd43dc946c91b499a1808ce0f1bb38e2470bc92bc307f747d8c96e44e
            • Instruction Fuzzy Hash: A541FB34700204DFCB49EBA8C550BEC77E3EF48218F1580A8D509AB7A2DB36ED45CB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E8243D Relevance: .1, Instructions: 88COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: e841b78dc5263f7d49ab50db4a28221e16a85e730fa418583b827c6a62f42ecc
            • Instruction ID: 70d98c284049cb1308676b5224f10300d507f235db6aef98f332738df56f7b0c
            • Opcode Fuzzy Hash: e841b78dc5263f7d49ab50db4a28221e16a85e730fa418583b827c6a62f42ecc
            • Instruction Fuzzy Hash: 66314D30A40205CFCB04DFA8D1949DDB7F2EF88228B19E165D909AB365CB31EC45CBA1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E82562 Relevance: .1, Instructions: 86COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 44ba2155393bbf0dc35ceb6602e34679fef5216270a1c371e23ba2c6f51098aa
            • Instruction ID: c68cfdcd37584fbcb1cbea92d3950533e1154731cf5b13c801abe7349841e297
            • Opcode Fuzzy Hash: 44ba2155393bbf0dc35ceb6602e34679fef5216270a1c371e23ba2c6f51098aa
            • Instruction Fuzzy Hash: 27313E30A40245CFCB04DFA8D19499DB7F2EF88228B19E165D949AB365CB35EC45CBA1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E808E8 Relevance: .1, Instructions: 78COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: a4fea4c7e86ec1619bb7b23eb1245d42101abe43026a87e72794fbbff191a713
            • Instruction ID: 47a47dc1db4f543c9084331631cf2a11b24f9c3c980a529a98f7b3e6ead31c8e
            • Opcode Fuzzy Hash: a4fea4c7e86ec1619bb7b23eb1245d42101abe43026a87e72794fbbff191a713
            • Instruction Fuzzy Hash: 11216D31B00215CFCB04EF64C5556EEB7F2AF88218F648569D409AB381DB369D4ACBA1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E81B54 Relevance: .1, Instructions: 78COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 351eb1cab647230340081888cf986528a6a811dad8146904027cec067ab18f0e
            • Instruction ID: 44ff39eabeb96cf3812d4268adf818e92a1e9ea345116c436108ac9cc685fd32
            • Opcode Fuzzy Hash: 351eb1cab647230340081888cf986528a6a811dad8146904027cec067ab18f0e
            • Instruction Fuzzy Hash: DE314C34B00144DFCB48EBA8C550BEC77E3EF48208F118094D60DAB7A2DB2AAD55DB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E808D8 Relevance: .1, Instructions: 73COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 0abf416615e268aac7d57931dab90777a442e5bbb4799a1d153bd0ac9deaac8c
            • Instruction ID: 1167118c9ab71581ea89cce9e9e16824a6afd5a59014a204726a5b75c13c5f92
            • Opcode Fuzzy Hash: 0abf416615e268aac7d57931dab90777a442e5bbb4799a1d153bd0ac9deaac8c
            • Instruction Fuzzy Hash: 48218131B001058FCB04DF68C541BEEB7F2AFC8318F6485A9D449AB381D7369E5ACB91
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E82BE8 Relevance: .1, Instructions: 69COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 62bc83d16838f64bcabf387c369ab6b14fade8796ff92484b90f9a09301093de
            • Instruction ID: e0dd692be0cbcefd95373dae6474379c2366cd4217da5a17bec8ea531bf2edda
            • Opcode Fuzzy Hash: 62bc83d16838f64bcabf387c369ab6b14fade8796ff92484b90f9a09301093de
            • Instruction Fuzzy Hash: E811B176A00104CFCF01EBB8D8549EDB3F2EF88254B1544B6DA49EB310EB31AD158BA0
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E828C0 Relevance: .1, Instructions: 68COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 6c408f59bd17a697324440f37308a3d66215bd802a4c005a201b57301cbaa446
            • Instruction ID: d460095fee2b8df4c9b60852db27d3487e7b3d8f7f0159b1c287e82bb2c16be1
            • Opcode Fuzzy Hash: 6c408f59bd17a697324440f37308a3d66215bd802a4c005a201b57301cbaa446
            • Instruction Fuzzy Hash: C6118731F402549BCF15EBB9C855BEE77E7EF88710F548429D54AB7380DA319C008BA5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E20D64 Relevance: .1, Instructions: 59COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074813719.0000000002E20000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e20000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 558e818b1788e7e6c61d49f555511576d47773d203dad170dddc89779d129fb0
            • Instruction ID: 5e7da81a4f7d34a39c77d2abdbcf0cf8dcde32362a686a0023503e8941c4465a
            • Opcode Fuzzy Hash: 558e818b1788e7e6c61d49f555511576d47773d203dad170dddc89779d129fb0
            • Instruction Fuzzy Hash: 20110630285280DFD711CB10D940B66FBA5EB9970CF28C99CE94A0B792C737E85BCA41
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E20D2C Relevance: .1, Instructions: 59COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074813719.0000000002E20000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e20000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: cb9ffa13fd472395d1665831da7e3610ba03909a0e2171fc5dc4debdd9bd6f20
            • Instruction ID: 7c14eac4b7b6239c55f176c9ebf80252a2b705790cbdad988b28b70d0d52ab18
            • Opcode Fuzzy Hash: cb9ffa13fd472395d1665831da7e3610ba03909a0e2171fc5dc4debdd9bd6f20
            • Instruction Fuzzy Hash: 6A21BE3554A6C1CFC313CB10C840B11FFA1EF57208F19CADAD48A4B6A3C736A81ADB92
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E807E8 Relevance: .1, Instructions: 51COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: ede5e8f9e3acda8f1781c2a92a97d99ec8880dd788ee186f770b83ea51759470
            • Instruction ID: 71e791314a28b12c72f6d60e6c4cae9f97d0b183a1d5eef22580a4ed31511b42
            • Opcode Fuzzy Hash: ede5e8f9e3acda8f1781c2a92a97d99ec8880dd788ee186f770b83ea51759470
            • Instruction Fuzzy Hash: 12018071E00204DFCB54EFB8D84159EBBFAEB89254711857AC509D7304EB359D45CBD0
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E807F8 Relevance: .0, Instructions: 46COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 7f86c494a0fd131561c6bf910beb29ba315fbd3af0c990e4e65fadc9e3f007d5
            • Instruction ID: 3fba69c8ffa92c898febe7281063aeb147e3361784d6f4b8b6225a063a435ab5
            • Opcode Fuzzy Hash: 7f86c494a0fd131561c6bf910beb29ba315fbd3af0c990e4e65fadc9e3f007d5
            • Instruction Fuzzy Hash: 1F015A71E00214DFCB54EBB8D84059EBBEAEB89254B10857AC90AE7305EB35AD06CB90
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E81E20 Relevance: .0, Instructions: 45COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 5a08161c5134b6dfa46eab234d8f6836683ca41372c226bacc2db31aa8caa36d
            • Instruction ID: ddc6ee206913ce8313fee5a98b5ca4c2f57b5c4aa099f1015956abfdfb79a968
            • Opcode Fuzzy Hash: 5a08161c5134b6dfa46eab234d8f6836683ca41372c226bacc2db31aa8caa36d
            • Instruction Fuzzy Hash: 6811A172A09345CFD701EF75E468499BBE2EFC1308B00CD5AE4498B399EB318C58CB96
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E205DF Relevance: .0, Instructions: 43COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074813719.0000000002E20000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e20000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: f190d0e0ba131cc070318a2117a94822a233b4c3a2abcf0d85fc38f9ae4cdc42
            • Instruction ID: 620e9fc9699f077cdcd7e3490f72c4a91ce3698e3f51eead759e2b1c754e0f9f
            • Opcode Fuzzy Hash: f190d0e0ba131cc070318a2117a94822a233b4c3a2abcf0d85fc38f9ae4cdc42
            • Instruction Fuzzy Hash: E301F2751493805FC3118F16AC018A2FFA8EF8623070984EBE8888B612D235A918C771
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E81BF4 Relevance: .0, Instructions: 39COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 25a3c957cadfb43bd09e0e7463488a2041bca3d2309b7e28fad01247b5d2a255
            • Instruction ID: 3f0cb6530586e6b10c4d77e1eba4cfcb651b52b345d0b59de67e1d4ee450c13a
            • Opcode Fuzzy Hash: 25a3c957cadfb43bd09e0e7463488a2041bca3d2309b7e28fad01247b5d2a255
            • Instruction Fuzzy Hash: 93014F35B40544CFDB08E7B4C155BEC77E2EF48218F1080A4D50D9B7A2DB3AAD55DB26
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E825A0 Relevance: .0, Instructions: 37COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 09339aee3c1ac315ae97f44f39b922c0b6d2f484136e40076d5ae8c2b7c8de5d
            • Instruction ID: 4ea61f1fe5c882ee2ffd8697566817ba5afcffb4f4e99abbeaf60206e968d24d
            • Opcode Fuzzy Hash: 09339aee3c1ac315ae97f44f39b922c0b6d2f484136e40076d5ae8c2b7c8de5d
            • Instruction Fuzzy Hash: CEF04FB2D00219DFCF10EBB9C8466DEBBF4EB48214F500576D609E7200E6369A00CBE1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E20E20 Relevance: .0, Instructions: 31COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074813719.0000000002E20000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e20000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 53963eade7438ca410e32634de66363e024afaa3f40a7da14d248b9d76a52dc3
            • Instruction ID: 01b9b582849ec8c34f528810fcfbc7439329bc7448e4251b11b6897145365fa1
            • Opcode Fuzzy Hash: 53963eade7438ca410e32634de66363e024afaa3f40a7da14d248b9d76a52dc3
            • Instruction Fuzzy Hash: 5DF01D35144644DFC716CF00D540B15FBA2FB89718F24CAADE94907762C737E813DA81
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E20606 Relevance: .0, Instructions: 27COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074813719.0000000002E20000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e20000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 6c1efc614ab680f08cca34ebd98f066f5b7beef04c98ba5be74c474af648c3c4
            • Instruction ID: 87657440aacd472f581a535e15194853fcc609659da87a81706aae4dd2194c2c
            • Opcode Fuzzy Hash: 6c1efc614ab680f08cca34ebd98f066f5b7beef04c98ba5be74c474af648c3c4
            • Instruction Fuzzy Hash: 7AE092766007444BD650CF0BEC41462F794EB84A30B08C07FDC0D8B711E276F508CAA5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E82CA9 Relevance: .0, Instructions: 27COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 8c5a7225826a6f5378017c940619170dcc93c29e2020c786213432f9c790ece1
            • Instruction ID: ffd95d9b03007d00e73c4119ffbb421c4f9b661d7eaa0afc5e6ee91ab370e5b8
            • Opcode Fuzzy Hash: 8c5a7225826a6f5378017c940619170dcc93c29e2020c786213432f9c790ece1
            • Instruction Fuzzy Hash: 90E09272A00110DFCB10DB79E055ADDBBF5EB89312B21C4BAD059D3301DB3259068B50
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E80ECC Relevance: .0, Instructions: 26COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 92a2c82b6b648f98e53971ec3d86d27000fda5cad53cbeee1ef6b128c9b299b7
            • Instruction ID: c863e9ba205267e9c9abcddda1cbdcb50a6617939e363871f87a86ff330684de
            • Opcode Fuzzy Hash: 92a2c82b6b648f98e53971ec3d86d27000fda5cad53cbeee1ef6b128c9b299b7
            • Instruction Fuzzy Hash: 8DF05E31A14108DBDF08EFB8E5545AE73B3BF84209B109128E00E97391CF359C89CB40
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E80E31 Relevance: .0, Instructions: 26COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 38ab7086a2a9e64be611fb6a8f080659100b05d85af9841ef5a93d8b7a2ccca3
            • Instruction ID: da6f8828304f0eafe70de44ed5e768bf2313d224e10b4ae45671c64cf4b4d33d
            • Opcode Fuzzy Hash: 38ab7086a2a9e64be611fb6a8f080659100b05d85af9841ef5a93d8b7a2ccca3
            • Instruction Fuzzy Hash: D4F05E31A54648DBDF58EF75E5546AE73B3BF88209B109128E00E97351CF319D89CB10
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E81C3E Relevance: .0, Instructions: 22COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: f6a109f55a80159811056e6d81debd85adfffb612683eb50dbd8ce742d1d57c7
            • Instruction ID: 3799829f272fe125371874367a9608195a3e7206a891d96bedf49e060eb40bfe
            • Opcode Fuzzy Hash: f6a109f55a80159811056e6d81debd85adfffb612683eb50dbd8ce742d1d57c7
            • Instruction Fuzzy Hash: A2E04F327005049FCF44B7B4D4126EC73A2EF84118F1080A5D20D87651DB29AD248762
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E80451 Relevance: .0, Instructions: 16COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: d367e02a1d17ece5e3bfbc5754b568ce1d3ee3d52dc688c75502bfb2491a37d0
            • Instruction ID: 3a731573b8d8db048068579e7a4391137b68a207b19f92067937d4830acb4c32
            • Opcode Fuzzy Hash: d367e02a1d17ece5e3bfbc5754b568ce1d3ee3d52dc688c75502bfb2491a37d0
            • Instruction Fuzzy Hash: 9BD05E21A080E0CBCA53A37830396FC3F65DF86114B080599D48782347CE010D128B49
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DA23F4 Relevance: .0, Instructions: 15COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074280084.0000000002DA2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA2000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2da2000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: b247f43ab70ab7ecf0a9ceeb084fb8fef518ca6e7de28abd74d5d2cff2d5fb1e
            • Instruction ID: 16eb90b4e39459a7a04e9260814c30e0e5e1db383198def8f96e82822b3c2579
            • Opcode Fuzzy Hash: b247f43ab70ab7ecf0a9ceeb084fb8fef518ca6e7de28abd74d5d2cff2d5fb1e
            • Instruction Fuzzy Hash: C8D05EB92046C14FE3168A1CC2A9F9537D4AB61708F4644F9AC408B7A3C7A8D986D240
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02DA23BC Relevance: .0, Instructions: 14COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074280084.0000000002DA2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA2000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2da2000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 7f7c6759293aa2eceec2932425bebec5050307137029215a4c52a3707db45e25
            • Instruction ID: 4b19cc15d84046607074ae4b3f9f29516c45fc9a560f0e8df3e32f36f4699652
            • Opcode Fuzzy Hash: 7f7c6759293aa2eceec2932425bebec5050307137029215a4c52a3707db45e25
            • Instruction Fuzzy Hash: 2CD05E342005814BDB15CA0DC2E8F5937D4AB41708F1644ECBC508B762C3B8DCC5CA00
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E80460 Relevance: .0, Instructions: 13COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000001.00000002.4074939096.0000000002E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_1_2_2e80000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 29bd947788d5ad5abd18a20b6396c088d7531719d11f1da536141f2cbcf4039a
            • Instruction ID: a0d232a835a98e27932beae1e5e047320902f085d4b7e714bfd472be901df0d7
            • Opcode Fuzzy Hash: 29bd947788d5ad5abd18a20b6396c088d7531719d11f1da536141f2cbcf4039a
            • Instruction Fuzzy Hash: C5C08C31B44164C70E06B2A970398AE378EEF8A6613050029EA0BC3386DF011C108BEE
            Uniqueness

            Uniqueness Score: -1.00%

            Execution Graph

            Execution Coverage:23.9%
            Dynamic/Decrypted Code Coverage:100%
            Signature Coverage:0%
            Total number of Nodes:88
            Total number of Limit Nodes:4
            execution_graph 2714 5f704b6 2715 5f704e4 FormatMessageW 2714->2715 2717 5f7056e 2715->2717 2746 2cda70c 2747 2cda73a FindCloseChangeNotification 2746->2747 2749 2cda774 2747->2749 2750 2cdb60c 2752 2cdb632 ConvertStringSecurityDescriptorToSecurityDescriptorW 2750->2752 2753 2cdb6ab 2752->2753 2754 2cdaa0f 2755 2cdaa46 CreateFileW 2754->2755 2757 2cdaacd 2755->2757 2718 2cdb087 2719 2cdb0c6 setsockopt 2718->2719 2721 2cdb10c 2719->2721 2616 2cdb0c6 2617 2cdb0fe setsockopt 2616->2617 2618 2cdb136 2616->2618 2619 2cdb10c 2617->2619 2618->2617 2620 2cdaa46 2621 2cdaa7e CreateFileW 2620->2621 2623 2cdaacd 2621->2623 2694 2cdb7c2 2697 2cdb7e2 OpenFileMappingW 2694->2697 2696 2cdb855 2697->2696 2758 2cdab1c 2759 2cdab5e GetFileType 2758->2759 2761 2cdabc0 2759->2761 2632 2cdb2de 2633 2cdb30a closesocket 2632->2633 2634 2cdb340 2632->2634 2635 2cdb318 2633->2635 2634->2633 2636 2cdbc5e 2639 2cdbc96 CreateMutexW 2636->2639 2638 2cdbcd9 2639->2638 2644 2cdae1e 2646 2cdae53 ReadFile 2644->2646 2647 2cdae85 2646->2647 2730 2cda459 2732 2cda49a RegQueryValueExW 2730->2732 2733 2cda523 2732->2733 2698 2cda2d2 2701 2cda2d6 SetErrorMode 2698->2701 2700 2cda33f 2701->2700 2722 2cdb8a4 2725 2cdb8e2 MapViewOfFile 2722->2725 2724 2cdb969 2725->2724 2726 2cdb2a6 2727 2cdb2de closesocket 2726->2727 2729 2cdb318 2727->2729 2738 2cda361 2739 2cda392 RegOpenKeyExW 2738->2739 2741 2cda420 2739->2741 2667 2cdb7e2 2669 2cdb81a OpenFileMappingW 2667->2669 2670 2cdb855 2669->2670 2766 5f70007 2767 5f70032 DuplicateHandle 2766->2767 2769 5f700b7 2767->2769 2679 2cda2fe 2680 2cda32a SetErrorMode 2679->2680 2681 2cda353 2679->2681 2682 2cda33f 2680->2682 2681->2680 2702 2cdadfe 2703 2cdae1e ReadFile 2702->2703 2705 2cdae85 2703->2705 2683 2cda73a 2684 2cda7a5 2683->2684 2685 2cda766 FindCloseChangeNotification 2683->2685 2684->2685 2686 2cda774 2685->2686 2770 2cdbc31 2772 2cdbc5e CreateMutexW 2770->2772 2773 2cdbcd9 2772->2773 2774 5f7020b 2776 5f7023e WSAConnect 2774->2776 2777 5f70292 2776->2777 2706 2cdbef0 2707 2cdbf0e GetProcessTimes 2706->2707 2709 2cdbf95 2707->2709 2710 5f702ca 2711 5f70306 getaddrinfo 2710->2711 2713 5f703b3 2711->2713 2742 2cdaf73 2743 2cdaf95 WSASocketW 2742->2743 2745 2cdb036 2743->2745 2778 2cda632 2780 2cda652 RegSetValueExW 2778->2780 2781 2cda6d3 2780->2781

            Executed Functions

            Function 05F702CA Relevance: 1.6, APIs: 1, Instructions: 104COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 0 5f702ca-5f703a3 6 5f703f5-5f703fa 0->6 7 5f703a5-5f703ad getaddrinfo 0->7 6->7 8 5f703b3-5f703c5 7->8 10 5f703c7-5f703f2 8->10 11 5f703fc-5f70401 8->11 11->10
            APIs
            • getaddrinfo.WS2_32(?,00000E90), ref: 05F703AB
            Memory Dump Source
            • Source File: 00000005.00000002.1969912734.0000000005F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F70000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_5f70000_WindowsUpdate.jbxd
            Similarity
            • API ID: getaddrinfo
            • String ID:
            • API String ID: 300660673-0
            • Opcode ID: 66c6f31af8ae56d0675cce0919a061b2406254bdd50e1726a9a907fb574dff2b
            • Instruction ID: 7b488e9bfe995e064a94b7ba6a9199ce8b5d037e98fa940e8a7af9cb3f468e18
            • Opcode Fuzzy Hash: 66c6f31af8ae56d0675cce0919a061b2406254bdd50e1726a9a907fb574dff2b
            • Instruction Fuzzy Hash: 3131C8715043846FEB21CB61CC44FE6BFBCEF06314F0444DAE9899B292D665A549CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDAA0F Relevance: 1.6, APIs: 1, Instructions: 98fileCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 15 2cdaa0f-2cdaa9e 19 2cdaaa0 15->19 20 2cdaaa3-2cdaaaf 15->20 19->20 21 2cdaab4-2cdaabd 20->21 22 2cdaab1 20->22 23 2cdaabf-2cdaae3 CreateFileW 21->23 24 2cdab0e-2cdab13 21->24 22->21 27 2cdab15-2cdab1a 23->27 28 2cdaae5-2cdab0b 23->28 24->23 27->28
            APIs
            • CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 02CDAAC5
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: CreateFile
            • String ID:
            • API String ID: 823142352-0
            • Opcode ID: dc70edea653a0f86aa5d4a0fc05bf1a52a24956e8bdd8a0019d98b2e6e9a2683
            • Instruction ID: 3f14c0c6aa0bf1f5039f4c664bfd68dfe3a14740d28b6009c750b209082c8625
            • Opcode Fuzzy Hash: dc70edea653a0f86aa5d4a0fc05bf1a52a24956e8bdd8a0019d98b2e6e9a2683
            • Instruction Fuzzy Hash: F031A3B1505380AFE722CF25CC44FA6BFF8EF46214F08859AE9898B652D375E509CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05F70007 Relevance: 1.6, APIs: 1, Instructions: 97COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 31 5f70007-5f700a7 36 5f700ff-5f70104 31->36 37 5f700a9-5f700b1 DuplicateHandle 31->37 36->37 39 5f700b7-5f700c9 37->39 40 5f70106-5f7010b 39->40 41 5f700cb-5f700fc 39->41 40->41
            APIs
            • DuplicateHandle.KERNELBASE(?,00000E90), ref: 05F700AF
            Memory Dump Source
            • Source File: 00000005.00000002.1969912734.0000000005F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F70000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_5f70000_WindowsUpdate.jbxd
            Similarity
            • API ID: DuplicateHandle
            • String ID:
            • API String ID: 3793708945-0
            • Opcode ID: 8f8d384bd4a6db8b01856beecf2a33e10be4aee99bb1f7d07c10aa090b228b61
            • Instruction ID: 16b46278b862f5ea7554e4c80cd2442669dbfffcdaa92be0652a0988ecc8b5c6
            • Opcode Fuzzy Hash: 8f8d384bd4a6db8b01856beecf2a33e10be4aee99bb1f7d07c10aa090b228b61
            • Instruction Fuzzy Hash: E731B572504344AFEB228F61DC44FABBFBCEF05224F04489AF985CB552D365A549CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDAF73 Relevance: 1.6, APIs: 1, Instructions: 96networkCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 45 2cdaf73-2cdaf93 46 2cdafb5-2cdb026 45->46 47 2cdaf95-2cdafb2 45->47 52 2cdb028-2cdb030 WSASocketW 46->52 53 2cdb077-2cdb07c 46->53 47->46 54 2cdb036-2cdb04c 52->54 53->52 56 2cdb07e-2cdb083 54->56 57 2cdb04e-2cdb074 54->57 56->57
            APIs
            • WSASocketW.WS2_32(?,?,?,?,?), ref: 02CDB02E
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: Socket
            • String ID:
            • API String ID: 38366605-0
            • Opcode ID: 616b01db7dfc0e13d373a0b886c61cae975785ca50b2814467501d387a1059cd
            • Instruction ID: 24eb561f1936f6839eef424c11eec83274dea78183ee2b26d2a1ab9ec94da84b
            • Opcode Fuzzy Hash: 616b01db7dfc0e13d373a0b886c61cae975785ca50b2814467501d387a1059cd
            • Instruction Fuzzy Hash: A031B6710097C05FD7128B61CC54B55BFB4EF07214F0988DBE9858F193C365A508CB72
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDA361 Relevance: 1.6, APIs: 1, Instructions: 90registryCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 60 2cda361-2cda3ed 64 2cda3ef 60->64 65 2cda3f2-2cda409 60->65 64->65 67 2cda44b-2cda450 65->67 68 2cda40b-2cda41e RegOpenKeyExW 65->68 67->68 69 2cda420-2cda448 68->69 70 2cda452-2cda457 68->70 70->69
            APIs
            • RegOpenKeyExW.KERNELBASE(?,00000E90), ref: 02CDA411
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: Open
            • String ID:
            • API String ID: 71445658-0
            • Opcode ID: fd0828d208ac7af2444cc689d68cca0c3a97f3a5059ad59a2447f47af5c95a76
            • Instruction ID: 3fe61dc55eecb4ee2597a088aa0dba40bf15d2698ffd4f2720294a1553f27b80
            • Opcode Fuzzy Hash: fd0828d208ac7af2444cc689d68cca0c3a97f3a5059ad59a2447f47af5c95a76
            • Instruction Fuzzy Hash: 71318472509784AFE721CF51CC44F9ABFBCEF05214F04849BE9858B652D364A94DCB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDA459 Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 75 2cda459-2cda4d7 78 2cda4dc-2cda4e5 75->78 79 2cda4d9 75->79 80 2cda4ea-2cda4f0 78->80 81 2cda4e7 78->81 79->78 82 2cda4f5-2cda50c 80->82 83 2cda4f2 80->83 81->80 85 2cda50e-2cda521 RegQueryValueExW 82->85 86 2cda543-2cda548 82->86 83->82 87 2cda54a-2cda54f 85->87 88 2cda523-2cda540 85->88 86->85 87->88
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,947D7848,00000000,00000000,00000000,00000000), ref: 02CDA514
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 2d7ec9c840fa36b148207e9e0119ee5d9016d849d7c88d42182cb95d13c3cdcc
            • Instruction ID: d2e02545bf36373c910ef6eeeb0893e7dcb60c09dfa3b831276033207220d4de
            • Opcode Fuzzy Hash: 2d7ec9c840fa36b148207e9e0119ee5d9016d849d7c88d42182cb95d13c3cdcc
            • Instruction Fuzzy Hash: F831A2765097846FD722CF21CC44FA6BFB8EF46214F08849AE985CB253D364E548CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDBEF0 Relevance: 1.6, APIs: 1, Instructions: 89timeCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 107 2cdbef0-2cdbf85 112 2cdbf87-2cdbf8f GetProcessTimes 107->112 113 2cdbfd2-2cdbfd7 107->113 114 2cdbf95-2cdbfa7 112->114 113->112 116 2cdbfd9-2cdbfde 114->116 117 2cdbfa9-2cdbfcf 114->117 116->117
            APIs
            • GetProcessTimes.KERNELBASE(?,00000E90,947D7848,00000000,00000000,00000000,00000000), ref: 02CDBF8D
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: ProcessTimes
            • String ID:
            • API String ID: 1995159646-0
            • Opcode ID: e9c5328a2c46a7d9e7371b50e9fabb7a82ddf44e07c8b0dec04e5f42db865c53
            • Instruction ID: 18c3accb69199afb0930300ca0a2ce9e4f9b63fe98e3f1600239d64e3faf6aad
            • Opcode Fuzzy Hash: e9c5328a2c46a7d9e7371b50e9fabb7a82ddf44e07c8b0dec04e5f42db865c53
            • Instruction Fuzzy Hash: 2031D5725097806FEB128F60DC45B96BFB8EF06314F0884DAE985CF153D325A909CBB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDB60C Relevance: 1.6, APIs: 1, Instructions: 89COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 92 2cdb60c-2cdb68d 96 2cdb68f 92->96 97 2cdb692-2cdb69b 92->97 96->97 98 2cdb69d-2cdb6a5 ConvertStringSecurityDescriptorToSecurityDescriptorW 97->98 99 2cdb6f3-2cdb6f8 97->99 101 2cdb6ab-2cdb6bd 98->101 99->98 102 2cdb6bf-2cdb6f0 101->102 103 2cdb6fa-2cdb6ff 101->103 103->102
            APIs
            • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E90), ref: 02CDB6A3
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: DescriptorSecurity$ConvertString
            • String ID:
            • API String ID: 3907675253-0
            • Opcode ID: 673de1badc1f7b73207a4f6c61d26cd95dee70ef178cdadb0a713915af5a03e7
            • Instruction ID: 0f52543a6c78b14e1ec64b5504acd2f70fe25339ceb9c931dd7ab7952cf184c1
            • Opcode Fuzzy Hash: 673de1badc1f7b73207a4f6c61d26cd95dee70ef178cdadb0a713915af5a03e7
            • Instruction Fuzzy Hash: 9B31B171504384AFEB21CB65DC45FAABBB8EF45214F08849AE984CB652D364A909CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDB8A4 Relevance: 1.6, APIs: 1, Instructions: 87fileCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 120 2cdb8a4-2cdb94e 125 2cdb950-2cdb967 MapViewOfFile 120->125 126 2cdb992-2cdb997 120->126 127 2cdb999-2cdb99e 125->127 128 2cdb969-2cdb98f 125->128 126->125 127->128
            APIs
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileView
            • String ID:
            • API String ID: 3314676101-0
            • Opcode ID: 4ac833e55c5b7d053816e4b751d7169046255d3e4ad3b00e321fdbf122737274
            • Instruction ID: 46c4567ea6ed3c0589bea418ca6508b40a1c581235028b73ba53ddc3b417067c
            • Opcode Fuzzy Hash: 4ac833e55c5b7d053816e4b751d7169046255d3e4ad3b00e321fdbf122737274
            • Instruction Fuzzy Hash: 1931D371405380AFD712CF15CC45F96FFF8EF06324F04459AE9888B252D365A909CB75
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05F704B6 Relevance: 1.6, APIs: 1, Instructions: 86windowCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 132 5f704b6-5f70513 134 5f70516-5f70568 FormatMessageW 132->134 136 5f7056e-5f70597 134->136
            APIs
            • FormatMessageW.KERNELBASE(?,00000E90,?,?), ref: 05F70566
            Memory Dump Source
            • Source File: 00000005.00000002.1969912734.0000000005F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F70000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_5f70000_WindowsUpdate.jbxd
            Similarity
            • API ID: FormatMessage
            • String ID:
            • API String ID: 1306739567-0
            • Opcode ID: 2f2675358bfba90a52d9eb9fcb55becfaa364b83883f796b3c6f8deabc69d292
            • Instruction ID: 694a72b8711fd7c8400a81ff5aa74c113cad2e755d3a48795fb782524a7144c0
            • Opcode Fuzzy Hash: 2f2675358bfba90a52d9eb9fcb55becfaa364b83883f796b3c6f8deabc69d292
            • Instruction Fuzzy Hash: E9318F7150E3C45FD3038B618C61A66BFB4EF47610F1A80CBD884CF6A3D6256919C7B2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDBC31 Relevance: 1.6, APIs: 1, Instructions: 85synchronizationCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 138 2cdbc31-2cdbcad 142 2cdbcaf 138->142 143 2cdbcb2-2cdbcbb 138->143 142->143 144 2cdbcbd 143->144 145 2cdbcc0-2cdbcc9 143->145 144->145 146 2cdbccb-2cdbcef CreateMutexW 145->146 147 2cdbd1a-2cdbd1f 145->147 150 2cdbd21-2cdbd26 146->150 151 2cdbcf1-2cdbd17 146->151 147->146 150->151
            APIs
            • CreateMutexW.KERNELBASE(?,?), ref: 02CDBCD1
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: CreateMutex
            • String ID:
            • API String ID: 1964310414-0
            • Opcode ID: bd8a45040967b27b7c98c3875e8cfb627052ee6cd5ab59cba7b0dcbe9b36bd4c
            • Instruction ID: 0a7a86248062f315a225430fe8a3811f150f396bc4a66bb015b0b602a890d1b3
            • Opcode Fuzzy Hash: bd8a45040967b27b7c98c3875e8cfb627052ee6cd5ab59cba7b0dcbe9b36bd4c
            • Instruction Fuzzy Hash: C831B1B1509380AFE711CF25CC85B96FFF8EF46214F08849AE988CB252D365E908CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05F70306 Relevance: 1.6, APIs: 1, Instructions: 84COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 154 5f70306-5f703a3 159 5f703f5-5f703fa 154->159 160 5f703a5-5f703ad getaddrinfo 154->160 159->160 161 5f703b3-5f703c5 160->161 163 5f703c7-5f703f2 161->163 164 5f703fc-5f70401 161->164 164->163
            APIs
            • getaddrinfo.WS2_32(?,00000E90), ref: 05F703AB
            Memory Dump Source
            • Source File: 00000005.00000002.1969912734.0000000005F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F70000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_5f70000_WindowsUpdate.jbxd
            Similarity
            • API ID: getaddrinfo
            • String ID:
            • API String ID: 300660673-0
            • Opcode ID: fc38003c7ea2c68a13d71fe33b303960330f981b298fe915dbef892973fa40cb
            • Instruction ID: 480cc90edbfea9f08a4bbeb117075c203d1e86f8173a2626407fe93085cea0ad
            • Opcode Fuzzy Hash: fc38003c7ea2c68a13d71fe33b303960330f981b298fe915dbef892973fa40cb
            • Instruction Fuzzy Hash: D321A172640244AFEB20DF60CC85FBAFBACEF04714F04485AFA499A681D7B5A5498F71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDAB1C Relevance: 1.6, APIs: 1, Instructions: 80COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 168 2cdab1c-2cdaba9 172 2cdabde-2cdabe3 168->172 173 2cdabab-2cdabbe GetFileType 168->173 172->173 174 2cdabe5-2cdabea 173->174 175 2cdabc0-2cdabdd 173->175 174->175
            APIs
            • GetFileType.KERNELBASE(?,00000E90,947D7848,00000000,00000000,00000000,00000000), ref: 02CDABB1
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileType
            • String ID:
            • API String ID: 3081899298-0
            • Opcode ID: 1f5b70249a4b31debb04ab142db3ab6a8983dcb427feaccb37a26160f17ddf64
            • Instruction ID: 375122e454155807f9fd0a26eec13664d0e76dee67f569cba4d3e2fd7236aa3b
            • Opcode Fuzzy Hash: 1f5b70249a4b31debb04ab142db3ab6a8983dcb427feaccb37a26160f17ddf64
            • Instruction Fuzzy Hash: 632137B54093806FE7128B21DC85BA2BFBCEF47324F0880D6E9848B293D264A90DC771
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05F70032 Relevance: 1.6, APIs: 1, Instructions: 80COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 179 5f70032-5f700a7 183 5f700ff-5f70104 179->183 184 5f700a9-5f700b1 DuplicateHandle 179->184 183->184 186 5f700b7-5f700c9 184->186 187 5f70106-5f7010b 186->187 188 5f700cb-5f700fc 186->188 187->188
            APIs
            • DuplicateHandle.KERNELBASE(?,00000E90), ref: 05F700AF
            Memory Dump Source
            • Source File: 00000005.00000002.1969912734.0000000005F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F70000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_5f70000_WindowsUpdate.jbxd
            Similarity
            • API ID: DuplicateHandle
            • String ID:
            • API String ID: 3793708945-0
            • Opcode ID: e4f954d9f2eff65a79b8ab98bfaebec9eb59aac8ac7f27969d90d7161f3d61b7
            • Instruction ID: 55ae64749341b00fc15292788aa02a51476ae4d94a808572461b5a91f587a508
            • Opcode Fuzzy Hash: e4f954d9f2eff65a79b8ab98bfaebec9eb59aac8ac7f27969d90d7161f3d61b7
            • Instruction Fuzzy Hash: 0E21A472600208AFEB21CF65DC44FABBBACEF04224F04886AE985DB651D775E5488F71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDB7C2 Relevance: 1.6, APIs: 1, Instructions: 78COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 192 2cdb7c2-2cdb831 196 2cdb836-2cdb845 192->196 197 2cdb833 192->197 198 2cdb847-2cdb86b OpenFileMappingW 196->198 199 2cdb896-2cdb89b 196->199 197->196 202 2cdb89d-2cdb8a2 198->202 203 2cdb86d-2cdb893 198->203 199->198 202->203
            APIs
            • OpenFileMappingW.KERNELBASE(?,?), ref: 02CDB84D
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileMappingOpen
            • String ID:
            • API String ID: 1680863896-0
            • Opcode ID: a0e48ee3c842c8afea37fd85dfcaed7aac7381f7ed2b321983cf0f2fe53088b0
            • Instruction ID: 5ced45b4795ecb6156b0f385034f33ee7726671fc4d4fcb1b31417b298865ad2
            • Opcode Fuzzy Hash: a0e48ee3c842c8afea37fd85dfcaed7aac7381f7ed2b321983cf0f2fe53088b0
            • Instruction Fuzzy Hash: 0D2183715053806FEB11CB65CC45FAAFFF8EF45214F08889AE9898B252D375E908CB75
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDA56A Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,?,?), ref: 02CDA606
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 3f474a44beca47179627d73b07265a682ca7073f3dc04ed4e0c7d49521b2db38
            • Instruction ID: e315b1c9a76234f31c9189053515c49381f09195448554efe1d19bb5f13a782f
            • Opcode Fuzzy Hash: 3f474a44beca47179627d73b07265a682ca7073f3dc04ed4e0c7d49521b2db38
            • Instruction Fuzzy Hash: BD21077550D3C06FC3138B25CC51B62BFB4EF87614F0A81CBE8888B653D2256919C7B2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDAA46 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON
            Download Yara Rule
            APIs
            • CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 02CDAAC5
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: CreateFile
            • String ID:
            • API String ID: 823142352-0
            • Opcode ID: dbc6238f1dea2700e695f98fa213aa06cd776e885d7cbe62397671acdeacc746
            • Instruction ID: a770f320d13ae3adbd968734ef60204d5a73e4342fed29d66cb570a6a74e46d9
            • Opcode Fuzzy Hash: dbc6238f1dea2700e695f98fa213aa06cd776e885d7cbe62397671acdeacc746
            • Instruction Fuzzy Hash: A421C171600244AFEB20CF25CD85F66FBE8EF08214F08856AEA498B751D375E508CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDB632 Relevance: 1.6, APIs: 1, Instructions: 76COMMON
            Download Yara Rule
            APIs
            • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E90), ref: 02CDB6A3
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: DescriptorSecurity$ConvertString
            • String ID:
            • API String ID: 3907675253-0
            • Opcode ID: ceaf050ed62bb8a64e5ee35020b7ed0f416428d126cf10d044d4290d6f676095
            • Instruction ID: 68e71e2c1fecd3c6e6bf6ae4a3836b0b555caca8539a67fe2c9b4325ea5f23b3
            • Opcode Fuzzy Hash: ceaf050ed62bb8a64e5ee35020b7ed0f416428d126cf10d044d4290d6f676095
            • Instruction Fuzzy Hash: 5C21D176600244AFEB20CF25DC45FAABBECEF44618F04846AEA45DB741D774E909CBB1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDB526 Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,947D7848,00000000,00000000,00000000,00000000), ref: 02CDB5B8
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 1fa047585fd40f7a6fb78a2d86e0d900031a816eeaf866799f2be0ccb114075b
            • Instruction ID: 59dd6c9a65fcbf4b0a07181d7ffca35967d031ffe480e0a905a557ae4df7df65
            • Opcode Fuzzy Hash: 1fa047585fd40f7a6fb78a2d86e0d900031a816eeaf866799f2be0ccb114075b
            • Instruction Fuzzy Hash: AB219A72504384AFD722CF11CC44FA6BBB8EF45214F08849AEA89CB652D364E948CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDA632 Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON
            Download Yara Rule
            APIs
            • RegSetValueExW.KERNELBASE(?,00000E90,947D7848,00000000,00000000,00000000,00000000), ref: 02CDA6C4
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: Value
            • String ID:
            • API String ID: 3702945584-0
            • Opcode ID: 909bc60fa2ffbfadf5a5dee2a5d1938b25a9ac8b8bb9c601ebc0a612641df9bd
            • Instruction ID: d83d7d57bf4d185260dd95dda98d2c171b0c326c0bfc08e660aa020c1fd75350
            • Opcode Fuzzy Hash: 909bc60fa2ffbfadf5a5dee2a5d1938b25a9ac8b8bb9c601ebc0a612641df9bd
            • Instruction Fuzzy Hash: 7D21B076504380AFE722CF11CC44FA7BFBCEF45614F08849AE9858B252D364E949CB75
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDA392 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON
            Download Yara Rule
            APIs
            • RegOpenKeyExW.KERNELBASE(?,00000E90), ref: 02CDA411
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: Open
            • String ID:
            • API String ID: 71445658-0
            • Opcode ID: cfdbe146990eb3b9e4e42da41c5ab8d0d0243a1d4133ba9bebd8ae6460aff476
            • Instruction ID: 9448a3214c70e31c7cb8088093a6d427f1ca0724b554e9125d3ba3251a26d1c1
            • Opcode Fuzzy Hash: cfdbe146990eb3b9e4e42da41c5ab8d0d0243a1d4133ba9bebd8ae6460aff476
            • Instruction Fuzzy Hash: 0C21AE72500204AEEB20DF55CC44FABFBECEF08618F04845AEE498B651D764E94DCAB6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDBC5E Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON
            Download Yara Rule
            APIs
            • CreateMutexW.KERNELBASE(?,?), ref: 02CDBCD1
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: CreateMutex
            • String ID:
            • API String ID: 1964310414-0
            • Opcode ID: a310b766f3a6b318c3816c8c327c8e623f13161ccc1736709693595ec5095408
            • Instruction ID: 0ab4352dff72cb7cfb834b193ade1ccbaa1274a81533e83b9bf3b2644e315234
            • Opcode Fuzzy Hash: a310b766f3a6b318c3816c8c327c8e623f13161ccc1736709693595ec5095408
            • Instruction Fuzzy Hash: CA21A471600644AFE720CF65CD45BAAFBE8EF44218F04886AEE48CB741D775E909CB75
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDADFE Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON
            Download Yara Rule
            APIs
            • ReadFile.KERNELBASE(?,00000E90,947D7848,00000000,00000000,00000000,00000000), ref: 02CDAE7D
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileRead
            • String ID:
            • API String ID: 2738559852-0
            • Opcode ID: 41b9952b72392099fdbda728e93112469dbf7326cc5d5a2084427ac78c2c95d1
            • Instruction ID: 5c2eede9f141d91b86e8a519db3081f20f310e1c172e796cfea0da58f05758c0
            • Opcode Fuzzy Hash: 41b9952b72392099fdbda728e93112469dbf7326cc5d5a2084427ac78c2c95d1
            • Instruction Fuzzy Hash: C121A172505380AFDB22CF51DC44FA7BFB8EF45214F08849AE9899B652C365A508CBB6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDA49A Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,947D7848,00000000,00000000,00000000,00000000), ref: 02CDA514
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: bb8cb0e55dc5b1213d1fe93db2ee659df6a9b2f81bc0a2d478728c68f382d86e
            • Instruction ID: 63b04f325f7037197f7d6344519053aee110f9aab4ed594273d0dc4319e15f65
            • Opcode Fuzzy Hash: bb8cb0e55dc5b1213d1fe93db2ee659df6a9b2f81bc0a2d478728c68f382d86e
            • Instruction Fuzzy Hash: 7121A276600604AFEB20CF15CC44FA7F7ECEF44614F04846AEE45CB651D364E648CAB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDB7E2 Relevance: 1.6, APIs: 1, Instructions: 68COMMON
            Download Yara Rule
            APIs
            • OpenFileMappingW.KERNELBASE(?,?), ref: 02CDB84D
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileMappingOpen
            • String ID:
            • API String ID: 1680863896-0
            • Opcode ID: 3f69337a58b5bd0d600e4ebfee370bbc1d6474553e0d8dfa961f690fb3ce2712
            • Instruction ID: 621df2cb1678af76b56f3e57e0c53053624cd2d06d1ab1ddc316610a13998b7a
            • Opcode Fuzzy Hash: 3f69337a58b5bd0d600e4ebfee370bbc1d6474553e0d8dfa961f690fb3ce2712
            • Instruction Fuzzy Hash: 4E219671504244AFEB10CF25CD45B6AFBE8EF04618F04846AEE498B741D375E908CB76
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDB087 Relevance: 1.6, APIs: 1, Instructions: 68COMMON
            Download Yara Rule
            APIs
            • setsockopt.WS2_32(?,?,?,?,?), ref: 02CDB104
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: setsockopt
            • String ID:
            • API String ID: 3981526788-0
            • Opcode ID: 23208acdf7ca4a2b58083c931c9d25a2ed2e898e84c521bd1afdec1d694dafd5
            • Instruction ID: 371ffee4458fb4b7bee0d3dbdf9b8e5e3646b9d982b6be68a34298d2148b1df8
            • Opcode Fuzzy Hash: 23208acdf7ca4a2b58083c931c9d25a2ed2e898e84c521bd1afdec1d694dafd5
            • Instruction Fuzzy Hash: 2121AC320093C09FDB128F65DC45AA6BFB4EF47324F0984DAD9C48F263D225A959CB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05F7020B Relevance: 1.6, APIs: 1, Instructions: 68networkCOMMON
            Download Yara Rule
            APIs
            • WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 05F7028A
            Memory Dump Source
            • Source File: 00000005.00000002.1969912734.0000000005F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F70000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_5f70000_WindowsUpdate.jbxd
            Similarity
            • API ID: Connect
            • String ID:
            • API String ID: 3144859779-0
            • Opcode ID: 2baa719551a8756702fca641264af5ea70d667befcb4a6663a322b7461b2cff9
            • Instruction ID: 7b6920f5f107f2443f63051d87c0aa5332111a5c5bcc028b03582801c0a6a2b0
            • Opcode Fuzzy Hash: 2baa719551a8756702fca641264af5ea70d667befcb4a6663a322b7461b2cff9
            • Instruction Fuzzy Hash: 33218375409784AFDB228F61CC44A92BFF4FF06310F0984DAE9858F562D375A419DB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDAFC2 Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON
            Download Yara Rule
            APIs
            • WSASocketW.WS2_32(?,?,?,?,?), ref: 02CDB02E
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: Socket
            • String ID:
            • API String ID: 38366605-0
            • Opcode ID: 7b1451c21a92277d085f38fedee42b32836fdabd2abcae3fb5c9ea67d990e34f
            • Instruction ID: e2dd77822fa38c9cdacd7b7fa0cde988df31b1258c271b814178b34685244979
            • Opcode Fuzzy Hash: 7b1451c21a92277d085f38fedee42b32836fdabd2abcae3fb5c9ea67d990e34f
            • Instruction Fuzzy Hash: 57219271500244AFEB21CF55DD45BAAFBA4EF04214F04885EEA458B651D375B518CBB1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDB8E2 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON
            Download Yara Rule
            APIs
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileView
            • String ID:
            • API String ID: 3314676101-0
            • Opcode ID: 70eb94d354f7cd2dd7c9eccb78ddc0658c22d2f5b3b5583d92c833eeb70999c2
            • Instruction ID: 422aa4756aacb766f689aed5b009507158f3e403a949c1b0d277c293265af2e9
            • Opcode Fuzzy Hash: 70eb94d354f7cd2dd7c9eccb78ddc0658c22d2f5b3b5583d92c833eeb70999c2
            • Instruction Fuzzy Hash: 7721A171500244AFEB21CF15CD45FAAFBE8EF08228F048459EA898B751D375A54CCBB6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDB546 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,947D7848,00000000,00000000,00000000,00000000), ref: 02CDB5B8
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 6b4d9d40028440cef0124c97fbd86f0fcf9c87c51c513e92b094aa83f1dff46c
            • Instruction ID: 52f876b5a0804e8a3ca77fbf7ea9308dc33b6fb806a15f78fb6494737b09e312
            • Opcode Fuzzy Hash: 6b4d9d40028440cef0124c97fbd86f0fcf9c87c51c513e92b094aa83f1dff46c
            • Instruction Fuzzy Hash: 4211D072600204AFEB21CF15CC41FAAFBECEF44718F08845AEA458B651E360E948CBB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDA652 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON
            Download Yara Rule
            APIs
            • RegSetValueExW.KERNELBASE(?,00000E90,947D7848,00000000,00000000,00000000,00000000), ref: 02CDA6C4
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: Value
            • String ID:
            • API String ID: 3702945584-0
            • Opcode ID: b9eb34fc999a8bc4188be6c52697a928e465cc61884f7e2958566c748f402e89
            • Instruction ID: 52a685fbd1acfa2b476536270ce1cbeaed91bc17fc542d458bf4e2e430f3bea0
            • Opcode Fuzzy Hash: b9eb34fc999a8bc4188be6c52697a928e465cc61884f7e2958566c748f402e89
            • Instruction Fuzzy Hash: 5811D076600204AFEB21CF15CC45FABFBECEF44614F04845AEE458A741D764E549CAB6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDBF2E Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON
            Download Yara Rule
            APIs
            • GetProcessTimes.KERNELBASE(?,00000E90,947D7848,00000000,00000000,00000000,00000000), ref: 02CDBF8D
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: ProcessTimes
            • String ID:
            • API String ID: 1995159646-0
            • Opcode ID: 2526d388051c4b686db16c310558e5778e87b3ea105544655f1d2753eeb547f2
            • Instruction ID: 57de47b9889a926578b779b9f410692331d28b11cdf55918cb3f39827cad3ef5
            • Opcode Fuzzy Hash: 2526d388051c4b686db16c310558e5778e87b3ea105544655f1d2753eeb547f2
            • Instruction Fuzzy Hash: C011E676600204AFEB21CF55DC44BAAFBA8EF44314F04846AEA45CB651D375E948CFB1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDB2A6 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
            Download Yara Rule
            APIs
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: closesocket
            • String ID:
            • API String ID: 2781271927-0
            • Opcode ID: 1e3d4bd6eb7bc85972e64e005c93d41985b34f1bd6651f3ca5418d9ea508f58a
            • Instruction ID: f03e25c72f4525912ea376e6035ec58cfafb019a7d395d0428856ce6e8168f6a
            • Opcode Fuzzy Hash: 1e3d4bd6eb7bc85972e64e005c93d41985b34f1bd6651f3ca5418d9ea508f58a
            • Instruction Fuzzy Hash: FA216D7150D3C09FDB128B25DC54792BFB4EF47214F0984DADDC48F263D2659909DBA2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDAE1E Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON
            Download Yara Rule
            APIs
            • ReadFile.KERNELBASE(?,00000E90,947D7848,00000000,00000000,00000000,00000000), ref: 02CDAE7D
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileRead
            • String ID:
            • API String ID: 2738559852-0
            • Opcode ID: d247dbfd5d202939419ea870631192298f1f5167fe4549d8741a0b88a99120e8
            • Instruction ID: 25f57b1db6f38cf83f905fbbf52138fa1b37a520bd18c2555aa0156f1b0fe94d
            • Opcode Fuzzy Hash: d247dbfd5d202939419ea870631192298f1f5167fe4549d8741a0b88a99120e8
            • Instruction Fuzzy Hash: 2F112772500344AFEB21CF51DC44FAAFBA8EF44314F04845AEA888BA51C375E518CBB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDA70C Relevance: 1.6, APIs: 1, Instructions: 59COMMON
            Download Yara Rule
            APIs
            • FindCloseChangeNotification.KERNELBASE(?), ref: 02CDA76C
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: ChangeCloseFindNotification
            • String ID:
            • API String ID: 2591292051-0
            • Opcode ID: bf4a61cb4890749622a68d55fbbfbada592c685bb4785c9cd18c1221d17c0643
            • Instruction ID: e17bc78713c6e126c6a4b4bcdb9f2564f7508b660e2c75ca0d75c74972e92962
            • Opcode Fuzzy Hash: bf4a61cb4890749622a68d55fbbfbada592c685bb4785c9cd18c1221d17c0643
            • Instruction Fuzzy Hash: 9011C871509380AFDB12CF25DC94792BFB8EF42220F0C84DAED858F652D2759508CB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDA2D2 Relevance: 1.6, APIs: 1, Instructions: 53COMMON
            Download Yara Rule
            APIs
            • SetErrorMode.KERNELBASE(?), ref: 02CDA330
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: ErrorMode
            • String ID:
            • API String ID: 2340568224-0
            • Opcode ID: e008a0349cc54146eb4e9fbafd4bd6b320b0c0771967cc1970364a963981bbe3
            • Instruction ID: 7c6379416c36d8b309ecde9347843c5c77f07a0e6aeebf20ebcb8f77c458c8d9
            • Opcode Fuzzy Hash: e008a0349cc54146eb4e9fbafd4bd6b320b0c0771967cc1970364a963981bbe3
            • Instruction Fuzzy Hash: 541191758093C09FDB128B25DC54B52BFB4EF47224F0980DBDD898F263D265A949CB62
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDAB5E Relevance: 1.6, APIs: 1, Instructions: 52COMMON
            Download Yara Rule
            APIs
            • GetFileType.KERNELBASE(?,00000E90,947D7848,00000000,00000000,00000000,00000000), ref: 02CDABB1
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileType
            • String ID:
            • API String ID: 3081899298-0
            • Opcode ID: aa7c9b4c144f9353ae25ce1acb7f17c28f1e43bf035a26b3d2a067a21993fe9b
            • Instruction ID: b8c6c523f5ca5f1a095f6c133b65d6c10fc86240f3661a25b2e713aac5942ded
            • Opcode Fuzzy Hash: aa7c9b4c144f9353ae25ce1acb7f17c28f1e43bf035a26b3d2a067a21993fe9b
            • Instruction Fuzzy Hash: 9C01D271600244BFE720CB15DC85FAAFBA8DF44624F148096EE498B741D368E54DCAB6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05F7023E Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON
            Download Yara Rule
            APIs
            • WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 05F7028A
            Memory Dump Source
            • Source File: 00000005.00000002.1969912734.0000000005F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F70000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_5f70000_WindowsUpdate.jbxd
            Similarity
            • API ID: Connect
            • String ID:
            • API String ID: 3144859779-0
            • Opcode ID: 753794747441a6a8d9883398b3bfc642c4cf7d9213627f5eb8313fbcc40ac4b0
            • Instruction ID: 8e93031a67fb4e4ab0ef04f91284868548a94effd8264f77ff1030a48c754aac
            • Opcode Fuzzy Hash: 753794747441a6a8d9883398b3bfc642c4cf7d9213627f5eb8313fbcc40ac4b0
            • Instruction Fuzzy Hash: AF1170325006089FDB20CF55D848F66FBE9FF08210F0885AADE858B622D775E458CF61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05F70516 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
            Download Yara Rule
            APIs
            • FormatMessageW.KERNELBASE(?,00000E90,?,?), ref: 05F70566
            Memory Dump Source
            • Source File: 00000005.00000002.1969912734.0000000005F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F70000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_5f70000_WindowsUpdate.jbxd
            Similarity
            • API ID: FormatMessage
            • String ID:
            • API String ID: 1306739567-0
            • Opcode ID: 8f347fa8018bbb0a244685c5a104a019c8e09d7c1e80d8b334fc3184043ff8c1
            • Instruction ID: d8dc4dcfd4acc14e026bf08cb9c4245b687416e0af4a69197a762c2088e4a17b
            • Opcode Fuzzy Hash: 8f347fa8018bbb0a244685c5a104a019c8e09d7c1e80d8b334fc3184043ff8c1
            • Instruction Fuzzy Hash: 0501B171600200AFD310DF16CC46B66FBA8FB88A24F14816AEC089BB41D731B515CBE5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDB0C6 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
            Download Yara Rule
            APIs
            • setsockopt.WS2_32(?,?,?,?,?), ref: 02CDB104
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: setsockopt
            • String ID:
            • API String ID: 3981526788-0
            • Opcode ID: 08256a64ef868dbd81cf72d7ad8b676515acb52af8f704de784185f6318246f1
            • Instruction ID: c669c85dd06413e7728f315013d21a5e469630c8e90c921d22da422ee28d46fb
            • Opcode Fuzzy Hash: 08256a64ef868dbd81cf72d7ad8b676515acb52af8f704de784185f6318246f1
            • Instruction Fuzzy Hash: 20019E325007449FDB20CF56DD85B66FBF0EF48324F0884AADE498B612D376A558CFA2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDA73A Relevance: 1.5, APIs: 1, Instructions: 43COMMON
            Download Yara Rule
            APIs
            • FindCloseChangeNotification.KERNELBASE(?), ref: 02CDA76C
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: ChangeCloseFindNotification
            • String ID:
            • API String ID: 2591292051-0
            • Opcode ID: 4128bf704448ab5b60eb399f6246e5c4a16f17db7d11a6223e76aebc7c3e6241
            • Instruction ID: bf870fd80f7d419d70be73e717ae4c842ec1f7b131ef90f7715b03f56331cde9
            • Opcode Fuzzy Hash: 4128bf704448ab5b60eb399f6246e5c4a16f17db7d11a6223e76aebc7c3e6241
            • Instruction Fuzzy Hash: A501DF71A002049FEB10CF25D8847A6FBA4EF40220F08C4AADE49CB752D375E548CA62
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDA5B6 Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,?,?), ref: 02CDA606
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: e161ec96b52924026ae5d89a71652eb450e81c22902ff25bcdf4f1afa1777d6f
            • Instruction ID: 43ab7da33a6440110053cec041ff653ff8d3b30afa79f4c00af8d3b5d3afa7f2
            • Opcode Fuzzy Hash: e161ec96b52924026ae5d89a71652eb450e81c22902ff25bcdf4f1afa1777d6f
            • Instruction Fuzzy Hash: D001A271500600AFD210DF16CC46B66FBA4FB88A24F14815AEC089BB41D771F515CBE5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDB2DE Relevance: 1.5, APIs: 1, Instructions: 39COMMON
            Download Yara Rule
            APIs
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: closesocket
            • String ID:
            • API String ID: 2781271927-0
            • Opcode ID: fa3f951997983d76cff11ce004cfe7398ec4dbf0d048acd506a0f05d5b796624
            • Instruction ID: 4ea02a4a888d1aeee3b7c09cca1fd5c70ab578f98a59d10141ca3d5db958f022
            • Opcode Fuzzy Hash: fa3f951997983d76cff11ce004cfe7398ec4dbf0d048acd506a0f05d5b796624
            • Instruction Fuzzy Hash: 2101D131A00244DFDB10CF15D884766FBA4EF44628F08C4AADE498F706D779E948CEA2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CDA2FE Relevance: 1.5, APIs: 1, Instructions: 35COMMON
            Download Yara Rule
            APIs
            • SetErrorMode.KERNELBASE(?), ref: 02CDA330
            Memory Dump Source
            • Source File: 00000005.00000002.1964617819.0000000002CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cda000_WindowsUpdate.jbxd
            Similarity
            • API ID: ErrorMode
            • String ID:
            • API String ID: 2340568224-0
            • Opcode ID: ed0fadfa72dd3e9b89de2dd2bfb90e803ba8fafe6a34ab2ca803da4a52cdd127
            • Instruction ID: 02b4f988aba60e61a568d8449af1a874e78f0024a8ccd917f9c5ce6541943820
            • Opcode Fuzzy Hash: ed0fadfa72dd3e9b89de2dd2bfb90e803ba8fafe6a34ab2ca803da4a52cdd127
            • Instruction Fuzzy Hash: 8DF0AF35904244DFDB10CF0AD885765FBA0EF44725F08C4AADE494B752D3B9E548CEA2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 030209F0 Relevance: .4, Instructions: 379COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 25ef23fa5d893f825f8403d7ea50e0e5ffbbc58b5737a239f57fa8f210971b9f
            • Instruction ID: 8d48496d409fe1234106d8285159163eb1acbed51ed1ecbe4760f8954f8fe27f
            • Opcode Fuzzy Hash: 25ef23fa5d893f825f8403d7ea50e0e5ffbbc58b5737a239f57fa8f210971b9f
            • Instruction Fuzzy Hash: E3E16C30B02204DFCB58DBB8D594AADBBF3AF89304F2544A9E405AB361DB35ED85CB51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 030209E2 Relevance: .3, Instructions: 292COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 20185fd41d9de25115370843879dca6a4175be4360b5a6ea7f1b67198a6277df
            • Instruction ID: 4579219020e4c875673ac46949a0f6f1afad73a84189d715f46e5cb9a0531fef
            • Opcode Fuzzy Hash: 20185fd41d9de25115370843879dca6a4175be4360b5a6ea7f1b67198a6277df
            • Instruction Fuzzy Hash: 81C14C34B02204DFCB58DBB8D594AADBBF3AF89304F2544A8E405AB361DB35ED85CB51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03021349 Relevance: .3, Instructions: 271COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 7f26c8a5d3355824fb250061f2b307c9d07c8a560f86947aeaa91a5d94bb99b4
            • Instruction ID: 31ae35ced919760dd3cb54a44afa805d8c8156099de2490e1706341c8483b88e
            • Opcode Fuzzy Hash: 7f26c8a5d3355824fb250061f2b307c9d07c8a560f86947aeaa91a5d94bb99b4
            • Instruction Fuzzy Hash: E2C12834A00254CFCB48DF78D598AAEB7F2EF8C304B1584A9D815AB761DB35AC45CF60
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03020F98 Relevance: .3, Instructions: 267COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: c95f1c3c16946901e7d6d0185015724ff5c5ca3ca7d677faf0a990540de399fc
            • Instruction ID: 515a20a9c210c38a3844383de0e04f4e6227cb8a9bcb6b9a31ea2c879ba3aefd
            • Opcode Fuzzy Hash: c95f1c3c16946901e7d6d0185015724ff5c5ca3ca7d677faf0a990540de399fc
            • Instruction Fuzzy Hash: BFB17E34A01215DFCB1CDFB8D484A9DBBF2AF49314F1582A9E925AB3A0DB31EC45CB51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03020A68 Relevance: .3, Instructions: 251COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 5ebc3421bb1876dbb12a0a72454968d31074e28de5778383c861c2c62ce4fffe
            • Instruction ID: e9f669b9d09eadfd0749a445fc3eea70c2e2262f93c1550bc8e382a8999be4c1
            • Opcode Fuzzy Hash: 5ebc3421bb1876dbb12a0a72454968d31074e28de5778383c861c2c62ce4fffe
            • Instruction Fuzzy Hash: 61A15E34B02204DFCB48DBB8D594AADB7F3AF89308F2544A8E405AB761DB35ED85CB51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 030213B8 Relevance: .2, Instructions: 215COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 96b35cd6990db9918ffdf4ee8c51cea381b3e7a6b38d1b4d552a382f4bf83871
            • Instruction ID: 569f3b36aef1419e4a87f22a1ee3c287968ddc62697d6f9ce75d72040ace3d95
            • Opcode Fuzzy Hash: 96b35cd6990db9918ffdf4ee8c51cea381b3e7a6b38d1b4d552a382f4bf83871
            • Instruction Fuzzy Hash: 63912834B002548FCB48EF78D554AEEB7F2AF8C304B1584A9D815AB761DB35AD45CF60
            Uniqueness

            Uniqueness Score: -1.00%

            Function 030213D6 Relevance: .2, Instructions: 211COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 099ac4b889bd7d5043774bdbecfb49e5d354dbb5561293532523bb2bbfeaf598
            • Instruction ID: 6aadb307d0d4fc1e99f71db66b62faa223d70e42359ce862631693aca9ee8daf
            • Opcode Fuzzy Hash: 099ac4b889bd7d5043774bdbecfb49e5d354dbb5561293532523bb2bbfeaf598
            • Instruction Fuzzy Hash: 41913834B002588FCB48EF78D554AEEB7F2AF8C304B1584A9D815AB761DB35AD49CF60
            Uniqueness

            Uniqueness Score: -1.00%

            Function 030213E9 Relevance: .2, Instructions: 210COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 4d0ce2bba570bf2ed496040c81293788796f4221349428a38025f8c1a0920b01
            • Instruction ID: a5709f2362cf621a93a1174372a7351de8c52ea912fb15c947b6fae47d8f6856
            • Opcode Fuzzy Hash: 4d0ce2bba570bf2ed496040c81293788796f4221349428a38025f8c1a0920b01
            • Instruction Fuzzy Hash: A6914934B002588FCB48EF78D554AEEB7F2AF8C304B1584A9D815AB761DB35AD49CF60
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03020006 Relevance: .2, Instructions: 199COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: b7d6788e06b605867bc32044e9f0f624968d2e97161a8f59859c714379afbad9
            • Instruction ID: cec8aba3106f3efd205f376659328fcf3abb47ad0dd3bb6d5c93c9721f5f1fb9
            • Opcode Fuzzy Hash: b7d6788e06b605867bc32044e9f0f624968d2e97161a8f59859c714379afbad9
            • Instruction Fuzzy Hash: E2811570D052889FCB06DFA5D9506EDBFF2AF8A304F1480AAC445AB361DB355D49CF11
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03020070 Relevance: .2, Instructions: 150COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 0e589b363b052de8d21f9f3c1f0270857541564a9fbad2e5e892378c240bc8ab
            • Instruction ID: ef495876914bc07c8596f7f1a1c5e4f4f003678ba9b051bed1a91a337bfb0824
            • Opcode Fuzzy Hash: 0e589b363b052de8d21f9f3c1f0270857541564a9fbad2e5e892378c240bc8ab
            • Instruction Fuzzy Hash: 9A61CCB4E012089FCB48DFA5D994AADBBF2AF89304F208169D809AB364DB355D45CF51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03020628 Relevance: .1, Instructions: 139COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 3159711cf17323cee9059bb585d40259da84f0dda936fb2dbebb321d6f67b355
            • Instruction ID: 55941f4f95bd325a2d2ddf501f0245ca07fb9d3c6b35267ccdb50b515fb87769
            • Opcode Fuzzy Hash: 3159711cf17323cee9059bb585d40259da84f0dda936fb2dbebb321d6f67b355
            • Instruction Fuzzy Hash: 4F515B34F02214CBDB14DBB4D498AAEBBF6AF88304F148569E406EB390DB75AC45CF90
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03020F88 Relevance: .1, Instructions: 129COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 1d0dcf16b7923614c204e9bc81e27b8988e237a1d16f16598ba01f91a8634df6
            • Instruction ID: 0a69f6c4b5a250cfdd9ea59852b2647ddfe60f71f5363b9720cf55cab2a1d97b
            • Opcode Fuzzy Hash: 1d0dcf16b7923614c204e9bc81e27b8988e237a1d16f16598ba01f91a8634df6
            • Instruction Fuzzy Hash: 82515C30E01244DFDB18DF79D484A9DBBF2EF48314F6985A9E821AB3A0DB75AC41CB54
            Uniqueness

            Uniqueness Score: -1.00%

            Function 0302130B Relevance: .1, Instructions: 114COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: dc5df4831d217085b816bceeb3c5cbfc84eb87a1c52718893958add1a6b9071e
            • Instruction ID: ba13e6208f33333cd59ce6d9b164dcd7bf936b3252b0b9c1dc94dd73061ef798
            • Opcode Fuzzy Hash: dc5df4831d217085b816bceeb3c5cbfc84eb87a1c52718893958add1a6b9071e
            • Instruction Fuzzy Hash: EF413F30E01254DFDB18DF79D484A9CBBF2AF48314F698699E811AB3A0DB75DC81CB54
            Uniqueness

            Uniqueness Score: -1.00%

            Function 030208E8 Relevance: .1, Instructions: 78COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 6d4a658ebc92c5c5431dc21af4ecb93530e78fd60bc91d115eba8b2321fb5755
            • Instruction ID: f4f8531d1d2563aa2ac4be1c6ea0598f5a982d40abfad38dfe48c273d9ff1cbb
            • Opcode Fuzzy Hash: 6d4a658ebc92c5c5431dc21af4ecb93530e78fd60bc91d115eba8b2321fb5755
            • Instruction Fuzzy Hash: CD217130B002158FDB04EF64C5456EDB7F2AF89218F648569D419AB341DB369D4ACBD1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 030208D8 Relevance: .1, Instructions: 77COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 1ed79c0838e16c2cd1c509dd7467f6e36b9da2a1bf76ecbae2956e84ca7eda5e
            • Instruction ID: 7fd14b1dbb5a7f2d1d564ecba09d95d7afd45f94134e87c3d107e6d3a9fd575d
            • Opcode Fuzzy Hash: 1ed79c0838e16c2cd1c509dd7467f6e36b9da2a1bf76ecbae2956e84ca7eda5e
            • Instruction Fuzzy Hash: 66219431B012159FCB04DF68C4817EDBBF2AF89314F688569D009AB341D7369E4ACB91
            Uniqueness

            Uniqueness Score: -1.00%

            Function 030207E8 Relevance: .1, Instructions: 53COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 19e519008c8540a23686a60a3cb3a3591a431bbdd5de7e81157fbbb9b6c6e559
            • Instruction ID: 484fc6640cd03b631fa9f9d232126dda7569fa52e886768572821e101e4382f2
            • Opcode Fuzzy Hash: 19e519008c8540a23686a60a3cb3a3591a431bbdd5de7e81157fbbb9b6c6e559
            • Instruction Fuzzy Hash: B311AD71E00214DFCB54DF78C885AAEBBF6EF89254720857AC54AD7314EB31AD06CB90
            Uniqueness

            Uniqueness Score: -1.00%

            Function 030207F8 Relevance: .0, Instructions: 46COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 1c356ff43e931ab4f16031e3ce71b5620e056b47605c1df985dca14163815453
            • Instruction ID: ca9b377c1912bde01f12209e57f3a8def34a8002fe3bbfdfd364c6835c3e2c23
            • Opcode Fuzzy Hash: 1c356ff43e931ab4f16031e3ce71b5620e056b47605c1df985dca14163815453
            • Instruction Fuzzy Hash: 72017C71E002159FCB54DFB8D84059EBBFAFF89254B10857AC90AE7314EB31AD46CB90
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03020E31 Relevance: .0, Instructions: 45COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: f0b6e9e890ac24ae643a974f61b75a70b9846889499ec4367809a1c6582e36b8
            • Instruction ID: a9946e9c644fa5af510f01ad40fa38e63f198e3c96d189e48fa4908365ee94cf
            • Opcode Fuzzy Hash: f0b6e9e890ac24ae643a974f61b75a70b9846889499ec4367809a1c6582e36b8
            • Instruction Fuzzy Hash: 8F01B530B016149BCB58EB79D854B6EB6F3AFC4208F148129E40AAB7A0DF319D46C751
            Uniqueness

            Uniqueness Score: -1.00%

            Function 037F05DF Relevance: .0, Instructions: 43COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1969170825.00000000037F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 037F0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_37f0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: a7a0e2faac9271041550523e00c11508c1dbfb0965c53f1fea64b508faea6926
            • Instruction ID: a61dda9f54f6e937ecdbba58e37b9cc437830bbc03c731d0d62e09d5bac1c9a7
            • Opcode Fuzzy Hash: a7a0e2faac9271041550523e00c11508c1dbfb0965c53f1fea64b508faea6926
            • Instruction Fuzzy Hash: 6A0186765097846FD7118F06EC44866FFB8EF86620709C4EFE8498B712D225B808CB72
            Uniqueness

            Uniqueness Score: -1.00%

            Function 037F0606 Relevance: .0, Instructions: 27COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1969170825.00000000037F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 037F0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_37f0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 00d3cfa07f3633c5d227353d930c6313c7b14e79f72bbe7164f8eed05cc94b04
            • Instruction ID: 7c373fc9dcf92047e90ce671495a4c6e4fd1959d5e7d87241c4d2e5b9fe6315b
            • Opcode Fuzzy Hash: 00d3cfa07f3633c5d227353d930c6313c7b14e79f72bbe7164f8eed05cc94b04
            • Instruction Fuzzy Hash: CCE092766006045FD650CF0AEC41452F7E4EB84630B18C07FDC0D8B711D276B508CAA5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03020ECC Relevance: .0, Instructions: 26COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 3e22a823cab76ad782f0b31ec8e3e4b2bf27e6afab3e3ece35417b74b96ad552
            • Instruction ID: d162b92350520a73f408595a7055fdeb06953235323c65b904f19b837c40d070
            • Opcode Fuzzy Hash: 3e22a823cab76ad782f0b31ec8e3e4b2bf27e6afab3e3ece35417b74b96ad552
            • Instruction Fuzzy Hash: 44F05E30A06214DBDF58EFB8E5486AD77F3BF84209B108568E00A972A0CF359C85CB40
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03020451 Relevance: .0, Instructions: 20COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 2e3e0506a8b314468b2953501f38087c6e68e527bd0c2ea25872266d73335f08
            • Instruction ID: 6aa9be52f5e33b735232325707b022c9e46979db9d3e34dbdb8471ad9ca292e2
            • Opcode Fuzzy Hash: 2e3e0506a8b314468b2953501f38087c6e68e527bd0c2ea25872266d73335f08
            • Instruction Fuzzy Hash: 71E0C2325040E08FCB66677868656FC3FB6EF8B21030D09C9C482CB212CF152822DB92
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CD23F4 Relevance: .0, Instructions: 15COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1964602652.0000000002CD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD2000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cd2000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: fa06ad713c303171aa4e8810508af793311bf0db29d00421365f5f572be3583a
            • Instruction ID: 7a74a2e7054447359bf206c969818a2d8170d980f47366eb1a4ad8b54bcef6c5
            • Opcode Fuzzy Hash: fa06ad713c303171aa4e8810508af793311bf0db29d00421365f5f572be3583a
            • Instruction Fuzzy Hash: 7ED05EB92056C14FE3178A1CC2A8F9537D4AB91708F4644FAAC408B7A3C768EA86E241
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02CD23BC Relevance: .0, Instructions: 14COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1964602652.0000000002CD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD2000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_2cd2000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: b57b0f2ab0aa8970dc5cd4081a97ee82dd9d8cd32d18025b9332b7dca2f794b6
            • Instruction ID: 18a396aabbe544200e4052d83971fcfa8726b3a62702e14e724f62939c513d12
            • Opcode Fuzzy Hash: b57b0f2ab0aa8970dc5cd4081a97ee82dd9d8cd32d18025b9332b7dca2f794b6
            • Instruction Fuzzy Hash: D4D05E342005814BD715CA0CC2D4F5937D8AB80708F1644E8BC148B762C3B4D9C5CA01
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03020460 Relevance: .0, Instructions: 13COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000005.00000002.1968987751.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_5_2_3020000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: a0379405c401c20d29490f7a6ad444f70d059d9a014eda41584f74adf999f98d
            • Instruction ID: c78bab1dfa6e117438e01ce9562eb7ac46c942f9b14de4fbde067f3d180eeb24
            • Opcode Fuzzy Hash: a0379405c401c20d29490f7a6ad444f70d059d9a014eda41584f74adf999f98d
            • Instruction Fuzzy Hash: AEC08C31B80164C74E2D32A870182AE378EEA89561304021AEA1BCB340DF091C109BEB
            Uniqueness

            Uniqueness Score: -1.00%

            Execution Graph

            Execution Coverage:24%
            Dynamic/Decrypted Code Coverage:100%
            Signature Coverage:0%
            Total number of Nodes:88
            Total number of Limit Nodes:4
            execution_graph 2721 2e0a361 2722 2e0a392 RegOpenKeyExW 2721->2722 2724 2e0a420 2722->2724 2603 2e0b7e2 2604 2e0b81a OpenFileMappingW 2603->2604 2606 2e0b855 2604->2606 2705 2e0b8a4 2706 2e0b8e2 MapViewOfFile 2705->2706 2708 2e0b969 2706->2708 2737 5f8033d 2740 5f8037e WSAConnect 2737->2740 2739 5f803d2 2740->2739 2709 2e0b2a6 2710 2e0b2de closesocket 2709->2710 2712 2e0b318 2710->2712 2713 5f804b6 2714 5f804e4 FormatMessageW 2713->2714 2716 5f8056e 2714->2716 2689 2e0bef0 2690 2e0bf0e GetProcessTimes 2689->2690 2692 2e0bf95 2690->2692 2745 2e0bc31 2746 2e0bc5e CreateMutexW 2745->2746 2748 2e0bcd9 2746->2748 2749 2e0a632 2750 2e0a652 RegSetValueExW 2749->2750 2752 2e0a6d3 2750->2752 2729 2e0af73 2730 2e0af95 WSASocketW 2729->2730 2732 2e0b036 2730->2732 2634 2e0a73a 2635 2e0a7a5 2634->2635 2636 2e0a766 FindCloseChangeNotification 2634->2636 2635->2636 2637 2e0a774 2636->2637 2638 2e0a2fe 2639 2e0a353 2638->2639 2640 2e0a32a SetErrorMode 2638->2640 2639->2640 2641 2e0a33f 2640->2641 2693 2e0adfe 2694 2e0ae1e ReadFile 2693->2694 2696 2e0ae85 2694->2696 2697 2e0b7c2 2698 2e0b7e2 OpenFileMappingW 2697->2698 2700 2e0b855 2698->2700 2646 2e0b0c6 2647 2e0b0fe setsockopt 2646->2647 2648 2e0b136 2646->2648 2649 2e0b10c 2647->2649 2648->2647 2650 2e0aa46 2652 2e0aa7e CreateFileW 2650->2652 2653 2e0aacd 2652->2653 2717 2e0b087 2720 2e0b0c6 setsockopt 2717->2720 2719 2e0b10c 2720->2719 2753 2e0a70c 2755 2e0a73a FindCloseChangeNotification 2753->2755 2756 2e0a774 2755->2756 2757 2e0b60c 2758 2e0b632 ConvertStringSecurityDescriptorToSecurityDescriptorW 2757->2758 2760 2e0b6ab 2758->2760 2761 2e0aa0f 2762 2e0aa46 CreateFileW 2761->2762 2764 2e0aacd 2762->2764 2701 2e0a2d2 2704 2e0a2d6 SetErrorMode 2701->2704 2703 2e0a33f 2704->2703 2765 5f8020b 2767 5f8023e getaddrinfo 2765->2767 2768 5f802eb 2767->2768 2733 2e0a459 2734 2e0a49a RegQueryValueExW 2733->2734 2736 2e0a523 2734->2736 2769 2e0ab1c 2771 2e0ab5e GetFileType 2769->2771 2772 2e0abc0 2771->2772 2673 2e0b2de 2674 2e0b340 2673->2674 2675 2e0b30a closesocket 2673->2675 2674->2675 2676 2e0b318 2675->2676 2677 2e0bc5e 2678 2e0bc96 CreateMutexW 2677->2678 2680 2e0bcd9 2678->2680 2685 2e0ae1e 2687 2e0ae53 ReadFile 2685->2687 2688 2e0ae85 2687->2688 2773 5f80006 2775 5f80032 DuplicateHandle 2773->2775 2776 5f800b7 2775->2776

            Executed Functions

            Function 03080007 Relevance: .2, Instructions: 204COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 7557af41dd0116877b6a472365c68df536ec4ccc02e6cc9e0941218307523604
            • Instruction ID: 8588ac678b7725be48a347cf92b571a61ebd325c29b8dfed14d543bc389edc3d
            • Opcode Fuzzy Hash: 7557af41dd0116877b6a472365c68df536ec4ccc02e6cc9e0941218307523604
            • Instruction Fuzzy Hash: 43811570D052889FCB16DFA5D950ADDBFF2AF8A304F2480AAD444AB362DB359D49CF11
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05F8020B Relevance: 1.6, APIs: 1, Instructions: 101COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 0 5f8020b-5f802db 6 5f8032d-5f80332 0->6 7 5f802dd-5f802e5 getaddrinfo 0->7 6->7 9 5f802eb-5f802fd 7->9 10 5f802ff-5f8032a 9->10 11 5f80334-5f80339 9->11 11->10
            APIs
            • getaddrinfo.WS2_32(?,00000E90), ref: 05F802E3
            Memory Dump Source
            • Source File: 00000008.00000002.2049667400.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_5f80000_WindowsUpdate.jbxd
            Similarity
            • API ID: getaddrinfo
            • String ID:
            • API String ID: 300660673-0
            • Opcode ID: 4ff55bce0674be1d19d486a0a8ff07edf9b826b90e7ea9ba923e9d5229e28fa9
            • Instruction ID: c10fff72af76dfc283ae2d426b2d29439b913635c4bc9ca1b2b85d12a2337c8a
            • Opcode Fuzzy Hash: 4ff55bce0674be1d19d486a0a8ff07edf9b826b90e7ea9ba923e9d5229e28fa9
            • Instruction Fuzzy Hash: 5031B8715043846FE721CB60DC44FEABBBCEF05314F04449AF9899B292D375A949CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0AA0F Relevance: 1.6, APIs: 1, Instructions: 98fileCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 15 2e0aa0f-2e0aa9e 19 2e0aaa0 15->19 20 2e0aaa3-2e0aaaf 15->20 19->20 21 2e0aab1 20->21 22 2e0aab4-2e0aabd 20->22 21->22 23 2e0ab0e-2e0ab13 22->23 24 2e0aabf-2e0aae3 CreateFileW 22->24 23->24 27 2e0ab15-2e0ab1a 24->27 28 2e0aae5-2e0ab0b 24->28 27->28
            APIs
            • CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 02E0AAC5
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: CreateFile
            • String ID:
            • API String ID: 823142352-0
            • Opcode ID: 83be0bf36d7543e1d3d5a6d87cf14b69ec833e8411b80cada78e8ac7b0e72d9a
            • Instruction ID: 7357beeb012c143334c7aa75d5cbc0923e082e4341188f038c6e272334144773
            • Opcode Fuzzy Hash: 83be0bf36d7543e1d3d5a6d87cf14b69ec833e8411b80cada78e8ac7b0e72d9a
            • Instruction Fuzzy Hash: F331C5B15053806FE722CF25CC44F62BFF8EF06214F08849AE9858B292D375E509CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05F80006 Relevance: 1.6, APIs: 1, Instructions: 98COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 31 5f80006-5f800a7 36 5f800a9-5f800b1 DuplicateHandle 31->36 37 5f800ff-5f80104 31->37 39 5f800b7-5f800c9 36->39 37->36 40 5f800cb-5f800fc 39->40 41 5f80106-5f8010b 39->41 41->40
            APIs
            • DuplicateHandle.KERNELBASE(?,00000E90), ref: 05F800AF
            Memory Dump Source
            • Source File: 00000008.00000002.2049667400.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_5f80000_WindowsUpdate.jbxd
            Similarity
            • API ID: DuplicateHandle
            • String ID:
            • API String ID: 3793708945-0
            • Opcode ID: 4244098009927ead63722e39c2c501ea4ea870307ea5c1547e7bc76466c7e7ec
            • Instruction ID: e233efa83cb58c9df8bcb3d51591610f05145668f335a0482f23d6f9b034e3a5
            • Opcode Fuzzy Hash: 4244098009927ead63722e39c2c501ea4ea870307ea5c1547e7bc76466c7e7ec
            • Instruction Fuzzy Hash: 8131C472504344AFEB228F61CC44FB7BBBCEF05224F04489AF985CB562D325A549CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0AF73 Relevance: 1.6, APIs: 1, Instructions: 96networkCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 45 2e0af73-2e0af93 46 2e0afb5-2e0b026 45->46 47 2e0af95-2e0afb2 45->47 52 2e0b077-2e0b07c 46->52 53 2e0b028-2e0b030 WSASocketW 46->53 47->46 52->53 55 2e0b036-2e0b04c 53->55 56 2e0b07e-2e0b083 55->56 57 2e0b04e-2e0b074 55->57 56->57
            APIs
            • WSASocketW.WS2_32(?,?,?,?,?), ref: 02E0B02E
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: Socket
            • String ID:
            • API String ID: 38366605-0
            • Opcode ID: 0c1afbdfdc47c908aa35f5c023b9f2eb1414fc59c26e609d2761769ffe2035b6
            • Instruction ID: 8ed40d6452012e43a8f97b7b1b650e4ff4e35cd89bfcfdf0fa568fa346cce62a
            • Opcode Fuzzy Hash: 0c1afbdfdc47c908aa35f5c023b9f2eb1414fc59c26e609d2761769ffe2035b6
            • Instruction Fuzzy Hash: 1B31A3714097C09FE7228B61CC54B56BFB4AF06214F0988DBE9858F2A3C369A449CB72
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0A361 Relevance: 1.6, APIs: 1, Instructions: 90registryCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 60 2e0a361-2e0a3ed 64 2e0a3f2-2e0a409 60->64 65 2e0a3ef 60->65 67 2e0a44b-2e0a450 64->67 68 2e0a40b-2e0a41e RegOpenKeyExW 64->68 65->64 67->68 69 2e0a420-2e0a448 68->69 70 2e0a452-2e0a457 68->70 70->69
            APIs
            • RegOpenKeyExW.KERNELBASE(?,00000E90), ref: 02E0A411
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: Open
            • String ID:
            • API String ID: 71445658-0
            • Opcode ID: c098dcb92b9a5927c0861e06eb6accab59f575a1e05b6c0981034c20f3069e74
            • Instruction ID: 3a9af93b4d194452c50c8ba00e70c3ca9b280be2d68d98e3a64a3707a38eb0e1
            • Opcode Fuzzy Hash: c098dcb92b9a5927c0861e06eb6accab59f575a1e05b6c0981034c20f3069e74
            • Instruction Fuzzy Hash: DC31A472408384AFE7228F51CC84FA7BFBCEF05214F04849BE9858B652D324A94DCB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0BEF0 Relevance: 1.6, APIs: 1, Instructions: 89timeCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 107 2e0bef0-2e0bf85 112 2e0bfd2-2e0bfd7 107->112 113 2e0bf87-2e0bf8f GetProcessTimes 107->113 112->113 115 2e0bf95-2e0bfa7 113->115 116 2e0bfd9-2e0bfde 115->116 117 2e0bfa9-2e0bfcf 115->117 116->117
            APIs
            • GetProcessTimes.KERNELBASE(?,00000E90,5FA41E18,00000000,00000000,00000000,00000000), ref: 02E0BF8D
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: ProcessTimes
            • String ID:
            • API String ID: 1995159646-0
            • Opcode ID: 824add843fceeedfd36212515a19183fc9058295dfd620b5010832caf134c0e2
            • Instruction ID: 8cb4e15359ea4c187b3c1e491b6dac11b79efc8b2b2baf0367bb0a9747e9536a
            • Opcode Fuzzy Hash: 824add843fceeedfd36212515a19183fc9058295dfd620b5010832caf134c0e2
            • Instruction Fuzzy Hash: 603127725093806FDB128F60DC45BA6BFB8EF06314F0884DAE984CF193C325A949CBB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0A459 Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 75 2e0a459-2e0a4d7 78 2e0a4d9 75->78 79 2e0a4dc-2e0a4e5 75->79 78->79 80 2e0a4e7 79->80 81 2e0a4ea-2e0a4f0 79->81 80->81 82 2e0a4f2 81->82 83 2e0a4f5-2e0a50c 81->83 82->83 85 2e0a543-2e0a548 83->85 86 2e0a50e-2e0a521 RegQueryValueExW 83->86 85->86 87 2e0a523-2e0a540 86->87 88 2e0a54a-2e0a54f 86->88 88->87
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,5FA41E18,00000000,00000000,00000000,00000000), ref: 02E0A514
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 3154cd5201fc14bb9a55c7fade3edca1cb70426295c8651f0451b06018529e57
            • Instruction ID: fc0e914b58b763564e1ec16b98980e9454f852373e5ffbc6829ecf2752038ef3
            • Opcode Fuzzy Hash: 3154cd5201fc14bb9a55c7fade3edca1cb70426295c8651f0451b06018529e57
            • Instruction Fuzzy Hash: 3631A2765093845FD722CF21CC84FA6BFB8EF06218F08849AE985CB293D364E549CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0B60C Relevance: 1.6, APIs: 1, Instructions: 89COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 92 2e0b60c-2e0b68d 96 2e0b692-2e0b69b 92->96 97 2e0b68f 92->97 98 2e0b6f3-2e0b6f8 96->98 99 2e0b69d-2e0b6a5 ConvertStringSecurityDescriptorToSecurityDescriptorW 96->99 97->96 98->99 101 2e0b6ab-2e0b6bd 99->101 102 2e0b6fa-2e0b6ff 101->102 103 2e0b6bf-2e0b6f0 101->103 102->103
            APIs
            • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E90), ref: 02E0B6A3
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: DescriptorSecurity$ConvertString
            • String ID:
            • API String ID: 3907675253-0
            • Opcode ID: 30b725b995b11090a3a359a99f8c40539d3b5c670ba9e68403f26087d077fcc9
            • Instruction ID: 91bcad5acd02331b690ee518401d21df3932be01d5c440180cf28cf93d7ebc7d
            • Opcode Fuzzy Hash: 30b725b995b11090a3a359a99f8c40539d3b5c670ba9e68403f26087d077fcc9
            • Instruction Fuzzy Hash: 9E31B171504380AFE721CB65DC45FAABBB8FF05214F08849AE984DB652D364A949CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0B8A4 Relevance: 1.6, APIs: 1, Instructions: 87fileCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 120 2e0b8a4-2e0b94e 125 2e0b950-2e0b967 MapViewOfFile 120->125 126 2e0b992-2e0b997 120->126 127 2e0b999-2e0b99e 125->127 128 2e0b969-2e0b98f 125->128 126->125 127->128
            APIs
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileView
            • String ID:
            • API String ID: 3314676101-0
            • Opcode ID: 798050da4984f776116c3752c55546d5a0941c3c990e8f18d8df117d24656199
            • Instruction ID: dd333f9d137207efbbbacb9abec688b834cec15322c4d7adb5c2c44a448d4827
            • Opcode Fuzzy Hash: 798050da4984f776116c3752c55546d5a0941c3c990e8f18d8df117d24656199
            • Instruction Fuzzy Hash: 0631C1B1405380AFD712CF55CC85F96FFB8FF06328F04859AE9888B252D325A959CB75
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05F804B6 Relevance: 1.6, APIs: 1, Instructions: 86windowCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 132 5f804b6-5f80513 134 5f80516-5f80568 FormatMessageW 132->134 136 5f8056e-5f80597 134->136
            APIs
            • FormatMessageW.KERNELBASE(?,00000E90,?,?), ref: 05F80566
            Memory Dump Source
            • Source File: 00000008.00000002.2049667400.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_5f80000_WindowsUpdate.jbxd
            Similarity
            • API ID: FormatMessage
            • String ID:
            • API String ID: 1306739567-0
            • Opcode ID: f7a9d19e6fbd977329a75a33e8e27b271e760e7df754755ea39a5017e8fea4e8
            • Instruction ID: a869b11f9e440f159f8f51f053899a4c4ff6af3165a28b6942d35a61f93e6497
            • Opcode Fuzzy Hash: f7a9d19e6fbd977329a75a33e8e27b271e760e7df754755ea39a5017e8fea4e8
            • Instruction Fuzzy Hash: 2B318F7154E3C45FD3038B618C65A66BFB4EF47610F1A80CBD884CF6A3D6296919C7B2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0BC31 Relevance: 1.6, APIs: 1, Instructions: 85synchronizationCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 138 2e0bc31-2e0bcad 142 2e0bcb2-2e0bcbb 138->142 143 2e0bcaf 138->143 144 2e0bcc0-2e0bcc9 142->144 145 2e0bcbd 142->145 143->142 146 2e0bd1a-2e0bd1f 144->146 147 2e0bccb-2e0bcef CreateMutexW 144->147 145->144 146->147 150 2e0bd21-2e0bd26 147->150 151 2e0bcf1-2e0bd17 147->151 150->151
            APIs
            • CreateMutexW.KERNELBASE(?,?), ref: 02E0BCD1
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: CreateMutex
            • String ID:
            • API String ID: 1964310414-0
            • Opcode ID: cf374e0f187f94e3bd97ab23cd5caeab1198f100a10ef1e33601ac6d6824ec99
            • Instruction ID: af92ea8bd33f0472035c5c9f64a62b4972ac484da8f7fc5d3b688a9c72422926
            • Opcode Fuzzy Hash: cf374e0f187f94e3bd97ab23cd5caeab1198f100a10ef1e33601ac6d6824ec99
            • Instruction Fuzzy Hash: 1D3152B1505384AFE711CF65CC85F96FFB8EF06214F08849EE9888B292D365E949CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05F8023E Relevance: 1.6, APIs: 1, Instructions: 84COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 154 5f8023e-5f802db 159 5f8032d-5f80332 154->159 160 5f802dd-5f802e5 getaddrinfo 154->160 159->160 162 5f802eb-5f802fd 160->162 163 5f802ff-5f8032a 162->163 164 5f80334-5f80339 162->164 164->163
            APIs
            • getaddrinfo.WS2_32(?,00000E90), ref: 05F802E3
            Memory Dump Source
            • Source File: 00000008.00000002.2049667400.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_5f80000_WindowsUpdate.jbxd
            Similarity
            • API ID: getaddrinfo
            • String ID:
            • API String ID: 300660673-0
            • Opcode ID: d119e6ba4acad73ef0e307aa3c7ad6641844f1aa95e39ee262231bca2b85f859
            • Instruction ID: a07eeb74516239e5cc1cdca433070ac835fc25ec3c1e9202b6e12ee7a4e135fd
            • Opcode Fuzzy Hash: d119e6ba4acad73ef0e307aa3c7ad6641844f1aa95e39ee262231bca2b85f859
            • Instruction Fuzzy Hash: A421A172600204AEEB31DB60DC85FBAF7ACEF04714F04485AFA499A681D7B9A54D8B71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0AB1C Relevance: 1.6, APIs: 1, Instructions: 80COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 168 2e0ab1c-2e0aba9 172 2e0abab-2e0abbe GetFileType 168->172 173 2e0abde-2e0abe3 168->173 174 2e0abc0-2e0abdd 172->174 175 2e0abe5-2e0abea 172->175 173->172 175->174
            APIs
            • GetFileType.KERNELBASE(?,00000E90,5FA41E18,00000000,00000000,00000000,00000000), ref: 02E0ABB1
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileType
            • String ID:
            • API String ID: 3081899298-0
            • Opcode ID: e4776a973117a929cfc388c491be1b7c25e9832a7c78f527e0c9c0288d4cd21a
            • Instruction ID: 315b5d586eb11c7808818759b84024e1b211b10c9e1c1684f0748f94ccb063ff
            • Opcode Fuzzy Hash: e4776a973117a929cfc388c491be1b7c25e9832a7c78f527e0c9c0288d4cd21a
            • Instruction Fuzzy Hash: 822128B54493806FD7128B21DC85BA2BFBCEF07324F0880D6E9848B293D264A909C771
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05F80032 Relevance: 1.6, APIs: 1, Instructions: 80COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 179 5f80032-5f800a7 183 5f800a9-5f800b1 DuplicateHandle 179->183 184 5f800ff-5f80104 179->184 186 5f800b7-5f800c9 183->186 184->183 187 5f800cb-5f800fc 186->187 188 5f80106-5f8010b 186->188 188->187
            APIs
            • DuplicateHandle.KERNELBASE(?,00000E90), ref: 05F800AF
            Memory Dump Source
            • Source File: 00000008.00000002.2049667400.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_5f80000_WindowsUpdate.jbxd
            Similarity
            • API ID: DuplicateHandle
            • String ID:
            • API String ID: 3793708945-0
            • Opcode ID: e8480555f062fbcc6bd4d15a8ea2906088041715ff79eff83c7cbb26c905a791
            • Instruction ID: ee285c77f5d6884465e419e6f3208cdbb91255ddbbc30e7cf27a10d6f594700f
            • Opcode Fuzzy Hash: e8480555f062fbcc6bd4d15a8ea2906088041715ff79eff83c7cbb26c905a791
            • Instruction Fuzzy Hash: 7621C172600204AFEB21DF65CC44FBBBBACEF04224F04886AE985CB651D775E54C8BB1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0B7C2 Relevance: 1.6, APIs: 1, Instructions: 78COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 192 2e0b7c2-2e0b831 196 2e0b833 192->196 197 2e0b836-2e0b845 192->197 196->197 198 2e0b896-2e0b89b 197->198 199 2e0b847-2e0b86b OpenFileMappingW 197->199 198->199 202 2e0b89d-2e0b8a2 199->202 203 2e0b86d-2e0b893 199->203 202->203
            APIs
            • OpenFileMappingW.KERNELBASE(?,?), ref: 02E0B84D
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileMappingOpen
            • String ID:
            • API String ID: 1680863896-0
            • Opcode ID: f9c29d762adf733af41aa0353bb95d29374e7f50c7d9353e58422f65edfb154f
            • Instruction ID: e2f35091b974998aeec87074bc69c8be9b62a35090865ece5797c70c27ce7ada
            • Opcode Fuzzy Hash: f9c29d762adf733af41aa0353bb95d29374e7f50c7d9353e58422f65edfb154f
            • Instruction Fuzzy Hash: D321A3715053806FE711CB65CC85FA6FFE8EF05214F08889EE9888B292D375E549C776
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0A56A Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,?,?), ref: 02E0A606
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 6097b0e0e3006486ef33c9bfaccb91c7f7fb6afb3ca3058e39500c96e7755130
            • Instruction ID: 5878818794fa814243dddd3896746ca64d84505a25ac8f5e3a92e62b6ac930bd
            • Opcode Fuzzy Hash: 6097b0e0e3006486ef33c9bfaccb91c7f7fb6afb3ca3058e39500c96e7755130
            • Instruction Fuzzy Hash: AC21B3755093C06FD3138B258C51B62BFB4EF87614F0A85CBE8889B663D225691AC7B2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0AA46 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON
            Download Yara Rule
            APIs
            • CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 02E0AAC5
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: CreateFile
            • String ID:
            • API String ID: 823142352-0
            • Opcode ID: 08d7904d297bff03a016cf36836f03ef498b396379e2a5c522adf45c0bf01069
            • Instruction ID: 76348ae089ee70f97a87f195fd9edfaa57d3433dfe3c9dd7c6f85956cf453456
            • Opcode Fuzzy Hash: 08d7904d297bff03a016cf36836f03ef498b396379e2a5c522adf45c0bf01069
            • Instruction Fuzzy Hash: 2921B271600344AFEB21CF65CD85FA6FBE8EF08218F048469EA498B792D375E449CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0B632 Relevance: 1.6, APIs: 1, Instructions: 76COMMON
            Download Yara Rule
            APIs
            • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E90), ref: 02E0B6A3
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: DescriptorSecurity$ConvertString
            • String ID:
            • API String ID: 3907675253-0
            • Opcode ID: f3c7118d7fc22b147a2fd9bf4a5c6341c5ca0b2be6fe01714dae078307aff9f2
            • Instruction ID: acc117b6ee09daecbf356bea1bc933384594c3da78245659997bb6917f3c5971
            • Opcode Fuzzy Hash: f3c7118d7fc22b147a2fd9bf4a5c6341c5ca0b2be6fe01714dae078307aff9f2
            • Instruction Fuzzy Hash: 1421D771600244AFEB20CF65DC85FAABBACFF04218F04846AE945DB751D774E549CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0B526 Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,5FA41E18,00000000,00000000,00000000,00000000), ref: 02E0B5B8
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 97d4c77eefae6891d5b54f2072308c093d18a0ef4807739647e1258f082bcaa6
            • Instruction ID: 1d39cd60e899f7ea58e047b195f22a93cbf7f3dfb3ca22d4a9acbff37a0a6836
            • Opcode Fuzzy Hash: 97d4c77eefae6891d5b54f2072308c093d18a0ef4807739647e1258f082bcaa6
            • Instruction Fuzzy Hash: A721AF72504380AFD722CF11CC85FA7BBB8EF05318F08849AE985CB692D364E949CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0A632 Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON
            Download Yara Rule
            APIs
            • RegSetValueExW.KERNELBASE(?,00000E90,5FA41E18,00000000,00000000,00000000,00000000), ref: 02E0A6C4
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: Value
            • String ID:
            • API String ID: 3702945584-0
            • Opcode ID: 00ff905e6cc633457e2f1efab79e6a2708a07c0110462d37f7961ec885f633c5
            • Instruction ID: 26550f83cef3c09a801fd0a950e021c2ce16f20b7b3af464969202a338f61739
            • Opcode Fuzzy Hash: 00ff905e6cc633457e2f1efab79e6a2708a07c0110462d37f7961ec885f633c5
            • Instruction Fuzzy Hash: C521A1725043846FD722CF51DC84FA7BBBCEF05214F08849AE9859B292D364E449C775
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0A392 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON
            Download Yara Rule
            APIs
            • RegOpenKeyExW.KERNELBASE(?,00000E90), ref: 02E0A411
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: Open
            • String ID:
            • API String ID: 71445658-0
            • Opcode ID: e4470db3808009b12f159d8f845b9327d1ae9e2e856c0a7b908ba1ee721e1c22
            • Instruction ID: 6a926067a19817b9f21e4a440b221de4ffde0370c7f6e85bad2ed28b550912ce
            • Opcode Fuzzy Hash: e4470db3808009b12f159d8f845b9327d1ae9e2e856c0a7b908ba1ee721e1c22
            • Instruction Fuzzy Hash: C621D472500304AEE720DF51CC84FABFBACEF04218F04846AEE4587751D364E94DCAB2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0BC5E Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON
            Download Yara Rule
            APIs
            • CreateMutexW.KERNELBASE(?,?), ref: 02E0BCD1
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: CreateMutex
            • String ID:
            • API String ID: 1964310414-0
            • Opcode ID: b26c1d0479bda1a1bc40af097c0bd2b4ff9ca45b4094df1412e9ee4404ab99d5
            • Instruction ID: 87675b6056392f5a700f91d0f73f3cf2c503bc990b0ff328d77be53e7c67c6ac
            • Opcode Fuzzy Hash: b26c1d0479bda1a1bc40af097c0bd2b4ff9ca45b4094df1412e9ee4404ab99d5
            • Instruction Fuzzy Hash: AE21AF71600244AFE720CF65CC85BA6FBE8EF04218F08C46AE9488B781D775E44ACA75
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05F8033D Relevance: 1.6, APIs: 1, Instructions: 72networkCOMMON
            Download Yara Rule
            APIs
            • WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 05F803CA
            Memory Dump Source
            • Source File: 00000008.00000002.2049667400.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_5f80000_WindowsUpdate.jbxd
            Similarity
            • API ID: Connect
            • String ID:
            • API String ID: 3144859779-0
            • Opcode ID: 9e761bf5958caba1b73ce21d6ce8e40213e28b9856fa045e9baf9680c58e7dd3
            • Instruction ID: 3ad06cca23ea7811c4531c4bef721317d2db93f666379ae5181bfc4905b93eca
            • Opcode Fuzzy Hash: 9e761bf5958caba1b73ce21d6ce8e40213e28b9856fa045e9baf9680c58e7dd3
            • Instruction Fuzzy Hash: 8C21B071409380AFDB22CF64CC44B62BFB8FF06310F0884DAE9858B163D339A819DB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0ADFE Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON
            Download Yara Rule
            APIs
            • ReadFile.KERNELBASE(?,00000E90,5FA41E18,00000000,00000000,00000000,00000000), ref: 02E0AE7D
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileRead
            • String ID:
            • API String ID: 2738559852-0
            • Opcode ID: d909f5ace0783a183aabcb74ed195dcbd9df4d0597dcb094e34561f6550b292c
            • Instruction ID: c944a7ddae1d775ad38b19bdf31d1c37988d833c8842627a51e13f82d7e9c197
            • Opcode Fuzzy Hash: d909f5ace0783a183aabcb74ed195dcbd9df4d0597dcb094e34561f6550b292c
            • Instruction Fuzzy Hash: 4421D471505380AFDB22CF51DC84FA7BFB8EF45214F08849AE9848B252C325A549CBB6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0A49A Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,5FA41E18,00000000,00000000,00000000,00000000), ref: 02E0A514
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: e9cde22b403d9c59886543fb3972ff71a3ac2ede5ccfb6b3bc3cb59fbc89121c
            • Instruction ID: 8f7ea67a86591117afa8e2e73db10184c122603bde9a9316c9d010e8e2c23e15
            • Opcode Fuzzy Hash: e9cde22b403d9c59886543fb3972ff71a3ac2ede5ccfb6b3bc3cb59fbc89121c
            • Instruction Fuzzy Hash: 29216F76640304AFE720CE15CC84FA6B7E8EF04618F04846AEE458B791D364E589CAB1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0B7E2 Relevance: 1.6, APIs: 1, Instructions: 68COMMON
            Download Yara Rule
            APIs
            • OpenFileMappingW.KERNELBASE(?,?), ref: 02E0B84D
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileMappingOpen
            • String ID:
            • API String ID: 1680863896-0
            • Opcode ID: c5586647ddf4a15b6a561ae8b3383fe1c9c8b5b9d76576d2fe84d8a745753a94
            • Instruction ID: 9d8b8ff4a7c645a343fa63c7e3e8e9187bfd63c1aab9aed1f5fb389d7d70c154
            • Opcode Fuzzy Hash: c5586647ddf4a15b6a561ae8b3383fe1c9c8b5b9d76576d2fe84d8a745753a94
            • Instruction Fuzzy Hash: 2B21A471600240AFE710CB25CC85BA6FBE8EF04618F04846EED488B791D375E449CB76
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0B087 Relevance: 1.6, APIs: 1, Instructions: 68COMMON
            Download Yara Rule
            APIs
            • setsockopt.WS2_32(?,?,?,?,?), ref: 02E0B104
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: setsockopt
            • String ID:
            • API String ID: 3981526788-0
            • Opcode ID: 1b0cd6f63c3191de47d5752c5e8d0584f7db2a26e1995455528e72f59d69c072
            • Instruction ID: 2f2b38a6bd0763309bd7739533032b323f62ebe04b4234820ad132231dd3d2ab
            • Opcode Fuzzy Hash: 1b0cd6f63c3191de47d5752c5e8d0584f7db2a26e1995455528e72f59d69c072
            • Instruction Fuzzy Hash: D021AC320093C09FDB128F65DC85AA2BFB4EF07324F0984DAD9C48F163D225A959CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0B8E2 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON
            Download Yara Rule
            APIs
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileView
            • String ID:
            • API String ID: 3314676101-0
            • Opcode ID: 847389781bef6aa26e4b51175a2a3c81e7711dec77bed905f29f1ca5cc75a008
            • Instruction ID: 7ad28d2486af2a7a218d9f87c4bc054d041ea5a62f3739fd6acd2118df1b3eae
            • Opcode Fuzzy Hash: 847389781bef6aa26e4b51175a2a3c81e7711dec77bed905f29f1ca5cc75a008
            • Instruction Fuzzy Hash: C221A171500244AFE721CF55CC85FAAFBE8FF08228F04845DE9898B651D375A45DCBB6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0AFC2 Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON
            Download Yara Rule
            APIs
            • WSASocketW.WS2_32(?,?,?,?,?), ref: 02E0B02E
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: Socket
            • String ID:
            • API String ID: 38366605-0
            • Opcode ID: e81f3884f94d150f8de0011152ebe2a83a9e1b1fd278ada5380f068322e14aab
            • Instruction ID: c332430bef46736cb8becb26cad65157b1d02cbe192e3e191188541f733a79a8
            • Opcode Fuzzy Hash: e81f3884f94d150f8de0011152ebe2a83a9e1b1fd278ada5380f068322e14aab
            • Instruction Fuzzy Hash: A321D471500244AFEB21CF65CC85FA6FBA4FF04318F04885EE9458B651D375A459CB72
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0B546 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,5FA41E18,00000000,00000000,00000000,00000000), ref: 02E0B5B8
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 3a0b89451272134584eb4b9cbe7c83583a8ae861d275ebc98b5aef53595df99e
            • Instruction ID: 3d76f2e3ea1f228088457b6827f7c9b218d81a477a67babcb0914531163ee65f
            • Opcode Fuzzy Hash: 3a0b89451272134584eb4b9cbe7c83583a8ae861d275ebc98b5aef53595df99e
            • Instruction Fuzzy Hash: F211AF72640204AFE721CF15CC85FAABBA8FF04718F04C49AE9458A691D364E589CAB1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0A652 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON
            Download Yara Rule
            APIs
            • RegSetValueExW.KERNELBASE(?,00000E90,5FA41E18,00000000,00000000,00000000,00000000), ref: 02E0A6C4
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: Value
            • String ID:
            • API String ID: 3702945584-0
            • Opcode ID: b82e4e3f52662ecafa6cfe1b3b826b262affb9c8d0b153bdbea433583fc09f0c
            • Instruction ID: 161d624f0fbe7b4fd7724e0038b046a33cb787ed73876e15d352c7b486d0620c
            • Opcode Fuzzy Hash: b82e4e3f52662ecafa6cfe1b3b826b262affb9c8d0b153bdbea433583fc09f0c
            • Instruction Fuzzy Hash: EA11E172640304AFE721CE51DC84FA7BBBCEF04614F04C06AEA459A781D764E489CAB2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0BF2E Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON
            Download Yara Rule
            APIs
            • GetProcessTimes.KERNELBASE(?,00000E90,5FA41E18,00000000,00000000,00000000,00000000), ref: 02E0BF8D
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: ProcessTimes
            • String ID:
            • API String ID: 1995159646-0
            • Opcode ID: e2aeba02b4610cd702cc24c0ce65ddc77b92b9a19f09751ce678355c5ba7bc84
            • Instruction ID: c578c5753c91d81236b46d9b01adee540b3e0369db2dfcfe295e0e166542ae0e
            • Opcode Fuzzy Hash: e2aeba02b4610cd702cc24c0ce65ddc77b92b9a19f09751ce678355c5ba7bc84
            • Instruction Fuzzy Hash: A511D372600204AFEB218F55DC84BAABBA8EF04314F04C46AE9458B651D375E559CBB2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0B2A6 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
            Download Yara Rule
            APIs
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: closesocket
            • String ID:
            • API String ID: 2781271927-0
            • Opcode ID: 47549bc7768a5065ff914ffaf4fb72bb9095f20cdf662c8fc9663076287bd074
            • Instruction ID: e8c8a7529b2ab3fd11dabcde7f2088cf943c901b0476266fed3421f17605b882
            • Opcode Fuzzy Hash: 47549bc7768a5065ff914ffaf4fb72bb9095f20cdf662c8fc9663076287bd074
            • Instruction Fuzzy Hash: 9F218C714093C09FDB128B25DC94B92BFB4EF07214F0984DADD848F1A3D269A909DBA2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0AE1E Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON
            Download Yara Rule
            APIs
            • ReadFile.KERNELBASE(?,00000E90,5FA41E18,00000000,00000000,00000000,00000000), ref: 02E0AE7D
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileRead
            • String ID:
            • API String ID: 2738559852-0
            • Opcode ID: b55d330613ac669cd709873cb830ada913254b1edd8e337b01d5279b82d533bc
            • Instruction ID: 74e847404086f60cc4e363b51f820c06a82fdfb4d629546a3694b55ddb474657
            • Opcode Fuzzy Hash: b55d330613ac669cd709873cb830ada913254b1edd8e337b01d5279b82d533bc
            • Instruction Fuzzy Hash: 1F11C871540304AFEB21CF51DC84FAAFBA8EF04714F04C46AEA859B751C375A589CBB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0A70C Relevance: 1.6, APIs: 1, Instructions: 59COMMON
            Download Yara Rule
            APIs
            • FindCloseChangeNotification.KERNELBASE(?), ref: 02E0A76C
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: ChangeCloseFindNotification
            • String ID:
            • API String ID: 2591292051-0
            • Opcode ID: 603842a6754d17f3d8cb17cef3949082f6080cb7cc7e76bc57dbdb1d5015d0d0
            • Instruction ID: 96a010b68b1ec9cb06c7fdbe5b2f3c0ae2abdcd7c50c55a12d1bc97772d7f736
            • Opcode Fuzzy Hash: 603842a6754d17f3d8cb17cef3949082f6080cb7cc7e76bc57dbdb1d5015d0d0
            • Instruction Fuzzy Hash: 1F11C875549380AFDB12CF25DC94BA2BFB8EF42224F0CC4DAED858F652D235A419CB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0A2D2 Relevance: 1.6, APIs: 1, Instructions: 53COMMON
            Download Yara Rule
            APIs
            • SetErrorMode.KERNELBASE(?), ref: 02E0A330
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: ErrorMode
            • String ID:
            • API String ID: 2340568224-0
            • Opcode ID: 36cb80dfc3b6e127b17ef464cae008b59a549d772b8e5603ce1ca77abc7b5a08
            • Instruction ID: 65270c1c1a0060784c0a5c1bea31c93ab3e9c6fee08f023955fd64ce2dd4c55d
            • Opcode Fuzzy Hash: 36cb80dfc3b6e127b17ef464cae008b59a549d772b8e5603ce1ca77abc7b5a08
            • Instruction Fuzzy Hash: FF11C1758493C09FDB128B25CC84B52BFB4EF07224F0980DBDD848F263C269A849CB72
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0AB5E Relevance: 1.6, APIs: 1, Instructions: 52COMMON
            Download Yara Rule
            APIs
            • GetFileType.KERNELBASE(?,00000E90,5FA41E18,00000000,00000000,00000000,00000000), ref: 02E0ABB1
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileType
            • String ID:
            • API String ID: 3081899298-0
            • Opcode ID: ab28da1cb4ce448ebc395a18bc851858afab628ce53706c6c277727fca7221ee
            • Instruction ID: 298309317e2c344fb537468df61bd62f6e0199a101a90c2c6f4bea98f104f178
            • Opcode Fuzzy Hash: ab28da1cb4ce448ebc395a18bc851858afab628ce53706c6c277727fca7221ee
            • Instruction Fuzzy Hash: 1601C471640348AEE720CB15DC85FA6B7A8EF04624F04C0A6EE488B781D368A54D8AB6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05F8037E Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON
            Download Yara Rule
            APIs
            • WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 05F803CA
            Memory Dump Source
            • Source File: 00000008.00000002.2049667400.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_5f80000_WindowsUpdate.jbxd
            Similarity
            • API ID: Connect
            • String ID:
            • API String ID: 3144859779-0
            • Opcode ID: 646f4432b96472a731d5201ed77103c6e2707b3b420c7a625f729ebad005876b
            • Instruction ID: fdda74be9368c1723452ab79d4f021c5050f87e500fcb11231cb83f4f8d9f005
            • Opcode Fuzzy Hash: 646f4432b96472a731d5201ed77103c6e2707b3b420c7a625f729ebad005876b
            • Instruction Fuzzy Hash: E61170325406049FDB20DF55D848B76FBE9FF04210F08859ADD858B622D739E558CB62
            Uniqueness

            Uniqueness Score: -1.00%

            Function 05F80516 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
            Download Yara Rule
            APIs
            • FormatMessageW.KERNELBASE(?,00000E90,?,?), ref: 05F80566
            Memory Dump Source
            • Source File: 00000008.00000002.2049667400.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_5f80000_WindowsUpdate.jbxd
            Similarity
            • API ID: FormatMessage
            • String ID:
            • API String ID: 1306739567-0
            • Opcode ID: b24d244de8d9c04925bd5d04a77784ce0f75ab8623b1abbb9d6b116b992bf76b
            • Instruction ID: 8f355a6bb86ea6dc1a0d98cf539a39c73add548f421ce8707d6f60fa18c1667b
            • Opcode Fuzzy Hash: b24d244de8d9c04925bd5d04a77784ce0f75ab8623b1abbb9d6b116b992bf76b
            • Instruction Fuzzy Hash: 6201B171600200AFD310DF16CC46B76FBA8FB88A20F14811AEC089BB41D735B515CBE5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0B0C6 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
            Download Yara Rule
            APIs
            • setsockopt.WS2_32(?,?,?,?,?), ref: 02E0B104
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: setsockopt
            • String ID:
            • API String ID: 3981526788-0
            • Opcode ID: d5a842502a67f235cfbd220b8ef549126d25e3c55c1634cd62eb5ec09e706a71
            • Instruction ID: 35024b6c3ebaa27a46a79e390abee9b534963c9ba849ab82854c8d1184574cc2
            • Opcode Fuzzy Hash: d5a842502a67f235cfbd220b8ef549126d25e3c55c1634cd62eb5ec09e706a71
            • Instruction Fuzzy Hash: 99018C325002449FDB20CF55D984B66FBA0FF08724F08C4AEDE498A652D376A499CBB2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0A5B6 Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,?,?), ref: 02E0A606
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 3fa8d63250b71681a206b2a56c18ae1886d6eaef788f97b5531eab04fa773be4
            • Instruction ID: fd5a74e5f93f778802ffd737ac4213adf3e54af9ef610d4363fd4ea40dee4d5f
            • Opcode Fuzzy Hash: 3fa8d63250b71681a206b2a56c18ae1886d6eaef788f97b5531eab04fa773be4
            • Instruction Fuzzy Hash: 7601A271540600ABD310DF16CC46B76FBA4FB88A24F14811AEC089BB41D775F525CBE6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0A73A Relevance: 1.5, APIs: 1, Instructions: 43COMMON
            Download Yara Rule
            APIs
            • FindCloseChangeNotification.KERNELBASE(?), ref: 02E0A76C
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: ChangeCloseFindNotification
            • String ID:
            • API String ID: 2591292051-0
            • Opcode ID: f042747f37cc4376d3791adad3b66ee065e365d093d422ee96fb8915f1c59aa1
            • Instruction ID: cd9e895a63be45b462b12b8bbe7b0b6cf7ff4d72437fc89a477bc8f8a1781bd7
            • Opcode Fuzzy Hash: f042747f37cc4376d3791adad3b66ee065e365d093d422ee96fb8915f1c59aa1
            • Instruction Fuzzy Hash: 2B01D4756403049FDB10CF15D8847A6FBA4EF40224F08C4AADE498B742D379E448CA62
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0B2DE Relevance: 1.5, APIs: 1, Instructions: 39COMMON
            Download Yara Rule
            APIs
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: closesocket
            • String ID:
            • API String ID: 2781271927-0
            • Opcode ID: 1ceedf944816e7ef5087fcc0012ece4244c77ef52a563f6244aee548239290f2
            • Instruction ID: 4b03f6bca54ac68e604491aa42868eee203b9b6d01d4cb4586381e3f952b2fe2
            • Opcode Fuzzy Hash: 1ceedf944816e7ef5087fcc0012ece4244c77ef52a563f6244aee548239290f2
            • Instruction Fuzzy Hash: FE01A271A402449FDB10CF15D884766FBA4EF04628F18C4AADD498F646D3B9A449CAA2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E0A2FE Relevance: 1.5, APIs: 1, Instructions: 35COMMON
            Download Yara Rule
            APIs
            • SetErrorMode.KERNELBASE(?), ref: 02E0A330
            Memory Dump Source
            • Source File: 00000008.00000002.2047782826.0000000002E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E0A000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e0a000_WindowsUpdate.jbxd
            Similarity
            • API ID: ErrorMode
            • String ID:
            • API String ID: 2340568224-0
            • Opcode ID: 3fae441fc6ae679379ea144c9b2d9cc001c942cf22feee864f56e4aaea41015c
            • Instruction ID: 6d30a2318c9ca8047af79de94187a2559d39ccecb3ff6d281f57536fc8036f7a
            • Opcode Fuzzy Hash: 3fae441fc6ae679379ea144c9b2d9cc001c942cf22feee864f56e4aaea41015c
            • Instruction Fuzzy Hash: 04F0AF35944348DFDB10CF19D889765FBA0EF04725F08C0AADE494F792D379A499CAA2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 030809F0 Relevance: .4, Instructions: 379COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 96f31b49ed8a0a1653580f15716e7f96974831784481cf103f87d8ac1c16db3e
            • Instruction ID: b7fd8df6769967778636267b0f50a196ad2f769ba1930b47735740a31240ab4f
            • Opcode Fuzzy Hash: 96f31b49ed8a0a1653580f15716e7f96974831784481cf103f87d8ac1c16db3e
            • Instruction Fuzzy Hash: B3E14C30B012049FCB58DFB8D594AADB7F3AF89308F2584A9E405AB361DB35ED49CB51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 030809E2 Relevance: .3, Instructions: 291COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 04055b1fcee80bc1d095e2c1d89214d5655b50b714e578cf7ca417a0ed5cf1c7
            • Instruction ID: 2b61f756e177a4b8cbd6b07c9780b8d9a3868fa464a6b51ddcf569b1dbd922e3
            • Opcode Fuzzy Hash: 04055b1fcee80bc1d095e2c1d89214d5655b50b714e578cf7ca417a0ed5cf1c7
            • Instruction Fuzzy Hash: 7BC14D34B02204DFCB58DFA8D594A9D77F3AF89308F6580A8E405AB361DB35ED89CB51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03081349 Relevance: .3, Instructions: 274COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: b7fce8a1c45795c4649a978998b24d4e65afc060c36461e674577693edebc909
            • Instruction ID: 674494806851fe5ef815816c07fce90dc5199e9f9d94af6c6b6399c3fa5b8e06
            • Opcode Fuzzy Hash: b7fce8a1c45795c4649a978998b24d4e65afc060c36461e674577693edebc909
            • Instruction Fuzzy Hash: CEC10934A001488FCB28DF78D550AEEB7F2FF4C204B1585A9D855AB761DB36AC46CF60
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03080F98 Relevance: .3, Instructions: 267COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 8f3235a070be1db2a77ed481441adf2c9a4aef6955003b5278943350d188b949
            • Instruction ID: 85c876c394b379276a2294eddcc00695a58c25ba6908c272907bdfbaeff3e569
            • Opcode Fuzzy Hash: 8f3235a070be1db2a77ed481441adf2c9a4aef6955003b5278943350d188b949
            • Instruction Fuzzy Hash: 07B17E34A01205DFCB18EFB8D484A9DB7F2AF89314F148699E915AB3A1DB31EC46CB50
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03080A68 Relevance: .3, Instructions: 251COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: f74bbe090c86364a41ff1822825409815110447ec89fa7e98b342dd531eced41
            • Instruction ID: 5032b77bc5463dfe9d9e264276656eed881d5a53d6f524ae6e3fd8391ea8b3e6
            • Opcode Fuzzy Hash: f74bbe090c86364a41ff1822825409815110447ec89fa7e98b342dd531eced41
            • Instruction Fuzzy Hash: B8A13D34B022049FCB58DFA8D194A9D77F3AF89308F6580A8E405AB365DB35ED89CB51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 030813B8 Relevance: .2, Instructions: 215COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 37fe51b7816f2f86157c2bfa498af06098a763662bad15335887d4d154040dc7
            • Instruction ID: 4fc2c5d42e7ccb04a87fd960bbbe5aadc7cacfcb21fed20e773a62c94ff3a30d
            • Opcode Fuzzy Hash: 37fe51b7816f2f86157c2bfa498af06098a763662bad15335887d4d154040dc7
            • Instruction Fuzzy Hash: FD914634A001448FCB28DF78D650AEEB7F2EF8C204B1585A9D855AB761DB36EC46CF61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 030813D6 Relevance: .2, Instructions: 211COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: c28592ce355350d6c6fa1021742e79046b9780be6f4ff1776be7b166844f71fb
            • Instruction ID: 5796ffd7a2c1b5c2baea4e8d13fa13624b68d1f57d2ecac64407d69292a20c9b
            • Opcode Fuzzy Hash: c28592ce355350d6c6fa1021742e79046b9780be6f4ff1776be7b166844f71fb
            • Instruction Fuzzy Hash: A9913734A001448FCB28DF78D650AEEB7F2EF8C204B1585A9D855AB761DB36EC46CF61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 030813E9 Relevance: .2, Instructions: 210COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 54248be26b22db264b499a1037697e5a46ac859ede32b5d179138e502a1fed35
            • Instruction ID: eb9763d7d4b11fe36f191cfbd64683d6597db4417a9754c6d70b17c769163e79
            • Opcode Fuzzy Hash: 54248be26b22db264b499a1037697e5a46ac859ede32b5d179138e502a1fed35
            • Instruction Fuzzy Hash: 0D914734A001448FCB28DF78D650AEEB7F2EF8C204B1585A9D855AB761DB36EC46CF61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03080070 Relevance: .2, Instructions: 150COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: bb1b09fe69c18ddca297cc1541bc43a9f1e0fe2d52f7546c86720a361dbfcd30
            • Instruction ID: 24f397b459fc31f510119812a745e656733960f8f795052deb6eb6f2530a94ae
            • Opcode Fuzzy Hash: bb1b09fe69c18ddca297cc1541bc43a9f1e0fe2d52f7546c86720a361dbfcd30
            • Instruction Fuzzy Hash: F161AEB4E012089FCB18DFA5DA949EDBBF2EF89304F208169D909AB364DB359D45CF50
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03080628 Relevance: .1, Instructions: 139COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: d377f9e2e2dba230300ef63a120c787b3ef802ff9bfb62210677bf2b9dc3f8ea
            • Instruction ID: 440f85cf02621bce9395531e94d967d20a7b92d2d42734541652ef1517dd6d9c
            • Opcode Fuzzy Hash: d377f9e2e2dba230300ef63a120c787b3ef802ff9bfb62210677bf2b9dc3f8ea
            • Instruction Fuzzy Hash: 68516D34A02114DFDB14EBB4D994AEEB7F2AF88304F148569E505AB390DB35AC45CF90
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03080F88 Relevance: .1, Instructions: 129COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: c88565db127eecb20e29ccfd13128d55722ac4f60536eb741a2926fd468295f8
            • Instruction ID: 4a618a46812c1e8fc3b348ef69d7d16557caff896ab25b6bddee9e38d7087d53
            • Opcode Fuzzy Hash: c88565db127eecb20e29ccfd13128d55722ac4f60536eb741a2926fd468295f8
            • Instruction Fuzzy Hash: F1515A30E01244DFDB18DF69D884A9DB7F2EF48314F1886A9E851AB3A1DB31AC42CF54
            Uniqueness

            Uniqueness Score: -1.00%

            Function 0308130B Relevance: .1, Instructions: 114COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 64bc55ca459b9cd24f9f515de13f4e9d5f5aa97bfc62cadae484d1ec72b4663f
            • Instruction ID: df28e1561236c718990a08323c2cc099b85e5328bf6e4d921aac64235c4efbcf
            • Opcode Fuzzy Hash: 64bc55ca459b9cd24f9f515de13f4e9d5f5aa97bfc62cadae484d1ec72b4663f
            • Instruction Fuzzy Hash: 94413A30A01244DFDB18DF79D484A9CB7F2AF48314F588699E851AB3A1DB75EC81CF54
            Uniqueness

            Uniqueness Score: -1.00%

            Function 030808E8 Relevance: .1, Instructions: 78COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 3b5bc29c91ad93a40de6dbc1019f82f708dd7ba6204fa4399cb01ec3384a42f0
            • Instruction ID: d0a6f407b9749faaefcad82e2f4a3245c77170b3652c875c001cac585b73aebb
            • Opcode Fuzzy Hash: 3b5bc29c91ad93a40de6dbc1019f82f708dd7ba6204fa4399cb01ec3384a42f0
            • Instruction Fuzzy Hash: BE219E31B002159FCB10EF64C5416EEB7F2AF88308F648569D449AB381DB36DD4ACBA1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 030808D8 Relevance: .1, Instructions: 76COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 8f57722e33196a24f87dc9fb951482c6f6f4f8ca9baa947dfae42ac7d50479fe
            • Instruction ID: ba1a88bf7e4cebe5d88f3e58a5d5ce3795d3ef0b3cfa35f105a8d7af279d0395
            • Opcode Fuzzy Hash: 8f57722e33196a24f87dc9fb951482c6f6f4f8ca9baa947dfae42ac7d50479fe
            • Instruction Fuzzy Hash: 6421A331B001159FCB50DF68C481BEEB7F2AF88318F2485A9D449AB381D7329D4BCB91
            Uniqueness

            Uniqueness Score: -1.00%

            Function 030807E8 Relevance: .1, Instructions: 54COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 4bcf93493f97e61f2a31168c7ce0312ff8fa92d36f0231bdb114d2dacef63558
            • Instruction ID: d38f05984c8dcdadf42cd8ca6f5beff62b0d0e6cae7af8bd5e1c7e7e9e599cd7
            • Opcode Fuzzy Hash: 4bcf93493f97e61f2a31168c7ce0312ff8fa92d36f0231bdb114d2dacef63558
            • Instruction Fuzzy Hash: D0015B71A002199FC764EB7898409EEBBEAEB88254B10857AC54AE7311EB31DD46CBD0
            Uniqueness

            Uniqueness Score: -1.00%

            Function 030807F8 Relevance: .0, Instructions: 46COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 3bb9bfdaee11fa575e8573c07d44058d306c3ee069a0348197b48ac3bb2d55b4
            • Instruction ID: fe61e85e746eb2cdb2910de9828ec43ee0e41133a3462d586108eaeaa2ceb390
            • Opcode Fuzzy Hash: 3bb9bfdaee11fa575e8573c07d44058d306c3ee069a0348197b48ac3bb2d55b4
            • Instruction Fuzzy Hash: 88015A71E002189FCB64DBB8D84059EB7EAFB89254B10857AC50AE7305EB31AD06CB90
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03080E31 Relevance: .0, Instructions: 45COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: dba338415906ade1c886ca92b5c8a3d00ac2e92b71b5fc32b66e64d0b3e3a9b6
            • Instruction ID: c4d66b0d75c7dfd8230f1bd013addab530d18ae26da9fd134a1bf2d2ec9edb97
            • Opcode Fuzzy Hash: dba338415906ade1c886ca92b5c8a3d00ac2e92b71b5fc32b66e64d0b3e3a9b6
            • Instruction Fuzzy Hash: 71019230B01604ABDB58EB79D854A7EB6E3AFC4308B148539E40A9B790DF319D46CB51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B605DF Relevance: .0, Instructions: 44COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2047606973.0000000002B60000.00000040.00000020.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2b60000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: c56c090c0f99f6d24f2a2ac829d5bbd23059451da7884b3ce35f1ed6170114b9
            • Instruction ID: 23fa9a71f5381ccb21fbe5c7e4419858f05b7ae5574131a2bed52756930a6208
            • Opcode Fuzzy Hash: c56c090c0f99f6d24f2a2ac829d5bbd23059451da7884b3ce35f1ed6170114b9
            • Instruction Fuzzy Hash: 3901D67650D3C06FC7128B15AC40872FFB8EF8662070984DFEC898B613D229B809C7B2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02B60606 Relevance: .0, Instructions: 27COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2047606973.0000000002B60000.00000040.00000020.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2b60000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 8fec130a9c2796f7fe137323d2db419855c12e91f2527117286b3d8e9c876dc8
            • Instruction ID: 44a660f94e43baabae0657f95b5574a6b1f9596b3ce809d637374910e7546dca
            • Opcode Fuzzy Hash: 8fec130a9c2796f7fe137323d2db419855c12e91f2527117286b3d8e9c876dc8
            • Instruction Fuzzy Hash: 5FE092B66406044BD750CF0AEC41462F794EB84630B08C07FDC0D8B711D23AB519CAA6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03080ECC Relevance: .0, Instructions: 26COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 689ce888bcaad04c94e98b72913a18d7f6b355679b61bf1a12c7e5fd8adf5f8f
            • Instruction ID: d3a22e6535546b23877c756b1370a068f79d517c5224b0655dafe86d2234267c
            • Opcode Fuzzy Hash: 689ce888bcaad04c94e98b72913a18d7f6b355679b61bf1a12c7e5fd8adf5f8f
            • Instruction Fuzzy Hash: CBF05E30A05108EBDB18EFB9E5446AE73F3BF84309B108578E00A87394CF359D89CB40
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03080451 Relevance: .0, Instructions: 21COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 4b3fac9b5e1b6a79bc5c7f3a77b5c0ce52c100226a054295864c92f6d366be20
            • Instruction ID: f9d404c5f58eae037e3a4360bf11d2e2368309291a077b2f7e0b4be2442a481d
            • Opcode Fuzzy Hash: 4b3fac9b5e1b6a79bc5c7f3a77b5c0ce52c100226a054295864c92f6d366be20
            • Instruction Fuzzy Hash: DCE0C2712CA7E44FC70227B924240F93FA65A8730038D41AAE1D6CABC2DA014C4A979A
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E023F4 Relevance: .0, Instructions: 15COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2047769120.0000000002E02000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E02000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e02000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 42a8ec3a1a1d590b159f993e5d4b85aeccce0a78342d21656db9c78f462788a9
            • Instruction ID: 5825d1a471f8c83e186bf97886f3c812df862a0ee204bc3d6cac0fc7bae010f0
            • Opcode Fuzzy Hash: 42a8ec3a1a1d590b159f993e5d4b85aeccce0a78342d21656db9c78f462788a9
            • Instruction Fuzzy Hash: E5D05EB92456C14FE3168A1CC2A8F9537D4AB5170CF4684F9AC408B7A3C768D9C6E240
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02E023BC Relevance: .0, Instructions: 14COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2047769120.0000000002E02000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E02000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_2e02000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: ac7755ee2ee40bc9ab6dd641f14af43715f9e72ee44921d8d3086081d60c4130
            • Instruction ID: ce85d851e9407c4ea3a330177229c3414331e5c239d8af710426945a88923480
            • Opcode Fuzzy Hash: ac7755ee2ee40bc9ab6dd641f14af43715f9e72ee44921d8d3086081d60c4130
            • Instruction Fuzzy Hash: 35D05E342405824BDB15CA0CD6D8F5937D4AB4070CF1684E8BC108B7A6C3B8D8C6CA00
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03080460 Relevance: .0, Instructions: 13COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000008.00000002.2048077447.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_8_2_3080000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: b9c42a4afd024b8b250de3737cc2f4426960af7f4e679dd838c3f7ae03ed5ab4
            • Instruction ID: 7ddbde795a9df06411843abd83f98450c7026ba7ee039621ef3873e2fc02a415
            • Opcode Fuzzy Hash: b9c42a4afd024b8b250de3737cc2f4426960af7f4e679dd838c3f7ae03ed5ab4
            • Instruction Fuzzy Hash: 41C080717C01744745043699701849D37CDE7857513450035F607C73C4DF114C5197DA
            Uniqueness

            Uniqueness Score: -1.00%

            Execution Graph

            Execution Coverage:24.2%
            Dynamic/Decrypted Code Coverage:100%
            Signature Coverage:0%
            Total number of Nodes:88
            Total number of Limit Nodes:4
            execution_graph 2564 26ab7e2 2566 26ab81a OpenFileMappingW 2564->2566 2567 26ab855 2566->2567 2650 26aa361 2651 26aa392 RegOpenKeyExW 2650->2651 2653 26aa420 2651->2653 2722 26ab2a6 2723 26ab2de closesocket 2722->2723 2725 26ab318 2723->2725 2726 26ab8a4 2727 26ab8e2 MapViewOfFile 2726->2727 2729 26ab969 2727->2729 2575 26aa73a 2576 26aa766 FindCloseChangeNotification 2575->2576 2577 26aa7a5 2575->2577 2578 26aa774 2576->2578 2577->2576 2579 26aa2fe 2580 26aa32a SetErrorMode 2579->2580 2581 26aa353 2579->2581 2582 26aa33f 2580->2582 2581->2580 2694 26aadfe 2695 26aae1e ReadFile 2694->2695 2697 26aae85 2695->2697 2698 59c020b 2700 59c023e getaddrinfo 2698->2700 2701 59c02eb 2700->2701 2670 26aa632 2672 26aa652 RegSetValueExW 2670->2672 2673 26aa6d3 2672->2673 2654 26aaf73 2655 26aaf95 WSASocketW 2654->2655 2657 26ab036 2655->2657 2702 59c0006 2703 59c0032 DuplicateHandle 2702->2703 2705 59c00b7 2703->2705 2706 26abef0 2707 26abf0e GetProcessTimes 2706->2707 2709 26abf95 2707->2709 2674 26abc31 2675 26abc5e CreateMutexW 2674->2675 2677 26abcd9 2675->2677 2710 59c033d 2712 59c037e WSAConnect 2710->2712 2713 59c03d2 2712->2713 2678 26aaa0f 2680 26aaa46 CreateFileW 2678->2680 2681 26aaacd 2680->2681 2682 26aa70c 2683 26aa73a FindCloseChangeNotification 2682->2683 2685 26aa774 2683->2685 2686 26ab60c 2688 26ab632 ConvertStringSecurityDescriptorToSecurityDescriptorW 2686->2688 2689 26ab6ab 2688->2689 2714 26ab7c2 2716 26ab7e2 OpenFileMappingW 2714->2716 2717 26ab855 2716->2717 2658 59c04b6 2659 59c04e4 FormatMessageW 2658->2659 2661 59c056e 2659->2661 2602 26aaa46 2603 26aaa7e CreateFileW 2602->2603 2605 26aaacd 2603->2605 2610 26ab0c6 2611 26ab0fe setsockopt 2610->2611 2612 26ab136 2610->2612 2613 26ab10c 2611->2613 2612->2611 2730 26ab087 2732 26ab0c6 setsockopt 2730->2732 2733 26ab10c 2732->2733 2662 26aa459 2664 26aa49a RegQueryValueExW 2662->2664 2665 26aa523 2664->2665 2622 26abc5e 2624 26abc96 CreateMutexW 2622->2624 2625 26abcd9 2624->2625 2630 26aae1e 2631 26aae53 ReadFile 2630->2631 2633 26aae85 2631->2633 2634 26ab2de 2635 26ab30a closesocket 2634->2635 2636 26ab340 2634->2636 2637 26ab318 2635->2637 2636->2635 2690 26aab1c 2692 26aab5e GetFileType 2690->2692 2693 26aabc0 2692->2693 2718 26aa2d2 2721 26aa2d6 SetErrorMode 2718->2721 2720 26aa33f 2721->2720

            Executed Functions

            Function 02AD0006 Relevance: .2, Instructions: 192COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: a4461606f101cab8499a29a38199bd55a1862deaebc8c394c51427dd7d408831
            • Instruction ID: 3be64bd7b10aa56c8b662afb910e898bee370aec809f317243cb7eb415402fca
            • Opcode Fuzzy Hash: a4461606f101cab8499a29a38199bd55a1862deaebc8c394c51427dd7d408831
            • Instruction Fuzzy Hash: 21812370E052889FCB05DFA5D960ADDBFF2AF8A304F2480AAC449AB362DB355D45CF11
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD09F0 Relevance: 1.6, Strings: 1, Instructions: 379COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 0 2ad09f0-2ad0a18 1 2ad0a1e-2ad0a2c 0->1 2 2ad0e46-2ad0e82 0->2 99 2ad0a2f call 2ad0c0c 1->99 100 2ad0a2f call 2ad0d1c 1->100 101 2ad0a2f call 2ad0c69 1->101 102 2ad0a2f call 2ad0a68 1->102 103 2ad0a2f call 2ad0dd5 1->103 104 2ad0a2f call 2ad0d87 1->104 105 2ad0a2f call 2ad09f0 1->105 106 2ad0a2f call 2ad09e2 1->106 18 2ad0e85 2->18 4 2ad0a35-2ad0a3c 7 2ad0a3e-2ad0a79 4->7 8 2ad0a83-2ad0ac7 4->8 7->8 22 2ad0ace-2ad0ade 8->22 23 2ad0ac9 8->23 19 2ad0e8f-2ad0e93 18->19 19->18 21 2ad0e95-2ad0eab 19->21 21->18 28 2ad0ead-2ad0eca 21->28 26 2ad0b15-2ad0bd7 22->26 27 2ad0ae0-2ad0b0d 22->27 23->22 49 2ad0c1d-2ad0c39 26->49 50 2ad0bd9-2ad0c0a 26->50 27->26 28->18 56 2ad0edf-2ad0f55 49->56 57 2ad0c3f-2ad0c43 49->57 50->49 83 2ad0f5c-2ad0f7f 56->83 57->56 59 2ad0c49-2ad0c4d 57->59 62 2ad0c4f-2ad0c67 59->62 63 2ad0c7a-2ad0c7e 59->63 62->63 63->49 64 2ad0c80-2ad0c96 63->64 68 2ad0c98-2ad0cac 64->68 69 2ad0cb5-2ad0cbc 64->69 68->69 72 2ad0d98-2ad0d9f 69->72 73 2ad0cc2-2ad0d85 69->73 76 2ad0daf-2ad0db6 72->76 77 2ad0da1-2ad0da4 72->77 73->72 76->49 78 2ad0dbc-2ad0e15 76->78 77->76 78->49 99->4 100->4 101->4 102->4 103->4 104->4 105->4 106->4
            Strings
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID: [@j^
            • API String ID: 0-1983493110
            • Opcode ID: d1901c4fd0703bdc1b6d67f5d815f34d04642193a07a75f58321339fc2889718
            • Instruction ID: f257e140b967e1fcb96c772272d28b0f2f1ef7cb4b5085f260cb77dd53185519
            • Opcode Fuzzy Hash: d1901c4fd0703bdc1b6d67f5d815f34d04642193a07a75f58321339fc2889718
            • Instruction Fuzzy Hash: 84E13934A01204DFDB09DBB8D594AADB7F3AF89308F2140A9E506AB361DF35ED85CB51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 059C020B Relevance: 1.6, APIs: 1, Instructions: 101COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 107 59c020b-59c02db 113 59c032d-59c0332 107->113 114 59c02dd-59c02e5 getaddrinfo 107->114 113->114 116 59c02eb-59c02fd 114->116 117 59c02ff-59c032a 116->117 118 59c0334-59c0339 116->118 118->117
            APIs
            • getaddrinfo.WS2_32(?,00000E90), ref: 059C02E3
            Memory Dump Source
            • Source File: 00000009.00000002.2156417227.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_59c0000_WindowsUpdate.jbxd
            Similarity
            • API ID: getaddrinfo
            • String ID:
            • API String ID: 300660673-0
            • Opcode ID: de6c58293b52f8f2f08678f64c0ffe5272c578b5edb4d3d923fe4349ea6945e3
            • Instruction ID: 8f3941301c2eefa149d59dfd94ba939f7a122b4eac57944dea5afd71317261fd
            • Opcode Fuzzy Hash: de6c58293b52f8f2f08678f64c0ffe5272c578b5edb4d3d923fe4349ea6945e3
            • Instruction Fuzzy Hash: 7A31A571504384AFE721CF60CC84FAABFBCEF05314F04449AEA899B292D375A949CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 059C0006 Relevance: 1.6, APIs: 1, Instructions: 98COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 138 59c0006-59c00a7 143 59c00ff-59c0104 138->143 144 59c00a9-59c00b1 DuplicateHandle 138->144 143->144 146 59c00b7-59c00c9 144->146 147 59c00cb-59c00fc 146->147 148 59c0106-59c010b 146->148 148->147
            APIs
            • DuplicateHandle.KERNELBASE(?,00000E90), ref: 059C00AF
            Memory Dump Source
            • Source File: 00000009.00000002.2156417227.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_59c0000_WindowsUpdate.jbxd
            Similarity
            • API ID: DuplicateHandle
            • String ID:
            • API String ID: 3793708945-0
            • Opcode ID: 1ba5a42a86122fa32955e6d439b8f116e465c131fba50400b7b29ee3fe4d0d7f
            • Instruction ID: 3f713c832334ea0dce725436c57217f334bfd75997bb3b9c57b8662f3333d83a
            • Opcode Fuzzy Hash: 1ba5a42a86122fa32955e6d439b8f116e465c131fba50400b7b29ee3fe4d0d7f
            • Instruction Fuzzy Hash: 2031C472504344AFEB228F61CC44FABBFBCEF05224F04489AF985CB652D325A549CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AAA0F Relevance: 1.6, APIs: 1, Instructions: 98fileCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 122 26aaa0f-26aaa9e 126 26aaaa3-26aaaaf 122->126 127 26aaaa0 122->127 128 26aaab1 126->128 129 26aaab4-26aaabd 126->129 127->126 128->129 130 26aab0e-26aab13 129->130 131 26aaabf-26aaae3 CreateFileW 129->131 130->131 134 26aab15-26aab1a 131->134 135 26aaae5-26aab0b 131->135 134->135
            APIs
            • CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 026AAAC5
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: CreateFile
            • String ID:
            • API String ID: 823142352-0
            • Opcode ID: b1aac7216bfcdc7257d646ef6426e33963cb6e4a04f59e11e95a125583adc2a2
            • Instruction ID: d913b295a1d1470c5f11fc28ca1203c9c09fafea2058d29966fb3192969e60f3
            • Opcode Fuzzy Hash: b1aac7216bfcdc7257d646ef6426e33963cb6e4a04f59e11e95a125583adc2a2
            • Instruction Fuzzy Hash: D331C2B1505380AFE722CF65CC44FA2BFF8EF06214F08849AE9858B652D365E909CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AAF73 Relevance: 1.6, APIs: 1, Instructions: 96networkCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 152 26aaf73-26aaf93 153 26aafb5-26ab026 152->153 154 26aaf95-26aafb2 152->154 159 26ab028-26ab030 WSASocketW 153->159 160 26ab077-26ab07c 153->160 154->153 161 26ab036-26ab04c 159->161 160->159 163 26ab07e-26ab083 161->163 164 26ab04e-26ab074 161->164 163->164
            APIs
            • WSASocketW.WS2_32(?,?,?,?,?), ref: 026AB02E
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: Socket
            • String ID:
            • API String ID: 38366605-0
            • Opcode ID: a75dc465ce539795a595062ce12cf16b62b4fb46b95b040fcc8c0b7af34faafd
            • Instruction ID: f41672322e649482867bb71ca57bf8075fbd792a21b019921f375630d1b5e820
            • Opcode Fuzzy Hash: a75dc465ce539795a595062ce12cf16b62b4fb46b95b040fcc8c0b7af34faafd
            • Instruction Fuzzy Hash: 2131A3714097C09FE7228F61CC55B56BFB4EF06214F0988DBE9858F6A3C365A908CB72
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AA361 Relevance: 1.6, APIs: 1, Instructions: 90registryCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 167 26aa361-26aa3ed 171 26aa3ef 167->171 172 26aa3f2-26aa409 167->172 171->172 174 26aa44b-26aa450 172->174 175 26aa40b-26aa41e RegOpenKeyExW 172->175 174->175 176 26aa452-26aa457 175->176 177 26aa420-26aa448 175->177 176->177
            APIs
            • RegOpenKeyExW.KERNELBASE(?,00000E90), ref: 026AA411
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: Open
            • String ID:
            • API String ID: 71445658-0
            • Opcode ID: c33bfa95c70243bd1ca4645726279802c4f8f80dc2f888052f00c09b6924fa65
            • Instruction ID: 04d91e5908e94e725b8ed69ed73c06f225a688d41de828c525f4bb28519a37b7
            • Opcode Fuzzy Hash: c33bfa95c70243bd1ca4645726279802c4f8f80dc2f888052f00c09b6924fa65
            • Instruction Fuzzy Hash: 4C318472509784AFE721CF51CC44F96BFBCEF05214F04849BE9858B652D325A94DCB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026ABEF0 Relevance: 1.6, APIs: 1, Instructions: 89timeCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 214 26abef0-26abf85 219 26abfd2-26abfd7 214->219 220 26abf87-26abf8f GetProcessTimes 214->220 219->220 221 26abf95-26abfa7 220->221 223 26abfd9-26abfde 221->223 224 26abfa9-26abfcf 221->224 223->224
            APIs
            • GetProcessTimes.KERNELBASE(?,00000E90,5EDEBC43,00000000,00000000,00000000,00000000), ref: 026ABF8D
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: ProcessTimes
            • String ID:
            • API String ID: 1995159646-0
            • Opcode ID: a3e0bf301100ed3695576e4ea1087b50794ba7928b0d1400312260754193aeaf
            • Instruction ID: 37ed64b50b4d2060acca0dffd99f9703727a0acb26fd4fa47afa50bbcda5b780
            • Opcode Fuzzy Hash: a3e0bf301100ed3695576e4ea1087b50794ba7928b0d1400312260754193aeaf
            • Instruction Fuzzy Hash: C331D5725097806FEB128F60DC45B96BFB8EF06314F0884DAE985CF553D325A909CBB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AA459 Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 182 26aa459-26aa4d7 185 26aa4d9 182->185 186 26aa4dc-26aa4e5 182->186 185->186 187 26aa4ea-26aa4f0 186->187 188 26aa4e7 186->188 189 26aa4f2 187->189 190 26aa4f5-26aa50c 187->190 188->187 189->190 192 26aa50e-26aa521 RegQueryValueExW 190->192 193 26aa543-26aa548 190->193 194 26aa54a-26aa54f 192->194 195 26aa523-26aa540 192->195 193->192 194->195
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,5EDEBC43,00000000,00000000,00000000,00000000), ref: 026AA514
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 6d7078747c3f8cb77c1824990bbe6bf113aedb15601a900eb38de188b152ed93
            • Instruction ID: d48db03fcd73e074c1808b58862d436e7cccc6e461c6f4e6269a389ca526f809
            • Opcode Fuzzy Hash: 6d7078747c3f8cb77c1824990bbe6bf113aedb15601a900eb38de188b152ed93
            • Instruction Fuzzy Hash: F231B1725093805FD722CF61CC54FA6BFB8EF06214F08849AE9858B252D364E94CCB75
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AB60C Relevance: 1.6, APIs: 1, Instructions: 89COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 199 26ab60c-26ab68d 203 26ab68f 199->203 204 26ab692-26ab69b 199->204 203->204 205 26ab69d-26ab6a5 ConvertStringSecurityDescriptorToSecurityDescriptorW 204->205 206 26ab6f3-26ab6f8 204->206 208 26ab6ab-26ab6bd 205->208 206->205 209 26ab6fa-26ab6ff 208->209 210 26ab6bf-26ab6f0 208->210 209->210
            APIs
            • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E90), ref: 026AB6A3
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: DescriptorSecurity$ConvertString
            • String ID:
            • API String ID: 3907675253-0
            • Opcode ID: 23b27199794f8ad01c88c5cd378162614930ee7f04bf61d4f06de4222ad055f7
            • Instruction ID: 6a628c34b5a3cffd5f94a437229fd019bef8e54041a31ef31c00a6d8c81c0fdc
            • Opcode Fuzzy Hash: 23b27199794f8ad01c88c5cd378162614930ee7f04bf61d4f06de4222ad055f7
            • Instruction Fuzzy Hash: 0731C371504380AFE721CF65DC45FABBFB8EF05214F08849AE984CB652D364E908CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AB8A4 Relevance: 1.6, APIs: 1, Instructions: 87fileCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 227 26ab8a4-26ab94e 232 26ab992-26ab997 227->232 233 26ab950-26ab967 MapViewOfFile 227->233 232->233 234 26ab999-26ab99e 233->234 235 26ab969-26ab98f 233->235 234->235
            APIs
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileView
            • String ID:
            • API String ID: 3314676101-0
            • Opcode ID: 563007f265aef1d6dc66d14d6699b018d32cb86e149b1ed6a3e845b101db29a4
            • Instruction ID: 606c2f1e05be4156e38a887959863282c54c1501cb778ecc0bada2fc72da8771
            • Opcode Fuzzy Hash: 563007f265aef1d6dc66d14d6699b018d32cb86e149b1ed6a3e845b101db29a4
            • Instruction Fuzzy Hash: 6531C171405380AFD712CF15CC45F96FFB8FF06324F04459AE9888B662D325A909CB65
            Uniqueness

            Uniqueness Score: -1.00%

            Function 059C04B6 Relevance: 1.6, APIs: 1, Instructions: 86windowCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 239 59c04b6-59c0513 241 59c0516-59c0568 FormatMessageW 239->241 243 59c056e-59c0597 241->243
            APIs
            • FormatMessageW.KERNELBASE(?,00000E90,?,?), ref: 059C0566
            Memory Dump Source
            • Source File: 00000009.00000002.2156417227.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_59c0000_WindowsUpdate.jbxd
            Similarity
            • API ID: FormatMessage
            • String ID:
            • API String ID: 1306739567-0
            • Opcode ID: b731e71032e7cb2c53a07d320e03c0af29163fb58ab1a632f15fbb1544d7982d
            • Instruction ID: 3db4f5ce7ffabd047406a982f526b1b16337453dc4876b314fddee9498599e12
            • Opcode Fuzzy Hash: b731e71032e7cb2c53a07d320e03c0af29163fb58ab1a632f15fbb1544d7982d
            • Instruction Fuzzy Hash: C0318E7150E3C45FD3138B618C65A66BFB4EF87610F1A80CBD884CF6A3D6256919C7B2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026ABC31 Relevance: 1.6, APIs: 1, Instructions: 85synchronizationCOMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 245 26abc31-26abcad 249 26abcaf 245->249 250 26abcb2-26abcbb 245->250 249->250 251 26abcbd 250->251 252 26abcc0-26abcc9 250->252 251->252 253 26abd1a-26abd1f 252->253 254 26abccb-26abcef CreateMutexW 252->254 253->254 257 26abd21-26abd26 254->257 258 26abcf1-26abd17 254->258 257->258
            APIs
            • CreateMutexW.KERNELBASE(?,?), ref: 026ABCD1
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: CreateMutex
            • String ID:
            • API String ID: 1964310414-0
            • Opcode ID: c5fd12fdc6085bf7dc5466b04d4aaeaa628fbaa734eb7d4375f48ef9cc4f72d0
            • Instruction ID: 8ebf64120b85374ab5d2a229417739148c9ae26d79375506add2cbd2d7ff1d55
            • Opcode Fuzzy Hash: c5fd12fdc6085bf7dc5466b04d4aaeaa628fbaa734eb7d4375f48ef9cc4f72d0
            • Instruction Fuzzy Hash: F5318471509380AFE711CF65CC55F96FFB8EF06214F08849AE988CB292D365E948CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 059C023E Relevance: 1.6, APIs: 1, Instructions: 84COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 261 59c023e-59c02db 266 59c032d-59c0332 261->266 267 59c02dd-59c02e5 getaddrinfo 261->267 266->267 269 59c02eb-59c02fd 267->269 270 59c02ff-59c032a 269->270 271 59c0334-59c0339 269->271 271->270
            APIs
            • getaddrinfo.WS2_32(?,00000E90), ref: 059C02E3
            Memory Dump Source
            • Source File: 00000009.00000002.2156417227.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_59c0000_WindowsUpdate.jbxd
            Similarity
            • API ID: getaddrinfo
            • String ID:
            • API String ID: 300660673-0
            • Opcode ID: 0ce48e35597dda9dd49af78bd25e48d3bb77c77c0d0a30a3d7a262aa267b3510
            • Instruction ID: 5412125e101d3124abfeb329b4b7fa10c36c7051f5dc3eea629bde24e383a243
            • Opcode Fuzzy Hash: 0ce48e35597dda9dd49af78bd25e48d3bb77c77c0d0a30a3d7a262aa267b3510
            • Instruction Fuzzy Hash: 30219171500204AEEB21DF60CC85FBAFBACEF04714F04489AEA499A681D7B5A54D8B72
            Uniqueness

            Uniqueness Score: -1.00%

            Function 059C0032 Relevance: 1.6, APIs: 1, Instructions: 80COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 286 59c0032-59c00a7 290 59c00ff-59c0104 286->290 291 59c00a9-59c00b1 DuplicateHandle 286->291 290->291 293 59c00b7-59c00c9 291->293 294 59c00cb-59c00fc 293->294 295 59c0106-59c010b 293->295 295->294
            APIs
            • DuplicateHandle.KERNELBASE(?,00000E90), ref: 059C00AF
            Memory Dump Source
            • Source File: 00000009.00000002.2156417227.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_59c0000_WindowsUpdate.jbxd
            Similarity
            • API ID: DuplicateHandle
            • String ID:
            • API String ID: 3793708945-0
            • Opcode ID: fe85c11cfebbef9717aef2dfe1ffbf96de5166ce999649422cb1b52507aa0855
            • Instruction ID: 71d888fb1b4ce29dac8ac3e680a3348b899a44cf834751e546e3d146bb63741c
            • Opcode Fuzzy Hash: fe85c11cfebbef9717aef2dfe1ffbf96de5166ce999649422cb1b52507aa0855
            • Instruction Fuzzy Hash: 6321B072600604AFEB21CF65CC44FABBBACEF04214F04886AE9858B651D771E54C8BB2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AAB1C Relevance: 1.6, APIs: 1, Instructions: 80COMMON
            Download Yara Rule

            Control-flow Graph

            • Executed
            • Not Executed
            control_flow_graph 275 26aab1c-26aaba9 279 26aabab-26aabbe GetFileType 275->279 280 26aabde-26aabe3 275->280 281 26aabc0-26aabdd 279->281 282 26aabe5-26aabea 279->282 280->279 282->281
            APIs
            • GetFileType.KERNELBASE(?,00000E90,5EDEBC43,00000000,00000000,00000000,00000000), ref: 026AABB1
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileType
            • String ID:
            • API String ID: 3081899298-0
            • Opcode ID: e75ea6ee3eb76b89a43b6d6bf41a21e0548baee40f5bcb2d2c2228c8bc9a573a
            • Instruction ID: 655d07c82c9d553f4145978f4e93d713dbb30b43f75b9a443fc182d70940a5a7
            • Opcode Fuzzy Hash: e75ea6ee3eb76b89a43b6d6bf41a21e0548baee40f5bcb2d2c2228c8bc9a573a
            • Instruction Fuzzy Hash: F621F8755097806FD7128F21DC45BA2BFBCEF47724F0980D6E9848B253D264A90DC775
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AB7C2 Relevance: 1.6, APIs: 1, Instructions: 78COMMON
            Download Yara Rule
            APIs
            • OpenFileMappingW.KERNELBASE(?,?), ref: 026AB84D
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileMappingOpen
            • String ID:
            • API String ID: 1680863896-0
            • Opcode ID: fccc6a52263670eed6e560278cc424aa3c816ed956d86840aa8400a4565ddb7a
            • Instruction ID: b6492e5f23574de871978e275a9071ad567f526cf7e4cf18039f0aab17c3511c
            • Opcode Fuzzy Hash: fccc6a52263670eed6e560278cc424aa3c816ed956d86840aa8400a4565ddb7a
            • Instruction Fuzzy Hash: C72183715093806FE721CF65CC45FA6FFE8EF45214F08889AE9888B652D375E908CB75
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AA56A Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,?,?), ref: 026AA606
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 0ac60981ef479e04314787d6431d006b083b8a8045c4e48457fb247df57f1a7f
            • Instruction ID: 81804c3da07e1fc1fc74a89dac87db81617515e94af5aff7d1545dc247d383a5
            • Opcode Fuzzy Hash: 0ac60981ef479e04314787d6431d006b083b8a8045c4e48457fb247df57f1a7f
            • Instruction Fuzzy Hash: C621D3755093C06FC3138B258C51B62BFB4EF87610F0A81CBE8888B653D225A91AC7B2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AAA46 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON
            Download Yara Rule
            APIs
            • CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 026AAAC5
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: CreateFile
            • String ID:
            • API String ID: 823142352-0
            • Opcode ID: 3ee0b937a78c62e44f46503c41b44b310be777259a0e2e750923773e390f3e76
            • Instruction ID: 3dad0bec4467d07f050ca2958076bd43c8e6c519e240473d5756bd5c373f85db
            • Opcode Fuzzy Hash: 3ee0b937a78c62e44f46503c41b44b310be777259a0e2e750923773e390f3e76
            • Instruction Fuzzy Hash: CE21AE71600244AFEB20CF65DD45B66FBF8EF08214F08856AEA498B752D371E908CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AB632 Relevance: 1.6, APIs: 1, Instructions: 76COMMON
            Download Yara Rule
            APIs
            • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E90), ref: 026AB6A3
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: DescriptorSecurity$ConvertString
            • String ID:
            • API String ID: 3907675253-0
            • Opcode ID: 9298dd5adae12333b524f924785b72de66a7c37a3a2b96882a178f20ec95a7e8
            • Instruction ID: 2cd99ba11e69f7417f1d07ba803aa1473f917733fea8c4d841159a2df65511b2
            • Opcode Fuzzy Hash: 9298dd5adae12333b524f924785b72de66a7c37a3a2b96882a178f20ec95a7e8
            • Instruction Fuzzy Hash: E321D172600244AFEB20CF29DC45BAABBACEF04214F14846AE945DB741D774E909CFB1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AB526 Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,5EDEBC43,00000000,00000000,00000000,00000000), ref: 026AB5B8
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 74b44caad9fb76abe6c85eed08075983e203388c8e5745fe6f9545fbcfa8218a
            • Instruction ID: cc7a0f7abb192b2b74ab0b27331bcba11223da6974bae28ffe8614a758163582
            • Opcode Fuzzy Hash: 74b44caad9fb76abe6c85eed08075983e203388c8e5745fe6f9545fbcfa8218a
            • Instruction Fuzzy Hash: C621AC72504780AFD722CF11CC44FA7BBB8EF46314F08849AE989CB652D365E948CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AA632 Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON
            Download Yara Rule
            APIs
            • RegSetValueExW.KERNELBASE(?,00000E90,5EDEBC43,00000000,00000000,00000000,00000000), ref: 026AA6C4
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: Value
            • String ID:
            • API String ID: 3702945584-0
            • Opcode ID: 56869421837239657e8a3faeee643ff0d36602989c68347b0d5f8cf8ae4e1f5c
            • Instruction ID: d942cf14ffba47fff18914176af044571ba07088e1adeaaef0ca2eaa35f33b0e
            • Opcode Fuzzy Hash: 56869421837239657e8a3faeee643ff0d36602989c68347b0d5f8cf8ae4e1f5c
            • Instruction Fuzzy Hash: 9721AF72504780AFE722CF55CC44FA7BBB8EF45214F08849AE9858B652D364E948CBB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AA392 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON
            Download Yara Rule
            APIs
            • RegOpenKeyExW.KERNELBASE(?,00000E90), ref: 026AA411
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: Open
            • String ID:
            • API String ID: 71445658-0
            • Opcode ID: 2b59727db7cde125f3274875e11efd6e57d7fbb90fc0c1ece99a69ad53c094bd
            • Instruction ID: 1bd3a3ca8b3ac091b60a9e7c33a3b425e42160b1419449afc0a16e2b2d49cb04
            • Opcode Fuzzy Hash: 2b59727db7cde125f3274875e11efd6e57d7fbb90fc0c1ece99a69ad53c094bd
            • Instruction Fuzzy Hash: B1219D72500604AEEB20DFA5CC48FAAFBACEF04614F04845BFA458B651D764E94DCEB6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 059C033D Relevance: 1.6, APIs: 1, Instructions: 72networkCOMMON
            Download Yara Rule
            APIs
            • WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 059C03CA
            Memory Dump Source
            • Source File: 00000009.00000002.2156417227.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_59c0000_WindowsUpdate.jbxd
            Similarity
            • API ID: Connect
            • String ID:
            • API String ID: 3144859779-0
            • Opcode ID: 6a03785b697a7515ec1b1369d7529131aa27026d40e6ca399d4c01b7a08ca040
            • Instruction ID: 7368b54d8cede32df8119677fc6a87ca384c247b98cf5aea9c12afcf3454d2b8
            • Opcode Fuzzy Hash: 6a03785b697a7515ec1b1369d7529131aa27026d40e6ca399d4c01b7a08ca040
            • Instruction Fuzzy Hash: 5921B271509380AFDB22CF64CC44B52BFB8FF46314F0884DAE9858B162D335A919DB62
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026ABC5E Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON
            Download Yara Rule
            APIs
            • CreateMutexW.KERNELBASE(?,?), ref: 026ABCD1
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: CreateMutex
            • String ID:
            • API String ID: 1964310414-0
            • Opcode ID: 2341bc00f49d75deb69113da44ecb9776f44a6f0dd3a6545228c203f55296439
            • Instruction ID: fe21661d414b3f37365833687d8695db10ae385337e011c723b1f9364aaa26c5
            • Opcode Fuzzy Hash: 2341bc00f49d75deb69113da44ecb9776f44a6f0dd3a6545228c203f55296439
            • Instruction Fuzzy Hash: D021D071600244AFE720CF25CC45FA6FBE8EF14218F048469ED498B741D771E909CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AADFE Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON
            Download Yara Rule
            APIs
            • ReadFile.KERNELBASE(?,00000E90,5EDEBC43,00000000,00000000,00000000,00000000), ref: 026AAE7D
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileRead
            • String ID:
            • API String ID: 2738559852-0
            • Opcode ID: 5dacdcc87abf79e673e7cbdcd38ea57f012385ee0f0078addea8e617538b6c38
            • Instruction ID: 771c9d03a678cf4f3b941cef31f88e10d6bb592c5cb3f8fedde2f188432fcdb1
            • Opcode Fuzzy Hash: 5dacdcc87abf79e673e7cbdcd38ea57f012385ee0f0078addea8e617538b6c38
            • Instruction Fuzzy Hash: 9B21A172505380AFDB22CF51DC44F97BFB8EF45210F08849BE9899B652D325A908CBB6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AA49A Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,5EDEBC43,00000000,00000000,00000000,00000000), ref: 026AA514
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 4d937175fa62ba49c49e5ef6826295e2246e0effb4957e96bfdea2aa7940bc2d
            • Instruction ID: 85a354de33539c073c9ecb6ff5d449c3018e25cdec8d472fc7fd50a90154400e
            • Opcode Fuzzy Hash: 4d937175fa62ba49c49e5ef6826295e2246e0effb4957e96bfdea2aa7940bc2d
            • Instruction Fuzzy Hash: A0219076600604AFEB20CF55DC44FA6B7FCEF04614F04845AED458B751D764ED48CAB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AB7E2 Relevance: 1.6, APIs: 1, Instructions: 68COMMON
            Download Yara Rule
            APIs
            • OpenFileMappingW.KERNELBASE(?,?), ref: 026AB84D
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileMappingOpen
            • String ID:
            • API String ID: 1680863896-0
            • Opcode ID: 9c89226162cfb852309500e1443c1b6a90afb1b147e1467e753d8c080fb877e4
            • Instruction ID: b57c858068f346cf54919f730c5b2d25a4253cc832317615b6e6d4cae66116e7
            • Opcode Fuzzy Hash: 9c89226162cfb852309500e1443c1b6a90afb1b147e1467e753d8c080fb877e4
            • Instruction Fuzzy Hash: BC219371604240AFE720CF29CD45BAAFBE8EF04624F04846AED488B741D375E909CB76
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AB087 Relevance: 1.6, APIs: 1, Instructions: 68COMMON
            Download Yara Rule
            APIs
            • setsockopt.WS2_32(?,?,?,?,?), ref: 026AB104
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: setsockopt
            • String ID:
            • API String ID: 3981526788-0
            • Opcode ID: 1ada02cb4b91381e3feecd3c2cb8a2301bf9482f22a06a0e90f065813127c4fa
            • Instruction ID: 3d9e7fa4584fa09db44975682f2419e798b71b70b561e8e00aefa16312c52ccf
            • Opcode Fuzzy Hash: 1ada02cb4b91381e3feecd3c2cb8a2301bf9482f22a06a0e90f065813127c4fa
            • Instruction Fuzzy Hash: DB21AC324093C09FDB228F65DC55AA2FFB4EF47320F0984DAD9C48F663D225A959CB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AB8E2 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON
            Download Yara Rule
            APIs
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileView
            • String ID:
            • API String ID: 3314676101-0
            • Opcode ID: 7c0838f3c040c5f59699a2592406861bc649c9a5bc5be2337d0254520589ec6b
            • Instruction ID: db9f9dbc9825ce29ef68521828ec254113cf26e29dd48dddbbfe2ce400ad650d
            • Opcode Fuzzy Hash: 7c0838f3c040c5f59699a2592406861bc649c9a5bc5be2337d0254520589ec6b
            • Instruction Fuzzy Hash: CF21CD71500244AFEB21CF15CC85BAAFBE8EF09228F048459E9898B751D375A90DCBA6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AAFC2 Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON
            Download Yara Rule
            APIs
            • WSASocketW.WS2_32(?,?,?,?,?), ref: 026AB02E
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: Socket
            • String ID:
            • API String ID: 38366605-0
            • Opcode ID: 4dc17d68bce905873d76e0111bd6511f83f3e8a915955d056fe57f16f6765550
            • Instruction ID: 8c24519d80dc078670ff94c093137d60ea0250a6d4547ee86cef715c795cf402
            • Opcode Fuzzy Hash: 4dc17d68bce905873d76e0111bd6511f83f3e8a915955d056fe57f16f6765550
            • Instruction Fuzzy Hash: 82210171500240AFEB20CF65CC45BA6FBA8FF04324F04885EEA898B751C376A40DCB72
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AB546 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,5EDEBC43,00000000,00000000,00000000,00000000), ref: 026AB5B8
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: 98b7cf24152a3121e12a5dd0f65b9ae0f7f71ce1f8c8e8945034f48c95d09c7b
            • Instruction ID: 8c4018427733739d4dfe51762d291c3007f3b03d6199ac9afdcec5704c38bb4a
            • Opcode Fuzzy Hash: 98b7cf24152a3121e12a5dd0f65b9ae0f7f71ce1f8c8e8945034f48c95d09c7b
            • Instruction Fuzzy Hash: 3911BE72600604AFEB21CF15CC45FAAFBE8EF04718F08845AE9458B752D761E948CFB1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AA652 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON
            Download Yara Rule
            APIs
            • RegSetValueExW.KERNELBASE(?,00000E90,5EDEBC43,00000000,00000000,00000000,00000000), ref: 026AA6C4
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: Value
            • String ID:
            • API String ID: 3702945584-0
            • Opcode ID: 813afaff2c8272f4d4456e6899780b9a36aa1bf48fc33f0a80c03ea94b9879a6
            • Instruction ID: 858a578128e2fae5b397f89802854c12e9378a8afe75ed5cd8a7ef2b72a774dd
            • Opcode Fuzzy Hash: 813afaff2c8272f4d4456e6899780b9a36aa1bf48fc33f0a80c03ea94b9879a6
            • Instruction Fuzzy Hash: 7111BB72600600AFEB21CF59CC44BABBBB8EF04624F18845AE9458A741D760E948CEB6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026ABF2E Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON
            Download Yara Rule
            APIs
            • GetProcessTimes.KERNELBASE(?,00000E90,5EDEBC43,00000000,00000000,00000000,00000000), ref: 026ABF8D
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: ProcessTimes
            • String ID:
            • API String ID: 1995159646-0
            • Opcode ID: bb3e3fcf263aaa2b9df7bdc3d892103e8bb27f29d2ec0a2720bf011a0cb1292a
            • Instruction ID: 14a9820ee7fedf817128dbd4eb98407a22ee83c060e00d09416837b4fcc26d2a
            • Opcode Fuzzy Hash: bb3e3fcf263aaa2b9df7bdc3d892103e8bb27f29d2ec0a2720bf011a0cb1292a
            • Instruction Fuzzy Hash: EB11E672600204AFEB21CF55DC44BAAFBE8EF44314F08846AE945CB651D375E948CFB1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AB2A6 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
            Download Yara Rule
            APIs
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: closesocket
            • String ID:
            • API String ID: 2781271927-0
            • Opcode ID: 2d14875287eed73e039bac0a3d9b83ea0c3f80d00ea2b60c7412a724c296318b
            • Instruction ID: 6f239db9b80164bf0982d148b176d416492ddc620ca2f93c01c37b834481bb9e
            • Opcode Fuzzy Hash: 2d14875287eed73e039bac0a3d9b83ea0c3f80d00ea2b60c7412a724c296318b
            • Instruction Fuzzy Hash: 6C219D7140D3C09FDB128B25DC54792BFB4EF47214F0984DADCC48F263D265A909DBA2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AAE1E Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON
            Download Yara Rule
            APIs
            • ReadFile.KERNELBASE(?,00000E90,5EDEBC43,00000000,00000000,00000000,00000000), ref: 026AAE7D
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileRead
            • String ID:
            • API String ID: 2738559852-0
            • Opcode ID: 7d1f90fa431295b2429f3283f21acc423ea220f119a88b5ebda9cdffe595588c
            • Instruction ID: 02d1f385918146dd0e29c378981c898c14dc8dd7c9fbe30c0bbd351520716c81
            • Opcode Fuzzy Hash: 7d1f90fa431295b2429f3283f21acc423ea220f119a88b5ebda9cdffe595588c
            • Instruction Fuzzy Hash: 2F110472600300AFEB21CF91DC44FAAFBB8EF44314F04845AE9888B651C335A90CCBB5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AA70C Relevance: 1.6, APIs: 1, Instructions: 59COMMON
            Download Yara Rule
            APIs
            • FindCloseChangeNotification.KERNELBASE(?), ref: 026AA76C
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: ChangeCloseFindNotification
            • String ID:
            • API String ID: 2591292051-0
            • Opcode ID: b83c8e9133f593c026e1f817d27700515c48abd581dc68ae85e3d9fdc29900e2
            • Instruction ID: e522fa881d20ece0bd44629ca09eea765e409cc88a6facdefedbe6ffac14721a
            • Opcode Fuzzy Hash: b83c8e9133f593c026e1f817d27700515c48abd581dc68ae85e3d9fdc29900e2
            • Instruction Fuzzy Hash: CE11C875509380AFDB12CF65DC54792BFB8EF42220F0C84DAED858F652D236E909CB61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AA2D2 Relevance: 1.6, APIs: 1, Instructions: 53COMMON
            Download Yara Rule
            APIs
            • SetErrorMode.KERNELBASE(?), ref: 026AA330
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: ErrorMode
            • String ID:
            • API String ID: 2340568224-0
            • Opcode ID: 46e8eb7d50b552da60ff59c0bc861b2191356266a50384932631861fc8171ef5
            • Instruction ID: 7e564feeadd5ab2a8ce5fce3777350098e96507f84e4c8a2afeefbb79cbe7bf7
            • Opcode Fuzzy Hash: 46e8eb7d50b552da60ff59c0bc861b2191356266a50384932631861fc8171ef5
            • Instruction Fuzzy Hash: 841191758097C09FDB128B25DC94B92BFB4EF47220F0D80DBDD858F263D265A909CB62
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AAB5E Relevance: 1.6, APIs: 1, Instructions: 52COMMON
            Download Yara Rule
            APIs
            • GetFileType.KERNELBASE(?,00000E90,5EDEBC43,00000000,00000000,00000000,00000000), ref: 026AABB1
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: FileType
            • String ID:
            • API String ID: 3081899298-0
            • Opcode ID: 75e16f10eade02d2e410984287098c21c8425df312c1b72d115c4ee2f83e575e
            • Instruction ID: dd1c753254bd443bb53f434485a839dbe3d4a30e10ac44365ef5ffffbb984657
            • Opcode Fuzzy Hash: 75e16f10eade02d2e410984287098c21c8425df312c1b72d115c4ee2f83e575e
            • Instruction Fuzzy Hash: 3101D271604244AFE720CF55DC85FAAFBA8EF44624F04809AEE088B741D364E94DCAB6
            Uniqueness

            Uniqueness Score: -1.00%

            Function 059C037E Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON
            Download Yara Rule
            APIs
            • WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 059C03CA
            Memory Dump Source
            • Source File: 00000009.00000002.2156417227.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_59c0000_WindowsUpdate.jbxd
            Similarity
            • API ID: Connect
            • String ID:
            • API String ID: 3144859779-0
            • Opcode ID: 2b30517870300776fb635b4a36590c723f785ba409877162803bbd4efc0693d2
            • Instruction ID: f3c2ce271025b0f8c74f898cdc880bd090b5b98e6e29d6f12ba253a64dca7f17
            • Opcode Fuzzy Hash: 2b30517870300776fb635b4a36590c723f785ba409877162803bbd4efc0693d2
            • Instruction Fuzzy Hash: CC117031604604DFDB20CF55D988B66FFE9FF44210F0889AADD458B662D335E558CB62
            Uniqueness

            Uniqueness Score: -1.00%

            Function 059C0516 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
            Download Yara Rule
            APIs
            • FormatMessageW.KERNELBASE(?,00000E90,?,?), ref: 059C0566
            Memory Dump Source
            • Source File: 00000009.00000002.2156417227.00000000059C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_59c0000_WindowsUpdate.jbxd
            Similarity
            • API ID: FormatMessage
            • String ID:
            • API String ID: 1306739567-0
            • Opcode ID: a1995f5acb6d4a108e16326e7d627b1c9820c756eabb8a4a787cb1832a851b36
            • Instruction ID: 1e6ac804a2f79ce765a7feb02abd2129de068bc5f88dbd37ef1703e9d9f6ab4c
            • Opcode Fuzzy Hash: a1995f5acb6d4a108e16326e7d627b1c9820c756eabb8a4a787cb1832a851b36
            • Instruction Fuzzy Hash: D1017171A00600AFD310DF16DC46B66FBA9FB88A20F14856AED089BB41D735F615CBE5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AB0C6 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
            Download Yara Rule
            APIs
            • setsockopt.WS2_32(?,?,?,?,?), ref: 026AB104
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: setsockopt
            • String ID:
            • API String ID: 3981526788-0
            • Opcode ID: 3673b491cdc3935fd96d474472ef4861f3875b9c9abb0d30161f073c246cae4f
            • Instruction ID: 53894095c7ffb8ccf8a33bd2c8c57db3f4f90b97760d4ecd30c8efb4d8f9e7ba
            • Opcode Fuzzy Hash: 3673b491cdc3935fd96d474472ef4861f3875b9c9abb0d30161f073c246cae4f
            • Instruction Fuzzy Hash: 7901DE325003409FDB20CF55D984B62FBA0EF04324F0888AADE498B612D376E958CF62
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AA73A Relevance: 1.5, APIs: 1, Instructions: 43COMMON
            Download Yara Rule
            APIs
            • FindCloseChangeNotification.KERNELBASE(?), ref: 026AA76C
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: ChangeCloseFindNotification
            • String ID:
            • API String ID: 2591292051-0
            • Opcode ID: 93a0b8f5234fd793d5dbeb6cb75363cee06db66021480443d454aad4a7319737
            • Instruction ID: e6aff97c335b66adf08672077b45aa2c6b88b9c94c632ebae0213347887c4e4e
            • Opcode Fuzzy Hash: 93a0b8f5234fd793d5dbeb6cb75363cee06db66021480443d454aad4a7319737
            • Instruction Fuzzy Hash: B201DF75A002009FEB10CF65D9947A6FBB4EF44220F08C4ABDD498B742D375E948CE62
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AA5B6 Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON
            Download Yara Rule
            APIs
            • RegQueryValueExW.KERNELBASE(?,00000E90,?,?), ref: 026AA606
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: QueryValue
            • String ID:
            • API String ID: 3660427363-0
            • Opcode ID: df9cb37aa8acaa9695201afb43766348fb5cf179c47ed015a49f4d9a482f63d8
            • Instruction ID: a7801b3e26cd80a1b4c99dacc9b05f545c71f76fa2344557a5537ae2d6cde828
            • Opcode Fuzzy Hash: df9cb37aa8acaa9695201afb43766348fb5cf179c47ed015a49f4d9a482f63d8
            • Instruction Fuzzy Hash: 0101A271500600ABD210DF16CC46B66FBA5FB88A20F14811AEC089BB41D771F515CBE5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD09E2 Relevance: 1.5, Strings: 1, Instructions: 291COMMON
            Download Yara Rule
            Strings
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID: [@j^
            • API String ID: 0-1983493110
            • Opcode ID: 477b91f495d4c4ebb74251f5d82a0407303a97f2030babc24e92c77f49aab159
            • Instruction ID: ec93772d53dbaf50e496a16279d5c251ef6c3fc060c024219942a3dd79eb0848
            • Opcode Fuzzy Hash: 477b91f495d4c4ebb74251f5d82a0407303a97f2030babc24e92c77f49aab159
            • Instruction Fuzzy Hash: E6C12A34A01204EFDB09DFA8D594A9D77F3AF89308F2140A8E506AB361DF35ED85CB51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AB2DE Relevance: 1.5, APIs: 1, Instructions: 39COMMON
            Download Yara Rule
            APIs
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: closesocket
            • String ID:
            • API String ID: 2781271927-0
            • Opcode ID: 79b73cb46500251d06c45aec6daa116f8cad2028d089ee7a02cf6fcbef6fceea
            • Instruction ID: d249b1b736d6a38744b931cb9d74852afb1ecb87fc2bb3d5bb8c536eb2552d76
            • Opcode Fuzzy Hash: 79b73cb46500251d06c45aec6daa116f8cad2028d089ee7a02cf6fcbef6fceea
            • Instruction Fuzzy Hash: A201D131A04244DFDB10CF25D984766FBA4EF44625F08C4AADD498F706D37AE948CEA2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026AA2FE Relevance: 1.5, APIs: 1, Instructions: 35COMMON
            Download Yara Rule
            APIs
            • SetErrorMode.KERNELBASE(?), ref: 026AA330
            Memory Dump Source
            • Source File: 00000009.00000002.2136064128.00000000026AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 026AA000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26aa000_WindowsUpdate.jbxd
            Similarity
            • API ID: ErrorMode
            • String ID:
            • API String ID: 2340568224-0
            • Opcode ID: f8a435a7b96e73a9841ee14108ab46c7855bd54b11355dbef92a3d41860bbdda
            • Instruction ID: 4e09536e2d519d8e44aa02cae26f7ef8c56073ad3502516e66893aa03672c460
            • Opcode Fuzzy Hash: f8a435a7b96e73a9841ee14108ab46c7855bd54b11355dbef92a3d41860bbdda
            • Instruction Fuzzy Hash: 7FF0FF31904604CFDB20CF09D988761FBA0EF00320F08C0DACD488B712D375E948CEA2
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD0A68 Relevance: 1.5, Strings: 1, Instructions: 251COMMON
            Download Yara Rule
            Strings
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID: [@j^
            • API String ID: 0-1983493110
            • Opcode ID: 69adf5769b95fdfc958ed6220fbd292b587bf6adf68b2aba09b275a2d379d42a
            • Instruction ID: e5d2174cb39e950bf61f0a1525a0d896c847d680fb0f157cc5d24a3332650a39
            • Opcode Fuzzy Hash: 69adf5769b95fdfc958ed6220fbd292b587bf6adf68b2aba09b275a2d379d42a
            • Instruction Fuzzy Hash: 00A10734B01208DFCB09DBA8D194AAD77F3AF89308F2540A8E506AB765DF35ED85CB51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD1349 Relevance: .3, Instructions: 271COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 012f015db10d92e7a62b42387f600ffd4486d1cda56ab3000d0639d7abc1902b
            • Instruction ID: acc0f674a305238c9c91286700d3a431aa7a3d9c11c68af15b4aa1da1808fba0
            • Opcode Fuzzy Hash: 012f015db10d92e7a62b42387f600ffd4486d1cda56ab3000d0639d7abc1902b
            • Instruction Fuzzy Hash: 66C1E534A04148CFDB05DFB8D590AAEB7F2FB4C304B1580A9D816AB761DB39AD45CF61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD0F98 Relevance: .3, Instructions: 267COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 83bbbc49dfa25f99fb608f990248a043eeefc46c5eceae64122d683b2abdc1bf
            • Instruction ID: 8f72afa998610727aaf6ded4f891d583954be9a4a1c5fd85ed5291064b057f39
            • Opcode Fuzzy Hash: 83bbbc49dfa25f99fb608f990248a043eeefc46c5eceae64122d683b2abdc1bf
            • Instruction Fuzzy Hash: 30B14834A00204DFCB18DFB8D584A9DB7F2AF89314F158269E91AAB3A4DF31EC45CB51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD13B8 Relevance: .2, Instructions: 215COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 70db2d06ae3bcc476319f1c02afef719fb57de6ba52c86a9a8159589223ad339
            • Instruction ID: 9d848286753285dba7e0a41b6107d2a126fc5b16c9b725cf5b6d676a6dc9ef65
            • Opcode Fuzzy Hash: 70db2d06ae3bcc476319f1c02afef719fb57de6ba52c86a9a8159589223ad339
            • Instruction Fuzzy Hash: DA91D534A04148CFDB05DFB8D590AEEB7F2BF8C204B1580A9D816AB761DB39AD45CF61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD13D6 Relevance: .2, Instructions: 211COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 6170b01c6ca7d3efe85e6ca47bcf22d3a25f67b6d61b00b67f522490a117e2e2
            • Instruction ID: d77c8a23e9f1becff0d20b39cd3ac70c3d5ee12db867f1b27274a7a90babf82e
            • Opcode Fuzzy Hash: 6170b01c6ca7d3efe85e6ca47bcf22d3a25f67b6d61b00b67f522490a117e2e2
            • Instruction Fuzzy Hash: B391E634A04148CFDB05DFB8D590AEEB7F2BF8C204B1580A9D816AB761DB39AD45CF61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD13E9 Relevance: .2, Instructions: 210COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 933147df1df295d84009a401b92bc8f5e8d1d084eb0ab1528ba0ca32a6131f42
            • Instruction ID: fe062a98683bad8acc5cbe20dd5d95c8de8ee0fceb7adf3dbf369b206321e277
            • Opcode Fuzzy Hash: 933147df1df295d84009a401b92bc8f5e8d1d084eb0ab1528ba0ca32a6131f42
            • Instruction Fuzzy Hash: 5591E734A04148CFDB05DFB8D590AEEB7F2BF8C204B1580A9D816AB761DB39AD45CF61
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD0070 Relevance: .2, Instructions: 150COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: f01a2d0c0d055f1c5cc779c9a42ec957e0046d9fa50713b93839295712fbab53
            • Instruction ID: 41f1fff3fd8b42e321a06644675534a40eee064e690bcffab864b33b85086fd3
            • Opcode Fuzzy Hash: f01a2d0c0d055f1c5cc779c9a42ec957e0046d9fa50713b93839295712fbab53
            • Instruction Fuzzy Hash: EF619CB4E01208DFDB08DFA5D990AAEBBF2BF89304F208169D909AB364DB355D45CF51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD0628 Relevance: .1, Instructions: 138COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: ce2ba55b417f6d5b93c33b7f538ddd09c098d7777f0e4a054b61e2ea49535213
            • Instruction ID: c619eb6bb95e0145853dd48b99811a44b10e4995f3fa8cf654d6829c2556788b
            • Opcode Fuzzy Hash: ce2ba55b417f6d5b93c33b7f538ddd09c098d7777f0e4a054b61e2ea49535213
            • Instruction Fuzzy Hash: 46517834A01114DBDB04EBB4E5A4A9DB7B2FB88304F218169E506AB390DF75AC80CFA1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD0F88 Relevance: .1, Instructions: 129COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 25f9326dff46c292ce1f727e6f92c41f736f5b9e5668083581a9da5bd7e423e8
            • Instruction ID: d3819fcfda05d1ac0bb8647812c6f0c745dbcf2bc1b265c09d4e357f36c749f5
            • Opcode Fuzzy Hash: 25f9326dff46c292ce1f727e6f92c41f736f5b9e5668083581a9da5bd7e423e8
            • Instruction Fuzzy Hash: 82513630E01244DFDB18DF69D484A9DB7F2AF48314F5885A9E916AB3A1DB71E881CF50
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD130B Relevance: .1, Instructions: 114COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 0480d0ee46dc0f86fa52399ca8f0c41eea34c710fb0d7c2ecca4395ad86588f7
            • Instruction ID: 1b42c84e0f39c80957c297df551bda7fd5512bce3ee69716343cd14f76d901a5
            • Opcode Fuzzy Hash: 0480d0ee46dc0f86fa52399ca8f0c41eea34c710fb0d7c2ecca4395ad86588f7
            • Instruction Fuzzy Hash: 45411834A01244DFDB18DFA9D484A9CB7F2AF48314F5486A9E916AB2A1DB75EC81CB10
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD08E8 Relevance: .1, Instructions: 78COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: ba01dd69d8c70ced603c9f867843fd850ac84ad91cb207b2c06e8e311df2519f
            • Instruction ID: 8228741014f46b8fefbbaa043701e6a34669ce5f07a7ee5e8c8b3bbaf141c8cb
            • Opcode Fuzzy Hash: ba01dd69d8c70ced603c9f867843fd850ac84ad91cb207b2c06e8e311df2519f
            • Instruction Fuzzy Hash: F2217130B00215CFDB04DF64C5416EEB7F2AF88318F648569D409AB381DB369D4ACBA1
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD08D8 Relevance: .1, Instructions: 76COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: f18d0c8991f718cf86936b1267b47de5399c84cd642892fdf03f947f7aed9352
            • Instruction ID: 0d72a670ce729d442d0d4e4d1fe1ad29ab4ef634209d9f1352f9832dcdc4f4c4
            • Opcode Fuzzy Hash: f18d0c8991f718cf86936b1267b47de5399c84cd642892fdf03f947f7aed9352
            • Instruction Fuzzy Hash: A8216031B001159FCB00DF68C591AEEB7F2EB99318F2485A9D009AB341DB36DE4ACB91
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD07E8 Relevance: .1, Instructions: 52COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: c8c171296db82e066948e5e60e798fb33e98a94ec61fdf9928059ed4b1f204a7
            • Instruction ID: 0b293c9ca0e9f5ecb4f84fd34c7df3507ba4758425f176e62f7f6a42b1e86dc0
            • Opcode Fuzzy Hash: c8c171296db82e066948e5e60e798fb33e98a94ec61fdf9928059ed4b1f204a7
            • Instruction Fuzzy Hash: B5115B71A00215EFCB54DF78C8809AEBBF6FB8925471085BAC50ADB314EB35AD06CB90
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD07F8 Relevance: .0, Instructions: 46COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 07a2b2ed73ff451053c4ebdade1d0dd07a3dee3aafb448ebe4740cac81f1a51f
            • Instruction ID: 465f576e3d29d96e34da53b99d006b964e153bdd5553247efc15c530bfbacdc8
            • Opcode Fuzzy Hash: 07a2b2ed73ff451053c4ebdade1d0dd07a3dee3aafb448ebe4740cac81f1a51f
            • Instruction Fuzzy Hash: 5A015A71E00214DFCB54DBB8D84059EBBFAFB89254B10817AC90AE7304EB35AD06CB90
            Uniqueness

            Uniqueness Score: -1.00%

            Function 032705DF Relevance: .0, Instructions: 45COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136721904.0000000003270000.00000040.00000020.00020000.00000000.sdmp, Offset: 03270000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_3270000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 7662a6d927403a6ebd55597210eded337273a6e0248ff022d24255076d4fff6d
            • Instruction ID: 6f43e961c230e81c469447b20f0dbc5ccaeaa217859e68fd87e27f5e4c623a1a
            • Opcode Fuzzy Hash: 7662a6d927403a6ebd55597210eded337273a6e0248ff022d24255076d4fff6d
            • Instruction Fuzzy Hash: 8501A7765497805FC7118F15EC41992BFE8EF86230B0984ABEC488B612D235B949CB71
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD0E31 Relevance: .0, Instructions: 45COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 873ea614edd011d320293e3d60119fb3067ec2eaf57169affbeb6b948ccda3c0
            • Instruction ID: 976fd5bf7ecfedbd7329371f52ab34a04a2f6c247048d8401af9888ecf47a2b3
            • Opcode Fuzzy Hash: 873ea614edd011d320293e3d60119fb3067ec2eaf57169affbeb6b948ccda3c0
            • Instruction Fuzzy Hash: 4A017530F046449BDB18EB79D9A4AAEB6F3AFC8308F10512DE50A97790DF319D46CB51
            Uniqueness

            Uniqueness Score: -1.00%

            Function 03270606 Relevance: .0, Instructions: 27COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136721904.0000000003270000.00000040.00000020.00020000.00000000.sdmp, Offset: 03270000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_3270000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 0008b92278879b525913fc7be27e41abe20f27cfaefea27fc06766cb54fa31be
            • Instruction ID: a53ded56ad7e18d724819783a50158dadbc49c721f06b5a3ffc78d21e31412ef
            • Opcode Fuzzy Hash: 0008b92278879b525913fc7be27e41abe20f27cfaefea27fc06766cb54fa31be
            • Instruction Fuzzy Hash: F7E09276A046044BD650CF0AFD41452F794EB84630B08C07FDC0D8BB11E636F609CAA5
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD0ECC Relevance: .0, Instructions: 26COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: ec7a69995ee3cf6397e866b14d085af0c3bf7d12bc2e5afb2916b78610d10a0a
            • Instruction ID: 9251eb657e959f382059cdfe0fee17253af9f910ed1c9dc81ff321b461008b68
            • Opcode Fuzzy Hash: ec7a69995ee3cf6397e866b14d085af0c3bf7d12bc2e5afb2916b78610d10a0a
            • Instruction Fuzzy Hash: DAF0D431A15554DBDB18EBB8E598AAE73B3BFC8309F104168E00A97295DF359C85CB81
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD0451 Relevance: .0, Instructions: 19COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 74fa5d1f42c8046ff7ddc4d81ca07a77cce31adbae200b546b41a63a79ddf410
            • Instruction ID: e84223ad3dc172a4e29a02d401992f1eebc78ac3fd220c5c545bb1d3e99547a6
            • Opcode Fuzzy Hash: 74fa5d1f42c8046ff7ddc4d81ca07a77cce31adbae200b546b41a63a79ddf410
            • Instruction Fuzzy Hash: CFE0C2322461E08FCB03AF78A83469C3FB6EF8B60030E14C9D546CF256CF1069A0DB96
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026A23F4 Relevance: .0, Instructions: 15COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2135844548.00000000026A2000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A2000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26a2000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 0390e6f9c951b749710bf9c369d4658732483bd61e723fe29e0bb666366bb7a6
            • Instruction ID: e57b389acb99f92f8b5021282de63fc6ada2d7b98bb2dc5725c309d2f4b33428
            • Opcode Fuzzy Hash: 0390e6f9c951b749710bf9c369d4658732483bd61e723fe29e0bb666366bb7a6
            • Instruction Fuzzy Hash: 62D05EB92446C14FE3168A1CC2B8F9537D4AB51708F4644F9AC408B7A3C768D9D6D650
            Uniqueness

            Uniqueness Score: -1.00%

            Function 026A23BC Relevance: .0, Instructions: 14COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2135844548.00000000026A2000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A2000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_26a2000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: c8482df3e107199abe79a62bb90e30cc7abd1b4b7aeb026ada3cd6697f434596
            • Instruction ID: 8609c59bacf9c2ca3f4482843c5ee3c4372b0a792a4714cf0421d657801703eb
            • Opcode Fuzzy Hash: c8482df3e107199abe79a62bb90e30cc7abd1b4b7aeb026ada3cd6697f434596
            • Instruction Fuzzy Hash: 06D05E342405814BDB15CA0CC2F4F5937D4AB41708F1644E8BC108B762C3B8DCC5CA00
            Uniqueness

            Uniqueness Score: -1.00%

            Function 02AD0460 Relevance: .0, Instructions: 13COMMON
            Download Yara Rule
            Memory Dump Source
            • Source File: 00000009.00000002.2136570136.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false
            Joe Sandbox IDA Plugin
            • Snapshot File: hcaresult_9_2_2ad0000_WindowsUpdate.jbxd
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 7b1cfa43dcca25e683d2b16d35807a3b03ef113fe038b80dbc62cac7e50051a4
            • Instruction ID: ed2a855b09fb08f989cb29dc5b66db1a1738779c9022bcd45f66e144450183c8
            • Opcode Fuzzy Hash: 7b1cfa43dcca25e683d2b16d35807a3b03ef113fe038b80dbc62cac7e50051a4
            • Instruction Fuzzy Hash: BFC08C317811A4870B0636A870381AE378EEB8A5613050029EA0BC3346DF015CD08BEE
            Uniqueness

            Uniqueness Score: -1.00%