Edit tour

Windows Analysis Report
02.dll.dll

Overview

General Information

Sample name:	02.dll.dll (renamed file extension from exe to dll)
Original sample name:	02.dll.exe
Analysis ID:	1427741
MD5:	4b7b85d70329e085ab06dcdf9557b0a0
SHA1:	3a277203cb4916eb1f55f867f0bd368476c613fb
SHA256:	49220571574da61781de37f35c66e8f0dadb18fdedb6d3a1be67485069cfd4b0
Tags:	exeQakbottchk08
Infos:

Detection

Bazar Loader, Qbot

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Check for Windows Defender sandbox

Multi AV Scanner detection for submitted file

Yara detected Bazar Loader

Yara detected Qbot

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 5484 cmdline: loaddll64.exe "C:\Users\user\Desktop\02.dll.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 1708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3720 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\02.dll.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 3440 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 3056 cmdline: C:\Windows\system32\WerFault.exe -u -p 3440 -s 424 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 1900 cmdline: rundll32.exe C:\Users\user\Desktop\02.dll.dll,bdnimbus_ask MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 3380 cmdline: C:\Windows\system32\WerFault.exe -u -p 1900 -s 416 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 4124 cmdline: rundll32.exe C:\Users\user\Desktop\02.dll.dll,bdnimbus_ask_async MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 4448 cmdline: C:\Windows\system32\WerFault.exe -u -p 4124 -s 420 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 1408 cmdline: rundll32.exe C:\Users\user\Desktop\02.dll.dll,bdnimbus_ask_bin MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 6620 cmdline: C:\Windows\system32\WerFault.exe -u -p 1408 -s 416 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 5612 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_ask MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5012 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_ask_async MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3092 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_ask_bin MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6540 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",checkit MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6204 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_uninit MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1216 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_text MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1360 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_set_optionv MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 2796 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_set_option MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3200 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_push_json MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1272 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_push_info MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1488 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_push_bin MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3116 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_mem_upload_async MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3652 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_mem_upload MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3924 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_type_of MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5952 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_string MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7180 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_real MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7200 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_path MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7212 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_object MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7232 cmdline: rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_long MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
QakBot, qbotQbot	QBot is a modular information stealer also known as Qakbot or Pinkslipbot. It has been active for years since 2007. It has historically been known as a banking Trojan, meaning that it steals financial data from infected systems, and a loader using C2 servers for payload targeting and download.	GOLD CABIN	http://blog.opensecurityresearch.com/2011/12/intro-to-reversing-w32pinkslipbot.html http://contagiodump.blogspot.com/2010/11/template.html http://www.secureworks.com/research/threat-profiles/gold-lagoon http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_qakbot_in_detail.pdf https://0xthreatintel.medium.com/reversing-qakbot-tlp-white-d1b8b37ad8e7	https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000016.00000002.2179248939.000001A41A0D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_2	Yara detected Qbot	Joe Security
00000016.00000002.2179248939.000001A41A0D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Bazar_2	Yara detected Bazar Loader	Joe Security
00000016.00000002.2180620271.000001A41A101000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Bazar_2	Yara detected Bazar Loader	Joe Security
00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_2	Yara detected Qbot	Joe Security
00000016.00000002.2180749909.000001A41A104000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_2	Yara detected Qbot	Joe Security
00000016.00000002.2181091820.000001A41BB06000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Qbot_2	Yara detected Qbot	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
22.2.rundll32.exe.1a41a104000.3.raw.unpack	JoeSecurity_Qbot_2	Yara detected Qbot	Joe Security
22.2.rundll32.exe.1a41a0d280d.2.raw.unpack	JoeSecurity_Qbot_2	Yara detected Qbot	Joe Security
22.2.rundll32.exe.1a41a0d060d.1.raw.unpack	JoeSecurity_Qbot_2	Yara detected Qbot	Joe Security
22.2.rundll32.exe.1a41a0d060d.1.raw.unpack	JoeSecurity_Bazar_2	Yara detected Bazar Loader	Joe Security
22.2.rundll32.exe.1a41a0d280d.2.unpack	JoeSecurity_Qbot_2	Yara detected Qbot	Joe Security
22.2.rundll32.exe.1a41a0d060d.1.unpack	JoeSecurity_Qbot_2	Yara detected Qbot	Joe Security
22.2.rundll32.exe.1a41a104000.3.unpack	JoeSecurity_Qbot_2	Yara detected Qbot	Joe Security
Click to see the 2 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 02.dll.dll	Virustotal: Detection: 19%			Perma Link
Source: 02.dll.dll	ReversingLabs: Detection: 13%

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00000001800750F0 CryptAcquireContextA,GetLastError,CryptGenRandom,

3_2_00000001800750F0

Source:

Binary string: C:\testing3\data\bdnc\BDNIMBUS-3071711\BDNIMBUS\bin\release\bdnc.pdb source: rundll32.exe, 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.2139051997.0000000180252000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000C.00000002.2145893367.0000000180252000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.2168111693.0000000180252000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2123138544.0000000180252000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000014.00000002.2113846587.0000000180252000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.2115651942.0000000180252000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000002.2168006557.0000000180252000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.2115667100.0000000180252000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2118582232.0000000180252000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000020.00000002.2120004903.0000000180252000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000021.00000002.2122221736.0000000180252000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000024.00000002.2119209789.0000000180252000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000025.00000002.2120409335.0000000180252000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000026.00000002.2120576111.0000000180252000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000027.00000002.2122212594.0000000180252000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000028.00000002.2122216421.0000000180252000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000029.00000002.2122426344.0000000180252000.00000002.00000001.01000000.00000003.sdmp, 02.dll.dll

Source: Amcache.hve.9.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B90ECD0 NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	22_2_000001A41B90ECD0
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B911BB8 NtAllocateVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	22_2_000001A41B911BB8
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B90E6E8 NtAllocateVirtualMemory,NtWriteVirtualMemory,	22_2_000001A41B90E6E8
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B90EE48 NtResumeThread,	22_2_000001A41B90EE48
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B91B1C4 NtProtectVirtualMemory,char_traits,NtProtectVirtualMemory,	22_2_000001A41B91B1C4

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018001E0A0	3_2_000000018001E0A0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018004D020	3_2_000000018004D020
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001800040B0	3_2_00000001800040B0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018002F0C0	3_2_000000018002F0C0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180030190	3_2_0000000180030190
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001800D61A0	3_2_00000001800D61A0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001800201B0	3_2_00000001800201B0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180009200	3_2_0000000180009200
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180083220	3_2_0000000180083220
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001800164D0	3_2_00000001800164D0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180004530	3_2_0000000180004530
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180250558	3_2_0000000180250558
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180244524	3_2_0000000180244524
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180032550	3_2_0000000180032550
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180236540	3_2_0000000180236540
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018022D588	3_2_000000018022D588
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180031570	3_2_0000000180031570
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001800475D0	3_2_00000001800475D0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001800195D0	3_2_00000001800195D0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018023065C	3_2_000000018023065C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018002F640	3_2_000000018002F640
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001800576A0	3_2_00000001800576A0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180036710	3_2_0000000180036710
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018024C700	3_2_000000018024C700
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180006760	3_2_0000000180006760
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180050770	3_2_0000000180050770
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001800307D0	3_2_00000001800307D0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018002F800	3_2_000000018002F800
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018000C840	3_2_000000018000C840
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018002E920	3_2_000000018002E920
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018022D95C	3_2_000000018022D95C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180031950	3_2_0000000180031950
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180032970	3_2_0000000180032970
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018022E968	3_2_000000018022E968
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001802439F4	3_2_00000001802439F4
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180032B40	3_2_0000000180032B40
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180020B50	3_2_0000000180020B50
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180031BB0	3_2_0000000180031BB0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018002FBB0	3_2_000000018002FBB0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180048C20	3_2_0000000180048C20
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018001CC70	3_2_000000018001CC70
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180031CB0	3_2_0000000180031CB0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018002FD10	3_2_000000018002FD10
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018022DD30	3_2_000000018022DD30
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180046DA0	3_2_0000000180046DA0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018001DDC0	3_2_000000018001DDC0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018004FDE0	3_2_000000018004FDE0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180030E40	3_2_0000000180030E40
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018002FE50	3_2_000000018002FE50
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180243EA4	3_2_0000000180243EA4
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41A0D0040	22_2_000001A41A0D0040
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41A0E6B49	22_2_000001A41A0E6B49
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41A0E2BA5	22_2_000001A41A0E2BA5
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41A0EE81D	22_2_000001A41A0EE81D
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41A0ED861	22_2_000001A41A0ED861
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41A0F208D	22_2_000001A41A0F208D
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41A0E48CD	22_2_000001A41A0E48CD
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41A0E8D41	22_2_000001A41A0E8D41
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41A0F055D	22_2_000001A41A0F055D
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41A0EB5CD	22_2_000001A41A0EB5CD
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41A0DB60D	22_2_000001A41A0DB60D
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41A0D4701	22_2_000001A41A0D4701
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B910F98	22_2_000001A41B910F98
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B912CC0	22_2_000001A41B912CC0
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B91BC54	22_2_000001A41B91BC54
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B920480	22_2_000001A41B920480
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B91CC10	22_2_000001A41B91CC10
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B914F3C	22_2_000001A41B914F3C
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B902AF4	22_2_000001A41B902AF4
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B9199C0	22_2_000001A41B9199C0
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B909A00	22_2_000001A41B909A00
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B917134	22_2_000001A41B917134
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B91E950	22_2_000001A41B91E950

Source: C:\Windows\System32\rundll32.exe	Code function: String function: 0000000180026F00 appears 52 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00000001800D7120 appears 105 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 000000018002B690 appears 297 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 0000000180043930 appears 40 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 0000000180227E80 appears 162 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00000001800C6790 appears 133 times

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3440 -s 424

Source: 02.dll.dll

Binary or memory string: OriginalFilenamebdnc.dllT vs 02.dll.dll

Source: classification engine

Classification label: mal84.troj.evad.winDLL@72/17@0/0

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_000000018001CC70 CertOpenSystemStoreA,CertEnumCertificatesInStore,CertEnumCertificatesInStore,CertEnumCRLsInStore,CertEnumCRLsInStore,CertCloseStore,

3_2_000000018001CC70

Source: C:\Windows\System32\rundll32.exe

Code function: 22_2_000001A41B9117AC CreateToolhelp32Snapshot,Process32First,Process32Next,FindCloseChangeNotification,

22_2_000001A41B9117AC

Source: C:\Windows\System32\rundll32.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1708:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1900
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1408
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3440
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4124

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\e0b944d2-36ac-4e22-bd7b-34a71db2a648

Jump to behavior

Source: 02.dll.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\02.dll.dll,bdnimbus_ask

Source: 02.dll.dll	Virustotal: Detection: 19%
Source: 02.dll.dll	ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\02.dll.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\02.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\02.dll.dll,bdnimbus_ask
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3440 -s 424
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1900 -s 416
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\02.dll.dll,bdnimbus_ask_async
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4124 -s 420
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\02.dll.dll,bdnimbus_ask_bin
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1408 -s 416
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_ask
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_ask_async
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_ask_bin
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",checkit
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_uninit
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_text
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_set_optionv
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_set_option
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_push_json
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_push_info
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_push_bin
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_mem_upload_async
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_mem_upload
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_type_of
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_string
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_real
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_path
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_object
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_long
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\02.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\02.dll.dll,bdnimbus_ask	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\02.dll.dll,bdnimbus_ask_async	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\02.dll.dll,bdnimbus_ask_bin	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_ask	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_ask_async	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_ask_bin	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",checkit	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_uninit	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_text	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_set_optionv	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_set_option	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_push_json	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_push_info	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_push_bin	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_mem_upload_async	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_mem_upload	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_type_of	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_string	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_real	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_path	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_object	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_long	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 02.dll.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 02.dll.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: 02.dll.dll

Static file information: File size 3691008 > 1048576

Source: 02.dll.dll

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x250400

Source: 02.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 02.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 02.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 02.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 02.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 02.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 02.dll.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: 02.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 02.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 02.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 02.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 02.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_000000018004FBF0 GetSystemDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,

3_2_000000018004FBF0

Source: 02.dll.dll

Static PE information: real checksum: 0x37113d should be: 0x3893d8

Source: 02.dll.dll

Static PE information: section name: _RDATA

Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41A0F634A push cs; retn 0000h	22_2_000001A41A0F6386
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41A0F4458 push ebx; iretd	22_2_000001A41A0F44DD
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41A0F44D4 push ebx; iretd	22_2_000001A41A0F44DD
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41A0F39DD push ds; ret	22_2_000001A41A0F39E5
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B922CC7 push ebx; iretd	22_2_000001A41B922CD0
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B92A101 push esp; ret	22_2_000001A41B92A10B
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B922C4B push ebx; iretd	22_2_000001A41B922CD0
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B9287C5 push esp; ret	22_2_000001A41B9287C4
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B92873C push esp; ret	22_2_000001A41B9287C4
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B924B3D push cs; retn 0000h	22_2_000001A41B924B79
Source: C:\Windows\System32\rundll32.exe	Code function: 22_2_000001A41B9221D0 push ds; ret	22_2_000001A41B9221D8

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Check for Windows Defender sandbox

Source: C:\Windows\System32\rundll32.exe

File Queried: C:\INTERNAL\__empty

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

API coverage: 2.1 %

Source: C:\Windows\System32\loaddll64.exe TID: 5424	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 6488	Thread sleep count: 237 > 30			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\rundll32.exe

Code function: 22_2_000001A41B910450 LookupAccountSidW,GetSystemInfo,

22_2_000001A41B910450

Source: C:\Windows\System32\loaddll64.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00000001802432BC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_00000001802432BC

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_000000018004FBF0 GetSystemDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,

3_2_000000018004FBF0

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001802432BC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		3_2_00000001802432BC
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180227ED0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		3_2_0000000180227ED0

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Windows\System32\rundll32.exe	Memory allocated: C:\Windows\System32\wermgr.exe base: 26204A90000 protect: page execute and read and write			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory allocated: C:\Windows\System32\wermgr.exe base: 26204AC0000 protect: page read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\rundll32.exe

Memory written: C:\Windows\System32\wermgr.exe base: 26204A90000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\wermgr.exe base: 26204AC0000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\wermgr.exe base: 26204A90000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\System32\wermgr.exe base: 7FF6070E6590	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\02.dll.dll",#1			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: unknown unknown			Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00000001800744F0 GetProcAddress,GetSystemTimeAsFileTime,

3_2_00000001800744F0

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_0000000180061840 GetVersion,RegOpenKeyExA,GetLastError,RegOpenKeyExA,GetLastError,RegCloseKey,RegCloseKey,RegOpenKeyExA,GetLastError,RegCloseKey,

3_2_0000000180061840

Source: C:\Windows\System32\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Bazar Loader

Source: Yara match	File source: 22.2.rundll32.exe.1a41a0d060d.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2179248939.000001A41A0D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2180620271.000001A41A101000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Qbot

Source: Yara match	File source: 22.2.rundll32.exe.1a41a104000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.rundll32.exe.1a41a0d280d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.rundll32.exe.1a41a0d060d.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.rundll32.exe.1a41a0d280d.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.rundll32.exe.1a41a0d060d.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.rundll32.exe.1a41a104000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2179248939.000001A41A0D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2180749909.000001A41A104000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2181091820.000001A41BB06000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Bazar Loader

Source: Yara match	File source: 22.2.rundll32.exe.1a41a0d060d.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2179248939.000001A41A0D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2180620271.000001A41A101000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Qbot

Source: Yara match	File source: 22.2.rundll32.exe.1a41a104000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.rundll32.exe.1a41a0d280d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.rundll32.exe.1a41a0d060d.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.rundll32.exe.1a41a0d280d.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.rundll32.exe.1a41a0d060d.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.rundll32.exe.1a41a104000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2179248939.000001A41A0D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2180749909.000001A41A104000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2181091820.000001A41BB06000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_000000018007BAC0 bind,WSAGetLastError,WSAGetLastError,

3_2_000000018007BAC0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	311 Process Injection	21 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Install Root Certificate	LSA Secrets	15 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
02.dll.dll	20%	Virustotal		Browse
02.dll.dll	13%	ReversingLabs	Win64.Trojan.Nekark

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.9.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427741
Start date and time:	2024-04-18 03:19:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	02.dll.dll (renamed file extension from exe to dll)
Original Sample Name:	02.dll.exe
Detection:	MAL
Classification:	mal84.troj.evad.winDLL@72/17@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 87% Number of executed functions: 34 Number of non-executed functions: 225

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12
Excluded domains from analysis (whitelisted): www.oracle.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, oracle.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

Time	Type	Description
03:20:10	API Interceptor	1x Sleep call for process: loaddll64.exe modified
03:20:12	API Interceptor	4x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_02._cbaa6bb8cd6eed0719b3582c44155bfdd9769a0_0d6cd92f_1df10794-12d3-4aeb-8e12-18077b77d8b2\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8082924720265338
Encrypted:	false
SSDEEP:	96:ql4p3FBRiGyKyssjA4RvT1If7QXIDcQvc6LcEtUcw3tsXaXz+HbHgSQgJjLh88W5:oc1iGysc0hP8QjtAzuiFYZ24lO8Y
MD5:	8BC8038677D312A01AB6770E00A57E21
SHA1:	D395D2560E8754E1F8F7F393F003B3181FAF5A2D
SHA-256:	A5D5799ED9BDBCAAA43590F5D055E4E5318D22AB9C46591F4EC79C01521EFA06
SHA-512:	CD37ECD4C2379B6179B69044D553B5BB893E24AAF4CB9D62141E578941C76D23BF3BF113659F0928FEE0839D1562335745E78970C0AE0C5066E972A850F9C644
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.7.6.8.0.3.5.5.6.0.6.8.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.7.8.7.6.8.0.3.8.0.6.0.6.8.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.d.f.1.0.7.9.4.-.1.2.d.3.-.4.a.e.b.-.8.e.1.2.-.1.8.0.7.7.b.7.7.d.8.b.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.c.f.5.b.d.f.0.-.a.3.5.9.-.4.a.4.b.-.a.9.d.1.-.2.d.5.7.2.4.a.6.a.b.e.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.0.2...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.1.c.-.0.0.0.1.-.0.0.1.4.-.5.c.6.3.-.2.e.8.a.2.e.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.2.!.r.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_02._cbaa6bb8cd6eed0719b3582c44155bfdd9769a0_0d6cd92f_4c7642fa-6aac-4566-ab6f-477eaee57c2a\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8115214235177357
Encrypted:	false
SSDEEP:	192:J8QIi0y6c0hPoX2aj1AzuiFYZ24lO8YC:JjIi56XhPodjyzuiFYY4lO8Y
MD5:	6EFB7DFB40031E1116F12D173F6139C4
SHA1:	993B47048ECE85AD7E7108F7474E89D2083AB579
SHA-256:	91375811CA61F07D3414EDEDA711EA214B3E13B60ED2CDEA2819C9B6FC116ECC
SHA-512:	0CC42587B12320CCEE9BC6A3027274043400EFEC7DC01B062EED7D260C2281C35FAA48C37AF9F2D1B5AB8DBA13C63B3C9DE3A375B53B35DF3F001037C617B261
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.7.6.8.0.0.7.2.5.0.9.9.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.7.8.7.6.8.0.1.1.9.3.8.4.9.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.c.7.6.4.2.f.a.-.6.a.a.c.-.4.5.6.6.-.a.b.6.f.-.4.7.7.e.a.e.e.5.7.c.2.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.a.4.4.7.0.e.1.-.e.e.b.7.-.4.7.5.0.-.9.3.a.7.-.d.1.7.6.0.1.9.9.a.5.6.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.0.2...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.7.0.-.0.0.0.1.-.0.0.1.4.-.f.d.6.9.-.6.4.8.8.2.e.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.2.!.r.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_02._cbaa6bb8cd6eed0719b3582c44155bfdd9769a0_0d6cd92f_78c6e70b-b349-4cf0-8a41-4c90649ff421\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8089879568754943
Encrypted:	false
SSDEEP:	96:qgp/FdhRiOyKynsjA4RvT1If7QXIDcQvc6LcEicw3j2EXaXz+HbHgSQgJjLh88WJ:LXXiOync0hPoX2aj9AzuiFYZ24lO8Y
MD5:	A3CB9E5CD69F38F677D78EC6959D4784
SHA1:	2C37BB455EE7B07FDAB72E7A7E0BA69742F8AD1C
SHA-256:	EF0968435DE28197566E7337146A5FC73EBA15AA8DB5CB0A2644C107996A401B
SHA-512:	27B634FF122E1E70E6EC276591F38E30B254627F20C3EE56420CE774DCCA2C2263F3A28565AB01817E71791473E3BDA87D6320C61022108749BFA326124E9EC5
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.7.6.8.0.6.5.7.2.5.7.2.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.7.8.7.6.8.0.6.8.2.2.5.7.2.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.8.c.6.e.7.0.b.-.b.3.4.9.-.4.c.f.0.-.8.a.4.1.-.4.c.9.0.6.4.9.f.f.4.2.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.2.7.2.2.5.0.6.-.8.4.0.1.-.4.b.3.0.-.9.7.a.a.-.0.b.d.5.7.b.0.b.0.8.d.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.0.2...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.8.0.-.0.0.0.1.-.0.0.1.4.-.8.7.8.a.-.f.a.8.b.2.e.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.2.!.r.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_02._cbaa6bb8cd6eed0719b3582c44155bfdd9769a0_0d6cd92f_86b06d30-c960-47a9-9170-11ab0561e4ea\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.811597969659895
Encrypted:	false
SSDEEP:	96:qWprrFrRizyKyzsjA4RvT1If7QXIDcQvc6LcEicw3j2EXaXz+HbHgSQgJjLh88WR:t/izyzc0hPoX2aj1AzuiFYZ24lO8Y
MD5:	1294F3C3A5768E99BD3F533DBB43B19C
SHA1:	716BDC40183E5F1BBC67FAA7C6F1E12E83047C10
SHA-256:	E55A113253EE2B686EE2C36667BAED157E10E16220E854DF3CBC8F334B4C254B
SHA-512:	397812AC79601347FB79D74DC3E2E2231A2735F847AD13E672CC92AC43D4863EF33275DA59B7B3A5436C8C17030A4E3135F5802D862000AA608857582AC26A8C
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.7.6.8.0.0.7.1.0.6.8.0.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.7.8.7.6.8.0.1.3.6.6.9.3.5.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.6.b.0.6.d.3.0.-.c.9.6.0.-.4.7.a.9.-.9.1.7.0.-.1.1.a.b.0.5.6.1.e.4.e.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.6.6.a.7.a.b.c.-.6.5.2.b.-.4.3.7.4.-.a.4.6.4.-.2.5.3.e.c.a.9.9.0.6.c.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.0.2...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.6.c.-.0.0.0.1.-.0.0.1.4.-.8.0.e.0.-.6.2.8.8.2.e.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.2.!.r.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E42.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Apr 18 01:20:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	58282
Entropy (8bit):	1.7193917176200701
Encrypted:	false
SSDEEP:	192:bs2I0D1DOMHorXMFK781rYu0EH240+MyjN39NRTji/iBuRd:I2N16qormM8dYM24HN3hi/p
MD5:	644772762B089464607684A5603C5A03
SHA1:	6FF3ABDF005AD41D7772FAC54BADE65EEB44B2F9
SHA-256:	C3DB242CB77E5B24D6A95EA12110C14F4216CB86D10B62225E58E7446962191A
SHA-512:	755BC48F73935D65D96DC239976C48962461A887DEB961ABBAC2C210F5431810DE37EE5572F3C1E9A1F15F680386DE360A5B517321D79B4D63E34EC237695FD7
Malicious:	false
Preview:	MDMP..a..... .......@u f........................@................,..........T.......8...........T.......................................................................................................................eJ......`.......Lw......................T.......l...@u f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E71.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Apr 18 01:20:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	58870
Entropy (8bit):	1.708872808113408
Encrypted:	false
SSDEEP:	192:bpI0u1POMHKllpHiKi4xQEdKr+CapD11Aaci:dc1Gq0lxi4xQEdKr+CapDjYi
MD5:	EAB344A5A9C8BE8D204D6AE40800359B
SHA1:	7171B4C0F5446AAC9868D002C02CB58728EC6F8C
SHA-256:	02222046B401ACD38D90CA70677DA64DDE7290750961B8EFBC80E0EACFB02935
SHA-512:	F921B79BD193E80E1C8799A4991DDA21DE1DEEDB2557B81966ADBD06C007D338479370E64468EBDD2D7119EA470CEA701C9E0D401DA43B7202214D20B8A0A9AF
Malicious:	false
Preview:	MDMP..a..... .......@u f........................@................,..........T.......8...........T.......................................................................................................................eJ......`.......Lw......................T.......p...@u f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F4D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8766
Entropy (8bit):	3.6984219958289297
Encrypted:	false
SSDEEP:	192:R6l7wVeJ+qVi6YlvA0gmfk372tvDpr+89bhsSfxLm:R6lXJDw6Ytbgmfk3ehJfg
MD5:	16FF884239786523B25BDD79161F60D0
SHA1:	BC6D0BED4D9D590149CE33E8B048010662967C5E
SHA-256:	8BFB47D40CAF933C40C7BB5093BE952E08378E95EFE4516AFEC4F3AD91707F97
SHA-512:	1A04D2A79BB20E5558981269D46C0FA6F47AE1600320470040D62C0D7CB0A1B43D0AF192E0543BBA4E0994F36BD63535362DA1867D99467FA00341A88C5D4465
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.4.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F4E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8758
Entropy (8bit):	3.697672319700179
Encrypted:	false
SSDEEP:	192:R6l7wVeJd1VUPX6Y0AcszOLgmfk372tvDprB89bh+Sf4Lm:R6lXJ/+6YzOgmfk3Xh7fZ
MD5:	6BDC52AB39792FBBDDD1A25FBDC1D53A
SHA1:	EBF5A54095B46D817986E62B025B1568CC4755EE
SHA-256:	D43D1A92E47F1B9A22E67B53B7284B43E0ACDD9FF9B72BA31D7121AA0B51410C
SHA-512:	8F9AD5DBB4E39ED37B568B06B8FA90F9386166090BBC06EF878E4F389AB12ABA359A75619A65FF9D2639F2786A329E3394A7656EB11F149CA648DDA99F7530B1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.9.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F8C.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4744
Entropy (8bit):	4.468276674950434
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3uJg771I90XWpW8VYeYm8M4JCfCXJFkRyq85mA7ptSTSld:uIjfUI7Dm7VGJyR0poOld
MD5:	E1A6C84DC4832C858D88925426277DA1
SHA1:	2BE3C580511F3CF1B4DDE1DEA953225D9527C50A
SHA-256:	FFCFC3ABC6ABEE78AD8CC5734282356660CF517DF4EDCBA48B6F3464A326CF06
SHA-512:	7A8B19F482AF3D5E94AD3DE11A20E68527C3C91949A2D579896EF2B46E56EFCCA94234C9B62003026767B152E3B08F8AE2439F2325131F25C73BD572891E6573
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="284662" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER800A.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4744
Entropy (8bit):	4.467290990541675
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3uJg771I90XWpW8VYXYm8M4JCfCXJFPKDmyq85mAeptSTSyDd:uIjfUI7Dm7VbJZKiNpoOyDd
MD5:	8B9A4B8E23816886E17C0C64DC19BCC6
SHA1:	472CE55121372B094300D79E97888176DC6DC6D1
SHA-256:	AEFB12FFA21CC253D465EB6E4EF5FC260945F3637C63B45DE87A44FBD6C7E13E
SHA-512:	11E9BABD14266320D9C30FEBE30182A8360A85C0BCF08E6AE4B408C3408657E71998779C2842D84390D86D2848E7C08E633F9430866B9F8920F823E14A667E1F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="284662" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER894E.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Apr 18 01:20:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	59694
Entropy (8bit):	1.6743203613055226
Encrypted:	false
SSDEEP:	96:5t85E3eABknlv1fvmBR25U2UUwgooi7MHBjLWOUMq9RXT6EfEODXexJqekRAOacw:06TkvVOMH5iO89Rm2XexgyOsrE2vW54
MD5:	2FD98A46EB3005DE47ECAE8A1CDF121E
SHA1:	39CD14F89AA2278C967ED928C5DF5AB4A979BB1B
SHA-256:	272C7390F5C035323AC74686547B0C981891DBC4932D92EEF4917304F6EFC361
SHA-512:	DD94F8F112C083AB9B47A67A5E1B2A2E45393ABD3F221811D34C925E649C65A235BF1D4B4453A73A5C6F99FD1B4F5CFF33CF42F9F1C5F205A7A9D7BAABE5A531
Malicious:	false
Preview:	MDMP..a..... .......Cu f........................@................,..........T.......8...........T.......................................................................................................................eJ......`.......Lw......................T...........Cu f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER898E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8506
Entropy (8bit):	3.694288426386566
Encrypted:	false
SSDEEP:	192:R6l7wVeJ2qVp6Y0dcszOLgmfk37vDpr089bT1yfKxm:R6lXJr76YGOgmfk3DTwf1
MD5:	99DF30C977564A5ABFC5A2FF693BAEC1
SHA1:	91BBF7A741C677700F149355EBD4629D1EBF3D3A
SHA-256:	4D98E460794FA518733218173635FBC616FDB3FB02D225D690B24D177793EA58
SHA-512:	BBF1FEAA4E0021CFBF2C035292E0ABEF0D4E8A8F014F6D2423C24181FFB87CEFC70945E6333E5C7985A31F69F4D397D56E0CDE9B964F0A4DDED55A3622C32113
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.1.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER89CD.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4743
Entropy (8bit):	4.467080925548001
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3uJg771I90XWpW8VYiYm8M4JCfCXJFG0yq85mA1CYptSTSpd:uIjfUI7Dm7VmJ1mpoOpd
MD5:	F5B41DD9878713AA8BE3228D8D363B40
SHA1:	A4B0695FEE3C66DCDCCFE8C2D7B0FB5D0035DA73
SHA-256:	59F453826B1B108AD0C75FF04D982D93F24EFC9EC00B56954086E783694E6C0A
SHA-512:	BBAE7E7D2FD210B4F5212CB99E4AE10C073D6F1284794130081CEA04FC1A94947CC601331C5300C1BFA628ED4775F6D8CD5C560311EF2F8DC8741102B0735ECB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="284662" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9516.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Apr 18 01:20:06 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	58826
Entropy (8bit):	1.7090980002259442
Encrypted:	false
SSDEEP:	192:tlRNIQoOMfUYqoQwo+OznLQJJ+yXHy2mT0x27:LrIQvyUYqoQkOznLXeHy2ez7
MD5:	0FA0AF43A912BE7E4311CAD17E122C59
SHA1:	F0EB182403CE5DF6FF74CF80D1EAA6ACF4A03F47
SHA-256:	F1C9B48FF71D358FF1E8EDC95E6294B9F3197040A30B2EDC2B7D4EF0437718E2
SHA-512:	60CD943FF9A0BD044D6647C0E6627AC4382CB771A122D6B1DFA311D37F900FD387346001F08AFA8F1D91F30A2EFC2DCF0A99F18C4EA1B8EC476DC36791B1B2D7
Malicious:	false
Preview:	MDMP..a..... .......Fu f........................@................,..........T.......8...........T.......................................................................................................................eJ......`.......Lw......................T...........Fu f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9555.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8506
Entropy (8bit):	3.6949204379085394
Encrypted:	false
SSDEEP:	192:R6l7wVeJQ+VS6Y0jcszOLgmfk372tvDpra89bugyf46m:R6lXJJA6YYOgmfk3quNfk
MD5:	BDCAAE2179159C3E6656229A9D81DFFE
SHA1:	C6E33EFB6EE7DC6A974DC9B437FD45DE1A0F97BC
SHA-256:	A086BECFC90AB057B3AD16BE85104F8A8D29BE5903144119FA7EA099F8FC186A
SHA-512:	449E7793F96AF160DD7E50A332407AF4B089F97C7F88B70538D577529F30291DEDF6475E31C79A124C2B8F528B200FAAA2F7C5B17BD4CC639F1DCB64B74E5F8B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.4.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9576.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4743
Entropy (8bit):	4.467824020362348
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3uJg771I90XWpW8VYrYm8M4JCfCXJFtyq85mAmaptSTSgd:uIjfUI7Dm7VXJv3apoOgd
MD5:	95985D277F5FE849CF463978C0038729
SHA1:	F7528A828A0DF4083FC091331ED67B60810988EE
SHA-256:	C14252C543D522A19E16DB35D274F0B2182B84D4D8BD00B512B30EB86D1A5E56
SHA-512:	93F2B67CFE50D030B1EE41DEDB4245FFB240495455F76438CE6AF4321B668981CA68C085D804DF717E680AAD75A8CE859615B5E6FE0D917B296F7F0503DFBAF7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="284662" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4224041272369385
Encrypted:	false
SSDEEP:	6144:gSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNa0uhiTw:LvloTMW+EZMM6DFy003w
MD5:	019AEAB32F0DF52C5BDA99EF3F0BFB80
SHA1:	1BE92D2D7D82C98D80A6808586582CF45F5113B2
SHA-256:	DCFF30054B1FF720115E6ACE21B8A2C6E992FD5B543D6DF5C7F0E9BB67EC04A3
SHA-512:	D637E44EA0A218E6904348EF86F70722446B9EE21FC2BC566B79791A8EDB91449D700397BA880FE7583848681A5FEC407ACE66DED8B5560EB400E9879662211B
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...................................................................................................................................................................................................................................................................................................................................................*...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Entropy (8bit):	6.537318244324088
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	02.dll.dll
File size:	3'691'008 bytes
MD5:	4b7b85d70329e085ab06dcdf9557b0a0
SHA1:	3a277203cb4916eb1f55f867f0bd368476c613fb
SHA256:	49220571574da61781de37f35c66e8f0dadb18fdedb6d3a1be67485069cfd4b0
SHA512:	50087b509b58a50db0a67f2aea2838c2783fb2d1d6f5a22d3a68b31e0cdfa7b3b5d469df16af437a6396d3f8dc75fafd689f9af9ce72bfb0c541a3f37ef77f03
SSDEEP:	49152:Js0ewfW1oFguIXFkCEDeQi5LpAO85kDe8MS6pBAuowCSHeuOz8eoY3qtI:vfWzuEKCh91Bw8HFwCS+uXevq
TLSH:	63068E9AB7A80198D876D23CC6575217D7F2F8111370A7CF1AA85ABA1F33BD6123E740
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................W.......W.........Y.............................W.......W...........T...A.......A...L...A.......A.[.....A......

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x18022848c
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x180000000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA
Time Stamp:	0x654A6229 [Tue Nov 7 16:13:29 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	13904d1cc18631217d0dcb5bf82fbc09

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007FB1F4806FF7h
call 00007FB1F4807520h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007FB1F4806E84h
int3
int3
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], esi
push edi
dec eax
sub esp, 10h
xor eax, eax
xor ecx, ecx
cpuid
inc esp
mov eax, ecx
inc ebp
xor ebx, ebx
inc esp
mov edx, edx
inc ecx
xor eax, 6C65746Eh
inc ecx
xor edx, 49656E69h
inc esp
mov ecx, ebx
mov esi, eax
xor ecx, ecx
inc ecx
lea eax, dword ptr [ebx+01h]
inc ebp
or edx, eax
cpuid
inc ecx
xor ecx, 756E6547h
mov dword ptr [esp], eax
inc ebp
or edx, ecx
mov dword ptr [esp+04h], ebx
mov edi, ecx
mov dword ptr [esp+08h], ecx
mov dword ptr [esp+0Ch], edx
jne 00007FB1F4807042h
dec eax
or dword ptr [0010534Bh], FFFFFFFFh
and eax, 0FFF3FF0h
cmp eax, 000106C0h
je 00007FB1F480701Ah
cmp eax, 00020660h
je 00007FB1F4807013h
cmp eax, 00020670h
je 00007FB1F480700Ch
add eax, FFFCF9B0h
cmp eax, 20h
jnbe 00007FB1F4807016h
dec eax
mov ecx, 00000001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x323820	0x470	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x323c90	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x35a000	0x2ce24	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x335000	0x23370	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x358600	0x99a8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x387000	0x88e8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2ff7b0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ff820	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x252000	0x720	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x250340	0x250400	8212fefc98cf34c10b676c17f6e3b55b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x252000	0xd32ca	0xd3400	76621fbe894919882b451ce2ab2e5f8e	False	0.35582470414201184	OpenPGP Public Key	5.471123081038307	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x326000	0xe340	0x8600	ab7cfd72ca12feccd3e2119d4ae467c3	False	0.3199335354477612	data	4.030393245026967	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x335000	0x23370	0x23400	addaf2046d8213bcddaac1c9045692e1	False	0.4740068151595745	data	6.252547672264087	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x359000	0xf4	0x200	67ade243d0c63bd0c48d2d7de33892fe	False	0.310546875	data	2.4479111720682543	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x35a000	0x2ce24	0x2d000	da3045c886eb606bb61f0c39710b28bb	False	0.819189453125	data	7.6855359501807365	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x387000	0x88e8	0x8a00	d3de77e238dd659c73844edc48a1722e	False	0.3052536231884058	data	5.465264225679551	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_STRING	0x35a0a0	0x2ca12	data			0.8229997483616153
RT_VERSION	0x386ab4	0x370	data	English	United States	0.4465909090909091

Imports

DLL	Import
USER32.dll	GetUserObjectInformationW, MessageBoxW, GetProcessWindowStation
CRYPT32.dll	CertGetCertificateChain, CertFreeCertificateChain, CertEnumCertificatesInStore, CertCreateCertificateContext, CertFreeCertificateContext, CertEnumCRLsInStore, CertGetNameStringA, CertCloseStore, CertOpenSystemStoreA
WINMM.dll	timeGetTime
WS2_32.dll	inet_ntoa, inet_addr, WSAGetOverlappedResult, select, getnameinfo, WSASend, WSARecv, getpeername, inet_ntop, gethostname, sendto, recvfrom, send, recv, freeaddrinfo, getaddrinfo, WSASetLastError, getprotobynumber, getservbyname, getservbyport, ntohl, gethostbyaddr, htonl, getsockopt, getsockname, ioctlsocket, connect, bind, accept, WSAWaitForMultipleEvents, WSASetEvent, WSAIoctl, WSAEventSelect, WSAEnumNetworkEvents, WSACreateEvent, WSACloseEvent, socket, closesocket, shutdown, WSAGetLastError, WSACleanup, WSAStartup, ntohs, htons, listen, gethostbyname, setsockopt
IPHLPAPI.DLL	if_nametoindex
ADVAPI32.dll	ReportEventW, RegisterEventSourceW, DeregisterEventSource, CryptGenRandom, CryptAcquireContextA, RegQueryValueExA, RegOpenKeyExA, RegQueryValueExW, RegOpenKeyExW, RegCloseKey
Secur32.dll	InitSecurityInterfaceA
bcrypt.dll	BCryptGenRandom
KERNEL32.dll	IsValidCodePage, FindFirstFileExW, FlushFileBuffers, GetFullPathNameW, GetCurrentDirectoryW, SetEndOfFile, GetConsoleOutputCP, GetTimeZoneInformation, LCMapStringW, CompareStringW, GetCommandLineW, FlsFree, GetEnvironmentStringsW, FlsGetValue, GetOEMCP, HeapReAlloc, HeapAlloc, HeapFree, FreeLibraryAndExitThread, ResumeThread, ExitThread, SetConsoleCtrlHandler, SetStdHandle, ExitProcess, FileTimeToSystemTime, SystemTimeToTzSpecificLocalTime, PeekNamedPipe, GetFileInformationByHandle, GetDriveTypeW, RtlPcToFileHeader, RaiseException, EncodePointer, LoadLibraryExW, InterlockedFlushSList, GetCPInfo, FlsAlloc, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetProcessHeap, GetStringTypeW, GetCommandLineA, FlsSetValue, HeapSize, WriteConsoleW, GetSystemDirectoryA, RtlUnwindEx, GetStartupInfoW, IsDebuggerPresent, CloseHandle, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, WaitForSingleObject, CreateEventA, CreateThread, GetCurrentThreadId, GetThreadId, Sleep, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, CreateFileW, GetFileSize, ReadFile, GetLastError, ReleaseMutex, CreateMutexA, GetModuleFileNameW, MapViewOfFile, UnmapViewOfFile, CreateFileMappingA, DeleteFileW, GetFileSizeEx, GetFileTime, WriteFile, GetCurrentProcessId, MoveFileW, LocalFree, FormatMessageA, GetTickCount64, VirtualAlloc, VirtualFree, SetFilePointerEx, SwitchToThread, RtlUnwind, FreeLibrary, GetProcAddress, LoadLibraryA, LocalAlloc, GetVersion, InitializeCriticalSectionAndSpinCount, TryEnterCriticalSection, ResetEvent, GetTickCount, GetSystemInfo, QueryPerformanceCounter, QueryPerformanceFrequency, SetWaitableTimer, GetSystemTimeAsFileTime, CreateWaitableTimerA, CreateIoCompletionPort, GetQueuedCompletionStatus, PostQueuedCompletionStatus, ReleaseSemaphore, CreateSemaphoreA, SetLastError, GetSystemTime, SystemTimeToFileTime, GetModuleHandleExW, InitializeSRWLock, ReleaseSRWLockExclusive, ReleaseSRWLockShared, AcquireSRWLockExclusive, AcquireSRWLockShared, SwitchToFiber, DeleteFiber, CreateFiberEx, FindClose, FindFirstFileW, FindNextFileW, MultiByteToWideChar, WideCharToMultiByte, GetStdHandle, GetFileType, GetModuleHandleW, GetEnvironmentVariableW, GetACP, ConvertFiberToThread, ConvertThreadToFiberEx, GetCurrentProcess, TerminateProcess, LoadLibraryW, GetConsoleMode, SetConsoleMode, ReadConsoleA, ReadConsoleW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, InitializeSListHead

Exports

Name	Ordinal	Address
bdnimbus_ask	1	0x180001a40
bdnimbus_ask_async	2	0x180001a90
bdnimbus_ask_bin	3	0x180001a70
bdnimbus_ask_bin_async	4	0x180001af0
bdnimbus_ask_json	5	0x180001a50
bdnimbus_ask_json_async	6	0x180001ac0
bdnimbus_dup_option	7	0x180001d10
bdnimbus_file_upload	8	0x1800477e0
bdnimbus_file_upload_async	9	0x1800478c0
bdnimbus_free_option	10	0x180001f20
bdnimbus_free_response	11	0x180001b20
bdnimbus_gen_upload	12	0x180047b40
bdnimbus_gen_upload_async	13	0x180047c10
bdnimbus_get_option	14	0x180001b80
bdnimbus_init	15	0x1800016e0
bdnimbus_json_alloc	16	0x1800264c0
bdnimbus_json_array_at	17	0x180026790
bdnimbus_json_array_size	18	0x180026750
bdnimbus_json_foreach	19	0x180026690
bdnimbus_json_free	20	0x180026520
bdnimbus_json_long	21	0x180026800
bdnimbus_json_object	22	0x180026550
bdnimbus_json_path	23	0x180026570
bdnimbus_json_real	24	0x180026880
bdnimbus_json_string	25	0x1800267b0
bdnimbus_json_type_of	26	0x1800268f0
bdnimbus_mem_upload	27	0x180047990
bdnimbus_mem_upload_async	28	0x180047a70
bdnimbus_push_bin	29	0x180001a10
bdnimbus_push_info	30	0x1800019b0
bdnimbus_push_json	31	0x1800019e0
bdnimbus_set_option	32	0x180001b40
bdnimbus_set_optionv	33	0x180001b70
bdnimbus_text	34	0x180001b30
bdnimbus_uninit	35	0x180001830
checkit	36	0x18002bab0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	03:20:00
Start date:	18/04/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\02.dll.dll"
Imagebase:	0x7ff79cde0000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:20:00
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:20:00
Start date:	18/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\02.dll.dll",#1
Imagebase:	0x7ff77ae60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:20:00
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\02.dll.dll,bdnimbus_ask
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:20:00
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",#1
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:20:00
Start date:	18/04/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 3440 -s 424
Imagebase:	0x7ff6e4750000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:20:00
Start date:	18/04/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1900 -s 416
Imagebase:	0x7ff6e4750000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:20:03
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\02.dll.dll,bdnimbus_ask_async
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:20:03
Start date:	18/04/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 4124 -s 420
Imagebase:	0x7ff6e4750000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:20:06
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\02.dll.dll,bdnimbus_ask_bin
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:20:06
Start date:	18/04/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1408 -s 416
Imagebase:	0x7ff6e4750000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:20:09
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_ask
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:20:09
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_ask_async
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:20:09
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_ask_bin
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:20:09
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",checkit
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_2, Description: Yara detected Qbot, Source: 00000016.00000002.2179248939.000001A41A0D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Bazar_2, Description: Yara detected Bazar Loader, Source: 00000016.00000002.2179248939.000001A41A0D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Bazar_2, Description: Yara detected Bazar Loader, Source: 00000016.00000002.2180620271.000001A41A101000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_2, Description: Yara detected Qbot, Source: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_2, Description: Yara detected Qbot, Source: 00000016.00000002.2180749909.000001A41A104000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_2, Description: Yara detected Qbot, Source: 00000016.00000002.2181091820.000001A41BB06000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:20:09
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_uninit
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:20:09
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_text
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:20:09
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_set_optionv
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	03:20:09
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_set_option
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:20:09
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_push_json
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:20:09
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_push_info
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:20:09
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_push_bin
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:20:09
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_mem_upload_async
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:20:09
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_mem_upload
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	03:20:09
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_type_of
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	03:20:09
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_string
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	03:20:09
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_real
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	03:20:09
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_path
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	03:20:09
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_object
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	03:20:09
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\02.dll.dll",bdnimbus_json_long
Imagebase:	0x7ff6c4e80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	34.7%
Total number of Nodes:	173
Total number of Limit Nodes:	7

Executed Functions

Function 000000018001E0A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32 ref: 000000018001E119
CreateEventA.KERNEL32 ref: 000000018001E129
InitializeCriticalSection.KERNEL32 ref: 000000018001E13D

Part of subcall function 000000018001DD10: GetModuleFileNameW.KERNEL32 ref: 000000018001DD3A

CloseHandle.KERNEL32 ref: 000000018001E2E5
DeleteCriticalSection.KERNEL32 ref: 000000018001E2F2
DeleteCriticalSection.KERNEL32 ref: 000000018001E361

Strings

2.7.23.13110, xrefs: 000000018001E20F

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$DeleteInitialize$CloseCreateEventFileHandleModuleName
String ID: 2.7.23.13110
API String ID: 2975721612-1325857564
Opcode ID: c9e64b5d5de874e64006b4208ba06e432c1c729c6a81084b4a47588ef50795a0
Instruction ID: 843db7772474d0ff59f03532d8ed536115c0c93ed1a7c00b4f46c3a83eeffc16
Opcode Fuzzy Hash: c9e64b5d5de874e64006b4208ba06e432c1c729c6a81084b4a47588ef50795a0
Instruction Fuzzy Hash: 2881E531914B8889F7929B24FC913E573A4BBAD344F12E215ED99A2371EF6883DDC340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001FD0 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 174
timethreadsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32 ref: 000000018000204C
CreateEventA.KERNEL32 ref: 000000018000205C
timeGetTime.WINMM ref: 000000018000207D
GetCurrentThreadId.KERNEL32 ref: 000000018000208A
EnterCriticalSection.KERNEL32 ref: 0000000180002099
GetThreadId.KERNEL32 ref: 00000001800020A6
LeaveCriticalSection.KERNEL32 ref: 00000001800020B5
EnterCriticalSection.KERNEL32 ref: 00000001800020C6
LeaveCriticalSection.KERNEL32 ref: 00000001800020D2
EnterCriticalSection.KERNEL32 ref: 0000000180002102
LeaveCriticalSection.KERNEL32 ref: 0000000180002125
WaitForSingleObject.KERNEL32 ref: 0000000180002131
EnterCriticalSection.KERNEL32 ref: 000000018000213C
LeaveCriticalSection.KERNEL32 ref: 000000018000218F
timeGetTime.WINMM ref: 00000001800021D1

Strings

bdnimbus_ask_ctx_wait, xrefs: 000000018000211B
..\src\api.c, xrefs: 000000018000214A, 000000018000223E
[%s:%d][WARN] %s: request to %s took %u ms, user timeout was %u, rc = %d, xrefs: 000000018000225A
[%s:%d][ERR] %s: WaitForSingleObject error: %d, xrefs: 000000018000215C
__bdnimbus_ask, xrefs: 0000000180002266

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ThreadTimetime$CreateCurrentEventInitializeObjectSingleWait
String ID: ..\src\api.c$[%s:%d][ERR] %s: WaitForSingleObject error: %d$[%s:%d][WARN] %s: request to %s took %u ms, user timeout was %u, rc = %d$__bdnimbus_ask$bdnimbus_ask_ctx_wait
API String ID: 3475094464-629591516
Opcode ID: 4812f55a05d24f0f1dbf1c4d37c89bdc218131ef0e698c61ea9a44a2263d4032
Instruction ID: ebc46655e71ab0e75ec1055d2866893212d24fa1d815d6748513bc1fb5e29a6f
Opcode Fuzzy Hash: 4812f55a05d24f0f1dbf1c4d37c89bdc218131ef0e698c61ea9a44a2263d4032
Instruction Fuzzy Hash: BC718236200B4886EBE6DB61A8543DA73A1F79DB84F00C115EE4A87B95EF7DD64D8700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001EA70 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 000000018001EAAA
GetLastError.KERNEL32 ref: 000000018001EAE5
GetFileSizeEx.KERNEL32 ref: 000000018001EB16
CloseHandle.KERNEL32 ref: 000000018001EB27

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

..\src\win\file_io.c, xrefs: 000000018001EAD0
get_file_size, xrefs: 000000018001EAB9
[%s:%d][ERR] %s: cannot open file %S, xrefs: 000000018001EAD9

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalFileSection$CloseCreateCurrentEnterErrorHandleLastLeaveSizeThread
String ID: ..\src\win\file_io.c$[%s:%d][ERR] %s: cannot open file %S$get_file_size
API String ID: 3280052567-2669655571
Opcode ID: 45f929fd0e639d7aef7f5431a0a027de0373f5f0b090254454440d89c421c287
Instruction ID: de0ae90fbf843a645470fe445282f392f43e2a92a7664f9cb0403a6a1208480a
Opcode Fuzzy Hash: 45f929fd0e639d7aef7f5431a0a027de0373f5f0b090254454440d89c421c287
Instruction Fuzzy Hash: 81115136604B8482E7919F15F44838A7361F78C7E4F448225FA9A47BA8DFBDC64CCB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E9C0 Relevance: 7.5, APIs: 5, Instructions: 44
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 000000018001E9F5
GetLastError.KERNEL32 ref: 000000018001EA04
GetFileTime.KERNEL32 ref: 000000018001EA2E
GetLastError.KERNEL32 ref: 000000018001EA38
CloseHandle.KERNEL32 ref: 000000018001EA4F

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleTime
String ID:
API String ID: 1269242970-0
Opcode ID: a85eb2a73fcc0a72a07e32b41153eee4fe11c919bff0b10b37ec7f831ab55c7c
Instruction ID: 14a81cfb772911ad3a2f477881eb7b80991d8a021900dc89311d75162ade7931
Opcode Fuzzy Hash: a85eb2a73fcc0a72a07e32b41153eee4fe11c919bff0b10b37ec7f831ab55c7c
Instruction Fuzzy Hash: 0F118235704A8482E7818F65B54439EB391F78DBE4F448221EE5A43BE8DFB8CA4D8B05

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001DD10 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000000018001DD3A

Strings

ini, xrefs: 000000018001DD47

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: FileModuleName
String ID: ini
API String ID: 514040917-2002237032
Opcode ID: 4c9063dbe73222241ec3c77244d17132559d2d8930efa9c75aa072f90e5a738f
Instruction ID: 69da000c27ac28c7fb1eb5c4cab2a579709fc5789aa7c6e6cd2fdab0c6b35570
Opcode Fuzzy Hash: 4c9063dbe73222241ec3c77244d17132559d2d8930efa9c75aa072f90e5a738f
Instruction Fuzzy Hash: 3F01177272498C41FBE1E725E85A3DA6366F78C7C4F819111794D865A7DE6CC70DC700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018024591C Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,000000018024538E,?,?,?,000000018024324B,?,?,00000000,00000001802434E6), ref: 0000000180245971

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5e631ba9620dac36c32f22ee6cc630d1abb859b983ebe6bde77ff4686a575f65
Instruction ID: 645a7a0aa2ff762d5ca64c374121d295e14282a5e18fe801c8784250173c1e0a
Opcode Fuzzy Hash: 5e631ba9620dac36c32f22ee6cc630d1abb859b983ebe6bde77ff4686a575f65
Instruction Fuzzy Hash: F8F06D74301E19C1FEEB57AA55883D542A35B9DBA0F0EC425498A863D3DE9CC68C8350

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0000000180061840 Relevance: 45.7, APIs: 10, Strings: 16, Instructions: 161
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,?,?,?,?,00000000,00000000,0000000180058CAB,?,?,00000000,00000001800577EA), ref: 0000000180061868
RegOpenKeyExA.ADVAPI32(?,?,?,?,?,00000000,00000000,0000000180058CAB,?,?,00000000,00000001800577EA), ref: 00000001800618A1
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000000,0000000180058CAB,?,?,00000000,00000001800577EA), ref: 00000001800618AB
RegOpenKeyExA.ADVAPI32(?,?,?,?,?,00000000,00000000,0000000180058CAB,?,?,00000000,00000001800577EA), ref: 00000001800618EB
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000000,0000000180058CAB,?,?,00000000,00000001800577EA), ref: 00000001800618F5
RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,00000000,0000000180058CAB,?,?,00000000,00000001800577EA), ref: 0000000180061A18
RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,00000000,0000000180058CAB,?,?,00000000,00000001800577EA), ref: 0000000180061A23

Strings

Found nameservers in %s/%s, xrefs: 0000000180061940, 00000001800619B1, 00000001800619EB, 0000000180061A87
System\CurrentControlSet\Services\VxD\MSTCP, xrefs: 0000000180061A33
Interfaces, xrefs: 00000001800618E4
NameServer, xrefs: 000000018006191B, 0000000180061A67
System\CurrentControlSet\Services\Tcpip\Parameters, xrefs: 0000000180061895
Couldn't open nt key, %d, xrefs: 00000001800618B1
Didn't find nameservers in %s/%s, xrefs: 000000018006194C, 0000000180061A90
Didn't find any nameservers., xrefs: 0000000180061ABB
"NameServer", xrefs: 0000000180061959, 00000001800619BA, 0000000180061A97
"DhcpNameServer", xrefs: 000000018006197F, 00000001800619FB
nt_key, xrefs: 0000000180061932
interfaces_key, xrefs: 00000001800619A3
Couldn't open interfaces key, %d, xrefs: 00000001800618FB
Couldn't open registry key, %d, xrefs: 0000000180061A4A
win_key, xrefs: 0000000180061A79
DhcpNameServer, xrefs: 000000018006196C, 00000001800619D3, 00000001800619F2

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CloseErrorLastOpen$Version
String ID: "DhcpNameServer"$"NameServer"$Couldn't open interfaces key, %d$Couldn't open nt key, %d$Couldn't open registry key, %d$DhcpNameServer$Didn't find any nameservers.$Didn't find nameservers in %s/%s$Found nameservers in %s/%s$Interfaces$NameServer$System\CurrentControlSet\Services\Tcpip\Parameters$System\CurrentControlSet\Services\VxD\MSTCP$interfaces_key$nt_key$win_key
API String ID: 3341952248-1655250277
Opcode ID: 6c3ddbc380e473385aff4a0542a0d0053935bc29c7950d62d0d2e5f648c7ada8
Instruction ID: 50693aa03402055f010696b665c53ed984b5e91d536782728a5d60e5f749edf0
Opcode Fuzzy Hash: 6c3ddbc380e473385aff4a0542a0d0053935bc29c7950d62d0d2e5f648c7ada8
Instruction Fuzzy Hash: 46719230208F4D99EA929BA1AC443DA2363F71DBC1F94C012B96A976E5DFB8C34DC341

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800195D0 Relevance: 42.4, APIs: 20, Strings: 4, Instructions: 355
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 000000018001964A
LeaveCriticalSection.KERNEL32 ref: 0000000180019660
LeaveCriticalSection.KERNEL32 ref: 000000018001968F
EnterCriticalSection.KERNEL32 ref: 0000000180019699
LeaveCriticalSection.KERNEL32 ref: 000000018001974E
EnterCriticalSection.KERNEL32 ref: 000000018001975B
LeaveCriticalSection.KERNEL32 ref: 0000000180019771

Strings

[%s:%d] %s: [uc:%p] global.last_renew > rt_setts.lutime, xrefs: 0000000180019702
..\src\user_context.c, xrefs: 00000001800196F6, 0000000180019B91
[%s:%d][WARN] %s: service:%s, returning %d (%s), xrefs: 0000000180019B9D
request_perform, xrefs: 00000001800196B7, 0000000180019B85

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: ..\src\user_context.c$[%s:%d] %s: [uc:%p] global.last_renew > rt_setts.lutime$[%s:%d][WARN] %s: service:%s, returning %d (%s)$request_perform
API String ID: 2978645861-3816031580
Opcode ID: 27be6d4d201fdc7913223c7abfdb0b04bf4603c09d1492bda433a85f53b958b2
Instruction ID: f743bb3ced1cc7ed3f1d4770ce890aef556ea09a39cdd427f4c724a96c1c67e5
Opcode Fuzzy Hash: 27be6d4d201fdc7913223c7abfdb0b04bf4603c09d1492bda433a85f53b958b2
Instruction Fuzzy Hash: EAF14836205F4886EB929F55F89039A73A4FB8DB94F548011EE9E877A4DF38CA4DC740

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004FDE0 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 233
networklibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32 ref: 000000018004FE43
LoadLibraryA.KERNEL32 ref: 000000018004FEBD
GetProcAddress.KERNEL32 ref: 000000018004FEE7
FreeLibrary.KERNEL32 ref: 000000018004FFA1
htons.WS2_32 ref: 000000018004FFDA
htonl.WS2_32 ref: 0000000180050066
htons.WS2_32 ref: 000000018005008E
socket.WS2_32 ref: 00000001800500CB
connect.WS2_32 ref: 00000001800500E5
getsockname.WS2_32 ref: 00000001800500FB
closesocket.WS2_32 ref: 0000000180050111
socket.WS2_32 ref: 0000000180050121
connect.WS2_32 ref: 000000018005013D
getsockname.WS2_32 ref: 0000000180050153
closesocket.WS2_32 ref: 0000000180050169

Strings

GetAdaptersAddresses, xrefs: 000000018004FED5
.dll, xrefs: 000000018004FE9A
2001:4860:b002::68, xrefs: 000000018005009B
%u.%u.%u.%u%c, xrefs: 0000000180050003
18.244.0.188, xrefs: 000000018005000F

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: Libraryclosesocketconnectgetsocknamehtonssocket$AddressDirectoryFreeLoadProcSystemhtonl
String ID: %u.%u.%u.%u%c$.dll$18.244.0.188$2001:4860:b002::68$GetAdaptersAddresses
API String ID: 4020265194-1616330253
Opcode ID: 0a18d030f62aa8def49b1ca51848812d0ba008792f5fbf028ec03468da30c1ce
Instruction ID: 5cfcbf66ea73a11519a8c437ba55c52334034679c7e324d6e27435a90e7f9bf1
Opcode Fuzzy Hash: 0a18d030f62aa8def49b1ca51848812d0ba008792f5fbf028ec03468da30c1ce
Instruction Fuzzy Hash: 3AB1D631700B8886FBA2CF21D4543EEB3A1FB49B84F548126EA4947B94EF79CA4DC744

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180009200 Relevance: 33.2, APIs: 4, Strings: 18, Instructions: 171
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,0000000180023F31,?,?,?,?,?,000000018001987D), ref: 0000000180009221
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,0000000180023F31,?,?,?,?,?,000000018001987D), ref: 0000000180009234

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,0000000180023F31,?,?,?,?,?,000000018001987D), ref: 0000000180009473
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,0000000180023F31,?,?,?,?,?,000000018001987D), ref: 00000001800094C0

Strings

[%s:%d][ERR] %s: No DNS servers found!, xrefs: 00000001800092D9
dns_client_init, xrefs: 00000001800092C0, 0000000180009320
[%s:%d][ERR] %s: evdns_base_set_option( dns->evdns_base, "attempts:", n ) failed , xrefs: 000000018000944D
..\src\dns_client.c, xrefs: 000000018000924B, 00000001800092CD, 0000000180009336, 0000000180009374, 00000001800093AB, 00000001800093EC, 0000000180009444, 00000001800094A4
[%s:%d][ERR] %s: evdns_base_set_option( dns->evdns_base, "timeout", DNS_CLIENT_TIMEOUT_STR ) failed , xrefs: 000000018000933F
[%s:%d][ERR] %s: evdns_base_set_option( dns->evdns_base, "randomize-case", r ? "1" : "0" ) failed , xrefs: 00000001800093F5
timeout, xrefs: 000000018000930C
randomize-case, xrefs: 00000001800093CD
max-timeouts:, xrefs: 0000000180009359
attempts:, xrefs: 0000000180009429
Disable probe request:, xrefs: 000000018000945D
[%s:%d][ERR] %s: evdns_base_set_option( dns->evdns_base, "Accept Truncate:", "1" ) failed , xrefs: 00000001800094AD
initial-probe-timeout, xrefs: 000000018000938D
[%s:%d][ERR] %s: evdns_base_set_option( dns->evdns_base, "initial-probe-timeout", "1") failed , xrefs: 00000001800093B4
[%s:%d] %s: %d, xrefs: 0000000180009257
Accept Truncate:, xrefs: 0000000180009486
[%s:%d][ERR] %s: evdns_base_set_option( dns->evdns_base, "max-timeouts:", "1" ) failed , xrefs: 000000018000937D
get_randomize_option, xrefs: 0000000180009244

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CurrentThread
String ID: ..\src\dns_client.c$Accept Truncate:$Disable probe request:$[%s:%d] %s: %d$[%s:%d][ERR] %s: No DNS servers found!$[%s:%d][ERR] %s: evdns_base_set_option( dns->evdns_base, "Accept Truncate:", "1" ) failed $[%s:%d][ERR] %s: evdns_base_set_option( dns->evdns_base, "attempts:", n ) failed $[%s:%d][ERR] %s: evdns_base_set_option( dns->evdns_base, "initial-probe-timeout", "1") failed $[%s:%d][ERR] %s: evdns_base_set_option( dns->evdns_base, "max-timeouts:", "1" ) failed $[%s:%d][ERR] %s: evdns_base_set_option( dns->evdns_base, "randomize-case", r ? "1" : "0" ) failed $[%s:%d][ERR] %s: evdns_base_set_option( dns->evdns_base, "timeout", DNS_CLIENT_TIMEOUT_STR ) failed $attempts:$dns_client_init$get_randomize_option$initial-probe-timeout$max-timeouts:$randomize-case$timeout
API String ID: 266293576-1865272581
Opcode ID: d965125f91bd393bc072160e9fc795a53708ffca34d92fdd2ae5516fba63296a
Instruction ID: 7cdc436ee3a4f6ff7606c3f3e86b83edbc338494da73fbdc1dea5e3e18587f39
Opcode Fuzzy Hash: d965125f91bd393bc072160e9fc795a53708ffca34d92fdd2ae5516fba63296a
Instruction Fuzzy Hash: 4F816932210B4991EBD3DB60E8567D933A1FB4C788F40D116B94AAB6A5DFB9C71CC344

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006760 Relevance: 31.9, APIs: 5, Strings: 13, Instructions: 388
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Part of subcall function 00000001800056C0: InitializeCriticalSection.KERNEL32 ref: 0000000180005704
Part of subcall function 00000001800056C0: CreateEventA.KERNEL32 ref: 0000000180005714
Part of subcall function 00000001800056C0: EnterCriticalSection.KERNEL32 ref: 000000018000578E
Part of subcall function 00000001800056C0: timeGetTime.WINMM ref: 000000018000579D

EnterCriticalSection.KERNEL32 ref: 0000000180006B42
SetEvent.KERNEL32 ref: 0000000180006B9A
SetEvent.KERNEL32 ref: 0000000180006BD3
LeaveCriticalSection.KERNEL32 ref: 0000000180006D91

Part of subcall function 000000018001BE50: EnterCriticalSection.KERNEL32(?,?,?,?,0000100100000200,000000018000684C), ref: 000000018001BE5F
Part of subcall function 000000018001BE50: timeGetTime.WINMM(?,?,?,?,0000100100000200,000000018000684C), ref: 000000018001BEFC
Part of subcall function 000000018001BE50: LeaveCriticalSection.KERNEL32(?,?,?,?,0000100100000200,000000018000684C), ref: 000000018001BF0F

timeGetTime.WINMM ref: 0000000180006C4B

Strings

[%s:%d] %s: bootstrap thread started, xrefs: 00000001800067C1
[%s:%d] %s: prev error : %s, try reloading system certs, xrefs: 0000000180006837
apply_bdnc_config_option, xrefs: 0000000180006971
..\src\bootstrap.c, xrefs: 00000001800067B5, 0000000180006825, 0000000180006920, 00000001800069AF, 0000000180006A7D, 0000000180006ABE, 0000000180006B0A, 0000000180006B5E, 0000000180006C21, 0000000180006DC0
[%s:%d] %s: global_state.benchmark_status = %d, xrefs: 0000000180006B6B
[%s:%d] %s: bootstrap thread exiting, xrefs: 0000000180006DCC
[%s:%d] %s: RUN AGAIN !!! ( restart bootstrap process ), xrefs: 0000000180006C2D
[%s:%d][WARN] %s: event_context_init failed %d, xrefs: 0000000180006AD0
[%s:%d] %s: %s: { %s: %d }, xrefs: 00000001800069CE
[%s:%d][ERR] %s: get_servers_list_from_bootstrap rc = %d ( %s) , xrefs: 000000018000692B
[%s:%d][ERR] %s: order_benchmark rc = %d ( %s) , xrefs: 0000000180006A88
[%s:%d] %s: APPLYING NULL RUNTIME SETTINGS !!!, xrefs: 0000000180006B16
bootstrap, xrefs: 00000001800067A8, 00000001800068E5, 00000001800068F5, 0000000180006AFD, 0000000180006B48, 0000000180006C14, 0000000180006D7E

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Enter$EventLeaveTimetime$CreateCurrentInitializeThread
String ID: ..\src\bootstrap.c$[%s:%d] %s: %s: { %s: %d }$[%s:%d] %s: APPLYING NULL RUNTIME SETTINGS !!!$[%s:%d] %s: RUN AGAIN !!! ( restart bootstrap process )$[%s:%d] %s: bootstrap thread exiting$[%s:%d] %s: bootstrap thread started$[%s:%d] %s: global_state.benchmark_status = %d$[%s:%d] %s: prev error : %s, try reloading system certs$[%s:%d][ERR] %s: get_servers_list_from_bootstrap rc = %d ( %s) $[%s:%d][ERR] %s: order_benchmark rc = %d ( %s) $[%s:%d][WARN] %s: event_context_init failed %d$apply_bdnc_config_option$bootstrap
API String ID: 309211180-4209523062
Opcode ID: 4481ecb29ffc6b536eedb4c4984aa92f8ec8390a69fb9a9f1b93b421f666f533
Instruction ID: 22e00712906eb4fa8e6d6b09bcf7699b900db35e0bb7b7f4762e6890db3f90e1
Opcode Fuzzy Hash: 4481ecb29ffc6b536eedb4c4984aa92f8ec8390a69fb9a9f1b93b421f666f533
Instruction Fuzzy Hash: 15126935A00A488AE7E7DB14E8553E933A6B38C784F44D116EE4A873A5DF79CB49C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000C840 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 198threadmemorysynchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,0000000180001708), ref: 000000018000C855
CreateEventA.KERNEL32(?,?,?,?,?,0000000180001708), ref: 000000018000C8BE
LeaveCriticalSection.KERNEL32(?,?,?,?,?,0000000180001708), ref: 000000018000C8D8
WaitForSingleObject.KERNEL32(?,?,?,?,?,0000000180001708), ref: 000000018000C8EA
EnterCriticalSection.KERNEL32(?,?,?,?,?,0000000180001708), ref: 000000018000C8F7
SetEvent.KERNEL32(?,?,?,?,?,0000000180001708), ref: 000000018000C90D
CloseHandle.KERNEL32(?,?,?,?,?,0000000180001708), ref: 000000018000C922
TlsAlloc.KERNEL32(?,?,?,?,?,0000000180001708), ref: 000000018000C9D6
CreateThread.KERNEL32 ref: 000000018000CA92
CreateThread.KERNEL32 ref: 000000018000CAD8
LeaveCriticalSection.KERNEL32(?,?,?,?,?,0000000180001708), ref: 000000018000CC1B

Strings

..\src\global_state.c, xrefs: 000000018000C993, 000000018000C9EF, 000000018000CBD4
[%s:%d] %s: tls_key %x, xrefs: 000000018000CA01
[%s:%d] %s: first time initialization, xrefs: 000000018000C99F
[%s:%d] %s: setup_network_awareness = %p, xrefs: 000000018000CBE6
global_state_init, xrefs: 000000018000C986

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Create$EnterEventLeaveThread$AllocCloseHandleObjectSingleWait
String ID: ..\src\global_state.c$[%s:%d] %s: first time initialization$[%s:%d] %s: setup_network_awareness = %p$[%s:%d] %s: tls_key %x$global_state_init
API String ID: 1335466951-2822856998
Opcode ID: 5b8900a781346861ece7d277ea429cfe35120803ada4f9a01b0f5194d2b7a4c7
Instruction ID: 5ad6e82f9b377ccd21d59a6e926ca7004b2a21ed97ba1f26592f93088c1d0b29
Opcode Fuzzy Hash: 5b8900a781346861ece7d277ea429cfe35120803ada4f9a01b0f5194d2b7a4c7
Instruction Fuzzy Hash: 63A14434200A4986FBD2DB20F8957D973A5BB8D3A4F05C625F86AA23E1DF39C34D8745

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001CC70 Relevance: 28.1, APIs: 6, Strings: 10, Instructions: 147encryptionCOMMON

Download Yara Rule

APIs

CertOpenSystemStoreA.CRYPT32 ref: 000000018001CC99
CertEnumCertificatesInStore.CRYPT32 ref: 000000018001CCFE
CertEnumCertificatesInStore.CRYPT32 ref: 000000018001CE29
CertEnumCRLsInStore.CRYPT32 ref: 000000018001CE7F

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

[%s:%d] %s: '%s' %s, xrefs: 000000018001CDBD
hcert_2_x509_store, xrefs: 000000018001CD18
..\src\ssl\ssl_ctx.c, xrefs: 000000018001CCB4, 000000018001CDB2, 000000018001CDF6, 000000018001CE4C
[%s:%d][ERR] %s: CertOpenSystemStore returned NULL, xrefs: 000000018001CCC0
not added, xrefs: 000000018001CDA5
[%s:%d][ERR] %s: d2i_X509 error on %p of size %d!!!, xrefs: 000000018001CE01
ROOT, xrefs: 000000018001CC90
[%s:%d] %s: Added %d certificates from a total of %d, xrefs: 000000018001CE58
x509_cert_dump, xrefs: 000000018001CDD8
add_windows_certs, xrefs: 000000018001CCA7

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CertStore$Enum$CertificatesCriticalSection$CurrentEnterLeaveOpenSystemThread
String ID: ..\src\ssl\ssl_ctx.c$ROOT$[%s:%d] %s: '%s' %s$[%s:%d] %s: Added %d certificates from a total of %d$[%s:%d][ERR] %s: CertOpenSystemStore returned NULL$[%s:%d][ERR] %s: d2i_X509 error on %p of size %d!!!$add_windows_certs$hcert_2_x509_store$not added$x509_cert_dump
API String ID: 3739351216-1269581511
Opcode ID: a9f4c900b65edde4121199c8f1765d23a1735cb14fc9985a2fb940b028b6c793
Instruction ID: f94e1e82e5a533933c28fd5015221c649a172d872045eb909d6649a0253eb7d2
Opcode Fuzzy Hash: a9f4c900b65edde4121199c8f1765d23a1735cb14fc9985a2fb940b028b6c793
Instruction Fuzzy Hash: 6D615F31305B8881EBA69B11E4153DA73A1FB4DBC4F44842AEA8E07B95EFBDC24DC744

Uniqueness

Uniqueness Score: -1.00%

Function 000000018024C700 Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1214COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 000000018024C74F
_invalid_parameter_noinfo.LIBCMT ref: 000000018024CD82
_invalid_parameter_noinfo.LIBCMT ref: 000000018024CEF8
_invalid_parameter_noinfo.LIBCMT ref: 000000018024D1B4
_invalid_parameter_noinfo.LIBCMT ref: 000000018024D3D4
_invalid_parameter_noinfo.LIBCMT ref: 000000018024D60F
memcpy_s.LIBCPMT ref: 000000018024D6EA
memcpy_s.LIBCPMT ref: 000000018024D795
memcpy_s.LIBCPMT ref: 000000018024D865

Part of subcall function 0000000180237738: _invalid_parameter_noinfo.LIBCMT ref: 000000018023776A

Strings

1#SNAN, xrefs: 000000018024C862
1#QNAN, xrefs: 000000018024C86B
1#IND, xrefs: 000000018024C83F
1#INF, xrefs: 000000018024C87B

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: f807d3a1488a21b4a9ecd99756f5715bf8b4cf850c1f9ec16a32a0ebbd74b94e
Instruction ID: 973a56cee8e1ce68f72cc750fb74a428385219353f6417a82e18618aa775506c
Opcode Fuzzy Hash: f807d3a1488a21b4a9ecd99756f5715bf8b4cf850c1f9ec16a32a0ebbd74b94e
Instruction Fuzzy Hash: CCB2E772710A988BE7E6CF68D4887ED77B2F348788F529215DA0657A84DFB4D708CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180048C20 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 267COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180048C59
LeaveCriticalSection.KERNEL32 ref: 0000000180048C7D
LeaveCriticalSection.KERNEL32 ref: 0000000180048D79
EnterCriticalSection.KERNEL32 ref: 0000000180048E8E
SetEvent.KERNEL32 ref: 0000000180048EDD
LeaveCriticalSection.KERNEL32 ref: 0000000180048EE7

Strings

katastif/manager, xrefs: 0000000180048C9D
[%s:%d] %s: upload->active_req->uc = NULL;, xrefs: 0000000180048F04
[%s:%d] %s: calling user_context_signal_uninit, xrefs: 0000000180048F3C
upload_cancel_context_req, xrefs: 0000000180048E9A, 0000000180048F23
[%s:%d] %s: signal user thread (due to BDNC_CTX_F_WAIT_4_UPLOADS), xrefs: 0000000180048ECD
..\src\upload\upload.c, xrefs: 0000000180048EC1, 0000000180048EF8, 0000000180048F30

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$Event
String ID: ..\src\upload\upload.c$[%s:%d] %s: calling user_context_signal_uninit$[%s:%d] %s: signal user thread (due to BDNC_CTX_F_WAIT_4_UPLOADS)$[%s:%d] %s: upload->active_req->uc = NULL;$katastif/manager$upload_cancel_context_req
API String ID: 204801070-3387526285
Opcode ID: d8d10ac81dc638fe6685ab753b90bad6cfb65405325f13776b30c7e1c7a6ad8b
Instruction ID: 7c05e3d8ff5dcce25a8e1f6d3fab9ec8ddb5ca7f3a214d1a3766e1aaadf0d831
Opcode Fuzzy Hash: d8d10ac81dc638fe6685ab753b90bad6cfb65405325f13776b30c7e1c7a6ad8b
Instruction Fuzzy Hash: 47C18D32201F8885EB92DF26E4943EE73A5F788B88F45C425EE4947795CF38CA59D344

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800201B0 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 310COMMON

Download Yara Rule

Strings

..\src\bdnc_conn.c, xrefs: 00000001800201E9, 0000000180020412, 0000000180020625
l, xrefs: 0000000180020204
bdnc_conn_read_cb, xrefs: 00000001800201FD, 0000000180020647
[%s:%d] %s: finish with error %d for conn %p, pending_cb: %d, response: %p, xrefs: 0000000180020631
[%s:%d][ERR] %s: primary not set, xrefs: 000000018002041E
[%s:%d] %s: finish with error %d for conn %p, pending_cb: %d, xrefs: 000000018002020C
bdnc_conn_start_ssl, xrefs: 0000000180020405

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: ..\src\bdnc_conn.c$[%s:%d] %s: finish with error %d for conn %p, pending_cb: %d$[%s:%d] %s: finish with error %d for conn %p, pending_cb: %d, response: %p$[%s:%d][ERR] %s: primary not set$bdnc_conn_read_cb$bdnc_conn_start_ssl$l
API String ID: 2351996187-4163792662
Opcode ID: 4f3cc9183cf747ac574d1dab44faca41f401c34a52d10e0e5ccd87735939675e
Instruction ID: 23ca67113a03f507704387ceb1ed6af91a2417c49003db995d7259e8f427f4fe
Opcode Fuzzy Hash: 4f3cc9183cf747ac574d1dab44faca41f401c34a52d10e0e5ccd87735939675e
Instruction Fuzzy Hash: 55D18D76200B8986EBA3DF21D4513EA33A1F788BD8F548122FE4947796DF78C659C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020B50 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 306COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 0000000180020BFD

Strings

..\src\bdnc_conn.c, xrefs: 0000000180020C09, 0000000180020D53, 0000000180020E04, 0000000180020EBA, 0000000180020F78, 0000000180021041
bdnc_conn_cancel_pending, xrefs: 0000000180020DED, 0000000180020F61
}, xrefs: 0000000180020C27
bdnc_conn_close, xrefs: 000000018002102A
[%s:%d] %s: finish with error %d for conn %p, pending_cb: %d, xrefs: 0000000180020C14, 0000000180020D5F, 0000000180020EC5
bdnc_conn_first_connect_event_cb, xrefs: 0000000180020C20, 0000000180020D48, 0000000180020ED1
[%s:%d] %s: [%p] cancel deferred, xrefs: 0000000180020E10, 0000000180020F84, 000000018002104D

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: closesocket
String ID: ..\src\bdnc_conn.c$[%s:%d] %s: [%p] cancel deferred$[%s:%d] %s: finish with error %d for conn %p, pending_cb: %d$bdnc_conn_cancel_pending$bdnc_conn_close$bdnc_conn_first_connect_event_cb$}
API String ID: 2781271927-2627043027
Opcode ID: 7fc59c2ff859337547ea90b7fbb311a5e87a8f8733c62fd8407955444834dfcb
Instruction ID: d1beeda486adc507a534d285dbe26d48ae6f0eb5da7a210d837fcc38e7860438
Opcode Fuzzy Hash: 7fc59c2ff859337547ea90b7fbb311a5e87a8f8733c62fd8407955444834dfcb
Instruction Fuzzy Hash: 39E16F31211B9882EBE7DF65E4553E933A1FB8CBC4F548136BA4A47696CF78C649C380

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800D61A0 Relevance: 13.9, Strings: 11, Instructions: 173COMMON

Download Yara Rule

Strings

reseed_time_interval, xrefs: 00000001800D63B6
cipher, xrefs: 00000001800D62A3
HMAC, xrefs: 00000001800D636B
crypto\rand\rand_lib.c, xrefs: 00000001800D6223, 00000001800D6272, 00000001800D645A
AES-256-CTR, xrefs: 00000001800D6299
mac, xrefs: 00000001800D6372
reseed_requests, xrefs: 00000001800D6388
digest, xrefs: 00000001800D62F1
properties, xrefs: 00000001800D633B
rand_new_drbg, xrefs: 00000001800D6217, 00000001800D6266, 00000001800D644E
CTR-DRBG, xrefs: 00000001800D61F0

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID: AES-256-CTR$CTR-DRBG$HMAC$cipher$crypto\rand\rand_lib.c$digest$mac$properties$rand_new_drbg$reseed_requests$reseed_time_interval
API String ID: 0-2016530501
Opcode ID: eb162fb543e1a40bd0f4c203ca3cd53d081e2c07a414a47c6fea23810da1aaef
Instruction ID: 0f2127ca39f0a023408fd4521642cb8b205a58c50436712588cd78e25827142a
Opcode Fuzzy Hash: eb162fb543e1a40bd0f4c203ca3cd53d081e2c07a414a47c6fea23810da1aaef
Instruction Fuzzy Hash: CC818E72A14B8D82EBA2DF24D9113E96360FB9D784F44E211EE4D13A97EF74D289C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004FBF0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 000000018004FC15
LoadLibraryA.KERNEL32 ref: 000000018004FC9E
GetProcAddress.KERNEL32 ref: 000000018004FCCF
FreeLibrary.KERNEL32 ref: 000000018004FD80

Strings

GetAdaptersAddresses, xrefs: 000000018004FCBD
.dll, xrefs: 000000018004FC7A

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: .dll$GetAdaptersAddresses
API String ID: 582185067-2500582564
Opcode ID: ae7b3a7f799668552c02c7bea7c440d77f657607e626616e438217d5028b37c3
Instruction ID: 0ebc1fcf9cf3d1b0d991d310005420524196b9b244dbe1e4d58269070a15d413
Opcode Fuzzy Hash: ae7b3a7f799668552c02c7bea7c440d77f657607e626616e438217d5028b37c3
Instruction Fuzzy Hash: 7D51A431605B8886EBB2DF21E4943EAB3A1F74DBC4F498115EA4D4BB94DF79C609C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001802432BC Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 0000000180243335
RtlLookupFunctionEntry.KERNEL32 ref: 000000018024334D
RtlVirtualUnwind.KERNEL32 ref: 0000000180243388
IsDebuggerPresent.KERNEL32 ref: 00000001802433C1
SetUnhandledExceptionFilter.KERNEL32 ref: 00000001802433CB
UnhandledExceptionFilter.KERNEL32 ref: 00000001802433D6

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: bf1ea08ba6c04a60860547c9da8ac28574935d2b4987126833dfed521a95f34e
Instruction ID: 7d60bbc265b93d377ac29006bb71f44d3c66d4126c01a303d965aaacf63ca65d
Opcode Fuzzy Hash: bf1ea08ba6c04a60860547c9da8ac28574935d2b4987126833dfed521a95f34e
Instruction Fuzzy Hash: DB319F32214F8486DBA1CF25E8843DE73A1F78D758F544126EA8E43B94EF78C259CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180236540 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00000001802365AA
memcpy_s.LIBCPMT ref: 00000001802365D5

Strings

, xrefs: 0000000180236708

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-3916222277
Opcode ID: 0a92a3545022d5413d45cc527e772310ed2624658a47654af9623816e738ea1b
Instruction ID: 72570f642db5a148e0d02af25445a132e8b6c81d9b4f5bfb8ba34872a80729a9
Opcode Fuzzy Hash: 0a92a3545022d5413d45cc527e772310ed2624658a47654af9623816e738ea1b
Instruction Fuzzy Hash: EFC1087271468987EBA1CF19E04CB9AF79AF38C788F46C125DB4647B64DB78D909CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001DDC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 000000018001DE2A
CreateEventA.KERNEL32 ref: 000000018001DE3A
InitializeCriticalSection.KERNEL32 ref: 000000018001DE4E

Strings

2.7.23.13110, xrefs: 000000018001DF2E

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalInitializeSection$CreateEvent
String ID: 2.7.23.13110
API String ID: 57637462-1325857564
Opcode ID: f30e2d7db92ed3dd10bb114c69df933067544c71c89ec14a3a83cfe4ebd590a8
Instruction ID: 26397df0cc9595524aa01511255dce5330eb7df4e4a16f6ebaab9d16fe4b3c02
Opcode Fuzzy Hash: f30e2d7db92ed3dd10bb114c69df933067544c71c89ec14a3a83cfe4ebd590a8
Instruction Fuzzy Hash: 37519531915F8889E2828B24F8853E573A4BBAD345F22E315ED9962331EF7953D98740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800744F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55libraryloadertimeCOMMON

Download Yara Rule

APIs

Part of subcall function 000000018004F700: GetSystemDirectoryA.KERNEL32 ref: 000000018004F728
Part of subcall function 000000018004F700: LoadLibraryA.KERNEL32 ref: 000000018004F7A4

GetProcAddress.KERNEL32(?,?,?,?,?,?,00000000,00000001800517FD), ref: 0000000180074526
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00000000,00000001800517FD), ref: 0000000180074567

Strings

GetSystemTimePreciseAsFileTime, xrefs: 000000018007451C
kernel32.dll, xrefs: 000000018007450B

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: SystemTime$AddressDirectoryFileLibraryLoadProc
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3557092845-706389432
Opcode ID: 55cef4bf8f9c2541f9799cbab292375fa13d88d890a53b068a3ee3544b9ca059
Instruction ID: 6cc047d9855c1ea3508eab19a221c0a26c3ddc9b8ce88b7f90a3ab2d865e91b2
Opcode Fuzzy Hash: 55cef4bf8f9c2541f9799cbab292375fa13d88d890a53b068a3ee3544b9ca059
Instruction Fuzzy Hash: ED118172B06A0C87FEDACB99A8543A46391BB4CBC5F44C525ED1E4A3E5EF2D825CC700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800576A0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 268COMMON

Download Yara Rule

Strings

Unable to seed random number generator; DNS can't run., xrefs: 00000001800576B5
Unrecognized flag passed to evdns_base_new(). Assuming you meant EVDNS_BASE_INITIALIZE_NAMESERVERS., xrefs: 00000001800577C0

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID: Unable to seed random number generator; DNS can't run.$Unrecognized flag passed to evdns_base_new(). Assuming you meant EVDNS_BASE_INITIALIZE_NAMESERVERS.
API String ID: 0-2473713154
Opcode ID: 011aeaf54e7f0377a30dae391b4c4ae5739835a86721212c16abfd16ae44365b
Instruction ID: 4150bd5637e90c64b7ceca6f0b373cccffa9058bbfbb566725ef4434246185f1
Opcode Fuzzy Hash: 011aeaf54e7f0377a30dae391b4c4ae5739835a86721212c16abfd16ae44365b
Instruction Fuzzy Hash: 4FC18B32301B4886EAAA9F25E1503E973A1FB48BC4F58C425FB4D17786DF7AD668D340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800750F0 Relevance: 4.6, APIs: 3, Instructions: 100encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 0000000180075165
GetLastError.KERNEL32 ref: 000000018007516F
CryptGenRandom.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000180074BFE,?,?,00000001), ref: 000000018007519B

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: Crypt$AcquireContextErrorLastRandom
String ID:
API String ID: 738925053-0
Opcode ID: 24e27a3411532a7dc29c23013b4d8dd64f0075c8f67cbcc84a1b24e7ee847d02
Instruction ID: d8c051dbc21a32a3005a5b716eea6e9132cbdff3dac1c79d32f264caec558372
Opcode Fuzzy Hash: 24e27a3411532a7dc29c23013b4d8dd64f0075c8f67cbcc84a1b24e7ee847d02
Instruction Fuzzy Hash: 255194311081E84DF7A38F209855BE53F60B76B706FA4C296E9D58229BDE6CC34DC710

Uniqueness

Uniqueness Score: -1.00%

Function 000000018007BAC0 Relevance: 4.6, APIs: 3, Instructions: 89networkCOMMON

Download Yara Rule

APIs

bind.WS2_32 ref: 000000018007BB96
WSAGetLastError.WS2_32 ref: 000000018007BBA0
WSAGetLastError.WS2_32 ref: 000000018007BBEE

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: ErrorLast$bind
String ID:
API String ID: 234189176-0
Opcode ID: 7c01bfd57b6bc5f73a7db8e90d4b76400e062e38255e765a05437eab505e4cb9
Instruction ID: 5e768571466bef01367656bf08ac5beaf0dd5f41de04be0e9b8119f92e001d1a
Opcode Fuzzy Hash: 7c01bfd57b6bc5f73a7db8e90d4b76400e062e38255e765a05437eab505e4cb9
Instruction Fuzzy Hash: E931B532A0878881F3A29B21E8557FA73B1F799784F50D225FA8986655DF7DC6CC8700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004D020 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 272COMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 000000018004D0DF

Strings

%u.%u.%u.%u%c, xrefs: 000000018004D078, 000000018004D197

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: htonl
String ID: %u.%u.%u.%u%c
API String ID: 2009864989-2006965413
Opcode ID: 5fe733ff000cc33adcc262e9e83b27277e124f5c6a553b22afdb2759a63767be
Instruction ID: 651051a97b173696949b5a0d4cbb0da7994fd8400fd85785f6a78117e6105f74
Opcode Fuzzy Hash: 5fe733ff000cc33adcc262e9e83b27277e124f5c6a553b22afdb2759a63767be
Instruction Fuzzy Hash: C4B1253270099C89FB92CF64D5843FC3BA2E719398F458167FE8912AD9DA78CA49C304

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180250558 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00000001802507A7
RaiseException.KERNEL32 ref: 00000001802507B8

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: bac15ef45a1164744c7e78e8d9d0c0cfd8c04e782fd59b0ed117bdadee376b64
Instruction ID: b6f5c1a7e3f664ec92f6c6426feea24630b21bce02c6b1ee4c6fe22bcdbd34f4
Opcode Fuzzy Hash: bac15ef45a1164744c7e78e8d9d0c0cfd8c04e782fd59b0ed117bdadee376b64
Instruction Fuzzy Hash: 0CB17E77210B48CBEB96CF29C88939C77A1F388B58F14C911EA5A837A4CB76D955CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180083220 Relevance: 2.8, Strings: 2, Instructions: 258COMMON

Download Yara Rule

Strings

SSL_CTX_new_ex, xrefs: 0000000180083274, 00000001800832C6, 00000001800832F4, 000000018008337E, 00000001800836BB
ssl\ssl_lib.c, xrefs: 0000000180083280, 00000001800832D2, 0000000180083300, 0000000180083345, 000000018008338A, 00000001800833AD, 00000001800833CF, 00000001800835AA, 00000001800836C7

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID: SSL_CTX_new_ex$ssl\ssl_lib.c
API String ID: 0-2988157636
Opcode ID: ebaac064148a911b11938bf1d40d822eeb55ab9a9f43339b01bd62b55be2a62d
Instruction ID: 15acb52419878a5aafea43a40a61abb358e33828e9d6474d67a671f098a02e92
Opcode Fuzzy Hash: ebaac064148a911b11938bf1d40d822eeb55ab9a9f43339b01bd62b55be2a62d
Instruction Fuzzy Hash: B6C16C71201B8981FBD2AB61E8527DD2295BB4CBC4F84C235BE494A7D6EF38C718C764

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180243EA4 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 000000018024402E
e+000, xrefs: 0000000180243FB1

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 7eff799d11099437d6d13ca5db6772bff11bc2e710af26e6e4c7a2c0146afb5c
Instruction ID: 537e0de2b0e44bf0fd93c7af20e339dd485944ebf3bda38d6219f646516358e3
Opcode Fuzzy Hash: 7eff799d11099437d6d13ca5db6772bff11bc2e710af26e6e4c7a2c0146afb5c
Instruction Fuzzy Hash: CC518C33714BD846E7668A359849799BBB2F358B94F4AD221DB5447AC1CFB9C50CC700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180244524 Relevance: 1.6, APIs: 1, Instructions: 324COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000000018024496A

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: f956c90f9fe8652eefa3aa77972db50812c8206d6400dd1c207db10f13c53667
Instruction ID: 0f8a3d84a55feef313639af65a22a038852416ee79c8f6226130d50376422e31
Opcode Fuzzy Hash: f956c90f9fe8652eefa3aa77972db50812c8206d6400dd1c207db10f13c53667
Instruction Fuzzy Hash: 78D12B33604B8486E7F6CF15A4C83EA66B2F74D794F15C225DB8947B99CFB8C6488B00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001802439F4 Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 0000000180243D52

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 22029e7076e556fd254b6f45e7f1098ea2c1ad0c83a818786026e6e1d0ca2266
Instruction ID: 4af847099146470aa4bf9895e291f3b661df1d43c6e8a0fbd4f83f8660aa7eed
Opcode Fuzzy Hash: 22029e7076e556fd254b6f45e7f1098ea2c1ad0c83a818786026e6e1d0ca2266
Instruction Fuzzy Hash: 84A16673704BC886EBA6CB26E4857DD7BA2E358B84F06C122CE8947785DE7DC619C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000018022E968 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

, xrefs: 000000018022EB81

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 44b266139db213409e27f082323fa97626a6eff5a34a577b130d5635c6366186
Instruction ID: 32fea846ee6f511e21983f07c9924b355861754c26a299270fee3da7a45953dc
Opcode Fuzzy Hash: 44b266139db213409e27f082323fa97626a6eff5a34a577b130d5635c6366186
Instruction Fuzzy Hash: 59B1A37220475885EBE68FB9C0593AD7BA2F30EB48F18811ACA4E07399CFB5C648D755

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800475D0 Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 00000001800475D4

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID: 0123456789abcdef
API String ID: 0-1757737011
Opcode ID: be88a3afbba0f17b173ea0ca8475850bc60dc4020012016c693cf99724b8eeeb
Instruction ID: da56144e33ff046463a4c48d80442d18c72364ad91b7bc63f228eae777aa0ff2
Opcode Fuzzy Hash: be88a3afbba0f17b173ea0ca8475850bc60dc4020012016c693cf99724b8eeeb
Instruction Fuzzy Hash: E1514D6721D6F44EE7068B6A04754FC3EA5C03A60671D83DAEBD2C6743E01DCB59EB21

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180046DA0 Relevance: .6, Instructions: 610COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e7d4b092d2c5fbf7f54d0f32176c11fb0e9140409f468464bcc754d8431844
Instruction ID: bfc66b18138f0aeec57e254b25644582ee023f3e163930aa58f2175b209e4fe5
Opcode Fuzzy Hash: 22e7d4b092d2c5fbf7f54d0f32176c11fb0e9140409f468464bcc754d8431844
Instruction Fuzzy Hash: D712A3B7B3816057C35DCB29EC52F9A36A2B7A4308B49D428E706D3F04E63DFA159B44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180031CB0 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c136c7238871fdd7bc024aa840689cbd01d6ce196475d0fa830f4ce16f3cd04
Instruction ID: cf153fbc2e246bc81ba228e4b4cc188e71397a4f982eae1b35fbc47da3a1c66c
Opcode Fuzzy Hash: 2c136c7238871fdd7bc024aa840689cbd01d6ce196475d0fa830f4ce16f3cd04
Instruction Fuzzy Hash: DCE1B42330A2C88FD75B8E5C984039E7F61E76AB84F49C16DDA8547782CA29D61FC351

Uniqueness

Uniqueness Score: -1.00%

Function 000000018023065C Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25873a9320c9abbac7544f4a04f2d8bd13f5afd92f1841d055a7b86d96c7861f
Instruction ID: 658807cee18b0fe1fd34d573135d25ea54df5214d6c62d6072ee9dec495a55d3
Opcode Fuzzy Hash: 25873a9320c9abbac7544f4a04f2d8bd13f5afd92f1841d055a7b86d96c7861f
Instruction Fuzzy Hash: 85D1F53260060886EBEACF5980A87AD77A2F70CF64F52C215DF49073A5DFB4CA5AC754

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180036710 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d719c3814f7e428ad1fab7630ae044cd5fadb905fa39e0a45fdf94a570764a
Instruction ID: 2330ceebf6aae6f0bedab20968a777e66a988ec3e4668880bf52da254e064176
Opcode Fuzzy Hash: a1d719c3814f7e428ad1fab7630ae044cd5fadb905fa39e0a45fdf94a570764a
Instruction Fuzzy Hash: 72C1D3326141E44BD28AEB29E45AA7A7791F78C346FD8801AFB8B47786C73CE118D710

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002E920 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f7097b4930c6a8404e2d9a7fb31dec1924b76d74107497c130d3cab46df2a7
Instruction ID: 8a356fb15d05a04bd1ab2996ab795ed530f884b0cb2f62537e07995056fdbd7f
Opcode Fuzzy Hash: 08f7097b4930c6a8404e2d9a7fb31dec1924b76d74107497c130d3cab46df2a7
Instruction Fuzzy Hash: A0B117236162C88BD716CB6D984039E7F60F366B84F48C359DB8697B52CA38E61AC351

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180030E40 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b32597bd30d117245bb197e5144a0f2140527752eb30554f81991e4981f1de
Instruction ID: 3b4c0a7595bb9208f7173e7f39ba30ad4a2caa5192e2c5ed8cd96c5164a13815
Opcode Fuzzy Hash: f6b32597bd30d117245bb197e5144a0f2140527752eb30554f81991e4981f1de
Instruction Fuzzy Hash: 4DA1136331A3C88BC756CB6C594038E7FA1F36AB84F59C55DEA8187782CA38D61AC351

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004530 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3c9a795ffff8cc46327ad08c5d7d29456e77d52ad8eb9aa789ac028d8139280
Instruction ID: c8d6b97177aa04becb7fdddf7cb4b34a8497c9bd295252fccc66f01f11646ebb
Opcode Fuzzy Hash: c3c9a795ffff8cc46327ad08c5d7d29456e77d52ad8eb9aa789ac028d8139280
Instruction Fuzzy Hash: ABB119B27100618BEB298B29F461FBA7791F7D874DFC5510A9B8327E85CA3CB814DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800040B0 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f56900f1e968381e6b723a899dcfc7d6a13bae0d07c83be87544b2206ee54f36
Instruction ID: f842dc6d09abecbee6a357c34d486999acb21f791724cee829b0a173a507966b
Opcode Fuzzy Hash: f56900f1e968381e6b723a899dcfc7d6a13bae0d07c83be87544b2206ee54f36
Instruction Fuzzy Hash: 9DB119B27100618BEB298729F461FBA7791F7D834EFC5510A9B8327E85CA3CB814DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180030190 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0bb594c666fb6c82b56590c01db519c8d08be540055e05532e9626c5d9920a4
Instruction ID: 96cd1bfae634da8d12dbe7bf4fd2a53c666ea0c5fd3ddcdef6ff582b1f247548
Opcode Fuzzy Hash: d0bb594c666fb6c82b56590c01db519c8d08be540055e05532e9626c5d9920a4
Instruction Fuzzy Hash: 7191162330B3D88AD757CBAC444079E7F65E769B84F5AC259DE8587382C938CA0BC391

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800307D0 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf7a9d8b2a4f956337acb34c8c296d11012329c59907389f414f6099eeab42c
Instruction ID: f0de323cb3fafd9ef2e2b4d6976eea93ad3fe9a64286a8bf8622bc400cd7e588
Opcode Fuzzy Hash: 5cf7a9d8b2a4f956337acb34c8c296d11012329c59907389f414f6099eeab42c
Instruction Fuzzy Hash: 6991042331A3C88BD746CFAC594039E7F61E36AB84F59C159DA8097793CA34D61BC391

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002F800 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cefa16c948b1ab4730909c219c4e5089701c2f6f42704e033e1ded241bdcd9a0
Instruction ID: 5a504d8110c90d35fa15e79adf7d326c18a4d6adb2a9632fbb64a19fa21f6491
Opcode Fuzzy Hash: cefa16c948b1ab4730909c219c4e5089701c2f6f42704e033e1ded241bdcd9a0
Instruction Fuzzy Hash: 2E7117233192E88BD32ACB2C5444BAE7F54E366780F49C26DDFC587746CA28CA09C351

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002F0C0 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5ae4d33ae77e124fe05f288f195b21e2aab3681a5c93213970b552b4689b663
Instruction ID: 1fa1682e5781ca040fb9e4a7e7fd38a7e7aa4ae22f3bbc0c063508b9579a9c72
Opcode Fuzzy Hash: b5ae4d33ae77e124fe05f288f195b21e2aab3681a5c93213970b552b4689b663
Instruction Fuzzy Hash: C3618D732052C88BD726CF6CA44035EBBA0F36AB88F58C159DB8587756CA38E91AC751

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180050770 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6bc7791e1504b5de156279efae98b42225f4ac07d224114c19cac82c8f6283f
Instruction ID: d9d7bdf3290344eeaa63e1a6965bb77e61c99ba5dbd88a0f7259a80976328950
Opcode Fuzzy Hash: c6bc7791e1504b5de156279efae98b42225f4ac07d224114c19cac82c8f6283f
Instruction Fuzzy Hash: 27514932600A48CAEB8ADF21D5517AC73A5F389BC0F24C526EB4E67785CF31C266C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800164D0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0551456e63e6e661a69eda5df98884eb2deccc585f14b8e4a0765c220eeca5be
Instruction ID: b4d89c6bc739a6625bf6ce210334f6ef44b6c1b229f3691f508dd590b9327473
Opcode Fuzzy Hash: 0551456e63e6e661a69eda5df98884eb2deccc585f14b8e4a0765c220eeca5be
Instruction Fuzzy Hash: 20514733305AC88BDB56CF2DD84039E7B61E3AABD0F49C159DB9A87792DA24D50AC700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018022D588 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c4cb5d0d40674ea1dd8f6b77da230bf83b51cd2fe6794a76e4a89e8a22a7a7
Instruction ID: 56d35ef465aeab04bed1e0c673fce5dec7cc8e0109b19855b008ce9e1ce25d4f
Opcode Fuzzy Hash: 74c4cb5d0d40674ea1dd8f6b77da230bf83b51cd2fe6794a76e4a89e8a22a7a7
Instruction Fuzzy Hash: 2151013760064882F7AA8F68C1483BCA7A2E349B68F558304CF49173D8CFE9CE59C780

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180031570 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c32812ee8966df7d1d1384a556c007bbb572470a7d3a22053908905fb586e68
Instruction ID: ee9f852c097d2fcc685e67a57fb4d3d54ada755df01214fba3ede28ac1609251
Opcode Fuzzy Hash: 7c32812ee8966df7d1d1384a556c007bbb572470a7d3a22053908905fb586e68
Instruction Fuzzy Hash: 9C5182232193C89FC306CF5C954038D7FA0F36A744F48866DDB9597B92CA38E56AC751

Uniqueness

Uniqueness Score: -1.00%

Function 000000018022D95C Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9045f3b26894576d61088d1619e8518051c951db8f386551f825922cc39794af
Instruction ID: 57afafa62139ce15cc45a2c0a87f04340f3dc7f987b5b77315fc761c4109f8c2
Opcode Fuzzy Hash: 9045f3b26894576d61088d1619e8518051c951db8f386551f825922cc39794af
Instruction Fuzzy Hash: 6651E03760465882E7AA8F68C0583ACA7B2E349B68F158304DE451B7D8CFE1DE89C780

Uniqueness

Uniqueness Score: -1.00%

Function 000000018022DD30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c9c268c3b241972250ece1e571e85bc233d5d83cb02bf08170c98e137f07fc2
Instruction ID: 419bbc8019598dac1632a8d64a85cb7b3c674dfa4410ff20840d525577d39c27
Opcode Fuzzy Hash: 2c9c268c3b241972250ece1e571e85bc233d5d83cb02bf08170c98e137f07fc2
Instruction Fuzzy Hash: C151D577600A5882E7AA8F68C1583ACB7A2E359F58F168305DF061B7D8CFE1CD45C780

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180032970 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 655e9c0c703ebf6b16e37822a6e87c8de60c6ad2afa1b71e393945c4a8bfb6af
Instruction ID: 8c275894ed04051122970ba4788b0e0c145f2dabdb11b916e3ba34bb771f00a2
Opcode Fuzzy Hash: 655e9c0c703ebf6b16e37822a6e87c8de60c6ad2afa1b71e393945c4a8bfb6af
Instruction Fuzzy Hash: A551D5232093C88BD716CF5D958038DBFA0F365B84F59C629DB9587B92CA38E51BC351

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002F640 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1eb749f18e00433ae9cfa30d35891820fabb8d52cae72114baae481739216e0
Instruction ID: 3bd69aead185770da9f7101d198a854eee6ec63ad6ee62b91feba0af086f4822
Opcode Fuzzy Hash: c1eb749f18e00433ae9cfa30d35891820fabb8d52cae72114baae481739216e0
Instruction Fuzzy Hash: DC41B6132197D88ED302CF5D5808B9D7F68E376B94F8A8299DF8597747CA34C609C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180032B40 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f88193fffd0d89d9c516691d820b665d22c63be5df261a46c4c1e0b03b5c2bb3
Instruction ID: 44a6f57969e189e860b254bbc33192bf21f8edc23a17bf8a92916eea8c6d9e82
Opcode Fuzzy Hash: f88193fffd0d89d9c516691d820b665d22c63be5df261a46c4c1e0b03b5c2bb3
Instruction Fuzzy Hash: 1D41A7232193D88AD306CF5D5804A8E7F68E376B54F8AC199DF8497743C634C649C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002FE50 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b54d0a560e82fa2ce900294f73c263cd33863ded6fad70219ff4453173f0ad8e
Instruction ID: d1d7dc10aa628dc2d3deaea8f4bd4ade27186f45365b539a38f20dcb0d40dbd9
Opcode Fuzzy Hash: b54d0a560e82fa2ce900294f73c263cd33863ded6fad70219ff4453173f0ad8e
Instruction Fuzzy Hash: 024171332193C88AD3068A6C585895E3F28D366340B8A829DEBC4D7743E536C619C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180032550 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0d349bfccf04567108c1f90e714519d19e349e7f09ce2b95f50a09e5655793f
Instruction ID: 91986e66ab341a7ed997bcc342dca55875aed30527f30589002cecf46c41b256
Opcode Fuzzy Hash: c0d349bfccf04567108c1f90e714519d19e349e7f09ce2b95f50a09e5655793f
Instruction Fuzzy Hash: 4241C2232193C89AD306CF9C954038EBFA0F366B54F59C629DB9197B92CA38D61BC351

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002FBB0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 036a3064e14ed08f9c6848db83d1a247dc96667b1d4a4d584533a7342ebbf511
Instruction ID: 643129ae3ab24142afbaa9f1ccc6f20fea8c2026ffdc491b72e980dded54ea26
Opcode Fuzzy Hash: 036a3064e14ed08f9c6848db83d1a247dc96667b1d4a4d584533a7342ebbf511
Instruction Fuzzy Hash: 6D316F332193CCCAD3068B5D585898E7F28D366341B8A819DEBC487747E536CA19C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180031950 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f45f7b6deb4f7a9a0a48ac491baacd34d4beda24f96ad2bf00d1c8a295fa8586
Instruction ID: d27a97fd0e8c3ad1c55433b68687aa36f5a34b26dc6686ebd583529c09961b1e
Opcode Fuzzy Hash: f45f7b6deb4f7a9a0a48ac491baacd34d4beda24f96ad2bf00d1c8a295fa8586
Instruction Fuzzy Hash: 2C3172332193CCCED302CB5D584898E7F64D36A341B8A819DDAC497747E935C619C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002FD10 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe6d48acf25183754f262e6e508bb9fed02ecf70cab6f44a180b447611eabd5a
Instruction ID: d6d481939fc481ab478d78aa68d7b9c2cae5f64aed55a68d47f4f39056cb7688
Opcode Fuzzy Hash: fe6d48acf25183754f262e6e508bb9fed02ecf70cab6f44a180b447611eabd5a
Instruction Fuzzy Hash: 6E3181332193CCCAD3028B5D585898E7F28D366341F8A81ADE7C087747E976CA19C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180031BB0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2424c5eb9507dd92b72fa6f4d21f0c1c551f1776ceba17abea8fd3eef51c787c
Instruction ID: 7155b28acd7eaf248143e551f18f8b1e5448e8bb6543337eb098fd19be59fc9c
Opcode Fuzzy Hash: 2424c5eb9507dd92b72fa6f4d21f0c1c551f1776ceba17abea8fd3eef51c787c
Instruction Fuzzy Hash: C42141232197C88AD706CF6D584018EBF60F3A6F94B8CC559EB849B74BCA38D51AC771

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001D300 Relevance: 47.4, APIs: 1, Strings: 26, Instructions: 182
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

CertGetNameStringA.CRYPT32 ref: 000000018001D5FD

Strings

__dump_chain, xrefs: 000000018001D34E
A valid name constraints for all namespaces, including UPN., xrefs: 000000018001D589
[%s:%d] %s: trust status info for %d simple chain, xrefs: 000000018001D36F
[%s:%d][ERR] %s: TrustStatus, unknown error status %08x, xrefs: 000000018001D44D
An exact match issuer certificate has been found for this certificate., xrefs: 000000018001D4FF
[%s:%d][ERR] %s: TrustStatus: %s, xrefs: 000000018001D4A6
A name match issuer certificate has been found for this certificate., xrefs: 000000018001D4E7
A CTL used to create this chain was not time-valid., xrefs: 000000018001D476
The certificate or chain has a preferred issuer., xrefs: 000000018001D517
A key match issuer certificate has been found for this certificate., xrefs: 000000018001D4F3
This certificate is self-signed., xrefs: 000000018001D4DB
The certificate chain created is a complex chain., xrefs: 000000018001D56E
A CTL used to create this chain did not have a valid signature., xrefs: 000000018001D46D
This certificate's certificate revocation list (CRL) validity has been extended., xrefs: 000000018001D577
[%s:%d] %s: TrustStatus: %s, xrefs: 000000018001D5B0
No information status reported., xrefs: 000000018001D50B
[%s:%d] %s: [%d,%d] subject %s, xrefs: 000000018001D61E
..\src\ssl\ssl_ctx.c, xrefs: 000000018001D364, 000000018001D446, 000000018001D494, 000000018001D54C, 000000018001D59E, 000000018001D613
This certificate is peer trusted. This status code applies to certificates only., xrefs: 000000018001D580
The certificate chain is not complete., xrefs: 000000018001D47F
A CTL used to create this chain is not valid for this usage., xrefs: 000000018001D434
[%s:%d][ERR] %s: TrustStatus, unknown info status : %08x, xrefs: 000000018001D560
An issuance chain policy exists. , xrefs: 000000018001D592
The revocation status of the certificate or one of the certificates in the certificate chain is unknown., xrefs: 000000018001D402
dump_trust_status, xrefs: 000000018001D343
One of the certificates in the chain was issued by a certification authority that the original certificate had certified., xrefs: 000000018001D488

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CertCurrentEnterLeaveNameStringThread
String ID: ..\src\ssl\ssl_ctx.c$A CTL used to create this chain did not have a valid signature.$A CTL used to create this chain is not valid for this usage.$A CTL used to create this chain was not time-valid.$A key match issuer certificate has been found for this certificate.$A name match issuer certificate has been found for this certificate.$A valid name constraints for all namespaces, including UPN.$An exact match issuer certificate has been found for this certificate.$An issuance chain policy exists. $No information status reported.$One of the certificates in the chain was issued by a certification authority that the original certificate had certified.$The certificate chain created is a complex chain.$The certificate chain is not complete.$The certificate or chain has a preferred issuer.$The revocation status of the certificate or one of the certificates in the certificate chain is unknown.$This certificate is peer trusted. This status code applies to certificates only.$This certificate is self-signed.$This certificate's certificate revocation list (CRL) validity has been extended.$[%s:%d] %s: TrustStatus: %s$[%s:%d] %s: [%d,%d] subject %s$[%s:%d] %s: trust status info for %d simple chain$[%s:%d][ERR] %s: TrustStatus, unknown error status %08x$[%s:%d][ERR] %s: TrustStatus, unknown info status : %08x$[%s:%d][ERR] %s: TrustStatus: %s$__dump_chain$dump_trust_status
API String ID: 2895763960-3520351524
Opcode ID: f2eae5b4fe7d755545b04a42f73ab6b2b711857b2a6f1880dcac838db4d4f715
Instruction ID: e6d4d31315e50e4e89499cde7ee9f8dd18ea2e92c4aa0d8288d592e0d963ed60
Opcode Fuzzy Hash: f2eae5b4fe7d755545b04a42f73ab6b2b711857b2a6f1880dcac838db4d4f715
Instruction Fuzzy Hash: 02911772205E4C96EBE68B14E4983E97366F34C388F948127F68A03AA4DF79C74DC704

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800251A0 Relevance: 31.8, APIs: 2, Strings: 16, Instructions: 285
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32 ref: 00000001800253AA
htons.WS2_32 ref: 000000018002548C

Strings

AF_INET6, xrefs: 00000001800252D4
IPv4, xrefs: 0000000180025221
AF_UNSPEC, xrefs: 00000001800252DB, 00000001800253ED, 00000001800253F6
< ipv4, xrefs: 00000001800253D7, 0000000180025427
store_ip_cb4, xrefs: 000000018002526C, 000000018002531E, 0000000180025348
\ ipv6, xrefs: 00000001800254C3, 0000000180025505
[%s:%d] %s: %s: address = %s, scope = %u, port = %u, xrefs: 00000001800254AC
AF_INET, xrefs: 00000001800252C9
[%s:%d] %s: %s: address family = %d (%s), xrefs: 0000000180025420, 00000001800254FE
other, xrefs: 0000000180025234, 000000018002530E, 0000000180025405, 00000001800254E3
[%s:%d] %s: result = %d, type = %d (%s), count = %d | ttl = %d | addr_info = %p, xrefs: 0000000180025261
[%s:%d] %s: / Primary address: %s, xrefs: 000000018002533A
[%s:%d] %s: %s: address = %s, port = %u, xrefs: 00000001800253D0
..\src\runtime_settings.c, xrefs: 0000000180025278, 0000000180025330, 0000000180025355, 00000001800253BD, 0000000180025415, 000000018002549F, 00000001800254F3
[%s:%d] %s: / Primary address: none, xrefs: 0000000180025361
IPv6, xrefs: 000000018002522D

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: htons
String ID: \ ipv6$..\src\runtime_settings.c$< ipv4$AF_INET$AF_INET6$AF_UNSPEC$IPv4$IPv6$[%s:%d] %s: / Primary address: %s$[%s:%d] %s: / Primary address: none$[%s:%d] %s: %s: address = %s, port = %u$[%s:%d] %s: %s: address = %s, scope = %u, port = %u$[%s:%d] %s: %s: address family = %d (%s)$[%s:%d] %s: result = %d, type = %d (%s), count = %d | ttl = %d | addr_info = %p$other$store_ip_cb4
API String ID: 4207154920-1733452965
Opcode ID: ce0b02dbca2d15f9c50501f14b8c5dd8cb7ca68603cf93cf9601f7c5bcd22f3d
Instruction ID: cee3229742a90a2e067ebf22ff192a0c8e34efccfb6ff124283e202110e63544
Opcode Fuzzy Hash: ce0b02dbca2d15f9c50501f14b8c5dd8cb7ca68603cf93cf9601f7c5bcd22f3d
Instruction Fuzzy Hash: 15E18E72614B8886E7A2CF24E4443E977B5F35C788F409216FE8E53665EF78D298C704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025670 Relevance: 31.8, APIs: 2, Strings: 16, Instructions: 276networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 0000000180025881
htons.WS2_32 ref: 000000018002592F

Strings

AF_INET6, xrefs: 00000001800257AC
IPv4, xrefs: 00000001800256F0
AF_UNSPEC, xrefs: 00000001800257B3
< ipv4, xrefs: 00000001800258C3
store_ip_cb6, xrefs: 000000018002573A, 00000001800257F2, 000000018002581E
\ ipv6, xrefs: 0000000180025968, 00000001800259AA
[%s:%d] %s: %s: address = %s, scope = %u, port = %u, xrefs: 000000018002594F
AF_INET, xrefs: 00000001800257A1
[%s:%d] %s: %s: address family = %d (%s), xrefs: 00000001800258B8, 00000001800259A3
other, xrefs: 0000000180025703, 00000001800257E2, 00000001800258A8, 0000000180025988
[%s:%d] %s: result = %d, type = %d (%s), count = %d | ttl = %d | addr_info = %p, xrefs: 000000018002572F
[%s:%d] %s: / Primary address: %s, xrefs: 0000000180025810
[%s:%d] %s: %s: address = %s, port = %u, xrefs: 000000018002588A
..\src\runtime_settings.c, xrefs: 0000000180025746, 0000000180025804, 000000018002582B, 00000001800258D5, 0000000180025942, 0000000180025998
[%s:%d] %s: / Primary address: none, xrefs: 0000000180025837
IPv6, xrefs: 00000001800256FC

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: htons
String ID: \ ipv6$..\src\runtime_settings.c$< ipv4$AF_INET$AF_INET6$AF_UNSPEC$IPv4$IPv6$[%s:%d] %s: / Primary address: %s$[%s:%d] %s: / Primary address: none$[%s:%d] %s: %s: address = %s, port = %u$[%s:%d] %s: %s: address = %s, scope = %u, port = %u$[%s:%d] %s: %s: address family = %d (%s)$[%s:%d] %s: result = %d, type = %d (%s), count = %d | ttl = %d | addr_info = %p$other$store_ip_cb6
API String ID: 4207154920-2304509321
Opcode ID: c02dbfde879d7e1c10602095f38e3e7b9749381c394583007656d70b7afc84ed
Instruction ID: b30f8b7513cb1f606db67ae45d8faa247448438f7d173b57704e5e1433d7628e
Opcode Fuzzy Hash: c02dbfde879d7e1c10602095f38e3e7b9749381c394583007656d70b7afc84ed
Instruction Fuzzy Hash: 8CD1A032A14B8886E7A2CF24E4453EA77B5F75C788F409216FE8D53665EF78D298C304

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800056C0 Relevance: 31.7, APIs: 5, Strings: 13, Instructions: 199timeCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 0000000180005704
CreateEventA.KERNEL32 ref: 0000000180005714

Part of subcall function 0000000180009200: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,0000000180023F31,?,?,?,?,?,000000018001987D), ref: 0000000180009221
Part of subcall function 0000000180009200: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,0000000180023F31,?,?,?,?,?,000000018001987D), ref: 0000000180009234

EnterCriticalSection.KERNEL32 ref: 000000018000578E
timeGetTime.WINMM ref: 000000018000579D
LeaveCriticalSection.KERNEL32 ref: 00000001800058EF

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

[%s:%d][ERR] %s: resolve_proxy_name returned %d %s, xrefs: 00000001800059A5
RequestError, xrefs: 0000000180005893
[%s:%d][WARN] %s: WARNING: dns_client_init failed, xrefs: 0000000180005778
SettingsChanged, xrefs: 000000018000588C
[%s:%d] %s: final reason %s ( %x ), xrefs: 00000001800058AE
[%s:%d][ERR] %s: bdnc_event_base_new failed, xrefs: 00000001800059FC
..\src\bootstrap.c, xrefs: 0000000180005771, 00000001800057D1, 00000001800058A2, 0000000180005912, 000000018000599A, 00000001800059F0
[%s:%d][ERR] %s: no resolver for bootstrap, xrefs: 000000018000591B
[%s:%d] %s: use static servers from this list: %s, xrefs: 00000001800057DD
event_context_init, xrefs: 000000018000575C, 00000001800059E3
TimerExpired, xrefs: 0000000180005881
ApplicationInit, xrefs: 0000000180005865
NetworkRenewal, xrefs: 0000000180005873

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CreateCurrentEventInitializeThreadTimetime
String ID: ..\src\bootstrap.c$ApplicationInit$NetworkRenewal$RequestError$SettingsChanged$TimerExpired$[%s:%d] %s: final reason %s ( %x )$[%s:%d] %s: use static servers from this list: %s$[%s:%d][ERR] %s: bdnc_event_base_new failed$[%s:%d][ERR] %s: no resolver for bootstrap$[%s:%d][ERR] %s: resolve_proxy_name returned %d %s$[%s:%d][WARN] %s: WARNING: dns_client_init failed$event_context_init
API String ID: 1613208664-822066791
Opcode ID: dd80157b75808917f73cbe13f1ae6920df67fdedc0e7ce6a3e3d66b79246c3c7
Instruction ID: c55bc870b91b4be3ed3069f22d5bdeacbf42ecbfd78c972b0c91f3b5ad82a32a
Opcode Fuzzy Hash: dd80157b75808917f73cbe13f1ae6920df67fdedc0e7ce6a3e3d66b79246c3c7
Instruction Fuzzy Hash: 50A16831200B489AE7E6DF24E8453DA33A6F74C794F44C22AE98A936A5DF78C759C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DBC0 Relevance: 31.6, APIs: 10, Strings: 8, Instructions: 96sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018000DBDE
LeaveCriticalSection.KERNEL32 ref: 000000018000DBEB

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

TlsSetValue.KERNEL32 ref: 000000018000DC45
EnterCriticalSection.KERNEL32 ref: 000000018000DC95
LeaveCriticalSection.KERNEL32 ref: 000000018000DCB0

Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B988

Sleep.KERNEL32 ref: 000000018000DCDE
EnterCriticalSection.KERNEL32 ref: 000000018000DCFC
SetEvent.KERNEL32 ref: 000000018000DD1D
LeaveCriticalSection.KERNEL32 ref: 000000018000DD2A
TlsSetValue.KERNEL32 ref: 000000018000DD60

Strings

[%s:%d] %s: WARNING: even_base_loop exited, xrefs: 000000018000DCCD
[%s:%d] %s: %s thread exiting, xrefs: 000000018000DD47
[%s:%d] %s: %s thread started, xrefs: 000000018000DC1F
network, xrefs: 000000018000DBF1
..\src\global_state.c, xrefs: 000000018000DC18, 000000018000DC51, 000000018000DCC1, 000000018000DD3B, 000000018000DD6C
timers, xrefs: 000000018000DBFB
run_base_loop, xrefs: 000000018000DC0C
[%s:%d] %s: tls_set( %x, %p ), xrefs: 000000018000DC5D, 000000018000DD7C

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$Value$CurrentEventSleepThread
String ID: ..\src\global_state.c$[%s:%d] %s: %s thread exiting$[%s:%d] %s: %s thread started$[%s:%d] %s: WARNING: even_base_loop exited$[%s:%d] %s: tls_set( %x, %p )$network$run_base_loop$timers
API String ID: 1464362966-2592715731
Opcode ID: 96435f2355397fa81c2ff12ecc4c051a692bf1b3370342a852d81864249950f9
Instruction ID: 5a97c332abc99f616807e15becdc49f430c8295717396d8dc64f276902d27095
Opcode Fuzzy Hash: 96435f2355397fa81c2ff12ecc4c051a692bf1b3370342a852d81864249950f9
Instruction Fuzzy Hash: F4510D34210A488AEBD29F10F8983C973A6F78C794F448116E94AA76A4CFBDC74DC748

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004A70 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 139synchronizationtimethreadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00000001800017C1), ref: 0000000180004A91
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00000001800017C1), ref: 0000000180004AD9
timeGetTime.WINMM(?,?,?,?,00000000,00000001800017C1), ref: 0000000180004AF3
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00000001800017C1), ref: 0000000180004B82
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00000001800017C1), ref: 0000000180004BB1
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00000001800017C1), ref: 0000000180004BD2
WaitForSingleObject.KERNEL32(?,?,?,?,00000000,00000001800017C1), ref: 0000000180004BEA
CloseHandle.KERNEL32(?,?,?,?,00000000,00000001800017C1), ref: 0000000180004BF7
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00000001800017C1), ref: 0000000180004C04
CreateThread.KERNEL32 ref: 0000000180004C2C
LeaveCriticalSection.KERNEL32 ref: 0000000180004CEA

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

[%s:%d] %s: a new bootstrap was postponed %d, xrefs: 0000000180004B58
[%s:%d] %s: skip bootstrap / null settings, xrefs: 0000000180004C99
[%s:%d] %s: suspended, xrefs: 0000000180004ABE
..\src\bootstrap.c, xrefs: 0000000180004AB2, 0000000180004B44, 0000000180004C8D
start_bootstrap, xrefs: 0000000180004AA5, 0000000180004B4B, 0000000180004C80

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$Thread$CloseCreateCurrentHandleObjectSingleTimeWaittime
String ID: ..\src\bootstrap.c$[%s:%d] %s: a new bootstrap was postponed %d$[%s:%d] %s: skip bootstrap / null settings$[%s:%d] %s: suspended$start_bootstrap
API String ID: 1241518772-161193796
Opcode ID: 00cbf1adfa6522d2b35eacbb47980d60363a15a33b57f0d204a372415dcd0c4e
Instruction ID: 7801855e8c00e359598b1d6a03679f213743a4ddb1832ab6c4ce20ca3143e73b
Opcode Fuzzy Hash: 00cbf1adfa6522d2b35eacbb47980d60363a15a33b57f0d204a372415dcd0c4e
Instruction Fuzzy Hash: FB712676204A488AF7E2CF50F8957D973A5F78C390F418126ED4A866A0DF69CB4CC748

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800260B0 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 131networkCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00000001800260E4
WSAStartup.WS2_32 ref: 00000001800260F4
WSAGetLastError.WS2_32 ref: 00000001800260FE

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

socket.WS2_32 ref: 0000000180026161
WSAGetLastError.WS2_32 ref: 0000000180026171

Strings

[%s:%d][ERR] %s: WSAStartup : %d ( %s ), xrefs: 000000018002613B
[%s:%d] %s: event set for %x ( FD_CLOSE %x, FD_READ %x, FD_WRITE %x, FD_ADDRESS_LIST_CHANGE %x, FD_ROUTING_INTERFACE_CHANGE %x ), xrefs: 00000001800262B0
, xrefs: 00000001800262C5
..\src\win\net_awareness.c, xrefs: 000000018002611E, 0000000180026191, 00000001800261F2, 000000018002625B, 00000001800262A1
[%s:%d][ERR] %s: socket error %d ( %s ), xrefs: 00000001800261AE
[%s:%d][ERR] %s: WSAEventSelect: %d ( %s ), xrefs: 0000000180026278
network_awareness_init, xrefs: 0000000180026125, 0000000180026198, 00000001800261F9, 0000000180026262, 0000000180026292
[%s:%d][ERR] %s: WSACreateEvent: %d ( %s ), xrefs: 000000018002620F

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$ErrorLast$CurrentEnterInitializeLeaveStartupThreadsocket
String ID: $..\src\win\net_awareness.c$[%s:%d] %s: event set for %x ( FD_CLOSE %x, FD_READ %x, FD_WRITE %x, FD_ADDRESS_LIST_CHANGE %x, FD_ROUTING_INTERFACE_CHANGE %x )$[%s:%d][ERR] %s: WSACreateEvent: %d ( %s )$[%s:%d][ERR] %s: WSAEventSelect: %d ( %s )$[%s:%d][ERR] %s: WSAStartup : %d ( %s )$[%s:%d][ERR] %s: socket error %d ( %s )$network_awareness_init
API String ID: 2392668120-1197466459
Opcode ID: 119964fdaa7e3fa3be35079194eca87a9674af8b075fc2aef1f6cf8f67251ff2
Instruction ID: af957c82111db8064bb51ab8a36141ce93cbc7400eed6d42bd02aea594757f9f
Opcode Fuzzy Hash: 119964fdaa7e3fa3be35079194eca87a9674af8b075fc2aef1f6cf8f67251ff2
Instruction Fuzzy Hash: E8514D30600B4886FBE29F64E4593DA73A6F74C394F408226B55A877E5EFBDC64C8744

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E380 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 195fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 000000018001E451
GetLastError.KERNEL32 ref: 000000018001E460
CloseHandle.KERNEL32 ref: 000000018001E4A3
GetFileSize.KERNEL32 ref: 000000018001E4B8
CreateFileMappingA.KERNEL32 ref: 000000018001E4ED
GetLastError.KERNEL32 ref: 000000018001E4FB
MapViewOfFile.KERNEL32 ref: 000000018001E51C
CloseHandle.KERNEL32 ref: 000000018001E56F
GetLastError.KERNEL32 ref: 000000018001E52A

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

UnmapViewOfFile.KERNEL32 ref: 000000018001E5C2
CloseHandle.KERNEL32 ref: 000000018001E5CB
GetLastError.KERNEL32 ref: 000000018001E607
CloseHandle.KERNEL32 ref: 000000018001E653

Strings

file_map_create, xrefs: 000000018001E474, 000000018001E540, 000000018001E58C, 000000018001E61D
[%s:%d][ERR] %s: cannot map file '%S', retcode %d, xrefs: 000000018001E492, 000000018001E55E, 000000018001E5B1, 000000018001E635
..\src\win\file_map.c, xrefs: 000000018001E489, 000000018001E555, 000000018001E5A5, 000000018001E629

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: File$CloseErrorHandleLast$CreateCriticalSectionView$CurrentEnterLeaveMappingSizeThreadUnmap
String ID: ..\src\win\file_map.c$[%s:%d][ERR] %s: cannot map file '%S', retcode %d$file_map_create
API String ID: 443895369-2830061828
Opcode ID: f4fab0987886befb8816391a9b32f8ec240fe3da210ee4bab075a4179f14fb9d
Instruction ID: b940511d9f2d3bd06b8c53d70090f835ebf09b701ef15f07a21dd95abdf27a9e
Opcode Fuzzy Hash: f4fab0987886befb8816391a9b32f8ec240fe3da210ee4bab075a4179f14fb9d
Instruction Fuzzy Hash: D2816D36204B4882EBA68B24E8587DE73A1F78D794F408216EE5747BA4DF7DCA4DC704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006F30 Relevance: 28.2, APIs: 2, Strings: 14, Instructions: 160networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00000001800070A3
htons.WS2_32 ref: 0000000180007167

Strings

AF_INET6, xrefs: 0000000180006FD1
AF_UNSPEC, xrefs: 0000000180006FE0
< ipv4, xrefs: 00000001800070EC
[%s:%d] %s: name = %s, rc = %d, xrefs: 0000000180006F99
resolve_proxy_name, xrefs: 0000000180006F82
\ ipv6, xrefs: 00000001800071A0, 00000001800071E8
[%s:%d] %s: %s: address = %s, scope = %u, port = %u, xrefs: 0000000180007187
AF_INET, xrefs: 0000000180006FC2
[%s:%d] %s: %s: address family = %d (%s), xrefs: 00000001800070DB, 00000001800071DB
other, xrefs: 0000000180007008, 00000001800070CB, 00000001800071C0
[%s:%d] %s: / Primary address: %s, xrefs: 000000018000702A
[%s:%d] %s: %s: address = %s, port = %u, xrefs: 00000001800070AC
[%s:%d] %s: / Primary address: none, xrefs: 000000018000704E
..\src\bootstrap_proxy.c, xrefs: 0000000180006F8D, 000000018000701E, 0000000180007047, 00000001800070F8, 000000018000717A, 00000001800071D0

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: htons
String ID: \ ipv6$..\src\bootstrap_proxy.c$< ipv4$AF_INET$AF_INET6$AF_UNSPEC$[%s:%d] %s: / Primary address: %s$[%s:%d] %s: / Primary address: none$[%s:%d] %s: %s: address = %s, port = %u$[%s:%d] %s: %s: address = %s, scope = %u, port = %u$[%s:%d] %s: %s: address family = %d (%s)$[%s:%d] %s: name = %s, rc = %d$other$resolve_proxy_name
API String ID: 4207154920-2387825641
Opcode ID: 0a740507b00c8fcd1c9b0e5dd580b7c6f67d37f748998d40ba28631955a50ca5
Instruction ID: 6074670467a04f40f85ed3d6b192f0ba218d174b8844367a24d49e407c03a00e
Opcode Fuzzy Hash: 0a740507b00c8fcd1c9b0e5dd580b7c6f67d37f748998d40ba28631955a50ca5
Instruction Fuzzy Hash: E0815D72608B88D5E7E2CB10E4453EAB3A5F358794F409216FA8E53665EF7DC29CC740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001830 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 83synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 0000000180001859
EnterCriticalSection.KERNEL32 ref: 000000018000187B
LeaveCriticalSection.KERNEL32 ref: 00000001800018CA
WaitForSingleObject.KERNEL32 ref: 00000001800018D9
EnterCriticalSection.KERNEL32 ref: 00000001800018E3
LeaveCriticalSection.KERNEL32 ref: 0000000180001916
EnterCriticalSection.KERNEL32 ref: 000000018000192B
LeaveCriticalSection.KERNEL32 ref: 000000018000194E
WaitForSingleObject.KERNEL32 ref: 000000018000195E
EnterCriticalSection.KERNEL32 ref: 000000018000196B
LeaveCriticalSection.KERNEL32 ref: 000000018000197F
CloseHandle.KERNEL32 ref: 000000018000199E

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

bdnimbus_uninit, xrefs: 0000000180001896
@, xrefs: 0000000180001881
..\src\api.c, xrefs: 00000001800018AA
[%s:%d] %s: wait for %d uploads, xrefs: 00000001800018B6

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ObjectSingleWait$CloseCreateCurrentEventHandleThread
String ID: ..\src\api.c$@$[%s:%d] %s: wait for %d uploads$bdnimbus_uninit
API String ID: 1381872527-2092499606
Opcode ID: 1a1ca4426385fb097f09188794586504926892a42b6176f22a100e036b662ee5
Instruction ID: ff04b055ded518ba045d970247867776e4573509aa3b8c0228ffe5078b061720
Opcode Fuzzy Hash: 1a1ca4426385fb097f09188794586504926892a42b6176f22a100e036b662ee5
Instruction Fuzzy Hash: D0416136224A48CAE7C1DF20E8587D973A1F789795F448115FA5B426F4DFB8CA4CCB05

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180044807 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 257COMMON

Download Yara Rule

APIs

~Hash.LIBCMT ref: 0000000180044F02

Strings

<unknown>, xrefs: 0000000180045027
?, xrefs: 0000000180044D89
Unexpected end of format string, xrefs: 0000000180044F65
<internal>, xrefs: 0000000180044CCA
Expected object, got %s, xrefs: 0000000180044CF9
NULL object key, xrefs: 0000000180044F25
Out of memory, xrefs: 0000000180044CBC
<format>, xrefs: 0000000180044F54, 0000000180044F72, 0000000180044FAB
%li object item(s) left unpacked: %s, xrefs: 000000018004503F
Expected format 's', got '%c', xrefs: 0000000180044F43
Expected '}' after '%c', got '%c', xrefs: 0000000180044F99
<validation>, xrefs: 0000000180044D08, 0000000180044EDF, 0000000180045051
<args>, xrefs: 0000000180044F32
Object item not found: %s, xrefs: 0000000180044ECD

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: Hash
String ID: %li object item(s) left unpacked: %s$<args>$<format>$<internal>$<unknown>$<validation>$?$Expected '}' after '%c', got '%c'$Expected format 's', got '%c'$Expected object, got %s$NULL object key$Object item not found: %s$Out of memory$Unexpected end of format string
API String ID: 1904921990-3531910078
Opcode ID: 05ee1e3be7e25bb9f4c975a4f49d63943ebbf26417133c7336f3457cf4f5f366
Instruction ID: aac3dcc0e64a85f60f118cafecc2e4279924eb8038b10cd5f3100a949d243600
Opcode Fuzzy Hash: 05ee1e3be7e25bb9f4c975a4f49d63943ebbf26417133c7336f3457cf4f5f366
Instruction Fuzzy Hash: 40A1C632200E4C55FAD39B16A4C03EA6391B74DBE8F569212FD6A4B3D6DE78C74D8348

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A910 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 217COMMON

Download Yara Rule

Strings

..\src\user_context.c, xrefs: 000000018001A9C7, 000000018001AA3B, 000000018001AACD, 000000018001AB1B, 000000018001AB91, 000000018001ABD4
set_local_cloud, xrefs: 000000018001A9BD, 000000018001AA31, 000000018001AA88, 000000018001AAB6, 000000018001AB0D, 000000018001ABC9
[%s:%d] %s: [%p] local rt setts host: %s, proxy: %s ( %X:%hd ), xrefs: 000000018001A9D2, 000000018001AAD8
[%s:%d] %s: [%p] local rt setts host: %s, port: %hd, xrefs: 000000018001ABDE
[%s:%d] %s: [%p] local rt setts host: %s, proxy: %s unknown address family (%u), xrefs: 000000018001AB27, 000000018001AB9D
[%s:%d] %s: [%p] local rt setts host: %s, proxy: %s ( [%X]:%hd ), xrefs: 000000018001AA46

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID: ..\src\user_context.c$[%s:%d] %s: [%p] local rt setts host: %s, port: %hd$[%s:%d] %s: [%p] local rt setts host: %s, proxy: %s ( %X:%hd )$[%s:%d] %s: [%p] local rt setts host: %s, proxy: %s ( [%X]:%hd )$[%s:%d] %s: [%p] local rt setts host: %s, proxy: %s unknown address family (%u)$set_local_cloud
API String ID: 0-1885314491
Opcode ID: f3ca5b164149379d52183903cf9d72181a51eceb819a41ff5944b2f860da48ce
Instruction ID: 4e4c4f695aa5cb01441d69daa9868e710223c9e570e77c7aa095e74c31e2acab
Opcode Fuzzy Hash: f3ca5b164149379d52183903cf9d72181a51eceb819a41ff5944b2f860da48ce
Instruction Fuzzy Hash: 7CB19D32208F4886E7D68F11E4843E973A5F74DB84F508112FA9A53BA4EF79C75AC740

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B570 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 167timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 000000018000B580
timeGetTime.WINMM ref: 000000018000B664

Strings

[%s:%d][WARN] %s: benchmark_threshold reached in less then 60s, ignore for now!, xrefs: 000000018000B5CF
[%s:%d] %s: benchmark_threshold reached, sending test request: %d, xrefs: 000000018000B6F4, 000000018000B7F7
verify_request, xrefs: 000000018000B5B6, 000000018000B6FB, 000000018000B7DA
_ServerStatus, xrefs: 000000018000B66A
..\src\conn_pool.c, xrefs: 000000018000B5C3, 000000018000B6EB, 000000018000B7E5

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: Timetime
String ID: ..\src\conn_pool.c$[%s:%d] %s: benchmark_threshold reached, sending test request: %d$[%s:%d][WARN] %s: benchmark_threshold reached in less then 60s, ignore for now!$_ServerStatus$verify_request
API String ID: 17336451-1321870699
Opcode ID: c70fa1663e0e7013da89e1d5bebb1d3788274e66c317e6f83b24b0f1fd45e71d
Instruction ID: c1e759012fd030fefee916f2192a9184179e6e64bccc9e399d3542b0f09327dc
Opcode Fuzzy Hash: c70fa1663e0e7013da89e1d5bebb1d3788274e66c317e6f83b24b0f1fd45e71d
Instruction Fuzzy Hash: AA817136604B4887E796DF24E8443D973A5F78CB88F448125EE4D83765EFB8C699C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007C50 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 132synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00000000,order_benchmark,00000001800065A4), ref: 0000000180007D29
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00000000,order_benchmark,00000001800065A4), ref: 0000000180007D3C
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00000000,order_benchmark,00000001800065A4), ref: 0000000180007D5A
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00000000,order_benchmark,00000001800065A4), ref: 0000000180007D77
WaitForSingleObject.KERNEL32(?,?,?,?,00000000,00000000,order_benchmark,00000001800065A4), ref: 0000000180007D89
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00000000,order_benchmark,00000001800065A4), ref: 0000000180007D96
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00000000,order_benchmark,00000001800065A4), ref: 0000000180007DAB
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00000000,order_benchmark,00000001800065A4), ref: 0000000180007E0B
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00000000,order_benchmark,00000001800065A4), ref: 0000000180007E2A
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00000000,order_benchmark,00000001800065A4), ref: 0000000180007E5C
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00000000,order_benchmark,00000001800065A4), ref: 0000000180007E8A

Strings

order_benchmark, xrefs: 0000000180007C50
uuid, xrefs: 0000000180007E11
/services/genid, xrefs: 0000000180007CA7

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ObjectSingleWait
String ID: /services/genid$order_benchmark$uuid
API String ID: 1755037574-1048225497
Opcode ID: be0883f20efd0d76a0a2a6a841d43ee9a55cfcc821b3e40db18a96e0385b213a
Instruction ID: 1e8baf09eb00181db9e948ab87d1ee444fbeb9943cc6251d5ddc077036d1fa89
Opcode Fuzzy Hash: be0883f20efd0d76a0a2a6a841d43ee9a55cfcc821b3e40db18a96e0385b213a
Instruction Fuzzy Hash: ED614B36610B4889EB92DF21E8943E833A5F79CB99F558212ED1E437A5DF78C68DC340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025C60 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 119networkCOMMON

Download Yara Rule

APIs

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

WSAWaitForMultipleEvents.WS2_32 ref: 0000000180025CEF
EnterCriticalSection.KERNEL32 ref: 0000000180025CFB
WSAEnumNetworkEvents.WS2_32 ref: 0000000180025D25
LeaveCriticalSection.KERNEL32 ref: 0000000180025D99
GetTickCount64.KERNEL32 ref: 0000000180025DB0
EnterCriticalSection.KERNEL32 ref: 0000000180025DC0
LeaveCriticalSection.KERNEL32 ref: 0000000180025DD4
LeaveCriticalSection.KERNEL32 ref: 0000000180025E08

Strings

, xrefs: 0000000180025D54
network_awareness_wait, xrefs: 0000000180025C91
..\src\win\net_awareness.c, xrefs: 0000000180025CB4, 0000000180025D2F, 0000000180025E19
[%s:%d] %s: exiting..., xrefs: 0000000180025E25
[%s:%d] %s: handling events %x , xrefs: 0000000180025D3A
[%s:%d] %s: waiting_time %d, do_bootstrap: %d, xrefs: 0000000180025CBF

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$Events$Count64CurrentEnumMultipleNetworkThreadTickWait
String ID: $..\src\win\net_awareness.c$[%s:%d] %s: exiting...$[%s:%d] %s: handling events %x $[%s:%d] %s: waiting_time %d, do_bootstrap: %d$network_awareness_wait
API String ID: 4207378580-2594836476
Opcode ID: 1f3ecd9d34664e200a46fcc124ad29c37d9d19c830f760999c733b4f300481ae
Instruction ID: 4ea8b29b0890a62dbe9c8e43208bc0b59dfaefe954f133a29bc1417d23952952
Opcode Fuzzy Hash: 1f3ecd9d34664e200a46fcc124ad29c37d9d19c830f760999c733b4f300481ae
Instruction Fuzzy Hash: 38517D36200B4882F7A29F11F8487DA7361F78C795F508215EE9A476E5EF79CA0DC748

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004DC60 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 85windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 000000018004DD88

Strings

non-recoverable failure in name resolution, xrefs: 000000018004DD9B
address family for nodename not supported, xrefs: 000000018004DCBC
memory allocation failure, xrefs: 000000018004DCD5
invalid value for ai_flags, xrefs: 000000018004DCED
No error, xrefs: 000000018004DCE1
system error, xrefs: 000000018004DCA4
nodename nor servname provided, or not known, xrefs: 000000018004DD3B
Request canceled, xrefs: 000000018004DCB0
ai_family not supported, xrefs: 000000018004DD23
temporary failure in name resolution, xrefs: 000000018004DDA7
ai_socktype not supported, xrefs: 000000018004DD2F
no address associated with nodename, xrefs: 000000018004DC98
servname not supported for ai_socktype, xrefs: 000000018004DD17

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: FormatMessage
String ID: No error$Request canceled$address family for nodename not supported$ai_family not supported$ai_socktype not supported$invalid value for ai_flags$memory allocation failure$no address associated with nodename$nodename nor servname provided, or not known$non-recoverable failure in name resolution$servname not supported for ai_socktype$system error$temporary failure in name resolution
API String ID: 1306739567-2106543238
Opcode ID: 69610d5da211b9e43433429a0ae27d88b74ee0a34548894950df51f15ef0d3a8
Instruction ID: be3758e770fb9b962f2b4101a5bd4e6f6ed3bfe85ad210926c0cba20e98dd418
Opcode Fuzzy Hash: 69610d5da211b9e43433429a0ae27d88b74ee0a34548894950df51f15ef0d3a8
Instruction Fuzzy Hash: F83162B5E00A4D9DEED68718ECC93D42251BB893D8FC9819BE61C417B5CE6C876D8708

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004E7C0 Relevance: 23.2, APIs: 10, Strings: 3, Instructions: 491networkCOMMON

Download Yara Rule

APIs

getprotobynumber.WS2_32 ref: 000000018004E8A6
getservbyname.WS2_32 ref: 000000018004E900
htons.WS2_32 ref: 000000018004E913
htons.WS2_32 ref: 000000018004E95A
htons.WS2_32 ref: 000000018004EA6D
htonl.WS2_32 ref: 000000018004EA81
if_nametoindex.IPHLPAPI ref: 000000018004EBF5
htons.WS2_32 ref: 000000018004EC72
htonl.WS2_32 ref: 000000018004EDFB
htons.WS2_32 ref: 000000018004EE13

Strings

tcp, xrefs: 000000018004E893
udp, xrefs: 000000018004E881
%u.%u.%u.%u%c, xrefs: 000000018004ED94

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: htons$htonl$getprotobynumbergetservbynameif_nametoindex
String ID: %u.%u.%u.%u%c$tcp$udp
API String ID: 2145373577-1920569115
Opcode ID: d639a59a576ee61bfcd3776ccb1a1d88b6018731c85ac12b0696f59186759f2f
Instruction ID: 0177892e018723988df61707d9891f823e3bf2eaf677c633446db0dae9630c52
Opcode Fuzzy Hash: d639a59a576ee61bfcd3776ccb1a1d88b6018731c85ac12b0696f59186759f2f
Instruction Fuzzy Hash: DD326D32B00B888AFB96CF65C4843ED33A1F75978CF05C529EE4957A85EF349698C744

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013430 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001800138D0: CreateMutexA.KERNEL32 ref: 0000000180013927
Part of subcall function 00000001800138D0: GetLastError.KERNEL32 ref: 0000000180013935

CreateFileW.KERNEL32 ref: 0000000180013510
GetLastError.KERNEL32 ref: 000000018001351F
GetFileSize.KERNEL32 ref: 000000018001353E
ReadFile.KERNEL32 ref: 00000001800135AB
CloseHandle.KERNEL32 ref: 00000001800135EF

Strings

[%s:%d] %s: %s, xrefs: 00000001800137EF
..\src\win\wslib_proxy.c, xrefs: 0000000180013567, 00000001800137E1, 0000000180013823
[%s:%d] %s: '%S' size %u , xrefs: 0000000180013585
[%s:%d] %s: failed %d %s, xrefs: 000000018001383B
read_proxy_settings_file, xrefs: 000000018001356E
get_wslib_proxy_settings, xrefs: 00000001800137E8, 0000000180013834

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: File$CreateErrorLast$CloseHandleMutexReadSize
String ID: ..\src\win\wslib_proxy.c$[%s:%d] %s: %s$[%s:%d] %s: '%S' size %u $[%s:%d] %s: failed %d %s$get_wslib_proxy_settings$read_proxy_settings_file
API String ID: 764440035-3347728553
Opcode ID: 9a9bac08991f274b7a23e2cda621e445181768074cf343ae3868277f66c27741
Instruction ID: 1f28283fa611dcfe7942fd8c26238b29b560e8adcb0d69f223728fe7e61b72dd
Opcode Fuzzy Hash: 9a9bac08991f274b7a23e2cda621e445181768074cf343ae3868277f66c27741
Instruction Fuzzy Hash: F5D1CD36304B8886EBA29F25A4453DAB7A1F788BD4F54C125FE8A43795DF78C60DCB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180009C30 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 197COMMON

Download Yara Rule

Strings

DNS_ERR_0x????????, xrefs: 0000000180009CD6
dns_client_resend_req, xrefs: 0000000180009E8E, 0000000180009EF2, 0000000180009F51
[%s:%d] %s: [resolving %s] result = %d, type = %s, count = %d, restarted = %d, xrefs: 0000000180009C9D
dns_client_cb, xrefs: 0000000180009C87
..\src\dns_client.c, xrefs: 0000000180009C92, 0000000180009D6A, 0000000180009E7B, 0000000180009EDF, 0000000180009F3A
IPv4, xrefs: 0000000180009C66
[%s:%d] %s: resending ipv4 request for %s, xrefs: 0000000180009E87
other, xrefs: 0000000180009C79
[%s:%d] %s: delta = %d for %s, xrefs: 0000000180009F46
[%s:%d] %s: [resolving %s] result = %s, xrefs: 0000000180009D81
[%s:%d] %s: resending ipv6 request for %s, xrefs: 0000000180009EEB
IPv6, xrefs: 0000000180009C72

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID: ..\src\dns_client.c$DNS_ERR_0x????????$IPv4$IPv6$[%s:%d] %s: [resolving %s] result = %d, type = %s, count = %d, restarted = %d$[%s:%d] %s: [resolving %s] result = %s$[%s:%d] %s: delta = %d for %s$[%s:%d] %s: resending ipv4 request for %s$[%s:%d] %s: resending ipv6 request for %s$dns_client_cb$dns_client_resend_req$other
API String ID: 0-3739046466
Opcode ID: 32a46044ef1a3408bdd975d5a75769f5444cbb9f17bdfa7217605a12f38ebfb9
Instruction ID: fc53509108d1d43912d9ba45907ae5a1d0392aad465786dc0c2a93443c90fc5d
Opcode Fuzzy Hash: 32a46044ef1a3408bdd975d5a75769f5444cbb9f17bdfa7217605a12f38ebfb9
Instruction Fuzzy Hash: 8D917F72205B4986EBE6CF15E4803D973A5F38CB88F548126EA8E87798DF78C659C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001BF30 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 162encryptionCOMMON

Download Yara Rule

APIs

CertCreateCertificateContext.CRYPT32 ref: 000000018001BFB0
GetLastError.KERNEL32 ref: 000000018001BFBE

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

x509_to_cert_context, xrefs: 000000018001BF6B, 000000018001BFD9
[%s:%d][ERR] %s: CertCreateCertificateContext failed %d, xrefs: 000000018001BFE6
verify_by_wincrypt, xrefs: 000000018001C0EE, 000000018001C131
..\src\ssl\ssl_ctx.c, xrefs: 000000018001BF78, 000000018001BFD2, 000000018001BFFD, 000000018001C024, 000000018001C0E5, 000000018001C11F
[%s:%d] %s: ChainContext->TrustStatus.dwErrorStatus %x, xrefs: 000000018001C12A
[%s:%d][ERR] %s: CertGetCertificateChain failed and returned 0x%x, xrefs: 000000018001C0F5
[%s:%d][ERR] %s: i2d_X509 failed!, xrefs: 000000018001BF84

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CertCertificateContextCreateCurrentEnterErrorLastLeaveThread
String ID: ..\src\ssl\ssl_ctx.c$[%s:%d] %s: ChainContext->TrustStatus.dwErrorStatus %x$[%s:%d][ERR] %s: CertCreateCertificateContext failed %d$[%s:%d][ERR] %s: CertGetCertificateChain failed and returned 0x%x$[%s:%d][ERR] %s: i2d_X509 failed!$verify_by_wincrypt$x509_to_cert_context
API String ID: 2957535492-3419966419
Opcode ID: 42f587d87058c165350c04bb0e66ed8e0915ac6bb1692d0a6f72c3ddf143d1ed
Instruction ID: d574a7da27866d80d0de8dbaaf123cab5504ce24c08647fd5e8a7f30685c46d4
Opcode Fuzzy Hash: 42f587d87058c165350c04bb0e66ed8e0915ac6bb1692d0a6f72c3ddf143d1ed
Instruction Fuzzy Hash: BD715E32605B4885FB92DF64E8457D933A1E78D788F408126BE4D17AA5EF79C78DC308

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800138D0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 123synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 0000000180013927
GetLastError.KERNEL32 ref: 0000000180013935
WaitForSingleObject.KERNEL32 ref: 0000000180013954
CloseHandle.KERNEL32 ref: 0000000180013961

Strings

vsserv, xrefs: 00000001800139FC
ImagePath, xrefs: 00000001800139C6
SYSTEM\CurrentControlSet\Services\VSSERV, xrefs: 000000018001398C
Global\WSLibDefProxyMutex, xrefs: 0000000180013911

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CloseCreateErrorHandleLastMutexObjectSingleWait
String ID: Global\WSLibDefProxyMutex$ImagePath$SYSTEM\CurrentControlSet\Services\VSSERV$vsserv
API String ID: 1736628457-1302513531
Opcode ID: 53e845cb16d2c7ce4f62b7733daffdc6e911f197ab93294faa4d4e4286a654b3
Instruction ID: 2e82a52f8cc0d8aaf4ad6456095f4e6be0633689a5f537d0375e193946d02534
Opcode Fuzzy Hash: 53e845cb16d2c7ce4f62b7733daffdc6e911f197ab93294faa4d4e4286a654b3
Instruction Fuzzy Hash: 91517135315B8882EBE29B24E4493AA7361FB8D7D4F808215F98A43BA5DF79C64DC704

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800072D0 Relevance: 21.2, APIs: 4, Strings: 8, Instructions: 193networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 0000000180007475
htons.WS2_32 ref: 000000018000752F
htons.WS2_32 ref: 00000001800075AC
htons.WS2_32 ref: 0000000180007615

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

event_context_init, xrefs: 00000001800072D3
[%s:%d][ERR] %s: error converting port %s, xrefs: 00000001800073E7
get_proxy_address, xrefs: 0000000180007338, 000000018000756F
[%s:%d][ERR] %s: INALID proxy string size %u > 255(domain) + 1(:) + 5(port), xrefs: 0000000180007357
get_proxy_port, xrefs: 00000001800073C7
[%s:%d][ERR] %s: resolving proxy name failed %d ( %s ), xrefs: 0000000180007585
..\src\bootstrap_proxy.c, xrefs: 000000018000734E, 00000001800073DE, 0000000180007568
%hu, xrefs: 00000001800073B6, 00000001800074D6

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: htons$CriticalSection$CurrentEnterLeaveThread
String ID: %hu$..\src\bootstrap_proxy.c$[%s:%d][ERR] %s: INALID proxy string size %u > 255(domain) + 1(:) + 5(port)$[%s:%d][ERR] %s: error converting port %s$[%s:%d][ERR] %s: resolving proxy name failed %d ( %s )$event_context_init$get_proxy_address$get_proxy_port
API String ID: 3061074959-946998157
Opcode ID: 77a81ed041eb999e9ada7486b30f522a9e071ba48bd6e18127870a6ec2549d73
Instruction ID: c7132afbdf041d4dd4573f23aff71851a48c8bfcff6e33a75c723e7ae48333ff
Opcode Fuzzy Hash: 77a81ed041eb999e9ada7486b30f522a9e071ba48bd6e18127870a6ec2549d73
Instruction Fuzzy Hash: 9291BD72B04A8881EBA2CF24E4083DA77A1F759798F44C126EA4D476D6DFBDC68DC700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180035560 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 139synchronizationCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 0000000180035639
CreateEventA.KERNEL32 ref: 0000000180035649
EnterCriticalSection.KERNEL32 ref: 00000001800356B6
LeaveCriticalSection.KERNEL32 ref: 00000001800356C6
WaitForSingleObject.KERNEL32 ref: 00000001800356D5
EnterCriticalSection.KERNEL32 ref: 00000001800356DF
LeaveCriticalSection.KERNEL32 ref: 00000001800356EF
DeleteCriticalSection.KERNEL32 ref: 0000000180035705
CloseHandle.KERNEL32 ref: 000000018003570F

Part of subcall function 0000000180035DD0: EnterCriticalSection.KERNEL32(?,?,?,?,0000000180034BD0), ref: 0000000180035DDB
Part of subcall function 0000000180035DD0: GetCurrentProcessId.KERNEL32(?,?,?,?,0000000180034BD0), ref: 0000000180035DEB
Part of subcall function 0000000180035DD0: LeaveCriticalSection.KERNEL32(?,?,?,?,0000000180034BD0), ref: 0000000180035E2B

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

__rpc_wrap_upload_callback, xrefs: 00000001800355BB
[%s:%d][ERR] %s: fail __rpc_wrap_upload_callback, xrefs: 00000001800355D4
..\src\rpc\rpc_server.c, xrefs: 00000001800355B4

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Current$CloseCreateDeleteEventHandleInitializeObjectProcessSingleThreadWait
String ID: ..\src\rpc\rpc_server.c$[%s:%d][ERR] %s: fail __rpc_wrap_upload_callback$__rpc_wrap_upload_callback
API String ID: 2203566803-1804713744
Opcode ID: 7a897d38a4fa222d0008ed8b71da0d66f69940668cbfb48c1b0c575fe22ff300
Instruction ID: 654090693d2f7f81e91e883800d9aaf31b2b54e3ecb5746176d451f464ae137f
Opcode Fuzzy Hash: 7a897d38a4fa222d0008ed8b71da0d66f69940668cbfb48c1b0c575fe22ff300
Instruction Fuzzy Hash: EB612476700A48CAEBA2DF64E4843DD33B5F748B88F418126EE4A57BA8DF34C659C744

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800358A0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 119synchronizationCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 0000000180035973
CreateEventA.KERNEL32 ref: 0000000180035983
EnterCriticalSection.KERNEL32 ref: 00000001800359F2
LeaveCriticalSection.KERNEL32 ref: 0000000180035A04
WaitForSingleObject.KERNEL32 ref: 0000000180035A13
EnterCriticalSection.KERNEL32 ref: 0000000180035A1D
LeaveCriticalSection.KERNEL32 ref: 0000000180035A2D
DeleteCriticalSection.KERNEL32 ref: 0000000180035A5A
CloseHandle.KERNEL32 ref: 0000000180035A64

Part of subcall function 0000000180035DD0: EnterCriticalSection.KERNEL32(?,?,?,?,0000000180034BD0), ref: 0000000180035DDB
Part of subcall function 0000000180035DD0: GetCurrentProcessId.KERNEL32(?,?,?,?,0000000180034BD0), ref: 0000000180035DEB
Part of subcall function 0000000180035DD0: LeaveCriticalSection.KERNEL32(?,?,?,?,0000000180034BD0), ref: 0000000180035E2B

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

__rpc_wrap_upload_read_callback, xrefs: 0000000180035903
[%s:%d][ERR] %s: fail __rpc_wrap_upload_callback, xrefs: 000000018003591C
..\src\rpc\rpc_server.c, xrefs: 00000001800358FC

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Current$CloseCreateDeleteEventHandleInitializeObjectProcessSingleThreadWait
String ID: ..\src\rpc\rpc_server.c$[%s:%d][ERR] %s: fail __rpc_wrap_upload_callback$__rpc_wrap_upload_read_callback
API String ID: 2203566803-743871013
Opcode ID: 4df97d72658ecfdfe64ba9671ecae55087768fbfaac0a1523e7a062799478404
Instruction ID: ea81d83cca56c09f99acbc3d04915c760471e47436f3e7449c4c784ddc32bcad
Opcode Fuzzy Hash: 4df97d72658ecfdfe64ba9671ecae55087768fbfaac0a1523e7a062799478404
Instruction Fuzzy Hash: A6511536700A488AEB92DFA4E4543DD33B5F748B5CF418626AE4E57BA8DE34C61DC380

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E810 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 110fileCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,0000000100000000,0000000180007E4C,?,?,?,?,00000000,00000000,order_benchmark,00000001800065A4), ref: 000000018001E88A
CreateFileW.KERNEL32 ref: 000000018001E8CF
GetLastError.KERNEL32 ref: 000000018001E8DE
WriteFile.KERNEL32 ref: 000000018001E905
GetLastError.KERNEL32 ref: 000000018001E915
CloseHandle.KERNEL32 ref: 000000018001E92C
DeleteFileW.KERNEL32 ref: 000000018001E939
DeleteFileW.KERNEL32 ref: 000000018001E94B
MoveFileW.KERNEL32 ref: 000000018001E957
GetLastError.KERNEL32 ref: 000000018001E961
DeleteFileW.KERNEL32 ref: 000000018001E978

Strings

%s.tmp.%d, xrefs: 000000018001E893

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: File$DeleteErrorLast$CloseCreateCurrentHandleMoveProcessWrite
String ID: %s.tmp.%d
API String ID: 556425708-2581808395
Opcode ID: af9e7c332613c6ae63707ca3cd97265a0599f4310e301c74c3619c70dfb9b7fc
Instruction ID: 976f2ae6779a7fe713dfaf19095e5d47e0c50095c6cd47f3a8abef3a7cd82836
Opcode Fuzzy Hash: af9e7c332613c6ae63707ca3cd97265a0599f4310e301c74c3619c70dfb9b7fc
Instruction Fuzzy Hash: F6417335204A4882FBD29B25A4043AD63A1FB8EBE0F54C216FD56477E4DF79C64E8705

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800189A0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 96COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00000001800189C2
LeaveCriticalSection.KERNEL32 ref: 00000001800189EA
LeaveCriticalSection.KERNEL32 ref: 0000000180018A0B
CloseHandle.KERNEL32 ref: 0000000180018A2C
DeleteCriticalSection.KERNEL32 ref: 0000000180018A36
EnterCriticalSection.KERNEL32 ref: 0000000180018A43
SetEvent.KERNEL32 ref: 0000000180018A75
SetEvent.KERNEL32 ref: 0000000180018A97
LeaveCriticalSection.KERNEL32 ref: 0000000180018AA4

Strings

..\src\user_context.c, xrefs: 0000000180018AEE
user_context_free, xrefs: 0000000180018AD7
[%s:%d] %s: context %p, xrefs: 0000000180018AF7

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$EnterEvent$CloseDeleteHandle
String ID: ..\src\user_context.c$[%s:%d] %s: context %p$user_context_free
API String ID: 3243869176-760787364
Opcode ID: 528c919e662e59c8ac7cecb139da6bb4a28bd3705507a498199fd55ba5a67612
Instruction ID: e40c35f0bea0219aec65af887ea09008c75b8dc8906a105946ee75eac4537473
Opcode Fuzzy Hash: 528c919e662e59c8ac7cecb139da6bb4a28bd3705507a498199fd55ba5a67612
Instruction Fuzzy Hash: E8413D36204E4896EB969F11E9943E87361FB88B80F50C411EF5A436A1CF79D76DC345

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800263A0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 51networksynchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,00000000,0000000180025C0A), ref: 00000001800263BA
closesocket.WS2_32 ref: 00000001800263FC
WSASetEvent.WS2_32(?,?,?,?,00000000,0000000180025C0A), ref: 0000000180026413
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,0000000180025C0A), ref: 000000018002641D
WaitForSingleObject.KERNEL32(?,?,?,?,00000000,0000000180025C0A), ref: 0000000180026431
CloseHandle.KERNEL32(?,?,?,?,00000000,0000000180025C0A), ref: 000000018002643B
WSACloseEvent.WS2_32 ref: 0000000180026452
WSACleanup.WS2_32 ref: 0000000180026465
DeleteCriticalSection.KERNEL32(?,?,?,?,00000000,0000000180025C0A), ref: 0000000180026475

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

[%s:%d] %s: closing socket %d for network awareness, xrefs: 00000001800263E3
..\src\win\net_awareness.c, xrefs: 00000001800263CF
network_awareness_uninit, xrefs: 00000001800263DC

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CloseEnterEventLeave$CleanupCurrentDeleteHandleObjectSingleThreadWaitclosesocket
String ID: ..\src\win\net_awareness.c$[%s:%d] %s: closing socket %d for network awareness$network_awareness_uninit
API String ID: 1809356277-1513254717
Opcode ID: cfbdc9b7a89ad74a1593a6fc0c17ca61ad7022e9dfc4d68184e00e9674f948e8
Instruction ID: 7455f4952d7b9762a678319bae2ec7ded4503d79f9d158b74ef4d52b35fb15d3
Opcode Fuzzy Hash: cfbdc9b7a89ad74a1593a6fc0c17ca61ad7022e9dfc4d68184e00e9674f948e8
Instruction Fuzzy Hash: 0D214F35201B0882EBD69F20E8583983365FB4DB69F048711ED6A436F4CF79C69DC345

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180122480 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 204registryfileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(00000000,?,?,?,?,00000000,00000001801222EC,00000001800D9FA7,?,00000001800D9DBE,?,0000000180082FCB,00000000,0000000180083325,?,00000000), ref: 00000001801224C4
GetFileType.KERNEL32(?,?,?,?,00000000,00000001801222EC,00000001800D9FA7,?,00000001800D9DBE,?,0000000180082FCB,00000000,0000000180083325,?,00000000), ref: 00000001801224D5
WriteFile.KERNEL32(?,?,?,?,00000000,00000001801222EC,00000001800D9FA7,?,00000001800D9DBE,?,0000000180082FCB,00000000,0000000180083325,?,00000000), ref: 0000000180122538
MultiByteToWideChar.KERNEL32(?,?,?,?,00000000,00000001801222EC,00000001800D9FA7,?,00000001800D9DBE,?,0000000180082FCB,00000000,0000000180083325,?,00000000), ref: 00000001801225A5
RegisterEventSourceW.ADVAPI32 ref: 0000000180122753
ReportEventW.ADVAPI32 ref: 0000000180122795
DeregisterEventSource.ADVAPI32 ref: 000000018012279E

Strings

no stack?, xrefs: 000000018012258B
OpenSSL, xrefs: 000000018012274C
OpenSSL: FATAL, xrefs: 00000001801227AC

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: Event$FileSource$ByteCharDeregisterHandleMultiRegisterReportTypeWideWrite
String ID: OpenSSL$OpenSSL: FATAL$no stack?
API String ID: 1270133462-278800372
Opcode ID: a6e30cf66f051693dae68a3b364c796e4b5a290642cf1f023cc859ad0de78500
Instruction ID: 0464d2c47092815e0f1c6173ad4242d1789bc52561a60bc39d23d63a031f175c
Opcode Fuzzy Hash: a6e30cf66f051693dae68a3b364c796e4b5a290642cf1f023cc859ad0de78500
Instruction Fuzzy Hash: 43911373214B8996EBA2CF24D8583ED3765F749BA4F408316EA6907B95EF78C358C300

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002C970 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 204networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 000000018002CB00
htons.WS2_32 ref: 000000018002CB11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,00000000,00000000,?,000000018002C173,?,?,00000000,000000018002C83F), ref: 000000018002CB95
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,00000000,00000000,?,000000018002C173,?,?,00000000,000000018002C83F), ref: 000000018002CBAE

Strings

..\src\push_conn.c, xrefs: 000000018002CC14, 000000018002CC60, 000000018002CCCB
prepare_ri, xrefs: 000000018002CC3C
push_connection_alloc, xrefs: 000000018002CCA4
push_connection_free, xrefs: 000000018002CCF7
h_id=, xrefs: 000000018002CBE9
[%s:%d] %s: '%s', xrefs: 000000018002CC21
[%s:%d] %s: pc = %p, push_id: %s, host: %s, port: %hu, xrefs: 000000018002CC6A, 000000018002CCD9

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSectionhtons$EnterLeave
String ID: ..\src\push_conn.c$[%s:%d] %s: '%s'$[%s:%d] %s: pc = %p, push_id: %s, host: %s, port: %hu$h_id=$prepare_ri$push_connection_alloc$push_connection_free
API String ID: 1465762026-1002155342
Opcode ID: a749c5ee49f4709239b3e20c736d3102acacfe4d0c1982ab3db86f3c62dc06dc
Instruction ID: 641d79cc962f26776d4766ab4eec7ee30122784416767a57afb92a7e53de2e65
Opcode Fuzzy Hash: a749c5ee49f4709239b3e20c736d3102acacfe4d0c1982ab3db86f3c62dc06dc
Instruction Fuzzy Hash: 09B14B32501BC886D796CF20E8507E933B5F758B88F049226EE8D47369EF78C298C354

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002B400 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 72fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001800032FA), ref: 000000018002B457
SetFilePointerEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001800032FA), ref: 000000018002B47B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001800032FA), ref: 000000018002B494
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001800032FA), ref: 000000018002B4A7
GetCurrentProcessId.KERNEL32 ref: 000000018002B4B4
LeaveCriticalSection.KERNEL32 ref: 000000018002B4E7

Strings

2.7.23.13110 26dabe2, xrefs: 000000018002B506
..\src\win\bdnc_log.c, xrefs: 000000018002B4FF
log_init_file, xrefs: 000000018002B51E
windows_amd64, xrefs: 000000018002B4ED
[%s:%d] %s: %s for %s, xrefs: 000000018002B517

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalFileSection$CloseCreateCurrentEnterHandleLeavePointerProcess
String ID: ..\src\win\bdnc_log.c$2.7.23.13110 26dabe2$[%s:%d] %s: %s for %s$log_init_file$windows_amd64
API String ID: 202967565-2997241219
Opcode ID: fd2539fee1170c0b6c44980dad3c98a43e8f297e9842d00d6b396c3a5fb21250
Instruction ID: 882ba3c42365f7850e249c491c584aca7eb675dd6f6499a08472139707a4f6cf
Opcode Fuzzy Hash: fd2539fee1170c0b6c44980dad3c98a43e8f297e9842d00d6b396c3a5fb21250
Instruction Fuzzy Hash: 90316935200B4885EBD29B15F8583A963A2B74D7B4F048311EE6A43BE4DFBDC65DC704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017D40 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 71fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001800032FA), ref: 000000018002B457
SetFilePointerEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001800032FA), ref: 000000018002B47B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001800032FA), ref: 000000018002B494
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001800032FA), ref: 000000018002B4A7
GetCurrentProcessId.KERNEL32 ref: 000000018002B4B4
LeaveCriticalSection.KERNEL32 ref: 000000018002B4E7

Strings

2.7.23.13110 26dabe2, xrefs: 000000018002B506
..\src\win\bdnc_log.c, xrefs: 000000018002B4FF
log_init_file, xrefs: 000000018002B51E
windows_amd64, xrefs: 000000018002B4ED
[%s:%d] %s: %s for %s, xrefs: 000000018002B517

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalFileSection$CloseCreateCurrentEnterHandleLeavePointerProcess
String ID: ..\src\win\bdnc_log.c$2.7.23.13110 26dabe2$[%s:%d] %s: %s for %s$log_init_file$windows_amd64
API String ID: 202967565-2997241219
Opcode ID: 2ecbfdb8859b5a3bd95fbd26eb6fe18c225c43cc11a6a7f6beea6a4c30b1d08a
Instruction ID: 5e2d66d8e8aca9ee2a19b27973b816b1ec104f0292d825ccf6606160d73b3ce5
Opcode Fuzzy Hash: 2ecbfdb8859b5a3bd95fbd26eb6fe18c225c43cc11a6a7f6beea6a4c30b1d08a
Instruction Fuzzy Hash: 24315535201B4885EBD39B20F8583A923A2BB4D7A4F048311EE6A43BE5DFBDC64DC704

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000322A Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 36synchronizationCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 000000018000321F

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

EnterCriticalSection.KERNEL32 ref: 0000000180003231
WaitForSingleObject.KERNEL32 ref: 0000000180003279
WaitForSingleObject.KERNEL32 ref: 000000018000328B
CloseHandle.KERNEL32 ref: 0000000180003298
CloseHandle.KERNEL32 ref: 00000001800032A5
LeaveCriticalSection.KERNEL32 ref: 00000001800032E4

Strings

[%s:%d] %s: RPC thread joinded, xrefs: 00000001800032C2
[%s:%d] %s: Waiting for RPC thread, xrefs: 000000018000325C
..\src\api.c, xrefs: 0000000180003250, 00000001800032B6
__bdnimbus_set_optionv, xrefs: 0000000180003243

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$CloseEnterHandleObjectSingleWait$CurrentThread
String ID: ..\src\api.c$[%s:%d] %s: RPC thread joinded$[%s:%d] %s: Waiting for RPC thread$__bdnimbus_set_optionv
API String ID: 2755589515-973058027
Opcode ID: 4fadbac417943e66058e638232ad83b01b11072ef91ee4fe71ea5bf788792abc
Instruction ID: 99d956d71abee1ef6cd4f2083baff09278aa10ab0e578b34bed3c4bd6b88c4ec
Opcode Fuzzy Hash: 4fadbac417943e66058e638232ad83b01b11072ef91ee4fe71ea5bf788792abc
Instruction Fuzzy Hash: 1F119339200A4886E7D3DB51FC993D87322BB8D7A1F55C212AC1A962F48F79878DC315

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000CD90 Relevance: 18.1, APIs: 7, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018000CDF1
LeaveCriticalSection.KERNEL32 ref: 000000018000CE3D

Strings

..\src\global_state.c, xrefs: 000000018000CEE6, 000000018000CF73
[%s:%d][WARN] %s: new_rt_setts not set!, xrefs: 000000018000CEF2
set_runtime_configuration, xrefs: 000000018000CF7A
runtime_settings_reconfiguration, xrefs: 000000018000CED9
[%s:%d] %s: new runtime_settings: %p | old: %p, xrefs: 000000018000CF91

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\global_state.c$[%s:%d] %s: new runtime_settings: %p | old: %p$[%s:%d][WARN] %s: new_rt_setts not set!$runtime_settings_reconfiguration$set_runtime_configuration
API String ID: 3168844106-171095035
Opcode ID: bc08d9edf48f212b4b4709a117028e77620c6804061d43fded0dc9ccb7a3570f
Instruction ID: 2f48f0bf0723d063989da4d47baf2ab918e7017de8bcfecdcd3d5279e0e8ffd7
Opcode Fuzzy Hash: bc08d9edf48f212b4b4709a117028e77620c6804061d43fded0dc9ccb7a3570f
Instruction Fuzzy Hash: 30514635205B4985EAD2DB51F8943E9B3A5BB8CBC0F45C422ED5E53BA5EF68C70C8341

Uniqueness

Uniqueness Score: -1.00%

Function 00000001802450F8 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000180245107
FlsGetValue.KERNEL32 ref: 000000018024511C
FlsSetValue.KERNEL32 ref: 000000018024513D
FlsSetValue.KERNEL32 ref: 000000018024516A
FlsSetValue.KERNEL32 ref: 000000018024517B
FlsSetValue.KERNEL32 ref: 000000018024518C
SetLastError.KERNEL32 ref: 00000001802451A7
FlsGetValue.KERNEL32 ref: 00000001802451DD
FlsSetValue.KERNEL32 ref: 00000001802451FC

Part of subcall function 000000018024591C: RtlAllocateHeap.NTDLL(?,?,00000000,000000018024538E,?,?,?,000000018024324B,?,?,00000000,00000001802434E6), ref: 0000000180245971

FlsSetValue.KERNEL32 ref: 0000000180245224

Part of subcall function 0000000180243168: HeapFree.KERNEL32(?,?,?,000000018024DD92,?,?,?,000000018024DDCF,?,?,00000000,000000018024C3C4,?,?,?,000000018024C2F7), ref: 000000018024317E
Part of subcall function 0000000180243168: GetLastError.KERNEL32(?,?,?,000000018024DD92,?,?,?,000000018024DDCF,?,?,00000000,000000018024C3C4,?,?,?,000000018024C2F7), ref: 0000000180243188

FlsSetValue.KERNEL32 ref: 0000000180245235
FlsSetValue.KERNEL32 ref: 0000000180245246

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocateFree
String ID:
API String ID: 3174826731-0
Opcode ID: 5436fd40256895cb00b8b959648f034ffeb9954ba6898a7639f87a1cbf12b989
Instruction ID: 2b1015b2fe9656ef3978541438f1d9c16d0c5384d045200822034322d338a4e2
Opcode Fuzzy Hash: 5436fd40256895cb00b8b959648f034ffeb9954ba6898a7639f87a1cbf12b989
Instruction Fuzzy Hash: 1D417130204A1C42FEDBA73959DD3E913A35F9D7B0F0AC7246C7A46AD3DDE89A498301

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004B780 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 228COMMON

Download Yara Rule

Strings

[%s:%d][ERR] %s: unsupported upload scheme '%s'!!!, xrefs: 000000018004B83D
upload_request_load_location, xrefs: 000000018004B782
[%s:%d][ERR] %s: evhttp_uri_parse error, xrefs: 000000018004B7D1
https, xrefs: 000000018004B825
[%s:%d][ERR] %s: ERROR: cannot upload over http ( BDNIMBUS_ENOSSLUPLOAD ), xrefs: 000000018004B8AD
parse_upload_location, xrefs: 000000018004B7B1, 000000018004B84A, 000000018004B894
http, xrefs: 000000018004B812
..\src\upload\upload_request.c, xrefs: 000000018004B7C8, 000000018004B853, 000000018004B8A1
[%s:%d][ERR] %s: evhttp_uri_get_scheme returned no scheme, xrefs: 000000018004B803

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: ..\src\upload\upload_request.c$[%s:%d][ERR] %s: ERROR: cannot upload over http ( BDNIMBUS_ENOSSLUPLOAD )$[%s:%d][ERR] %s: evhttp_uri_get_scheme returned no scheme$[%s:%d][ERR] %s: evhttp_uri_parse error$[%s:%d][ERR] %s: unsupported upload scheme '%s'!!!$http$https$parse_upload_location$upload_request_load_location
API String ID: 2351996187-241596716
Opcode ID: 8079441460dfc8464459651d25028fae7c1d32f95bf65a50c77bea82710f2cdf
Instruction ID: cc8e5094f05d1f1e27fe8fabce802c0643e4d57b20fa4aa0b26cd0ebe8607634
Opcode Fuzzy Hash: 8079441460dfc8464459651d25028fae7c1d32f95bf65a50c77bea82710f2cdf
Instruction Fuzzy Hash: EDA1D631204B8C81FAE6DF25A8803EB7391FB4D7D4F458115BE9A87796DE78C608C305

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800333C0 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Part of subcall function 0000000180035ED0: EnterCriticalSection.KERNEL32(?,?,?,00000001800334E5), ref: 0000000180035EFB
Part of subcall function 0000000180035ED0: LeaveCriticalSection.KERNEL32(?,?,?,00000001800334E5), ref: 0000000180035F5F

EnterCriticalSection.KERNEL32 ref: 000000018003350D
SetEvent.KERNEL32 ref: 000000018003352B
LeaveCriticalSection.KERNEL32 ref: 0000000180033535

Strings

[%s:%d] %s: RPC loop starting %p, xrefs: 0000000180033445
[%s:%d][ERR] %s: RPC: invalid message size (%d) received, xrefs: 000000018003358F
[%s:%d][ERR] %s: {msg_id:%x, api_id:%d, client_id:%p} NOT found, xrefs: 000000018003354D
half_duplex_recv_th, xrefs: 00000001800333E4
[%s:%d] %s: RPC loop ended, xrefs: 0000000180033604
..\src\rpc\rpc_server.c, xrefs: 0000000180033411, 0000000180033439, 0000000180033541, 000000018003357B, 00000001800335F8
[%s:%d] %s: waiting 4 client to start, xrefs: 0000000180033418

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CurrentEventThread
String ID: ..\src\rpc\rpc_server.c$[%s:%d] %s: RPC loop ended$[%s:%d] %s: RPC loop starting %p$[%s:%d] %s: waiting 4 client to start$[%s:%d][ERR] %s: RPC: invalid message size (%d) received$[%s:%d][ERR] %s: {msg_id:%x, api_id:%d, client_id:%p} NOT found$half_duplex_recv_th
API String ID: 1044671773-1970580199
Opcode ID: 8c2da57c64eba52655e1ddaff454360a55f926717f7460f52b42f5034c96fbd9
Instruction ID: 24ee1619065de2eaff0b08eff75d7f11f1a7f5bce561264a1d2ce2690badced4
Opcode Fuzzy Hash: 8c2da57c64eba52655e1ddaff454360a55f926717f7460f52b42f5034c96fbd9
Instruction Fuzzy Hash: FA713A72205B89D6EBA2DF21E4843DA73A5F74CB88F418516EB8E47B64DF38C659C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013AF0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 88fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000180013B32
GetLastError.KERNEL32 ref: 0000000180013B41
GetFileSize.KERNEL32 ref: 0000000180013B68
ReadFile.KERNEL32 ref: 0000000180013BD7
CloseHandle.KERNEL32 ref: 0000000180013C21

Strings

..\src\win\wslib_proxy.c, xrefs: 0000000180013B95
[%s:%d] %s: '%S' size %u , xrefs: 0000000180013BB3
read_proxy_settings_file, xrefs: 0000000180013B9C

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastReadSize
String ID: ..\src\win\wslib_proxy.c$[%s:%d] %s: '%S' size %u $read_proxy_settings_file
API String ID: 3577853679-2197343608
Opcode ID: ee1b067515cf3df9bf7c21b1e771e9be1b3553fde29a0fdc65ed59c47d982b5e
Instruction ID: f825f7d504682b49347d9de6a57a1cf39243cbde83097939fa561fd33ee31ea7
Opcode Fuzzy Hash: ee1b067515cf3df9bf7c21b1e771e9be1b3553fde29a0fdc65ed59c47d982b5e
Instruction Fuzzy Hash: B331B335304A4486E7E29F25A8853DD76A1F78CBD0F108225FE4A837D4DF79C64D8744

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180048AA0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 71COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32 ref: 0000000180048AE6

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B988

EnterCriticalSection.KERNEL32 ref: 0000000180048B7C
SetEvent.KERNEL32 ref: 0000000180048B90
LeaveCriticalSection.KERNEL32 ref: 0000000180048B9A
TlsSetValue.KERNEL32 ref: 0000000180048BA8

Strings

[%s:%d] %s: Upload thread stopped !!!, xrefs: 0000000180048B6C
run_base_upload_loop, xrefs: 0000000180048AF2
[%s:%d] %s: Upload thread started !!!, xrefs: 0000000180048B3C
..\src\upload\upload.c, xrefs: 0000000180048AFE, 0000000180048B30, 0000000180048B60, 0000000180048BB4
[%s:%d] %s: tls_set( %x, %p ), xrefs: 0000000180048B09, 0000000180048BC4

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue$CurrentEventThread
String ID: ..\src\upload\upload.c$[%s:%d] %s: Upload thread started !!!$[%s:%d] %s: Upload thread stopped !!!$[%s:%d] %s: tls_set( %x, %p )$run_base_upload_loop
API String ID: 109659918-3087495567
Opcode ID: 26a30512afc71eed2cdae5c6c1ec1121441c4120e32c3eefbc150fda66eece7d
Instruction ID: 9c826b0a16dc58543024116b3e31329d636cb8b6a5f7aeed879db46551f25062
Opcode Fuzzy Hash: 26a30512afc71eed2cdae5c6c1ec1121441c4120e32c3eefbc150fda66eece7d
Instruction Fuzzy Hash: 77318F35214A4896E3D2DB11F8897D93362F78C794F808115EA8A83BA5CFBCC75EC740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001D10 Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180001D6A
LeaveCriticalSection.KERNEL32 ref: 0000000180001D88
EnterCriticalSection.KERNEL32 ref: 0000000180001DA2
LeaveCriticalSection.KERNEL32 ref: 0000000180001DC0
EnterCriticalSection.KERNEL32 ref: 0000000180001DDA
LeaveCriticalSection.KERNEL32 ref: 0000000180001DF8
EnterCriticalSection.KERNEL32 ref: 0000000180001E12
LeaveCriticalSection.KERNEL32 ref: 0000000180001E30
EnterCriticalSection.KERNEL32 ref: 0000000180001EAA
LeaveCriticalSection.KERNEL32 ref: 0000000180001EC8

Strings

2.7.23.13110 26dabe2, xrefs: 0000000180001E8A

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: 2.7.23.13110 26dabe2
API String ID: 3168844106-1144658929
Opcode ID: a5d96aee57a43fa8385db11e393a447b04ed0111086fc0bfdbf9c76a4413c1e6
Instruction ID: dd2827d4fc4ca981009a0feb46e65ef921334ac641c9dc7c726b7ee9a999237a
Opcode Fuzzy Hash: a5d96aee57a43fa8385db11e393a447b04ed0111086fc0bfdbf9c76a4413c1e6
Instruction Fuzzy Hash: B7515E3571464886EBD79B5AF9D83EC6362B78D7C1F858011ED0E877A6DE28CB8C8305

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001B80 Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180001BE8
LeaveCriticalSection.KERNEL32 ref: 0000000180001BFC

Part of subcall function 000000018000CC70: EnterCriticalSection.KERNEL32(?,?,?,0000000180001BD4), ref: 000000018000CC82
Part of subcall function 000000018000CC70: LeaveCriticalSection.KERNEL32(?,?,?,0000000180001BD4), ref: 000000018000CCA2

EnterCriticalSection.KERNEL32 ref: 0000000180001C14
LeaveCriticalSection.KERNEL32(?), ref: 0000000180001C30
EnterCriticalSection.KERNEL32 ref: 0000000180001C48
LeaveCriticalSection.KERNEL32 ref: 0000000180001C5F
EnterCriticalSection.KERNEL32 ref: 0000000180001CA2
LeaveCriticalSection.KERNEL32 ref: 0000000180001CE2

Strings

2.7.23.13110 26dabe2, xrefs: 0000000180001C8F

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: 2.7.23.13110 26dabe2
API String ID: 3168844106-1144658929
Opcode ID: b5f2a6aac9a5f95bd2ca3143ba8770d5a3ba73f3d8a8c3d3e80964c90a0832d8
Instruction ID: 926b6632d78d4d6e5feddfab0be0de2bd2ebf384825cad0466e3cc00d0982598
Opcode Fuzzy Hash: b5f2a6aac9a5f95bd2ca3143ba8770d5a3ba73f3d8a8c3d3e80964c90a0832d8
Instruction Fuzzy Hash: 43416A36240648CEF7E6CF64E8987E973A2F79D382F44C411F94686AA4DE38CB4C8701

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001C1D0 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 122timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,?,?,?,?,00000000,000000018001C644,?,?,?,?,?,?,000000018001B7B3), ref: 000000018001C203

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

<null>, xrefs: 000000018001C2D2
[%s:%d] %s: SSL_CTX_load_verify_locations( <ctx>, '%s', '%s') = %d, xrefs: 000000018001C30F
..\src\ssl\ssl_ctx.c, xrefs: 000000018001C233, 000000018001C2E6, 000000018001C33B, 000000018001C383
[%s:%d] %s: SSL_CTX_load_verify_locations( <ctx>, NULL, '%s' ) = %d, xrefs: 000000018001C38F
load_CryptoApi_certs, xrefs: 000000018001C226
[%s:%d][ERR] %s: Cannot get X509_STORE handler, xrefs: 000000018001C23F
[%s:%d] %s: SSL_CTX_load_verify_locations( <ctx>, '%s', NULL ) = %d, xrefs: 000000018001C347
ssl_verify_init, xrefs: 000000018001C2DC

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThreadTimetime
String ID: ..\src\ssl\ssl_ctx.c$<null>$[%s:%d] %s: SSL_CTX_load_verify_locations( <ctx>, '%s', '%s') = %d$[%s:%d] %s: SSL_CTX_load_verify_locations( <ctx>, '%s', NULL ) = %d$[%s:%d] %s: SSL_CTX_load_verify_locations( <ctx>, NULL, '%s' ) = %d$[%s:%d][ERR] %s: Cannot get X509_STORE handler$load_CryptoApi_certs$ssl_verify_init
API String ID: 3735742524-2469524778
Opcode ID: b61784dd9f628794cdd7a761bc4964dcf1e2c777bb036b3527d21130d8ac50b0
Instruction ID: 65e8701c34c59ec61103a26eac132668d1b223db1f516a26d16f45797026a6d3
Opcode Fuzzy Hash: b61784dd9f628794cdd7a761bc4964dcf1e2c777bb036b3527d21130d8ac50b0
Instruction Fuzzy Hash: 1F517A71204B5886FBE29F61A9457EA6392F78CBC0F448022FD4A57B95DF7CC7098709

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001CA00 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 104encryptionCOMMON

Download Yara Rule

APIs

CertEnumCertificatesInStore.CRYPT32 ref: 000000018001CA30
CertEnumCertificatesInStore.CRYPT32 ref: 000000018001CB5A

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

[%s:%d] %s: '%s' %s, xrefs: 000000018001CAEE
hcert_2_x509_store, xrefs: 000000018001CA52
..\src\ssl\ssl_ctx.c, xrefs: 000000018001CAE3, 000000018001CB27, 000000018001CB85
not added, xrefs: 000000018001CAD6
[%s:%d][ERR] %s: d2i_X509 error on %p of size %d!!!, xrefs: 000000018001CB32
[%s:%d] %s: Added %d certificates from a total of %d, xrefs: 000000018001CB91
x509_cert_dump, xrefs: 000000018001CB09

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CertCertificatesCriticalEnumSectionStore$CurrentEnterLeaveThread
String ID: ..\src\ssl\ssl_ctx.c$[%s:%d] %s: '%s' %s$[%s:%d] %s: Added %d certificates from a total of %d$[%s:%d][ERR] %s: d2i_X509 error on %p of size %d!!!$hcert_2_x509_store$not added$x509_cert_dump
API String ID: 2440139821-491327956
Opcode ID: d5cbb395237e02620f5676faf9bb2646f103db0e9073b4156a005748b6ce5e9c
Instruction ID: 99436d05f4a99e0147eb94f1b8e7199ddcbc5544fc89d65bedf8dbe8c9934fa4
Opcode Fuzzy Hash: d5cbb395237e02620f5676faf9bb2646f103db0e9073b4156a005748b6ce5e9c
Instruction Fuzzy Hash: FB41AF32205B8881EBA6DB11E8453CAB3A1F78CB84F448026BE8E57B55DF7CC64DC744

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800079E0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 96synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,bootstrap,00000000,0000000180006A66), ref: 0000000180007B20
LeaveCriticalSection.KERNEL32(?,?,bootstrap,00000000,0000000180006A66), ref: 0000000180007B37
EnterCriticalSection.KERNEL32(?,?,bootstrap,00000000,0000000180006A66), ref: 0000000180007B55
LeaveCriticalSection.KERNEL32(?,?,bootstrap,00000000,0000000180006A66), ref: 0000000180007B77
WaitForSingleObject.KERNEL32(?,?,bootstrap,00000000,0000000180006A66), ref: 0000000180007B89
EnterCriticalSection.KERNEL32(?,?,bootstrap,00000000,0000000180006A66), ref: 0000000180007B96
LeaveCriticalSection.KERNEL32(?,?,bootstrap,00000000,0000000180006A66), ref: 0000000180007BAC

Strings

/_ServerStatus, xrefs: 0000000180007A40
bootstrap, xrefs: 00000001800079E2

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ObjectSingleWait
String ID: /_ServerStatus$bootstrap
API String ID: 1755037574-130918473
Opcode ID: 9eb958907503b538cfff137fec2646ad1a707b5eed82fa35041749c7d3116e58
Instruction ID: a05a9ca6cab213d071a7201c093994c89e936c8f311dc16310d987ad1a324c2b
Opcode Fuzzy Hash: 9eb958907503b538cfff137fec2646ad1a707b5eed82fa35041749c7d3116e58
Instruction Fuzzy Hash: F2511436210A49CAEB928B11F8953D873A1F78DB86F55C121EE4D537A0CF79C69EC340

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DDC0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018000DDD1
LeaveCriticalSection.KERNEL32 ref: 000000018000DDDE

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Part of subcall function 000000018002A720: EnterCriticalSection.KERNEL32(?,?,?,000000018000DE1C), ref: 000000018002A747
Part of subcall function 000000018002A720: LeaveCriticalSection.KERNEL32 ref: 000000018002A764
Part of subcall function 000000018002A720: WaitForSingleObject.KERNEL32 ref: 000000018002A773
Part of subcall function 000000018002A720: EnterCriticalSection.KERNEL32 ref: 000000018002A77D
Part of subcall function 000000018002A720: SetEvent.KERNEL32(?,?,?,000000018000DE1C), ref: 000000018002A7C7
Part of subcall function 000000018002A720: SetEvent.KERNEL32 ref: 000000018002A7D7
Part of subcall function 000000018002A720: LeaveCriticalSection.KERNEL32 ref: 000000018002A7E1

EnterCriticalSection.KERNEL32 ref: 000000018000DEB6
SetEvent.KERNEL32 ref: 000000018000DEDE
LeaveCriticalSection.KERNEL32 ref: 000000018000DEEB

Strings

..\src\global_state.c, xrefs: 000000018000DDF1, 000000018000DEFC
[%s:%d] %s: callback Q thread started, xrefs: 000000018000DDFD
run_queue_cb, xrefs: 000000018000DDE4
[%s:%d] %s: callback Q thread exiting, xrefs: 000000018000DF08

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Event$CurrentObjectSingleThreadWait
String ID: ..\src\global_state.c$[%s:%d] %s: callback Q thread exiting$[%s:%d] %s: callback Q thread started$run_queue_cb
API String ID: 4222902948-3667148152
Opcode ID: 039c9572e23054b82063d7eefe3be83b922dd5212fded71edc57744f7649869b
Instruction ID: 1cca8a9db4d77c4b10ee6001e2193c957e0ce12eaff444aaeadaf8d164c6a068
Opcode Fuzzy Hash: 039c9572e23054b82063d7eefe3be83b922dd5212fded71edc57744f7649869b
Instruction Fuzzy Hash: B4415A3521064D82EAD6FF15E8683E93362F79DB80F15C426A90A4B3B1CE38CB4DC351

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180078F30 Relevance: 15.2, APIs: 10, Instructions: 168networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 0000000180078FCA
WSAIoctl.WS2_32 ref: 0000000180079018
WSAIoctl.WS2_32 ref: 0000000180079064
WSAIoctl.WS2_32 ref: 00000001800790B0
closesocket.WS2_32 ref: 00000001800790C4
CreateIoCompletionPort.KERNEL32 ref: 0000000180079125
CreateSemaphoreA.KERNEL32 ref: 0000000180079145
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000000018007919A
CloseHandle.KERNEL32 ref: 00000001800791AD
CloseHandle.KERNEL32 ref: 00000001800791CA

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: Ioctl$CloseCreateHandle$CompletionCountCriticalInitializePortSectionSemaphoreSpinclosesocketsocket
String ID:
API String ID: 292372088-0
Opcode ID: af75cb7e055b23f3d3fea0101285e7762915e6d512d5540f9432bc1b99ef9a55
Instruction ID: 17857b3395490d8332481039e521f9b15836d62bcd75ec1a93c47590b9067488
Opcode Fuzzy Hash: af75cb7e055b23f3d3fea0101285e7762915e6d512d5540f9432bc1b99ef9a55
Instruction Fuzzy Hash: 28819D36201B448AEBA1CF60E4543DD77B5F788798F408229EE9A17B98DF3AC659C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002D09 Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 115COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 0000000180002E1A
LeaveCriticalSection.KERNEL32 ref: 0000000180002E29
EnterCriticalSection.KERNEL32 ref: 0000000180002D13

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

[%s:%d] %s: set proxy name: %s ( rc = %d ), xrefs: 0000000180002D40
[%s:%d] %s: set proxy user: %s ( rc = %d ), xrefs: 0000000180002D9B
[%s:%d][ERR] %s: (%p, %d (%s), '%s', ... ) => %d %s, xrefs: 0000000180002C8D
[%s:%d] %s: (%p, %d (%s), '%s', ... ) => 0 , xrefs: 0000000180002A4C
..\src\api.c, xrefs: 0000000180002A40, 0000000180002D25, 0000000180002D80, 0000000180002DD3, 00000001800033E5
[%s:%d] %s: set proxy pass: %p ( rc = %d ), xrefs: 0000000180002DEE
__bdnimbus_set_optionv, xrefs: 0000000180002A57, 0000000180002D33, 0000000180002D8E, 0000000180002DE1, 00000001800033DA

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$CurrentThread
String ID: ..\src\api.c$[%s:%d] %s: (%p, %d (%s), '%s', ... ) => 0 $[%s:%d] %s: set proxy name: %s ( rc = %d )$[%s:%d] %s: set proxy pass: %p ( rc = %d )$[%s:%d] %s: set proxy user: %s ( rc = %d )$[%s:%d][ERR] %s: (%p, %d (%s), '%s', ... ) => %d %s$__bdnimbus_set_optionv
API String ID: 1614919063-2398511795
Opcode ID: f535a6f429b1c4c2ad5f6ff5289d2b54ee42c6337dcc141ba4736c23fed0c20d
Instruction ID: b3baf9a2f3de947c0f612e92c8bfeb295f5f432392326d1dbb2a6e88e7266ff5
Opcode Fuzzy Hash: f535a6f429b1c4c2ad5f6ff5289d2b54ee42c6337dcc141ba4736c23fed0c20d
Instruction Fuzzy Hash: B651E236204B4886E6E3DB14F8483DAB3A5F78D390F54811AFA8A47795DF79C74C8705

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800160B0 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 256timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00000001800162AB

Strings

disabledServices, xrefs: 00000001800161E1
[%s:%d] %s: %.*s, xrefs: 000000018001619D
[%s:%d][ERR] %s: req %p (%s) finished with %d (%s), alived %u ms, uc: %p, xrefs: 00000001800162EC
retryAfter, xrefs: 00000001800161BD
parse_e429_response, xrefs: 0000000180016187
request_finish, xrefs: 0000000180016311
..\src\request.c, xrefs: 0000000180016193, 00000001800162E0

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: Timetime
String ID: ..\src\request.c$[%s:%d] %s: %.*s$[%s:%d][ERR] %s: req %p (%s) finished with %d (%s), alived %u ms, uc: %p$disabledServices$parse_e429_response$request_finish$retryAfter
API String ID: 17336451-2053248451
Opcode ID: 5cb9198d55c79fed7f845b8fdc01a5d57c37ee0f844bdc26eb7b77a30a42d1e2
Instruction ID: 7040ac98332650cab1113c3b264cce5b26bdce49f7bcc8696eb15c555fb06eed
Opcode Fuzzy Hash: 5cb9198d55c79fed7f845b8fdc01a5d57c37ee0f844bdc26eb7b77a30a42d1e2
Instruction Fuzzy Hash: CFB18C32605F8882EBA79B56E8543EA73A4FB8DBC0F448115EE5947BA1DF38D6198700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180049460 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 102COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180049554
SetEvent.KERNEL32 ref: 000000018004959C
LeaveCriticalSection.KERNEL32 ref: 00000001800495A6

Part of subcall function 000000018004C190: EnterCriticalSection.KERNEL32(?,?,?,00000001800487B9), ref: 000000018004C1BA

Strings

[%s:%d] %s: upload->active_req->uc = NULL;, xrefs: 00000001800495C3
[%s:%d] %s: calling user_context_signal_uninit, xrefs: 00000001800495F3
upload_cancel_context_req, xrefs: 00000001800494E6
[%s:%d] %s: signal user thread (due to BDNC_CTX_F_WAIT_4_UPLOADS), xrefs: 000000018004958C
..\src\upload\upload.c, xrefs: 0000000180049580, 00000001800495B7, 00000001800495E7

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Enter$EventLeave
String ID: ..\src\upload\upload.c$[%s:%d] %s: calling user_context_signal_uninit$[%s:%d] %s: signal user thread (due to BDNC_CTX_F_WAIT_4_UPLOADS)$[%s:%d] %s: upload->active_req->uc = NULL;$upload_cancel_context_req
API String ID: 2312473273-1064316082
Opcode ID: 5f766c7356f2ebd719f09cc95e00e2bd64462dd0e70fe549c9ba7dc7e5c4f2e5
Instruction ID: f11d5cbc34f869a7b0e42f8cc431a4f3d37f080c9e7098246a7c8b5a72dced1a
Opcode Fuzzy Hash: 5f766c7356f2ebd719f09cc95e00e2bd64462dd0e70fe549c9ba7dc7e5c4f2e5
Instruction Fuzzy Hash: 13516132200F8885EBA2CF25E8903D973A1F788BC8F588125EB8D57B64CF78C649C744

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004F320 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 83networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 000000018004F356
htons.WS2_32 ref: 000000018004F3AD
htons.WS2_32 ref: 000000018004F3D7
htons.WS2_32 ref: 000000018004F43E

Strings

<addr with socktype %d>, xrefs: 000000018004F3E1
%d.%d.%d.%d, xrefs: 000000018004F371
[%s]:%d, xrefs: 000000018004F45D
%s:%d, xrefs: 000000018004F3C5

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: htons$htonl
String ID: %d.%d.%d.%d$%s:%d$<addr with socktype %d>$[%s]:%d
API String ID: 3369762329-1216508268
Opcode ID: 609c90a3c106093d1d179caaecd49baa5310451ddba33a930813c85da8563603
Instruction ID: 9efbf095c0dd8a5504d8049cbc0fd497cd8c6c67e16c623c4e0958e94c4f9775
Opcode Fuzzy Hash: 609c90a3c106093d1d179caaecd49baa5310451ddba33a930813c85da8563603
Instruction Fuzzy Hash: 9831D032204A9C86E7A59F11E8547FAB361F748BC9F40C022EA8A07795DFBCC20DC754

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025E70 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 75networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32 ref: 0000000180025ED0
WSAGetLastError.WS2_32 ref: 0000000180025EDD
WSAIoctl.WS2_32 ref: 0000000180025F18
WSAGetLastError.WS2_32 ref: 0000000180025F1E

Strings

set_notify_for_routing, xrefs: 0000000180025F52
..\src\win\net_awareness.c, xrefs: 0000000180025F3F
[%s:%d] %s: WSAIoctl: %u %s ( was %u ), xrefs: 0000000180025F4B
global_state_init, xrefs: 0000000180025E7B

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: ErrorIoctlLast
String ID: ..\src\win\net_awareness.c$[%s:%d] %s: WSAIoctl: %u %s ( was %u )$global_state_init$set_notify_for_routing
API String ID: 4052769934-1785990878
Opcode ID: c60331c274bdd641438baebe408ac386b012b3594fe0e58bde1bb7a96aa94271
Instruction ID: a5c4c05b9dd9169a1091c8590d96c415d745f0709d46988db7431300ea6b850b
Opcode Fuzzy Hash: c60331c274bdd641438baebe408ac386b012b3594fe0e58bde1bb7a96aa94271
Instruction Fuzzy Hash: 5C31C132314B488AE3919F21F48878E77A5F38C7A0F654125FA9E43760DF79CA49CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800746D0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 000000018004F700: GetSystemDirectoryA.KERNEL32 ref: 000000018004F728
Part of subcall function 000000018004F700: LoadLibraryA.KERNEL32 ref: 000000018004F7A4

GetProcAddress.KERNEL32(00000000,global_state_init,00000001,00000001800517F0), ref: 0000000180074721
GetProcAddress.KERNEL32 ref: 0000000180074734
QueryPerformanceFrequency.KERNEL32(00000000,global_state_init,00000001,00000001800517F0), ref: 000000018007475B
QueryPerformanceCounter.KERNEL32 ref: 000000018007476A

Strings

GetTickCount64, xrefs: 0000000180074717
GetTickCount, xrefs: 0000000180074727
kernel32.dll, xrefs: 00000001800746FF
global_state_init, xrefs: 00000001800746D6

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: AddressPerformanceProcQuery$CounterDirectoryFrequencyLibraryLoadSystem
String ID: GetTickCount$GetTickCount64$global_state_init$kernel32.dll
API String ID: 2776266448-3976587219
Opcode ID: 9de8c2cd129278b1a836ca67e1f9b88983c896e1e562f8e79040fb132cc13fd1
Instruction ID: d26e0a64a4493626af3eccd2c43ee1c9dff3afb5016bb678955f1b0d74bc0cb1
Opcode Fuzzy Hash: 9de8c2cd129278b1a836ca67e1f9b88983c896e1e562f8e79040fb132cc13fd1
Instruction Fuzzy Hash: 6A21AE33915F4482E782CF25E8443A963A1FB9EB98F15D221FA4D1A250FFB9C6D9C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002320 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 49synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180002336
LeaveCriticalSection.KERNEL32 ref: 0000000180002363
WaitForSingleObject.KERNEL32 ref: 000000018000236F
EnterCriticalSection.KERNEL32 ref: 000000018000237A

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

LeaveCriticalSection.KERNEL32 ref: 00000001800023CF

Strings

bdnimbus_ask_ctx_wait, xrefs: 0000000180002357
..\src\api.c, xrefs: 0000000180002388
[%s:%d][ERR] %s: WaitForSingleObject error: %d, xrefs: 000000018000239A

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CurrentObjectSingleThreadWait
String ID: ..\src\api.c$[%s:%d][ERR] %s: WaitForSingleObject error: %d$bdnimbus_ask_ctx_wait
API String ID: 179774263-1127040622
Opcode ID: 4856455216e1ade61b418de75d4e4e971b4b49c36b617b596058301190f6d8a2
Instruction ID: 9fdab854352f808565ed66c7b3b2b3bfefabb1a75745a7a5dfd1771561dde262
Opcode Fuzzy Hash: 4856455216e1ade61b418de75d4e4e971b4b49c36b617b596058301190f6d8a2
Instruction Fuzzy Hash: 1A115136604B0482EBA29F24E84838A7771F78DB90F549115EE8A577A8CF7DCB8DC744

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000C690 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 44synchronizationCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 000000018000C6FA
WaitForSingleObject.KERNEL32 ref: 000000018000C70C
EnterCriticalSection.KERNEL32 ref: 000000018000C719
WaitForSingleObject.KERNEL32 ref: 000000018000C747
CloseHandle.KERNEL32 ref: 000000018000C754

Part of subcall function 000000018002A900: EnterCriticalSection.KERNEL32(?,?,?,000000018000C6B0), ref: 000000018002A91E
Part of subcall function 000000018002A900: SetEvent.KERNEL32 ref: 000000018002A935
Part of subcall function 000000018002A900: SetEvent.KERNEL32 ref: 000000018002A945
Part of subcall function 000000018002A900: LeaveCriticalSection.KERNEL32 ref: 000000018002A94F

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

..\src\global_state.c, xrefs: 000000018000C6DB
[%s:%d] %s: main thread is waiting for GLOBAL_STATE_F_QUEUE_CB_TH, xrefs: 000000018000C6E7
stop_and_wait_for_queue_cb_thread, xrefs: 000000018000C6C1

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$EventObjectSingleWait$CloseCurrentHandleThread
String ID: ..\src\global_state.c$[%s:%d] %s: main thread is waiting for GLOBAL_STATE_F_QUEUE_CB_TH$stop_and_wait_for_queue_cb_thread
API String ID: 182355978-2003621415
Opcode ID: 82b754fbdb0cc1d2c8d7fd93d35b5d8f3757da05c064168f054269f8a33b6585
Instruction ID: 940b230d548f313aac0ebcf407b645f4f1a45a7fc84e10fe66e931c5ee4505f8
Opcode Fuzzy Hash: 82b754fbdb0cc1d2c8d7fd93d35b5d8f3757da05c064168f054269f8a33b6585
Instruction Fuzzy Hash: 2021FF38224A488AEAC28B05F8997D47361B75E7A0F818A01E81A973B0DF7CC74D8745

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000C5B0 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 40synchronizationCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 000000018000C60F
WaitForSingleObject.KERNEL32 ref: 000000018000C621
EnterCriticalSection.KERNEL32 ref: 000000018000C62E
WaitForSingleObject.KERNEL32 ref: 000000018000C65D
CloseHandle.KERNEL32 ref: 000000018000C66A

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

..\src\global_state.c, xrefs: 000000018000C5F0
stop_and_wait_for_network_thread, xrefs: 000000018000C5DE
[%s:%d] %s: main thread is waiting for GLOBAL_STATE_F_BASE_NET_TH, xrefs: 000000018000C5FC

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeaveObjectSingleWait$CloseCurrentHandleThread
String ID: ..\src\global_state.c$[%s:%d] %s: main thread is waiting for GLOBAL_STATE_F_BASE_NET_TH$stop_and_wait_for_network_thread
API String ID: 824138704-1339108529
Opcode ID: ed84b774268d298ace03d3419181603a2dd9baa3d8222c104fdb242a9160848b
Instruction ID: 584f7307129af4e77f02be21a6a621d524ac4c4d5891b2f805795696a78cd406
Opcode Fuzzy Hash: ed84b774268d298ace03d3419181603a2dd9baa3d8222c104fdb242a9160848b
Instruction Fuzzy Hash: EE11EF38214A4886EAD69F14F8A87D47361BB8D7A4F458615AC1AA67B0CF6AC70DC305

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180238FB0 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180238B48: _invalid_parameter_noinfo.LIBCMT ref: 0000000180238B89
Part of subcall function 0000000180238B48: _invalid_parameter_noinfo.LIBCMT ref: 0000000180238C09
Part of subcall function 0000000180238B48: _invalid_parameter_noinfo.LIBCMT ref: 0000000180238C5D
Part of subcall function 0000000180238B48: _get_daylight.LIBCMT ref: 0000000180238CB5

CreateFileW.KERNEL32 ref: 00000001802390B6
CreateFileW.KERNEL32 ref: 0000000180239106
GetLastError.KERNEL32 ref: 0000000180239136
GetFileType.KERNEL32 ref: 000000018023914B
GetLastError.KERNEL32 ref: 0000000180239155
CloseHandle.KERNEL32 ref: 0000000180239188
CloseHandle.KERNEL32 ref: 00000001802392EC
CreateFileW.KERNEL32 ref: 0000000180239321
GetLastError.KERNEL32 ref: 0000000180239330

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 7d477e3dbcdc1afbc5002e0a13d68bbc2d3a54585df8d0be353f78d9fc5a743e
Instruction ID: faca5aab624e0fca4e7bc230a98309656351223b82a9db2ead8856a2abd9d567
Opcode Fuzzy Hash: 7d477e3dbcdc1afbc5002e0a13d68bbc2d3a54585df8d0be353f78d9fc5a743e
Instruction Fuzzy Hash: A3C1B136721A4885EB91CFA9D4847ED3762F34EBA8F028205DE6A977E4CF75C659C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002A03 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 111COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 0000000180002B53

Strings

[%s:%d][ERR] %s: (%p, %d (%s), %p, ... ) => %d %s, xrefs: 0000000180003339
[%s:%d][ERR] %s: (%p, %d (%s), %d ... ) => %d %s, xrefs: 00000001800033BF
[%s:%d][ERR] %s: (%p, %d (%s), '%s', ... ) => %d %s, xrefs: 0000000180002C8D
[%s:%d] %s: (%p, %d (%s), '%s', ... ) => 0 , xrefs: 0000000180002A4C
..\src\api.c, xrefs: 0000000180002A40, 0000000180002BF7, 000000018000336A, 00000001800033E5
[%s:%d] %s: (%p, %d (%s), %d ... ) => 0 , xrefs: 0000000180002C03
__bdnimbus_set_optionv, xrefs: 0000000180002A57, 0000000180002C0E, 0000000180003381, 00000001800033DA
[%s:%d] %s: (%p, %d (%s), %p, ... ) => 0 , xrefs: 0000000180003376

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalLeaveSection
String ID: ..\src\api.c$[%s:%d] %s: (%p, %d (%s), %d ... ) => 0 $[%s:%d] %s: (%p, %d (%s), %p, ... ) => 0 $[%s:%d] %s: (%p, %d (%s), '%s', ... ) => 0 $[%s:%d][ERR] %s: (%p, %d (%s), %d ... ) => %d %s$[%s:%d][ERR] %s: (%p, %d (%s), %p, ... ) => %d %s$[%s:%d][ERR] %s: (%p, %d (%s), '%s', ... ) => %d %s$__bdnimbus_set_optionv
API String ID: 3988221542-1200060697
Opcode ID: d4aad92e9995a5dbe60300a9fe24993a70a6f89ebd8eb29bd7e11578dc14db27
Instruction ID: 4b2b828e3f1018bc54856b40711e2704bf5fe2cc09988ae27c2be7239d6c037b
Opcode Fuzzy Hash: d4aad92e9995a5dbe60300a9fe24993a70a6f89ebd8eb29bd7e11578dc14db27
Instruction Fuzzy Hash: 5D511D32204B4882E6A3DF04F4853DEB7A9F789390F54811AFA8A57B99DF79C74D8704

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D500 Relevance: 13.6, APIs: 4, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018000D538
LeaveCriticalSection.KERNEL32 ref: 000000018000D560
LeaveCriticalSection.KERNEL32 ref: 000000018000D5FE
LeaveCriticalSection.KERNEL32 ref: 000000018000D689

Strings

..\src\global_state.c, xrefs: 000000018000D57D, 000000018000D5AF
del_generic_cb, xrefs: 000000018000D566, 000000018000D5D3, 000000018000D63F
[%s:%d] %s: deleted %p( %p %p ) POSTPONED!!!, xrefs: 000000018000D5DF
[%s:%d] %s: deleted %p( %p %p ), xrefs: 000000018000D609
[%s:%d] %s: not found %p, xrefs: 000000018000D589

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: ..\src\global_state.c$[%s:%d] %s: deleted %p( %p %p )$[%s:%d] %s: deleted %p( %p %p ) POSTPONED!!!$[%s:%d] %s: not found %p$del_generic_cb
API String ID: 2978645861-2112457589
Opcode ID: 4c3429c61565d443c7b03338e9660710c190f01d61a877a1922624940bd3761a
Instruction ID: 1b96c8d13916760ec01447b88cb7b5ae01fa1650c71a4c83d5d903787271a89d
Opcode Fuzzy Hash: 4c3429c61565d443c7b03338e9660710c190f01d61a877a1922624940bd3761a
Instruction Fuzzy Hash: 17414935204F4886EB92CF11F898399B3A5F74CB98F448026EE8E47768DF78CA59C744

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D8F0 Relevance: 13.6, APIs: 4, Strings: 5, Instructions: 75COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,FFFFFFFF,0000000180007E95,?,?,?,?,00000000,00000000,order_benchmark,00000001800065A4), ref: 000000018000D8FF
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,FFFFFFFF,0000000180007E95,?,?,?,?,00000000,00000000,order_benchmark,00000001800065A4), ref: 000000018000D924

Part of subcall function 0000000180023510: EnterCriticalSection.KERNEL32(?,?,00000000,0000000180019A64), ref: 0000000180023529
Part of subcall function 0000000180023510: LeaveCriticalSection.KERNEL32(?,?,00000000,0000000180019A64), ref: 0000000180023544

Part of subcall function 00000001800230C0: EnterCriticalSection.KERNEL32(?,?,?,?,?,000000018001988F), ref: 00000001800230DF
Part of subcall function 00000001800230C0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,000000018001988F), ref: 00000001800231AB

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,FFFFFFFF,0000000180007E95,?,?,?,?,00000000,00000000,order_benchmark,00000001800065A4), ref: 000000018000D9AC
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,FFFFFFFF,0000000180007E95,?,?,?,?,00000000,00000000,order_benchmark,00000001800065A4), ref: 000000018000DA3D

Strings

..\src\global_state.c, xrefs: 000000018000D973, 000000018000DA00
[%s:%d][WARN] %s: new_rt_setts not set!, xrefs: 000000018000D97F
set_runtime_configuration, xrefs: 000000018000DA07
runtime_settings_reconfiguration, xrefs: 000000018000D966
[%s:%d] %s: new runtime_settings: %p | old: %p, xrefs: 000000018000DA1E

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\global_state.c$[%s:%d] %s: new runtime_settings: %p | old: %p$[%s:%d][WARN] %s: new_rt_setts not set!$runtime_settings_reconfiguration$set_runtime_configuration
API String ID: 3168844106-171095035
Opcode ID: 4620e804b6823204836979436af67620b0dfd3ac33ef004efcf27bfac2388db2
Instruction ID: 6a4774551b0dfa83a4dc06bef9207b4e29dc8a2676d8b233fe4cef0371954f69
Opcode Fuzzy Hash: 4620e804b6823204836979436af67620b0dfd3ac33ef004efcf27bfac2388db2
Instruction Fuzzy Hash: 0331F134205B4C84EAC3EB51F8993E973A5BB8D780F45C526AC5E57BA1EF68C70C8351

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A720 Relevance: 13.6, APIs: 9, Instructions: 69synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,000000018000DE1C), ref: 000000018002A747
LeaveCriticalSection.KERNEL32 ref: 000000018002A764
WaitForSingleObject.KERNEL32 ref: 000000018002A773
EnterCriticalSection.KERNEL32 ref: 000000018002A77D
SetEvent.KERNEL32(?,?,?,000000018000DE1C), ref: 000000018002A7C7
SetEvent.KERNEL32 ref: 000000018002A7D7
LeaveCriticalSection.KERNEL32 ref: 000000018002A7E1
SetEvent.KERNEL32 ref: 000000018002A7FE
LeaveCriticalSection.KERNEL32 ref: 000000018002A808

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EventLeave$Enter$ObjectSingleWait
String ID:
API String ID: 566905196-0
Opcode ID: edcc3c41415538bfc390ca1367e41471408fad6d3b14c990d2f526ed5bc4f478
Instruction ID: e7f0873e16b5b19b95d44be1a8ecf77a3a54f3baf0cc91199f1c5f191f7c112c
Opcode Fuzzy Hash: edcc3c41415538bfc390ca1367e41471408fad6d3b14c990d2f526ed5bc4f478
Instruction Fuzzy Hash: 1A317F36615A48C6EBD68F20D85839833B1FB49F99F04D011EA0A466A8DF79CECEC744

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800347D0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 277COMMON

Download Yara Rule

Strings

[%s:%d] %s: uc->rpc_del_upload_cb:%p, rpc->rpc_del_upload_ctx:%p, xrefs: 0000000180034B87
call_upload_del_cb, xrefs: 0000000180034BB1
[%s:%d] %s: uc->del_upload_cb: %p, xrefs: 000000018003497C
[%s:%d] %s: deserialize_bdnimbus_upload_mem_inline failed, xrefs: 000000018003487A, 00000001800348E9
..\src\rpc\rpc_server.c, xrefs: 0000000180034866, 00000001800348E2, 0000000180034972, 0000000180034B7C
bdnc_rpc_upload_mem, xrefs: 000000018003486D, 00000001800348C9, 00000001800349EC

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: ..\src\rpc\rpc_server.c$[%s:%d] %s: deserialize_bdnimbus_upload_mem_inline failed$[%s:%d] %s: uc->del_upload_cb: %p$[%s:%d] %s: uc->rpc_del_upload_cb:%p, rpc->rpc_del_upload_ctx:%p$bdnc_rpc_upload_mem$call_upload_del_cb
API String ID: 2351996187-1633071430
Opcode ID: 0a14d611b7958ed79a7f28d566651cf0ac4f786f8b53df557a9a83989b5442e8
Instruction ID: c3af8545dcf07a6a505f726fb4bb8314b54817288c936cb3fb66b1716a8c6aa0
Opcode Fuzzy Hash: 0a14d611b7958ed79a7f28d566651cf0ac4f786f8b53df557a9a83989b5442e8
Instruction Fuzzy Hash: 9BD18B76605B889AEB92DFA1E4447DE33B5F348B88F418226EE4D2BB45DF34C259C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020720 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 252timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00000001800209C5

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

..\src\bdnc_conn.c, xrefs: 0000000180020825, 00000001800208E0, 000000018002093E, 0000000180020A70, 0000000180020AB2
[%s:%d][ERR] %s: verify result = %s, xrefs: 0000000180020A82
bdnc_conn_event_cb, xrefs: 0000000180020789, 0000000180020817, 00000001800208D3, 0000000180020932, 0000000180020A24
[%s:%d] %s: [%p] reconnect for %s/%s ( eof: %d, reset: %d ), xrefs: 0000000180020968
[%s:%d] %s: finish with error %d for conn %p, pending_cb: %d, xrefs: 0000000180020830, 0000000180020ABD
[%s:%d] %s: HTTP/1.0 -> bdnc_conn_read_cb, xrefs: 00000001800208EC

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThreadTimetime
String ID: ..\src\bdnc_conn.c$[%s:%d] %s: HTTP/1.0 -> bdnc_conn_read_cb$[%s:%d] %s: [%p] reconnect for %s/%s ( eof: %d, reset: %d )$[%s:%d] %s: finish with error %d for conn %p, pending_cb: %d$[%s:%d][ERR] %s: verify result = %s$bdnc_conn_event_cb
API String ID: 3735742524-967673846
Opcode ID: 6e6b67173464e17977284189583b3937e8685d35ccbcf551b64d19319810eb64
Instruction ID: 6c514ad553dea33484b7f7ee02ae49dc2bfddd32306905c10365512579a3f139
Opcode Fuzzy Hash: 6e6b67173464e17977284189583b3937e8685d35ccbcf551b64d19319810eb64
Instruction Fuzzy Hash: 8AB19D32200B4986FBE79F21E4543E933A1B78C7C8F588125EE4A47696CF79C748C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004CB80 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 249COMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 000000018004CBB9

Strings

AF_INET, xrefs: 000000018004CB87
::%x:%d.%d.%d.%d, xrefs: 000000018004CE00
%d.%d.%d.%d, xrefs: 000000018004CBD4
AF_UNSPEC, xrefs: 000000018004CB8E
::%d.%d.%d.%d, xrefs: 000000018004CDC9
resolve_proxy_name, xrefs: 000000018004CB8C

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: htonl
String ID: %d.%d.%d.%d$::%d.%d.%d.%d$::%x:%d.%d.%d.%d$AF_INET$AF_UNSPEC$resolve_proxy_name
API String ID: 2009864989-1222235624
Opcode ID: 4c01e5d969d9f24989f037145770978b6622f66a7725fe1f30cbcd25998b7539
Instruction ID: f2f21ef3280e0569db12a15c33e6ab86d1d04236031b790e1717f1e3bc634973
Opcode Fuzzy Hash: 4c01e5d969d9f24989f037145770978b6622f66a7725fe1f30cbcd25998b7539
Instruction Fuzzy Hash: 43915B326086E845E7E64B16A080BFAAFA0E75E7C9F159025FBD543BD1DB3CCA44C709

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002B690 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 183threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
LeaveCriticalSection.KERNEL32 ref: 000000018002B75D
LeaveCriticalSection.KERNEL32 ref: 000000018002B9AF

Strings

[%u][%x], xrefs: 000000018002B726
%02d-%02d-%04d %02d:%02d:%02d, xrefs: 000000018002B8E4

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$CurrentEnterThread
String ID: %02d-%02d-%04d %02d:%02d:%02d$[%u][%x]
API String ID: 2905768538-2640658925
Opcode ID: 9b6a27e051363e1507048ae24a9b5629dd95297ee78633f70037b90ec4d32421
Instruction ID: ef81d45ae3b7ff6b1553c9d0bed3767ea04715abbf16eec18a61b164b1448ca7
Opcode Fuzzy Hash: 9b6a27e051363e1507048ae24a9b5629dd95297ee78633f70037b90ec4d32421
Instruction Fuzzy Hash: 2A81087260878886D7A5CF15E8403D9B7A6F7CC784F448116EB9AC7B99CF78C608CB04

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004A910 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 122fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018004A930
LeaveCriticalSection.KERNEL32 ref: 000000018004A99F

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

SetEvent.KERNEL32 ref: 000000018004A991
DeleteFileW.KERNEL32 ref: 000000018004A9C2

Strings

upload_request_destroy, xrefs: 000000018004A95F
[%s:%d] %s: signal user thread (due to BDNC_CTX_F_WAIT_4_UPLOADS), xrefs: 000000018004A978
..\src\upload\upload_request.c, xrefs: 000000018004A96C

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CurrentDeleteEventFileThread
String ID: ..\src\upload\upload_request.c$[%s:%d] %s: signal user thread (due to BDNC_CTX_F_WAIT_4_UPLOADS)$upload_request_destroy
API String ID: 1858711550-450168033
Opcode ID: a4ecf4f0fd60b557a4e68960f919b471bd5fa657e3d4f70fa77d325f88bd54ce
Instruction ID: 4f34fc86f00e2ab98ad9473e39cb4686a54bd963291c308212b1a3de00b0d32f
Opcode Fuzzy Hash: a4ecf4f0fd60b557a4e68960f919b471bd5fa657e3d4f70fa77d325f88bd54ce
Instruction Fuzzy Hash: FE517032B05B8485FB92CF64C5903E92361EB9EB8CF199235AE4D46259DF70CA94C319

Uniqueness

Uniqueness Score: -1.00%

Function 00000001802462EC Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,00000000,00000001802466E2,?,?,00000030,000000018023EA64), ref: 000000018024646B
GetProcAddress.KERNEL32(?,00000000,00000000,00000001802466E2,?,?,00000030,000000018023EA64), ref: 0000000180246477

Strings

api-ms-, xrefs: 00000001802463B5
ext-ms-, xrefs: 00000001802463C8

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 811f19c18a3efcdefff856f236ed497edf66aae4bfda2973178c105d00040c0a
Instruction ID: 069f3964ad5436ca78a4ef1f19adfe0ea66ff5aa25f048deb4a46c95e59106e3
Opcode Fuzzy Hash: 811f19c18a3efcdefff856f236ed497edf66aae4bfda2973178c105d00040c0a
Instruction Fuzzy Hash: 3F41C471311E4841FFA7DB16A89C7D623A6B74DBE0F09C125AD1987794EEBCC64D8340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800503A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 00000001800503EE
getaddrinfo.WS2_32 ref: 0000000180050409
getaddrinfo.WS2_32 ref: 0000000180050430
freeaddrinfo.WS2_32 ref: 00000001800504A2
freeaddrinfo.WS2_32 ref: 00000001800504BA
freeaddrinfo.WS2_32 ref: 00000001800504CA

Strings

1.2.3.4, xrefs: 00000001800503DF, 0000000180050402, 0000000180050429

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: freeaddrinfogetaddrinfo
String ID: 1.2.3.4
API String ID: 1109861670-961314917
Opcode ID: 56dd9588c4faf3cc82696c023dc4a23791f160c13d6ed4cf75c04c82520fd995
Instruction ID: 41649376475ddf57a752597658049daa98fbf412abe65550830a9091164eb7b6
Opcode Fuzzy Hash: 56dd9588c4faf3cc82696c023dc4a23791f160c13d6ed4cf75c04c82520fd995
Instruction Fuzzy Hash: 99413EB2605B48C5EB92CF15E4443A973A2FB8DBD0F64C126EA5D43764DF79C648CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001D3BA Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 76encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

CertGetNameStringA.CRYPT32 ref: 000000018001D5FD

Strings

[%s:%d] %s: [%d,%d] subject %s, xrefs: 000000018001D61E
..\src\ssl\ssl_ctx.c, xrefs: 000000018001D494, 000000018001D59E, 000000018001D613
This certificate is self-signed., xrefs: 000000018001D4DB
No error found for this certificate or chain., xrefs: 000000018001D3BA
[%s:%d] %s: TrustStatus: %s, xrefs: 000000018001D5B0
[%s:%d][ERR] %s: TrustStatus: %s, xrefs: 000000018001D4A6

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CertCurrentEnterLeaveNameStringThread
String ID: ..\src\ssl\ssl_ctx.c$No error found for this certificate or chain.$This certificate is self-signed.$[%s:%d] %s: TrustStatus: %s$[%s:%d] %s: [%d,%d] subject %s$[%s:%d][ERR] %s: TrustStatus: %s
API String ID: 2895763960-2601876936
Opcode ID: 89a4d313c60c7cc81da759525584a5d9207bc9e580a29a333887a73ce4be9539
Instruction ID: 79b1095e530f3e4dee1b6a024bac06800fcbc1c18140509c10ad2506a68a8c27
Opcode Fuzzy Hash: 89a4d313c60c7cc81da759525584a5d9207bc9e580a29a333887a73ce4be9539
Instruction Fuzzy Hash: 4F314C36204E8896E7B68B14E4993DA7761F38C798F448116EA8E47B94DF7DC748CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001D3C6 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 76encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

CertGetNameStringA.CRYPT32 ref: 000000018001D5FD

Strings

[%s:%d] %s: [%d,%d] subject %s, xrefs: 000000018001D61E
..\src\ssl\ssl_ctx.c, xrefs: 000000018001D494, 000000018001D59E, 000000018001D613
This certificate or one of the certificates in the certificate chain is not time-valid., xrefs: 000000018001D3C6
This certificate is self-signed., xrefs: 000000018001D4DB
[%s:%d] %s: TrustStatus: %s, xrefs: 000000018001D5B0
[%s:%d][ERR] %s: TrustStatus: %s, xrefs: 000000018001D4A6

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CertCurrentEnterLeaveNameStringThread
String ID: ..\src\ssl\ssl_ctx.c$This certificate is self-signed.$This certificate or one of the certificates in the certificate chain is not time-valid.$[%s:%d] %s: TrustStatus: %s$[%s:%d] %s: [%d,%d] subject %s$[%s:%d][ERR] %s: TrustStatus: %s
API String ID: 2895763960-830705213
Opcode ID: 503f0c5cbf34da30294bcea99caaab83463e86928f2f9d1e47575ddc0bcdabcf
Instruction ID: 6f54ae76759b5c264b688fad59f5977cbe135bb4cd10e7558c4c5f7153410dd5
Opcode Fuzzy Hash: 503f0c5cbf34da30294bcea99caaab83463e86928f2f9d1e47575ddc0bcdabcf
Instruction Fuzzy Hash: 50313A36204E8896E7A68B14E4993DA7762F38C798F448116EA8E47B94DF79C748CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001D3D2 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 76encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

CertGetNameStringA.CRYPT32 ref: 000000018001D5FD

Strings

[%s:%d] %s: [%d,%d] subject %s, xrefs: 000000018001D61E
..\src\ssl\ssl_ctx.c, xrefs: 000000018001D494, 000000018001D59E, 000000018001D613
This certificate is self-signed., xrefs: 000000018001D4DB
Trust for this certificate or one of the certificates in the certificate chain has been revoked., xrefs: 000000018001D3D2
[%s:%d] %s: TrustStatus: %s, xrefs: 000000018001D5B0
[%s:%d][ERR] %s: TrustStatus: %s, xrefs: 000000018001D4A6

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CertCurrentEnterLeaveNameStringThread
String ID: ..\src\ssl\ssl_ctx.c$This certificate is self-signed.$Trust for this certificate or one of the certificates in the certificate chain has been revoked.$[%s:%d] %s: TrustStatus: %s$[%s:%d] %s: [%d,%d] subject %s$[%s:%d][ERR] %s: TrustStatus: %s
API String ID: 2895763960-4012600948
Opcode ID: fda515c3e43c88a5b9233a4db1a2378157ecfb75e1ee87bbaffb32dc0bf07716
Instruction ID: cd0fe6b6f41bf1a75b88395d5e8bb9e48ad6fc80c466849558e6c1f1b23b628a
Opcode Fuzzy Hash: fda515c3e43c88a5b9233a4db1a2378157ecfb75e1ee87bbaffb32dc0bf07716
Instruction Fuzzy Hash: C7314C36204E8896E7F68B14E4993DA7762F38C798F448116EA8E47B94DF7DC748CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001D3DE Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 76encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

CertGetNameStringA.CRYPT32 ref: 000000018001D5FD

Strings

[%s:%d] %s: [%d,%d] subject %s, xrefs: 000000018001D61E
..\src\ssl\ssl_ctx.c, xrefs: 000000018001D494, 000000018001D59E, 000000018001D613
The certificate or one of the certificates in the certificate chain does not have a valid signature., xrefs: 000000018001D3DE
This certificate is self-signed., xrefs: 000000018001D4DB
[%s:%d] %s: TrustStatus: %s, xrefs: 000000018001D5B0
[%s:%d][ERR] %s: TrustStatus: %s, xrefs: 000000018001D4A6

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CertCurrentEnterLeaveNameStringThread
String ID: ..\src\ssl\ssl_ctx.c$The certificate or one of the certificates in the certificate chain does not have a valid signature.$This certificate is self-signed.$[%s:%d] %s: TrustStatus: %s$[%s:%d] %s: [%d,%d] subject %s$[%s:%d][ERR] %s: TrustStatus: %s
API String ID: 2895763960-2905763976
Opcode ID: dfb2fec7097f1169fdf249581eb298fc9e9399a857d40d4d43a018abc079b935
Instruction ID: 2879c2942f376f5939b7c700de4183f0adaebe04e464ef5eec7d4fc7123ebb18
Opcode Fuzzy Hash: dfb2fec7097f1169fdf249581eb298fc9e9399a857d40d4d43a018abc079b935
Instruction Fuzzy Hash: 42314C36204E8896E7F68B14E4993DA7762F38C798F448116EA8E47B94DF7DC748CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001D3EA Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 76encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

CertGetNameStringA.CRYPT32 ref: 000000018001D5FD

Strings

[%s:%d] %s: [%d,%d] subject %s, xrefs: 000000018001D61E
..\src\ssl\ssl_ctx.c, xrefs: 000000018001D494, 000000018001D59E, 000000018001D613
This certificate is self-signed., xrefs: 000000018001D4DB
[%s:%d] %s: TrustStatus: %s, xrefs: 000000018001D5B0
The certificate or certificate chain is not valid in its proposed usage., xrefs: 000000018001D3EA
[%s:%d][ERR] %s: TrustStatus: %s, xrefs: 000000018001D4A6

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CertCurrentEnterLeaveNameStringThread
String ID: ..\src\ssl\ssl_ctx.c$The certificate or certificate chain is not valid in its proposed usage.$This certificate is self-signed.$[%s:%d] %s: TrustStatus: %s$[%s:%d] %s: [%d,%d] subject %s$[%s:%d][ERR] %s: TrustStatus: %s
API String ID: 2895763960-4000714078
Opcode ID: 50b0b4a3b8a5898d935d5fef6c394c3e68ea6e2d0cc9ce99bf4d94d9bca4ae40
Instruction ID: 8a0950370153c62395282abaedcb2ab3eeeb98f349accf578229e3d619235a70
Opcode Fuzzy Hash: 50b0b4a3b8a5898d935d5fef6c394c3e68ea6e2d0cc9ce99bf4d94d9bca4ae40
Instruction Fuzzy Hash: DD314C36204E8896E7F68B14E4993DA7762F38C798F448116EA8E47B94DF7DC748CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001D3F6 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 76encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

CertGetNameStringA.CRYPT32 ref: 000000018001D5FD

Strings

[%s:%d] %s: [%d,%d] subject %s, xrefs: 000000018001D61E
..\src\ssl\ssl_ctx.c, xrefs: 000000018001D494, 000000018001D59E, 000000018001D613
This certificate is self-signed., xrefs: 000000018001D4DB
The certificate or certificate chain is based on an untrusted root., xrefs: 000000018001D3F6
[%s:%d] %s: TrustStatus: %s, xrefs: 000000018001D5B0
[%s:%d][ERR] %s: TrustStatus: %s, xrefs: 000000018001D4A6

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CertCurrentEnterLeaveNameStringThread
String ID: ..\src\ssl\ssl_ctx.c$The certificate or certificate chain is based on an untrusted root.$This certificate is self-signed.$[%s:%d] %s: TrustStatus: %s$[%s:%d] %s: [%d,%d] subject %s$[%s:%d][ERR] %s: TrustStatus: %s
API String ID: 2895763960-1692811234
Opcode ID: a8c9fa18192722c6abe0691c66f9de96f2c88a7818a8bd8ed989c2eac07d21cd
Instruction ID: f11c647ee2e59f9f93dc9556567bd4d1f07d186dcdfa9fca0ddee45fcb4e5060
Opcode Fuzzy Hash: a8c9fa18192722c6abe0691c66f9de96f2c88a7818a8bd8ed989c2eac07d21cd
Instruction Fuzzy Hash: 46314C36204E8896E7F68B14E4997DA7762F38C798F448116EA8E47B94DF7DC748CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025FA0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 64networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32 ref: 0000000180025FE6
WSAGetLastError.WS2_32 ref: 0000000180025FF3
WSAIoctl.WS2_32 ref: 000000018002602E
WSAGetLastError.WS2_32 ref: 0000000180026034

Strings

set_notify_for_addr_list, xrefs: 0000000180026068
..\src\win\net_awareness.c, xrefs: 0000000180026055
[%s:%d] %s: WSAIoctl: %u %s ( was %u ), xrefs: 0000000180026061

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: ErrorIoctlLast
String ID: ..\src\win\net_awareness.c$[%s:%d] %s: WSAIoctl: %u %s ( was %u )$set_notify_for_addr_list
API String ID: 4052769934-1125124881
Opcode ID: d86c0f8c3bf2b8a479e782c4ad6054cd258662b04071cec794a70966361a2414
Instruction ID: 0883a04876e2a1ef11a0fcdba47e412b37c60e203ad391151f4b21d98d00016d
Opcode Fuzzy Hash: d86c0f8c3bf2b8a479e782c4ad6054cd258662b04071cec794a70966361a2414
Instruction Fuzzy Hash: 1021A232608B4886E3919F14F48878E77A5F38C794F644129F79E43B64DF39C949CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008020 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 45synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018000809A
LeaveCriticalSection.KERNEL32 ref: 00000001800080B1
EnterCriticalSection.KERNEL32 ref: 00000001800080CF
LeaveCriticalSection.KERNEL32 ref: 00000001800080E7
WaitForSingleObject.KERNEL32 ref: 00000001800080F9
EnterCriticalSection.KERNEL32 ref: 0000000180008106

Strings

/bdnc/config, xrefs: 000000018000802B

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Enter$Leave$ObjectSingleWait
String ID: /bdnc/config
API String ID: 3202826245-1471951825
Opcode ID: 1a081b4b3b7ff62cb6e9ac89dc87fec0de7d7e05d18e58109ce4068a5418e5fb
Instruction ID: 918dd7174c8e9d2e5bfc1052dc23328c7d6cd76beaa8d12d47a2aa5ee088da03
Opcode Fuzzy Hash: 1a081b4b3b7ff62cb6e9ac89dc87fec0de7d7e05d18e58109ce4068a5418e5fb
Instruction Fuzzy Hash: 9E21A235211A0899EBC2CB14F8993D833A6F74DB46F55C121E94A523B0DFBAC79EC304

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800486B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 34synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,wait_for_context_free,0000000180047E94,?,?,0000000C,000000018000E422,?,?,?,?,?,?,000000018000CC0F), ref: 00000001800486C1
LeaveCriticalSection.KERNEL32(?,?,wait_for_context_free,0000000180047E94,?,?,0000000C,000000018000E422,?,?,?,?,?,?,000000018000CC0F), ref: 00000001800486D8
WaitForSingleObject.KERNEL32(?,?,wait_for_context_free,0000000180047E94,?,?,0000000C,000000018000E422,?,?,?,?,?,?,000000018000CC0F), ref: 00000001800486E7
EnterCriticalSection.KERNEL32(?,?,wait_for_context_free,0000000180047E94,?,?,0000000C,000000018000E422,?,?,?,?,?,?,000000018000CC0F), ref: 00000001800486F1
WaitForSingleObject.KERNEL32(?,?,wait_for_context_free,0000000180047E94,?,?,0000000C,000000018000E422,?,?,?,?,?,?,000000018000CC0F), ref: 000000018004870B
CloseHandle.KERNEL32(?,?,wait_for_context_free,0000000180047E94,?,?,0000000C,000000018000E422,?,?,?,?,?,?,000000018000CC0F), ref: 0000000180048715

Strings

wait_for_context_free, xrefs: 00000001800486B5

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterObjectSingleWait$CloseHandleLeave
String ID: wait_for_context_free
API String ID: 14126859-400412057
Opcode ID: 067c26eb05d6341be3d7c410d7f016947cd0d2a58d1ce12998e5f7b22b8d3a52
Instruction ID: faa86e63e99f929e24153d3cb05489b5eaad1c58e9a6be0d31d7a42ab81c7900
Opcode Fuzzy Hash: 067c26eb05d6341be3d7c410d7f016947cd0d2a58d1ce12998e5f7b22b8d3a52
Instruction Fuzzy Hash: 1E011236210E0483DBD18F24D8983983365FB5DB68F109211EE57966E4CF35C98EC745

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002CE00 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,00000000,000000018002C1E9,?,?,00000000,000000018002C83F), ref: 000000018002CE84
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,000000018002C1E9,?,?,00000000,000000018002C83F), ref: 000000018002CEB3
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,000000018002C1E9,?,?,00000000,000000018002C83F), ref: 000000018002CEC0
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,000000018002C1E9,?,?,00000000,000000018002C83F), ref: 000000018002CEFA
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,000000018002C1E9,?,?,00000000,000000018002C83F), ref: 000000018002CF09

Strings

..\src\push_conn.c, xrefs: 000000018002CF97
[%s:%d][ERR] %s: bdnc_conn_send_request failed %d, xrefs: 000000018002CFAB
push_connection_open, xrefs: 000000018002CF9E

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: ..\src\push_conn.c$[%s:%d][ERR] %s: bdnc_conn_send_request failed %d$push_connection_open
API String ID: 2978645861-3597901987
Opcode ID: 09b6c439917777657a4ce4be6900d6df4ce36ccb9258c5528812c6ff56c3ca16
Instruction ID: 06ae97e0176cf36e9581fbb8113113edc06894ddb73c123febbde2dd4a8267d0
Opcode Fuzzy Hash: 09b6c439917777657a4ce4be6900d6df4ce36ccb9258c5528812c6ff56c3ca16
Instruction Fuzzy Hash: C2515635201B4885EBD3AF61E8903E973A5F78CB84F088432EE4A477A5DF78C649C341

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A610 Relevance: 12.1, APIs: 8, Instructions: 67synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,000000018000C3E5), ref: 000000018002A63E
LeaveCriticalSection.KERNEL32(?,?,?,000000018000C3E5), ref: 000000018002A65D
WaitForSingleObject.KERNEL32(?,?,?,000000018000C3E5), ref: 000000018002A66C
EnterCriticalSection.KERNEL32(?,?,?,000000018000C3E5), ref: 000000018002A676
SetEvent.KERNEL32(?,?,?,000000018000C3E5), ref: 000000018002A691
LeaveCriticalSection.KERNEL32(?,?,?,000000018000C3E5), ref: 000000018002A69B
SetEvent.KERNEL32(?,?,?,000000018000C3E5), ref: 000000018002A6DC
LeaveCriticalSection.KERNEL32(?,?,?,000000018000C3E5), ref: 000000018002A6E6

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$EnterEvent$ObjectSingleWait
String ID:
API String ID: 1746239557-0
Opcode ID: 34779330f159c25ec2c15b414f99b4598b826a73481a0bff5d138f25335823df
Instruction ID: 6c1c52e891d6639d8eae6d0d96d5dc3bcafb54306510f89d0e07e7e39c53ca8b
Opcode Fuzzy Hash: 34779330f159c25ec2c15b414f99b4598b826a73481a0bff5d138f25335823df
Instruction Fuzzy Hash: BF312F36614A48C7EBD69F25E85839C7361F749F49F089011EB4A876A8DF39CD8ECB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000018022CC48 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018022CC88
_invalid_parameter_noinfo.LIBCMT ref: 000000018022D034
_invalid_parameter_noinfo.LIBCMT ref: 000000018022D2DF

Strings

p, xrefs: 000000018022CD0E
p, xrefs: 000000018022CD86
f, xrefs: 000000018022CD7E

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 47e2dc1a9d14f18961fa778694a57ed7105e7571ba05d49e7aca47af43d18681
Instruction ID: d2bd8444d3f23c7f3e25602cdd66a4f33f255346cbaaad4e31f01f1fa6e2c521
Opcode Fuzzy Hash: 47e2dc1a9d14f18961fa778694a57ed7105e7571ba05d49e7aca47af43d18681
Instruction Fuzzy Hash: 6112C77260414986FBA69E95E04C7E9F763F398750F94C212EAC247AC4CFF9C7888B54

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018F60 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 395networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 000000018001917A
EnterCriticalSection.KERNEL32 ref: 0000000180019195
LeaveCriticalSection.KERNEL32 ref: 00000001800191B7

Strings

..\src\user_context.c, xrefs: 0000000180019468
[%s:%d] %s: proxy info are the same, xrefs: 0000000180019474
set_proxy_for_local_cloud, xrefs: 000000018001945B

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeavehtons
String ID: ..\src\user_context.c$[%s:%d] %s: proxy info are the same$set_proxy_for_local_cloud
API String ID: 1768908292-2023176744
Opcode ID: dc1b21991c8ab9e02b1775b7c98a2b3344a59050df09cb475f41f34ee80f500d
Instruction ID: e65824a77cf8ba9d9f9ba2cb6f98eb1d6c197f1b556284911918d0e552be233b
Opcode Fuzzy Hash: dc1b21991c8ab9e02b1775b7c98a2b3344a59050df09cb475f41f34ee80f500d
Instruction Fuzzy Hash: 66126C22E15FC886EB66CF7885403FD6360F7A9788F15E215EF8912656EF74A2D9C300

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F9E0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 171networktimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 000000018001FADE
htons.WS2_32 ref: 000000018001FB48
htons.WS2_32 ref: 000000018001FBB8

Part of subcall function 000000018001B530: EnterCriticalSection.KERNEL32(?,?,00000000,00000001800219E1,?,?,?,?,?,000000018001F538,?,?,?,?,?,000000018001F5C2), ref: 000000018001B544
Part of subcall function 000000018001B530: LeaveCriticalSection.KERNEL32(?,?,00000000,00000001800219E1,?,?,?,?,?,000000018001F538,?,?,?,?,?,000000018001F5C2), ref: 000000018001B559

Strings

..\src\bdnc_conn.c, xrefs: 000000018001FC57
bdnc_conn_connect_to, xrefs: 000000018001FC4C
[%s:%d][ERR] %s: retcode %d | IPv%d, xrefs: 000000018001FC69

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSectionhtons$EnterLeaveTimetime
String ID: ..\src\bdnc_conn.c$[%s:%d][ERR] %s: retcode %d | IPv%d$bdnc_conn_connect_to
API String ID: 3844482643-1465590489
Opcode ID: 5801169d488d35aa2e66517d5a2cf4945a3907b25ac88b8cd0e6cb39b6ce4d93
Instruction ID: ddfd2835b1c4ecefc2bc64bc78f713a08cce69926846ee01bfcaaed69ad7298f
Opcode Fuzzy Hash: 5801169d488d35aa2e66517d5a2cf4945a3907b25ac88b8cd0e6cb39b6ce4d93
Instruction Fuzzy Hash: 9C818172A14B8883E7A28F35D5513E973A0FB5D784F48D225EF8906656EF78E398C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180009FF5 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 152timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 000000018000A081

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

dns_client_resend_req, xrefs: 000000018000A0EC, 000000018000A14F, 000000018000A1BC
[%s:%d] %s: resending ipv4 request for %s, xrefs: 000000018000A0E5
..\src\dns_client.c, xrefs: 000000018000A0D9, 000000018000A13C, 000000018000A1A5
[%s:%d] %s: delta = %d for %s, xrefs: 000000018000A1B1
[%s:%d] %s: resending ipv6 request for %s, xrefs: 000000018000A148

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThreadTimetime
String ID: ..\src\dns_client.c$[%s:%d] %s: delta = %d for %s$[%s:%d] %s: resending ipv4 request for %s$[%s:%d] %s: resending ipv6 request for %s$dns_client_resend_req
API String ID: 3735742524-2039202327
Opcode ID: 138c332fd2258847834adbe3ac2881d0c501d889e6c687895f308dbf28d0e1b8
Instruction ID: 29a22c4dcb176a97405ca33374420a4aa0fc1f10657263111aadc543ecd44e2f
Opcode Fuzzy Hash: 138c332fd2258847834adbe3ac2881d0c501d889e6c687895f308dbf28d0e1b8
Instruction Fuzzy Hash: 6241A0726097888BE782CF60E8503C977B0F388B98F448116EA8D83785DF7CC659C754

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D290 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 148COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018000D323
LeaveCriticalSection.KERNEL32 ref: 000000018000D4CB

Strings

..\src\global_state.c, xrefs: 000000018000D39C, 000000018000D3C4, 000000018000D47A
add_generic_cb, xrefs: 000000018000D32D, 000000018000D390
[%s:%d] %s: modifying %p( %p %p ), xrefs: 000000018000D37E, 000000018000D40C
[%s:%d] %s: adding %p( %p %p ), xrefs: 000000018000D486
[%s:%d] %s: modifying %p( %p %p ) POSTPONED!!!, xrefs: 000000018000D367, 000000018000D3D3

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\global_state.c$[%s:%d] %s: adding %p( %p %p )$[%s:%d] %s: modifying %p( %p %p )$[%s:%d] %s: modifying %p( %p %p ) POSTPONED!!!$add_generic_cb
API String ID: 3168844106-1818589484
Opcode ID: de5b69830b311a453271c436257550988254a9457b62ba25081f2930dd29f695
Instruction ID: 795913124595cc02675c5d8c113375a72628c718f03657c69d321adfff6ff6ac
Opcode Fuzzy Hash: de5b69830b311a453271c436257550988254a9457b62ba25081f2930dd29f695
Instruction Fuzzy Hash: 20613A36204B4882EB92CF15F49439973A9F35CB98F148016EF8E47B68DF38D6A9C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180051050 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 129COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00000001800510F0
closesocket.WS2_32 ref: 000000018005110D
closesocket.WS2_32 ref: 0000000180051155
closesocket.WS2_32 ref: 0000000180051167

Strings

%s: could not reinitialize event mechanism, xrefs: 00000001800511BE
..\3rdparty\libevent\event.c, xrefs: 00000001800511B7

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: closesocket
String ID: %s: could not reinitialize event mechanism$..\3rdparty\libevent\event.c
API String ID: 2781271927-3269442241
Opcode ID: 245a2c782f2341a591b1787f9e95fb1b915b8ab12a7e91ae7cf80be6a7f1ab03
Instruction ID: b266cfb273c498e1dd8d81c21599455e184d791877a3e1b116572a7e66948342
Opcode Fuzzy Hash: 245a2c782f2341a591b1787f9e95fb1b915b8ab12a7e91ae7cf80be6a7f1ab03
Instruction Fuzzy Hash: 5551EE32700B889AE69ADB25D6803E963A1F74C7F0F548311BB79536D1DF31D6B98340

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DF30 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 123COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018000DF69
LeaveCriticalSection.KERNEL32 ref: 000000018000DFCF
EnterCriticalSection.KERNEL32 ref: 000000018000E0DE
LeaveCriticalSection.KERNEL32 ref: 000000018000E13D

Strings

..\src\global_state.c, xrefs: 000000018000E054
[%s:%d] %s: skip %p (resolver_dirty:%d), xrefs: 000000018000E05E
rt_setts_free_event_cb, xrefs: 000000018000DFF3

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\global_state.c$[%s:%d] %s: skip %p (resolver_dirty:%d)$rt_setts_free_event_cb
API String ID: 3168844106-1389472473
Opcode ID: beeb78d7ac5b3c792651a3b0abcf1618421f90caaef306dd07ef4ba9e1b3f880
Instruction ID: e39a89f86301e0fc4737947259033fd3a30c75aecac38f80efbc2039b3862313
Opcode Fuzzy Hash: beeb78d7ac5b3c792651a3b0abcf1618421f90caaef306dd07ef4ba9e1b3f880
Instruction Fuzzy Hash: 9C619136611B5888EB92CB60E8903DC73B8F74CB88F548526DE4D63B68DF38C659C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A450 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 119COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32 ref: 000000018000A631

Strings

dump_pool_stats, xrefs: 000000018000A50F
[%s:%d] %s: requests: ok %d, timeout %d, 404 %d, 4xx %d, 5xx %d, err %d , TOTAL %d ( received %u in %lu avg speed %lu), xrefs: 000000018000A5A2
[%s:%d] %s: connections: %d, max %d, total %d, xrefs: 000000018000A5ED
..\src\conn_pool.c, xrefs: 000000018000A4EB, 000000018000A5AE, 000000018000A5E2
[%s:%d] %s: %s %s, xrefs: 000000018000A508

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalDeleteSection
String ID: ..\src\conn_pool.c$[%s:%d] %s: %s %s$[%s:%d] %s: connections: %d, max %d, total %d$[%s:%d] %s: requests: ok %d, timeout %d, 404 %d, 4xx %d, 5xx %d, err %d , TOTAL %d ( received %u in %lu avg speed %lu)$dump_pool_stats
API String ID: 166494926-2410711694
Opcode ID: 5dfaa4e20397f967b4e8b92ddf3538969ee04d31920d68ab6c185acf05528763
Instruction ID: bb35fd8c9f627c2d20535109c4e32ad6c448fc2c877c19a5d92d9724d9be8555
Opcode Fuzzy Hash: 5dfaa4e20397f967b4e8b92ddf3538969ee04d31920d68ab6c185acf05528763
Instruction Fuzzy Hash: 27513877204B84CBD7A1CF15E4807DAB7A1F38CB98F548116EA8A43B28DF79D659CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D6B0 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,0000000180006591), ref: 000000018000D6E7
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,0000000180006591), ref: 000000018000D7D0
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,0000000180006591), ref: 000000018000D801
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,0000000180006591), ref: 000000018000D866

Strings

..\src\global_state.c, xrefs: 000000018000D798
call_callback_list, xrefs: 000000018000D712
[%s:%d] %s: calling callback %p( %p ), xrefs: 000000018000D7A4

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\global_state.c$[%s:%d] %s: calling callback %p( %p )$call_callback_list
API String ID: 3168844106-1899174435
Opcode ID: 2b48bc8958287a58f7ad15448b915052d1b217836762c9ad636c2b98c4a93f74
Instruction ID: 537a6c87d4b8f8d61256ef27ec1536c5a3c0bbce35c018194b4583f0f72d1720
Opcode Fuzzy Hash: 2b48bc8958287a58f7ad15448b915052d1b217836762c9ad636c2b98c4a93f74
Instruction Fuzzy Hash: C351183A205F4885DB92CF25E49439873A5F74CF98F598126DE9D43368DF34CAA9C390

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180009050 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 90networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00000001800090D7

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

htons.WS2_32 ref: 000000018000918A

Part of subcall function 000000018004CB80: htonl.WS2_32 ref: 000000018004CBB9

Strings

[%s:%d] %s: address = %s, port = %u, xrefs: 00000001800090FD
..\src\dns_client.c, xrefs: 00000001800090EA, 000000018000919D
[%s:%d] %s: address = %s, scope = %u, port = %u, xrefs: 00000001800091A7
dns_client_get_first_ip_cb, xrefs: 0000000180009104, 00000001800091C1

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSectionhtons$CurrentEnterLeaveThreadhtonl
String ID: ..\src\dns_client.c$[%s:%d] %s: address = %s, port = %u$[%s:%d] %s: address = %s, scope = %u, port = %u$dns_client_get_first_ip_cb
API String ID: 474373079-2763971249
Opcode ID: de424b891416c0fc8b3b7d0c7f4385858e84e1b4817cec40c76c8c0aac486371
Instruction ID: dc66ab27ba58395d15c1f9660868df85fc6543a1e19ba8c5867faf12a5c4e3bb
Opcode Fuzzy Hash: de424b891416c0fc8b3b7d0c7f4385858e84e1b4817cec40c76c8c0aac486371
Instruction Fuzzy Hash: 4C41A932A197C986D7A2CF20E4457EA73B1F79D344F40D216FA9943955EF78C698CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180047CB0 Relevance: 10.6, APIs: 7, Instructions: 89threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180047CC1
InitializeCriticalSection.KERNEL32 ref: 0000000180047D21
CreateEventA.KERNEL32 ref: 0000000180047D31
CreateThread.KERNEL32 ref: 0000000180047DA4
LeaveCriticalSection.KERNEL32 ref: 0000000180047E07

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Create$EnterEventInitializeLeaveThread
String ID:
API String ID: 1702641810-0
Opcode ID: 1ed007824a097f7cb57e4c36cc54dae6ea0aab7d0e6e7ce567bf2ba0e23ced35
Instruction ID: ee79941e995427a8b1a2800e020f3bfbf1124fecc697b0c6033508826328d4df
Opcode Fuzzy Hash: 1ed007824a097f7cb57e4c36cc54dae6ea0aab7d0e6e7ce567bf2ba0e23ced35
Instruction Fuzzy Hash: F9416B35311B0882EB96EF20E8543D973A5FB8DB98F448625EE5E467A9DF38C65CC340

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B8B0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 79COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018001B8E0
LeaveCriticalSection.KERNEL32 ref: 000000018001B9AC

Strings

<null>, xrefs: 000000018001B928
[%s:%d][ERR] %s: SSL_CTX_load_verify_locations( %s, %s ) failed, xrefs: 000000018001B93F
..\src\ssl\ssl_ctx.c, xrefs: 000000018001B932, 000000018001B9B9
ssl_set_cafile, xrefs: 000000018001B8ED
[%s:%d] %s: '%s' / '%s', xrefs: 000000018001B9C5

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\ssl\ssl_ctx.c$<null>$[%s:%d] %s: '%s' / '%s'$[%s:%d][ERR] %s: SSL_CTX_load_verify_locations( %s, %s ) failed$ssl_set_cafile
API String ID: 3168844106-574870105
Opcode ID: b5fc41472998e5f567e328dd1e5212570c8cef32f1db8495c89dbf7b727b101b
Instruction ID: 5f783dba8843dbbef727ba91ec3b79622dd5853df2bb65838fb58a2a809a4561
Opcode Fuzzy Hash: b5fc41472998e5f567e328dd1e5212570c8cef32f1db8495c89dbf7b727b101b
Instruction Fuzzy Hash: 30410771304B8885FB929B61E8453D973AABB8C7D4F408016AE4E93B64DF79C65DC701

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001BA20 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 79COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018001BA50
LeaveCriticalSection.KERNEL32 ref: 000000018001BB1C

Strings

<null>, xrefs: 000000018001BA98
[%s:%d][ERR] %s: SSL_CTX_load_verify_locations( %s, %s ) failed, xrefs: 000000018001BAAF
..\src\ssl\ssl_ctx.c, xrefs: 000000018001BAA2, 000000018001BB29
ssl_set_cadir, xrefs: 000000018001BA5D
[%s:%d] %s: '%s' / '%s', xrefs: 000000018001BB35

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\ssl\ssl_ctx.c$<null>$[%s:%d] %s: '%s' / '%s'$[%s:%d][ERR] %s: SSL_CTX_load_verify_locations( %s, %s ) failed$ssl_set_cadir
API String ID: 3168844106-3072686584
Opcode ID: da029fcf94767fa848028a7cefce00be1309eaf601cceeb71b8403d51fe9a0a9
Instruction ID: a15b3f44fccbce623c1167d6713580091d4300b5cf45e0c66aa58edc5ab0a670
Opcode Fuzzy Hash: da029fcf94767fa848028a7cefce00be1309eaf601cceeb71b8403d51fe9a0a9
Instruction Fuzzy Hash: 31315B31308B8881EB939B65E8813D663A6BB4C7D4F448016AD4D93BA4DFB9C74DC300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018720 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 78COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 0000000180018802
CreateEventA.KERNEL32 ref: 0000000180018812

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

..\src\user_context.c, xrefs: 000000018001883C
N, xrefs: 000000018001875B
[%s:%d] %s: context %p, xrefs: 0000000180018848
user_context_alloc, xrefs: 0000000180018832

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CreateCurrentEnterEventInitializeLeaveThread
String ID: N$..\src\user_context.c$[%s:%d] %s: context %p$user_context_alloc
API String ID: 78216027-3613468263
Opcode ID: f21308f5de6151b9a500d2dfc5bd88609de848488b976866a4a316fe4df45184
Instruction ID: 95827f0dd77ae004570a8cc8fb64766553f20dc6169e22a1291f9b47bf8ee76b
Opcode Fuzzy Hash: f21308f5de6151b9a500d2dfc5bd88609de848488b976866a4a316fe4df45184
Instruction Fuzzy Hash: 1631F736205F4485E7968F64F8903DA33A9FB4CB48F988136EA8D47759EF39C668C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001BC90 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 51COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018001BC9F
LeaveCriticalSection.KERNEL32 ref: 000000018001BD6E

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

ssl_cache_disable_nolock, xrefs: 000000018001BD2F
..\src\ssl\ssl_ctx.c, xrefs: 000000018001BCAC
[%s:%d] %s: disabling ssl session cache %p, xrefs: 000000018001BD3C
ssl_cache_enable_nolock, xrefs: 000000018001BCC1
[%s:%d] %s: enabling ssl session cache %p, xrefs: 000000018001BCCE

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CurrentThread
String ID: ..\src\ssl\ssl_ctx.c$[%s:%d] %s: disabling ssl session cache %p$[%s:%d] %s: enabling ssl session cache %p$ssl_cache_disable_nolock$ssl_cache_enable_nolock
API String ID: 266293576-1428956281
Opcode ID: 422440b229d4ed87566aae4be69e9391b44e28cae719272004d80937ca66b8ab
Instruction ID: c8568b56e150789116b5bface2f7c7956d6c322b6337d634ee42ff725fa2a7ea
Opcode Fuzzy Hash: 422440b229d4ed87566aae4be69e9391b44e28cae719272004d80937ca66b8ab
Instruction Fuzzy Hash: FF21E534315B1D8AFBE39B61E8883D523AAB74D7A5F40C025AD49877A1EF79878DC340

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001BE50 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 44timeCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0000100100000200,000000018000684C), ref: 000000018001BE5F
timeGetTime.WINMM(?,?,?,?,0000100100000200,000000018000684C), ref: 000000018001BEFC

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

LeaveCriticalSection.KERNEL32(?,?,?,?,0000100100000200,000000018000684C), ref: 000000018001BF0F

Strings

ssl_reload_certs, xrefs: 000000018001BE92
..\src\ssl\ssl_ctx.c, xrefs: 000000018001BE9F
[%s:%d][ERR] %s: SSL_CTX_load_verify_locations failed, xrefs: 000000018001BEAB

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CurrentThreadTimetime
String ID: ..\src\ssl\ssl_ctx.c$[%s:%d][ERR] %s: SSL_CTX_load_verify_locations failed$ssl_reload_certs
API String ID: 535464691-2800379527
Opcode ID: bc805758313d33ec14c27c620cb1b6eeffffee58310d4e177e5c7dc6c8b31032
Instruction ID: bc8d68683ba637ecfa3912148b2dc96da995a49de9cc6b1ac7fbd79769259688
Opcode Fuzzy Hash: bc805758313d33ec14c27c620cb1b6eeffffee58310d4e177e5c7dc6c8b31032
Instruction Fuzzy Hash: E1112874305A5885FBD79B25E8593E523A6BB8D7C1F44C016E90A866A1DF39C74DC700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001CF70 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 44encryptionCOMMON

Download Yara Rule

APIs

CertCreateCertificateContext.CRYPT32 ref: 000000018001CFCB
GetLastError.KERNEL32 ref: 000000018001CFD9

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

x509_to_cert_context, xrefs: 000000018001CF8B, 000000018001CFF4
[%s:%d][ERR] %s: CertCreateCertificateContext failed %d, xrefs: 000000018001D001
..\src\ssl\ssl_ctx.c, xrefs: 000000018001CF98, 000000018001CFED, 000000018001D019
[%s:%d][ERR] %s: i2d_X509 failed!, xrefs: 000000018001CFA4

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CertCertificateContextCreateCurrentEnterErrorLastLeaveThread
String ID: ..\src\ssl\ssl_ctx.c$[%s:%d][ERR] %s: CertCreateCertificateContext failed %d$[%s:%d][ERR] %s: i2d_X509 failed!$x509_to_cert_context
API String ID: 2957535492-2770004481
Opcode ID: 4af7e0c3ef67d44e626c9504b50739684c83d0f8363336a906f1533cc26fea50
Instruction ID: 59b62983645f46be8166496134814fa65f392fce480ef653bc1418771b2749db
Opcode Fuzzy Hash: 4af7e0c3ef67d44e626c9504b50739684c83d0f8363336a906f1533cc26fea50
Instruction Fuzzy Hash: 04115B35204B4881EB929B24E8453CA33A2AB4C784F808126FA4E437A5EFBEC34DC704

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800024B0 Relevance: 10.5, APIs: 7, Instructions: 43COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00000001800024CE
SetEvent.KERNEL32 ref: 00000001800024EC
LeaveCriticalSection.KERNEL32 ref: 00000001800024F7
EnterCriticalSection.KERNEL32 ref: 0000000180002500
LeaveCriticalSection.KERNEL32 ref: 000000018000250F
DeleteCriticalSection.KERNEL32 ref: 000000018000251C
CloseHandle.KERNEL32 ref: 0000000180002526

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CloseDeleteEventHandle
String ID:
API String ID: 2132285870-0
Opcode ID: d2d2199ee8c04a4b143c2ef6fd2045d29a06ea299de04015a6d79fac4834aab8
Instruction ID: 220bf2a861041dd283c1eb6e0c179d186f64f6bd20d57d66d865f884cc45bd31
Opcode Fuzzy Hash: d2d2199ee8c04a4b143c2ef6fd2045d29a06ea299de04015a6d79fac4834aab8
Instruction Fuzzy Hash: 54117035204A4482E7D5DB12EA9836D7365FB8DBC0F009010EE0747FA4CF78D6AE8745

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006E20 Relevance: 10.5, APIs: 7, Instructions: 43synchronizationthreadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180006E2D
LeaveCriticalSection.KERNEL32 ref: 0000000180006E4E
WaitForSingleObject.KERNEL32 ref: 0000000180006E66
CloseHandle.KERNEL32 ref: 0000000180006E73
EnterCriticalSection.KERNEL32 ref: 0000000180006E80
CreateThread.KERNEL32 ref: 0000000180006EA8
LeaveCriticalSection.KERNEL32 ref: 0000000180006EE1

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CloseCreateHandleObjectSingleThreadWait
String ID:
API String ID: 1118446344-0
Opcode ID: d6fbb27dc71b9bb45a3e03f2c4ca4039059d8645390de1f76c501d957e768064
Instruction ID: f66d544484fc3a7b008fe99be17124468214c8f80cae91bbdbd0259278ff5cdd
Opcode Fuzzy Hash: d6fbb27dc71b9bb45a3e03f2c4ca4039059d8645390de1f76c501d957e768064
Instruction Fuzzy Hash: 7E11F038210B498AFB868B60FC993947362B78D361F418615EC1A923F0DF7C868E8345

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E960 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28synchronizationCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 000000018000E9BC
WaitForSingleObject.KERNEL32 ref: 000000018000E9CE
EnterCriticalSection.KERNEL32 ref: 000000018000E9DB

Strings

wait_for_context_free, xrefs: 000000018000E971
..\src\global_state.c, xrefs: 000000018000E99D
[%s:%d] %s: main thread is waiting for global_state.contexts, xrefs: 000000018000E9A9

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeaveObjectSingleWait
String ID: ..\src\global_state.c$[%s:%d] %s: main thread is waiting for global_state.contexts$wait_for_context_free
API String ID: 501323975-3251086152
Opcode ID: 75c0ce70ca474cdc7d63e01295ab784c1057197f7f3abede72f7fe58ba74c14b
Instruction ID: 87b7a98533aeb2d61614d01219c6eba34cc35b9b093462350c5e8b4f61532cb9
Opcode Fuzzy Hash: 75c0ce70ca474cdc7d63e01295ab784c1057197f7f3abede72f7fe58ba74c14b
Instruction Fuzzy Hash: 3301E835210A8896EAD28F10F8983D4B765F74D794F55C511E95A636B0CF79CB8DC304

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007820 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 103COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,000000018000690E), ref: 000000018000782F
LeaveCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,000000018000690E), ref: 0000000180007861

Part of subcall function 0000000180008020: EnterCriticalSection.KERNEL32 ref: 000000018000809A
Part of subcall function 0000000180008020: LeaveCriticalSection.KERNEL32 ref: 00000001800080B1
Part of subcall function 0000000180008020: EnterCriticalSection.KERNEL32 ref: 00000001800080CF
Part of subcall function 0000000180008020: LeaveCriticalSection.KERNEL32 ref: 00000001800080E7
Part of subcall function 0000000180008020: WaitForSingleObject.KERNEL32 ref: 00000001800080F9
Part of subcall function 0000000180008020: EnterCriticalSection.KERNEL32 ref: 0000000180008106

LeaveCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,000000018000690E), ref: 00000001800079B6

Strings

..\src\bootstrap_requests.c, xrefs: 0000000180007990
[%s:%d][ERR] %s: ERROR: no bootstrap server! , xrefs: 000000018000799C
get_servers_list_from_bootstrap, xrefs: 0000000180007983

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ObjectSingleWait
String ID: ..\src\bootstrap_requests.c$[%s:%d][ERR] %s: ERROR: no bootstrap server! $get_servers_list_from_bootstrap
API String ID: 1755037574-2486673372
Opcode ID: 999a8019b45ec64d43c4e4f18cceb462fba9670c5e31061901572f508e2cf9f9
Instruction ID: 572254b0c11c9106eb2950b2279cb81425843537f017e7f5e11299b40e301380
Opcode Fuzzy Hash: 999a8019b45ec64d43c4e4f18cceb462fba9670c5e31061901572f508e2cf9f9
Instruction Fuzzy Hash: 2C4157367006488AEB92DF14E8443E8B3A1F79CB95F448125ED8E873A5EF78CA49C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E6D0 Relevance: 9.1, APIs: 6, Instructions: 87fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 000000018001E713
GetLastError.KERNEL32 ref: 000000018001E722
GetFileSize.KERNEL32 ref: 000000018001E74B
CloseHandle.KERNEL32 ref: 000000018001E7D5

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastSize
String ID:
API String ID: 281206921-0
Opcode ID: a3d20ad20c15e23918d45ba01288cf3366f71431c14937eeb88c7874deafadc6
Instruction ID: 9ee00e559af4ae8c09aa3f7a506bba57cc2e15fc533ec405e3140e287ea3e942
Opcode Fuzzy Hash: a3d20ad20c15e23918d45ba01288cf3366f71431c14937eeb88c7874deafadc6
Instruction Fuzzy Hash: C3318D35208B8886F7929F25A54439D73A5F78AFE0F248126EF4943BE4DF78CA4D8700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002A7D Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 62COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180002A87
LeaveCriticalSection.KERNEL32 ref: 0000000180002A9E

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

[%s:%d] %s: (%p, %d (%s), '%s', ... ) => 0 , xrefs: 0000000180002A4C
..\src\api.c, xrefs: 0000000180002A40, 0000000180002BF7
[%s:%d] %s: (%p, %d (%s), %d ... ) => 0 , xrefs: 0000000180002C03
__bdnimbus_set_optionv, xrefs: 0000000180002A57, 0000000180002C0E

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CurrentThread
String ID: ..\src\api.c$[%s:%d] %s: (%p, %d (%s), %d ... ) => 0 $[%s:%d] %s: (%p, %d (%s), '%s', ... ) => 0 $__bdnimbus_set_optionv
API String ID: 266293576-1966894916
Opcode ID: 34eebfcdf529f269edc055db5292bd147e61b7b0dd806886553b4dd7cb2f322d
Instruction ID: 61583d5790021653779d152a67f8cc1a9638e6c95872152d4524c4af7a6c918a
Opcode Fuzzy Hash: 34eebfcdf529f269edc055db5292bd147e61b7b0dd806886553b4dd7cb2f322d
Instruction Fuzzy Hash: F0212736204B4886E6A3DB10F8893DD7365F7893A0F54812AFE8A577A5DF38C74D8308

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002EC4 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 61COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180002ED0
LeaveCriticalSection.KERNEL32 ref: 0000000180002EEC

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

[%s:%d][ERR] %s: (%p, %d (%s), %p, ... ) => %d %s, xrefs: 0000000180003339
..\src\api.c, xrefs: 000000018000336A, 00000001800033E5
__bdnimbus_set_optionv, xrefs: 0000000180003381, 00000001800033DA
[%s:%d] %s: (%p, %d (%s), %p, ... ) => 0 , xrefs: 0000000180003376

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CurrentThread
String ID: ..\src\api.c$[%s:%d] %s: (%p, %d (%s), %p, ... ) => 0 $[%s:%d][ERR] %s: (%p, %d (%s), %p, ... ) => %d %s$__bdnimbus_set_optionv
API String ID: 266293576-1097658329
Opcode ID: 6bcd5375db991a4f404929a42dcdb4bde30ef80a38ef6c92066f56f0a16044a4
Instruction ID: cc9573ebb344a1c310f2fc099d272aaf92bda924b97941398c6b934287c30f86
Opcode Fuzzy Hash: 6bcd5375db991a4f404929a42dcdb4bde30ef80a38ef6c92066f56f0a16044a4
Instruction Fuzzy Hash: B0212636204B8882E6E3CF05F4457DAB3A9F78D390F50852AFA8A47795DF78C64D8704

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800230C0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,000000018001988F), ref: 00000001800230DF
LeaveCriticalSection.KERNEL32(?,?,?,?,?,000000018001988F), ref: 00000001800231AB

Part of subcall function 000000018000A660: timeGetTime.WINMM(?,?,00000016,0000000180023104,?,?,?,?,?,000000018001988F), ref: 000000018000A722
Part of subcall function 000000018000A660: InitializeCriticalSection.KERNEL32(?,?,00000016,0000000180023104,?,?,?,?,?,000000018001988F), ref: 000000018000A757

Strings

[%s:%d][WARN] %s: create second pool failed %d (continue without), xrefs: 000000018002315F
..\src\runtime_settings.c, xrefs: 000000018002314B, 000000018002318F
[%s:%d][ERR] %s: create pool failed %d, xrefs: 0000000180023198
runtime_settings_create_pools_nolock, xrefs: 0000000180023152, 0000000180023179

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeaveTimetime
String ID: ..\src\runtime_settings.c$[%s:%d][ERR] %s: create pool failed %d$[%s:%d][WARN] %s: create second pool failed %d (continue without)$runtime_settings_create_pools_nolock
API String ID: 1999974736-2564490013
Opcode ID: b3784d0af378a4bcfebd734ec67364e6e63a8b081f24cdc35edb3ef37b54fd22
Instruction ID: af602f8c2c486dcbea48d00051e5e4a9f773179a94eb64fc5c7f3b157ce3cacc
Opcode Fuzzy Hash: b3784d0af378a4bcfebd734ec67364e6e63a8b081f24cdc35edb3ef37b54fd22
Instruction Fuzzy Hash: 5C215332200B4882F792CF25E8463CA77A5F748B88F448132EA49876A8DF79C75DC744

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002D3C0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 58COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018002D3F0
LeaveCriticalSection.KERNEL32 ref: 000000018002D409

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

..\src\push_conn.c, xrefs: 000000018002D47E
prepare_ri, xrefs: 000000018002D4A7
h_id=, xrefs: 000000018002D453
[%s:%d] %s: '%s', xrefs: 000000018002D48B

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CurrentThread
String ID: ..\src\push_conn.c$[%s:%d] %s: '%s'$h_id=$prepare_ri
API String ID: 266293576-3497664589
Opcode ID: 0f0582aec2e82975588b0d92df11f3a07ea75f8f6cabd12527be38a494f50f0c
Instruction ID: e578366323b3963eece4ef5c0fb6270cdfb4429010da5e419c5f922787018dd6
Opcode Fuzzy Hash: 0f0582aec2e82975588b0d92df11f3a07ea75f8f6cabd12527be38a494f50f0c
Instruction Fuzzy Hash: 8F216F35600A8886D796CF15F8443D9B7A1F74CB94F848212EF5E573A4EF78C649C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180245270 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00000001802397CD,?,?,?,?,0000000180245983,?,?,00000000,000000018024538E,?,?,?), ref: 000000018024527F
FlsSetValue.KERNEL32(?,?,?,00000001802397CD,?,?,?,?,0000000180245983,?,?,00000000,000000018024538E,?,?,?), ref: 00000001802452B5
FlsSetValue.KERNEL32(?,?,?,00000001802397CD,?,?,?,?,0000000180245983,?,?,00000000,000000018024538E,?,?,?), ref: 00000001802452E2
FlsSetValue.KERNEL32(?,?,?,00000001802397CD,?,?,?,?,0000000180245983,?,?,00000000,000000018024538E,?,?,?), ref: 00000001802452F3
FlsSetValue.KERNEL32(?,?,?,00000001802397CD,?,?,?,?,0000000180245983,?,?,00000000,000000018024538E,?,?,?), ref: 0000000180245304
SetLastError.KERNEL32(?,?,?,00000001802397CD,?,?,?,?,0000000180245983,?,?,00000000,000000018024538E,?,?,?), ref: 000000018024531F

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 9f583164f44ff690fa5e6e672e510909bffa6910aeaa3e5a778e9e72501ea637
Instruction ID: c25cf190199965df55b1d30f1c3bd9eefd59afa614a635e980f1d98b3d108bed
Opcode Fuzzy Hash: 9f583164f44ff690fa5e6e672e510909bffa6910aeaa3e5a778e9e72501ea637
Instruction Fuzzy Hash: EC119030304A5842FAD797395ADD3ED22635F4D7B0F06C725AC7647AD7DEE896488700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001802402C8 Relevance: 9.1, APIs: 6, Instructions: 54threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001802402E4
CreateThread.KERNEL32 ref: 0000000180240328
ResumeThread.KERNEL32 ref: 000000018024033D
GetLastError.KERNEL32 ref: 0000000180240348
CloseHandle.KERNEL32(?,?,?,?,?,0000000180079171), ref: 0000000180240367
FreeLibrary.KERNEL32(?,?,?,?,?,0000000180079171), ref: 0000000180240376

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: Thread$CloseCreateErrorFreeHandleLastLibraryResume_invalid_parameter_noinfo
String ID:
API String ID: 2082702847-0
Opcode ID: 16518c2ce5099810014b9bb4fec56a4780c897c93b7361d9e885c401ac592d7f
Instruction ID: 1aafe6cccef4da3911572311c9e3f865616e9bda0f99f7506b68cfbaefcf588a
Opcode Fuzzy Hash: 16518c2ce5099810014b9bb4fec56a4780c897c93b7361d9e885c401ac592d7f
Instruction Fuzzy Hash: 15117535201F4882FFD69F60A49C3D966B2AB4DBB4F0587249E3A067D5DFB8C65C8740

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001EBB0 Relevance: 9.1, APIs: 6, Instructions: 54fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 000000018001EBEE
GetLastError.KERNEL32 ref: 000000018001EBFD
WriteFile.KERNEL32 ref: 000000018001EC22
GetLastError.KERNEL32 ref: 000000018001EC32
CloseHandle.KERNEL32 ref: 000000018001EC49
DeleteFileW.KERNEL32 ref: 000000018001EC56

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: File$ErrorLast$CloseCreateDeleteHandleWrite
String ID:
API String ID: 527566810-0
Opcode ID: 93d01b7b42ad8aba496a24ddd242df452c8683dbd39fdc3b8486bf2409ccf091
Instruction ID: a7ea3d4b5eb4b0f2510525a7836d794ad96a194cc9f13974da0ae0209f6c6933
Opcode Fuzzy Hash: 93d01b7b42ad8aba496a24ddd242df452c8683dbd39fdc3b8486bf2409ccf091
Instruction Fuzzy Hash: 0611B135304A8486E7D19F25B84479E6391F78EBE4F088226FE5643BE4CF78C64E8B41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023410 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 53COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,00000000,000000018000B272), ref: 000000018002342F
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,000000018000B272), ref: 00000001800234DF

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

[%s:%d][WARN] %s: Dropping fallback server '%s', xrefs: 00000001800234A9
runtime_settings_disable_pool, xrefs: 0000000180023468, 00000001800234B4
..\src\runtime_settings.c, xrefs: 000000018002344D, 000000018002349C
[%s:%d][WARN] %s: Dropping primary server '%s', xrefs: 0000000180023457

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CurrentThread
String ID: ..\src\runtime_settings.c$[%s:%d][WARN] %s: Dropping fallback server '%s'$[%s:%d][WARN] %s: Dropping primary server '%s'$runtime_settings_disable_pool
API String ID: 266293576-3019508685
Opcode ID: 1972c96a3b0b350409bf65c75b1856e108601108305c1db728819998a8401ee1
Instruction ID: 0da31aacbb180e771dfeb006b4034b57f3af5e7da4a12fb3a0444bbfa059aec9
Opcode Fuzzy Hash: 1972c96a3b0b350409bf65c75b1856e108601108305c1db728819998a8401ee1
Instruction Fuzzy Hash: A4214832214B4882EB92CF04E8453D93365F348B98F448226EA5D477A4DFB9C79DC344

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003119 Relevance: 9.0, APIs: 6, Instructions: 49threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018000312B
LeaveCriticalSection.KERNEL32 ref: 000000018000321F

Part of subcall function 0000000180035F90: InitializeCriticalSection.KERNEL32 ref: 0000000180035F9B

CreateThread.KERNEL32 ref: 000000018000319D
CreateThread.KERNEL32 ref: 00000001800031CE
LeaveCriticalSection.KERNEL32 ref: 00000001800031F1
LeaveCriticalSection.KERNEL32 ref: 0000000180003208

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$CreateThread$EnterInitialize
String ID:
API String ID: 3856160661-0
Opcode ID: d904f1ee93490a578cdf5dc06bf2d8df8fbadb9ffc4c387a3cd810ef317960f6
Instruction ID: 1f5614d7916ce66e5acbce3256de060ec7bf0dde78e2f019fd9bd43870c5c5f7
Opcode Fuzzy Hash: d904f1ee93490a578cdf5dc06bf2d8df8fbadb9ffc4c387a3cd810ef317960f6
Instruction Fuzzy Hash: 8031E335504B898AF7D3CF20F8953E97365BB9D345F16D215ED8A612A1DF78938C8300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002F4A Relevance: 9.0, APIs: 3, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180002F5D
LeaveCriticalSection.KERNEL32 ref: 0000000180002F7C
LeaveCriticalSection.KERNEL32 ref: 0000000180002F93

Strings

[%s:%d][ERR] %s: (%p, %d (%s), %d ... ) => %d %s, xrefs: 00000001800033BF
..\src\api.c, xrefs: 00000001800033E5
__bdnimbus_set_optionv, xrefs: 00000001800033DA

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: ..\src\api.c$[%s:%d][ERR] %s: (%p, %d (%s), %d ... ) => %d %s$__bdnimbus_set_optionv
API String ID: 2978645861-2152615962
Opcode ID: d7163eb7689da703687f0bd927ebc2e3634607bd170b5bd894254d7c8da87836
Instruction ID: ef9a8150743f62da2b0ee4592be5a6837098ceedc137e120a90da58a90d2ba29
Opcode Fuzzy Hash: d7163eb7689da703687f0bd927ebc2e3634607bd170b5bd894254d7c8da87836
Instruction Fuzzy Hash: 84112B36204A4986E7D3DF04F8943DAB765F78C390F548026EE8A576A0DF78CB8D8704

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004D474 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 167networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 000000018004D593
if_nametoindex.IPHLPAPI ref: 000000018004D5C8
htons.WS2_32 ref: 000000018004D68A
htonl.WS2_32 ref: 000000018004D726

Strings

%u.%u.%u.%u%c, xrefs: 000000018004D6B6

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: htons$htonlif_nametoindex
String ID: %u.%u.%u.%u%c
API String ID: 2561321223-2006965413
Opcode ID: 53411e93d8350e9484b1ce6c4d6ebe8ab69a485c750d48b380e59efba621b760
Instruction ID: 35b7adf9c890975608c7d92794581267117574bc98f1f0db81dc250ba5802238
Opcode Fuzzy Hash: 53411e93d8350e9484b1ce6c4d6ebe8ab69a485c750d48b380e59efba621b760
Instruction Fuzzy Hash: 3E61F832604B9C86E796CF61E4443EEA391EB8D7C8F86C122FA4947B95DF78C649C704

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001FC90 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 117networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 000000018001FD12
htons.WS2_32 ref: 000000018001FD88

Strings

..\src\bdnc_conn.c, xrefs: 000000018001FE28
bdnc_conn_connect_to, xrefs: 000000018001FE1D
[%s:%d][ERR] %s: retcode %d | IPv%d, xrefs: 000000018001FE3A

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: htons
String ID: ..\src\bdnc_conn.c$[%s:%d][ERR] %s: retcode %d | IPv%d$bdnc_conn_connect_to
API String ID: 4207154920-1465590489
Opcode ID: d855e5026fa61797d0f32f41629bda256d34ea699283512ad9cd5d747f4b0a4f
Instruction ID: fe012ee93217bb7339b19ce4cf79f46d7e3168de4d79c7e9eac180a8c5aa2049
Opcode Fuzzy Hash: d855e5026fa61797d0f32f41629bda256d34ea699283512ad9cd5d747f4b0a4f
Instruction Fuzzy Hash: F2510C32A14B8893E7969B34A6013F96361F769784F05A316EF8916653EF74E2E8C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001ED70 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(?,?,?,?,?,?,?,?,00000000,000000018001DC57), ref: 000000018001F03B
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,000000018001DC57), ref: 000000018001F09E

Strings

..\src\win\win_error.c, xrefs: 000000018001F06A
map_system_error, xrefs: 000000018001F05D
[%s:%d][WARN] %s: unmapped error code %u (%s) defaults to %u (%s), xrefs: 000000018001F085

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: FormatFreeLocalMessage
String ID: ..\src\win\win_error.c$[%s:%d][WARN] %s: unmapped error code %u (%s) defaults to %u (%s)$map_system_error
API String ID: 1427518018-1192454891
Opcode ID: 8a2278eeb5c41d9edc9162d035036487058ef662e450edacb6f0be5de45b7874
Instruction ID: 5080f43d37f40177c093e2649b39a717a9e33135c5a0f7f27bc878ec9d5738f0
Opcode Fuzzy Hash: 8a2278eeb5c41d9edc9162d035036487058ef662e450edacb6f0be5de45b7874
Instruction Fuzzy Hash: ED314D72708B4487E796CB09F4943A977A6F78C784F448136EB4943799DF38C659CB04

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001DC10 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 000000018001DC33
WSAGetLastError.WS2_32 ref: 000000018001DC45

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

[%s:%d][ERR] %s: [LITTLE_DNS_CREATE FAILED] WSAStartup : %d ( %s ), xrefs: 000000018001DC82
wsa_init, xrefs: 000000018001DC6C
..\src\win\dll_main.c, xrefs: 000000018001DC65

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CurrentEnterErrorLastLeaveStartupThread
String ID: ..\src\win\dll_main.c$[%s:%d][ERR] %s: [LITTLE_DNS_CREATE FAILED] WSAStartup : %d ( %s )$wsa_init
API String ID: 2492808808-2025973463
Opcode ID: d704506496ccc184f6d933dd0b7d2340d7e173b0604b8dc33ef4e40f5a0d33be
Instruction ID: 976fb2669a3ada6986766cdd128c2b71c0e88becb05099fa721b4a1a6ca9d81a
Opcode Fuzzy Hash: d704506496ccc184f6d933dd0b7d2340d7e173b0604b8dc33ef4e40f5a0d33be
Instruction Fuzzy Hash: 97116535705A8985FBE29B20F4593EE73A1F78C784F804026A94E47796DF7DC609C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018CF0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 102COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180018D8E
LeaveCriticalSection.KERNEL32 ref: 0000000180018DB0

Part of subcall function 0000000180023510: EnterCriticalSection.KERNEL32(?,?,00000000,0000000180019A64), ref: 0000000180023529
Part of subcall function 0000000180023510: LeaveCriticalSection.KERNEL32(?,?,00000000,0000000180019A64), ref: 0000000180023544

Strings

..\src\user_context.c, xrefs: 0000000180018E16
[%s:%d] %s: same local cloud as before, xrefs: 0000000180018E22
user_context_make_pool, xrefs: 0000000180018E09

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\user_context.c$[%s:%d] %s: same local cloud as before$user_context_make_pool
API String ID: 3168844106-3378153947
Opcode ID: f27f08862ed75a11f60147ecb178d8ad76df11be8b65570a4d5faecc6f6d5d29
Instruction ID: cd8fdc4f6830065916ce87a711c8cfb564820c7dfa47cd6ecbbcfe718334fcbc
Opcode Fuzzy Hash: f27f08862ed75a11f60147ecb178d8ad76df11be8b65570a4d5faecc6f6d5d29
Instruction Fuzzy Hash: A141A231304A8C86FBF79B20E4413DA63A1FB9CB94F449121BA6E476D5DF69C74C8700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180047EC0 Relevance: 7.6, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,?,?,000000018004BEA4), ref: 0000000180047F18
CreateEventA.KERNEL32(?,?,?,?,?,000000018004BEA4), ref: 0000000180047F28

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CreateCriticalEventInitializeSection
String ID:
API String ID: 2948115387-0
Opcode ID: 92fbf76cb88296915da757d29c98939f2ddd2a17b26dd985f5833f2e2b40f7fd
Instruction ID: be7e0f58a337ead562f9325772191238a007a2055be4571096901461ac4615bd
Opcode Fuzzy Hash: 92fbf76cb88296915da757d29c98939f2ddd2a17b26dd985f5833f2e2b40f7fd
Instruction Fuzzy Hash: D1418C36300B0482EB86DF25E45439A73A5FB8DB98F488225EF5D47799DF38C659C704

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004E110 Relevance: 7.6, APIs: 5, Instructions: 91networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 000000018004E135

Part of subcall function 000000018004C660: ioctlsocket.WS2_32 ref: 000000018004C67B

connect.WS2_32 ref: 000000018004E165
WSAGetLastError.WS2_32 ref: 000000018004E17E
getsockopt.WS2_32 ref: 000000018004E1AF
closesocket.WS2_32 ref: 000000018004E20E

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: ErrorLastclosesocketconnectgetsockoptioctlsocketsocket
String ID:
API String ID: 4130793707-0
Opcode ID: e98fdf225a7e3dd375d57c8ffba94f9efe440dd21e9565f8f829ff09d4fda712
Instruction ID: 82d4cb1e292c85e3eb848b6054ef754ca3f48c26c769ccadaa5c312ba9f5046a
Opcode Fuzzy Hash: e98fdf225a7e3dd375d57c8ffba94f9efe440dd21e9565f8f829ff09d4fda712
Instruction Fuzzy Hash: 6D31B436340A9886F7925F65E4843A9A355A74DBE8F048130EF5D877E4EEB8C6C98708

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180033860 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018003394B
LeaveCriticalSection.KERNEL32 ref: 000000018003395C

Strings

[%s:%d] %s: uc:: %p uninit_cb %p, uninit_cb_ctx: %p, xrefs: 0000000180033913
bdnc_rpc_uninit, xrefs: 0000000180033931
..\src\rpc\rpc_server.c, xrefs: 0000000180033907

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\rpc\rpc_server.c$[%s:%d] %s: uc:: %p uninit_cb %p, uninit_cb_ctx: %p$bdnc_rpc_uninit
API String ID: 3168844106-3466849464
Opcode ID: 4b274b643260cd595935a2272eb26db8ee367b5548dfd8a13621337052c13f0a
Instruction ID: ae5cc7343d858c8fcfdd9a89bd2c98f29dce470cb5912bdbd501eded6ac714dd
Opcode Fuzzy Hash: 4b274b643260cd595935a2272eb26db8ee367b5548dfd8a13621337052c13f0a
Instruction Fuzzy Hash: 19316E72204B88C6EB96DF11E4443AEB7B4F789B84F50811AEB8D47B95CF79C658CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B3D0 Relevance: 7.6, APIs: 5, Instructions: 71synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 000000018001B43A
LeaveCriticalSection.KERNEL32 ref: 000000018001B472
WaitForSingleObject.KERNEL32 ref: 000000018001B481
EnterCriticalSection.KERNEL32 ref: 000000018001B48E
CloseHandle.KERNEL32 ref: 000000018001B4B4

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CloseCreateEnterEventHandleLeaveObjectSingleWait
String ID:
API String ID: 2040285216-0
Opcode ID: 45cbce1aac5454b4c528fb41922c458fc7f06567335373b44a584a6670801366
Instruction ID: 4b8ddacb18f41e7bd915431af2756e142325291e67d16ff2178cc58486baa7cf
Opcode Fuzzy Hash: 45cbce1aac5454b4c528fb41922c458fc7f06567335373b44a584a6670801366
Instruction Fuzzy Hash: 2A31F835201F4886EB969F65F8A03A933A5BB8CB94F15C025DD5E873A1DF38CA9DC350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007710 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 62COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,0000000180006903), ref: 0000000180007739
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,0000000180006903), ref: 0000000180007768

Strings

..\src\bootstrap_requests.c, xrefs: 000000018000779F
get_server_in_use, xrefs: 00000001800077B2
[%s:%d] %s: using '%s' for bootstrap, xrefs: 00000001800077AB

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\bootstrap_requests.c$[%s:%d] %s: using '%s' for bootstrap$get_server_in_use
API String ID: 3168844106-2759011966
Opcode ID: 1dbde184db15ae1564fbd4efa6912e340ed183488bff0532649f7c6abad01482
Instruction ID: b228d881ab95364eee0434aefafa85cab198e6d6128ad548623a57b8935f56a8
Opcode Fuzzy Hash: 1dbde184db15ae1564fbd4efa6912e340ed183488bff0532649f7c6abad01482
Instruction Fuzzy Hash: 0A214835700B4986EAD2DB15A8453E973A1BB9D7C0F889521FE8E477A2DE3CC61DC700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000AAF0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018000AB10
LeaveCriticalSection.KERNEL32 ref: 000000018000AB8C

Strings

[%s:%d] %s: closed %d conns, xrefs: 000000018000ABB8
conn_pool_flush, xrefs: 000000018000AB96
..\src\conn_pool.c, xrefs: 000000018000ABAC

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\conn_pool.c$[%s:%d] %s: closed %d conns$conn_pool_flush
API String ID: 3168844106-2818039318
Opcode ID: c30361e4588053d347f7da0ee1f4b73222ce94e47ff0c482c0ec520e01931182
Instruction ID: 795a0993610d39dcc86ed79424fb5c34b8b80a6376800435f3339eb45ffcb57d
Opcode Fuzzy Hash: c30361e4588053d347f7da0ee1f4b73222ce94e47ff0c482c0ec520e01931182
Instruction Fuzzy Hash: 1E211B36204B8486EB92DF16E450399B7A5F34CF94F488121EF4D47729CF78C659C784

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D170 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 000000018000D199

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

..\src\global_state.c, xrefs: 000000018000D1A2
add_deferred2_cb, xrefs: 000000018000D1AC
[%s:%d][ERR] %s: no tls value, xrefs: 000000018000D23B
[%s:%d] %s: defer:%p, xrefs: 000000018000D1BA

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThreadValue
String ID: ..\src\global_state.c$[%s:%d] %s: defer:%p$[%s:%d][ERR] %s: no tls value$add_deferred2_cb
API String ID: 938596877-2559096411
Opcode ID: 2f8d48d296023333bbe0a4ea6773dec48edcc17d579cb20ed922ae2a79e95a00
Instruction ID: d58e17015753ad9314fdceabc259c09050d6ae1ff07f16561ec3783be693913f
Opcode Fuzzy Hash: 2f8d48d296023333bbe0a4ea6773dec48edcc17d579cb20ed922ae2a79e95a00
Instruction Fuzzy Hash: 5B215936204B4885E792CF52F44439AB7A8F78CBC0F59812AEA8C47B65CF79C669C744

Uniqueness

Uniqueness Score: -1.00%

Function 000000018025019C Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000001802501C4
_set_statfp.LIBCMT ref: 00000001802501DF
_set_statfp.LIBCMT ref: 00000001802501FB
_set_statfp.LIBCMT ref: 0000000180250237

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: a47e8a96681cae208dd7e58e20b9541c68d7121ab1c0bd7d305ff87d73d86bf7
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: 2611A772A10A1AC1F6E61168FCCE3F910436B5C370F05C624BE67472DB8EE68E49870C

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B2E0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018000B348
LeaveCriticalSection.KERNEL32 ref: 000000018000B358

Strings

[%s:%d] %s: test request status: %d, xrefs: 000000018000B339
test_req_cb, xrefs: 000000018000B317
..\src\conn_pool.c, xrefs: 000000018000B32D

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\conn_pool.c$[%s:%d] %s: test request status: %d$test_req_cb
API String ID: 3168844106-348288455
Opcode ID: 788f56574136d824df9f8acd5da6c3e54cb4ac2d83d8257f79bcaf65f0849bc8
Instruction ID: 55ad0f9963340c6fc357a40262f2ddbb39df0fdbaa8febdf21ce3d9b5a943f02
Opcode Fuzzy Hash: 788f56574136d824df9f8acd5da6c3e54cb4ac2d83d8257f79bcaf65f0849bc8
Instruction Fuzzy Hash: AE21D172604B8886E7A2CF20E8003D9B3A5F748BD4F148521FF8587BA5DF78CB598B45

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002B67 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180002B79
LeaveCriticalSection.KERNEL32 ref: 0000000180002B90

Strings

[%s:%d][ERR] %s: (%p, %d (%s), '%s', ... ) => %d %s, xrefs: 0000000180002C8D
..\src\api.c, xrefs: 00000001800033E5
__bdnimbus_set_optionv, xrefs: 00000001800033DA

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\api.c$[%s:%d][ERR] %s: (%p, %d (%s), '%s', ... ) => %d %s$__bdnimbus_set_optionv
API String ID: 3168844106-3420288915
Opcode ID: 25ddfb83e29ce44af68a9fc84dd7b981b9875d78a8293f65dd1941c097e4ea35
Instruction ID: fd8031424561f2a50685e5724edb69696d366670552c7967d0d0b846752dca86
Opcode Fuzzy Hash: 25ddfb83e29ce44af68a9fc84dd7b981b9875d78a8293f65dd1941c097e4ea35
Instruction Fuzzy Hash: CD113036304B4882E6E3DB45B4953DAB3A9B78D3A0F188416BE4A47795DF79C78D8700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D080 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 000000018000D0A0

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

..\src\global_state.c, xrefs: 000000018000D0A9
add_deferred_cb, xrefs: 000000018000D0B3
[%s:%d][ERR] %s: no tls value, xrefs: 000000018000D13E
[%s:%d] %s: defer:%p, xrefs: 000000018000D0C1

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThreadValue
String ID: ..\src\global_state.c$[%s:%d] %s: defer:%p$[%s:%d][ERR] %s: no tls value$add_deferred_cb
API String ID: 938596877-285705756
Opcode ID: 72aaddcbab316d0e23d5338872f0a7bdb38fc5ef0cb08674e4ea1343df58576a
Instruction ID: c8a8ff3a8bcd7d6cfe73623ca6607efb015f8ad1120208db7c37881ca87feb6e
Opcode Fuzzy Hash: 72aaddcbab316d0e23d5338872f0a7bdb38fc5ef0cb08674e4ea1343df58576a
Instruction Fuzzy Hash: CF214772205F4895EB92DF01F84439977A5F78CB80F48C52AEA8C87765DFB8C668C744

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180245338 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000000018024324B,?,?,00000000,00000001802434E6,?,?,?,?,?,000000018022F9A3), ref: 0000000180245357
FlsSetValue.KERNEL32(?,?,?,000000018024324B,?,?,00000000,00000001802434E6,?,?,?,?,?,000000018022F9A3), ref: 0000000180245376
FlsSetValue.KERNEL32(?,?,?,000000018024324B,?,?,00000000,00000001802434E6,?,?,?,?,?,000000018022F9A3), ref: 000000018024539E
FlsSetValue.KERNEL32(?,?,?,000000018024324B,?,?,00000000,00000001802434E6,?,?,?,?,?,000000018022F9A3), ref: 00000001802453AF
FlsSetValue.KERNEL32(?,?,?,000000018024324B,?,?,00000000,00000001802434E6,?,?,?,?,?,000000018022F9A3), ref: 00000001802453C0

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b7a2a8410df512859f03416aeffe42ceb84a6c54b6a0ccb28e37e5694552d66f
Instruction ID: 86f3b37fc4dbba8f65f1812321c188053e0cc066a773b606751227958da6a6bc
Opcode Fuzzy Hash: b7a2a8410df512859f03416aeffe42ceb84a6c54b6a0ccb28e37e5694552d66f
Instruction Fuzzy Hash: B011D330704B1841FADB972959D93ED22A35F8C7F0F0AC36468B946AD7DEE8D6498300

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A830 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018002A857
LeaveCriticalSection.KERNEL32 ref: 000000018002A867
SetEvent.KERNEL32 ref: 000000018002A8B5
SetEvent.KERNEL32 ref: 000000018002A8C5
LeaveCriticalSection.KERNEL32 ref: 000000018002A8CF

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EventLeave$Enter
String ID:
API String ID: 1122070342-0
Opcode ID: 0decf1d0251684fd8282ad892097de0c6d370d480a779acd307e2e40a4bb68a0
Instruction ID: a22baeb204cd0895b1052237d962a01552b22a454fe05fdf9137959a55f7555e
Opcode Fuzzy Hash: 0decf1d0251684fd8282ad892097de0c6d370d480a779acd307e2e40a4bb68a0
Instruction Fuzzy Hash: 60216D76615A48C2EB968F61D84436C73A1FB89F99F089021EA0A47694DF39CEDAC700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B7D0 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018001B7E1
LeaveCriticalSection.KERNEL32 ref: 000000018001B846

Strings

..\src\ssl\ssl_ctx.c, xrefs: 000000018001B87E
ssl_global_uninit, xrefs: 000000018001B871
[%s:%d] %s: SSL global uninit done, xrefs: 000000018001B88A

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\ssl\ssl_ctx.c$[%s:%d] %s: SSL global uninit done$ssl_global_uninit
API String ID: 3168844106-4231627440
Opcode ID: e7cea2bff40ef3230d41f8516d995d73bd1a1d8f8f5d877c38df8ae32a39a22f
Instruction ID: 96e9cd532eed0d4eaaef8dcce5a93d363e65d5a741b261ac1fba4fe924452841
Opcode Fuzzy Hash: e7cea2bff40ef3230d41f8516d995d73bd1a1d8f8f5d877c38df8ae32a39a22f
Instruction Fuzzy Hash: 9C215834301A5888FBD7EB21F8553E173AABB4CBC5F54C116AD4A426A1CF79878CC340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002AB5 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180002ABF
LeaveCriticalSection.KERNEL32 ref: 0000000180002B53

Strings

[%s:%d] %s: (%p, %d (%s), '%s', ... ) => 0 , xrefs: 0000000180002A4C
..\src\api.c, xrefs: 0000000180002A40
__bdnimbus_set_optionv, xrefs: 0000000180002A57

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\api.c$[%s:%d] %s: (%p, %d (%s), '%s', ... ) => 0 $__bdnimbus_set_optionv
API String ID: 3168844106-3113967066
Opcode ID: 8a33aeb8260c3deee69b2dbd8f5f921939c60bacd7aa7a8f9c175d9843a9132e
Instruction ID: 5b4036d32402e0838f070e41bf3359d168dc1da95eb6bd46d079f05c8639675f
Opcode Fuzzy Hash: 8a33aeb8260c3deee69b2dbd8f5f921939c60bacd7aa7a8f9c175d9843a9132e
Instruction Fuzzy Hash: 36012936200B4886E6E3DB10F8983D97365B78D3A5F948016FE8A576A5DF38C78DC304

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002B18 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180002B22
LeaveCriticalSection.KERNEL32 ref: 0000000180002B53

Strings

[%s:%d] %s: (%p, %d (%s), '%s', ... ) => 0 , xrefs: 0000000180002A4C
..\src\api.c, xrefs: 0000000180002A40
__bdnimbus_set_optionv, xrefs: 0000000180002A57

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\api.c$[%s:%d] %s: (%p, %d (%s), '%s', ... ) => 0 $__bdnimbus_set_optionv
API String ID: 3168844106-3113967066
Opcode ID: ba6bb5018df3efbfeb9880a7fec7239d659dfb3dc0786f9bd16111840b9382ce
Instruction ID: 693b2808d39fdda9ddbe9e3e90a8f201a7e06ccbd0e148f88b5272e47cec5846
Opcode Fuzzy Hash: ba6bb5018df3efbfeb9880a7fec7239d659dfb3dc0786f9bd16111840b9382ce
Instruction Fuzzy Hash: 8D012936200B4886E6E3DB10F8943D97365B78D3A5F948516FE8A576A5DF38C78DC304

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000CCC0 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180023510: EnterCriticalSection.KERNEL32(?,?,00000000,0000000180019A64), ref: 0000000180023529
Part of subcall function 0000000180023510: LeaveCriticalSection.KERNEL32(?,?,00000000,0000000180019A64), ref: 0000000180023544

Part of subcall function 00000001800230C0: EnterCriticalSection.KERNEL32(?,?,?,?,?,000000018001988F), ref: 00000001800230DF
Part of subcall function 00000001800230C0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,000000018001988F), ref: 00000001800231AB

EnterCriticalSection.KERNEL32 ref: 000000018000CCDD
LeaveCriticalSection.KERNEL32 ref: 000000018000CD6E

Strings

..\src\global_state.c, xrefs: 000000018000CD31
set_runtime_configuration, xrefs: 000000018000CD38
[%s:%d] %s: new runtime_settings: %p | old: %p, xrefs: 000000018000CD4F

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\global_state.c$[%s:%d] %s: new runtime_settings: %p | old: %p$set_runtime_configuration
API String ID: 3168844106-926155798
Opcode ID: ae87472ef7f049c07e4db9ee48789db4c451a54f15c44e8c38a3ebdfbe86e4b6
Instruction ID: c6f73a34b41ee7b9542861018fb298e76f288c9d628ad152982f306bafa4115e
Opcode Fuzzy Hash: ae87472ef7f049c07e4db9ee48789db4c451a54f15c44e8c38a3ebdfbe86e4b6
Instruction Fuzzy Hash: AC11C2B4210B0984EAC2EB51F8953D973A4BB8C780F55D526AC5E53761EE3CC75CC350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007EF0 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180007EFF
LeaveCriticalSection.KERNEL32 ref: 0000000180007F29

Strings

..\src\bootstrap_requests.c, xrefs: 0000000180007F54
get_server_in_use, xrefs: 0000000180007F6D
[%s:%d] %s: using '%s' for bootstrap, xrefs: 0000000180007F60

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\bootstrap_requests.c$[%s:%d] %s: using '%s' for bootstrap$get_server_in_use
API String ID: 3168844106-2759011966
Opcode ID: 4a061f32318d102704a72ba4af49c11e84d15e33e847691cf68d6d16f2f27f2a
Instruction ID: 5fd0539af7aaf33631f86e75cb245d35ef348e465ef4ae1e8ae341bf5e372193
Opcode Fuzzy Hash: 4a061f32318d102704a72ba4af49c11e84d15e33e847691cf68d6d16f2f27f2a
Instruction Fuzzy Hash: 5D018835700A4A82EAD3DF20E8553E573A0BB5C781F488432AE4E066A2EE2CC35DC304

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002B32 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180002B3C
LeaveCriticalSection.KERNEL32 ref: 0000000180002B53

Strings

[%s:%d] %s: (%p, %d (%s), '%s', ... ) => 0 , xrefs: 0000000180002A4C
..\src\api.c, xrefs: 0000000180002A40
__bdnimbus_set_optionv, xrefs: 0000000180002A57

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\api.c$[%s:%d] %s: (%p, %d (%s), '%s', ... ) => 0 $__bdnimbus_set_optionv
API String ID: 3168844106-3113967066
Opcode ID: e1780a604520911bfc75e7f7e09f083ce212bc6189ae514f81ab2b90515fa2f1
Instruction ID: 0341176769dab752b3e04aff50f8778375d4b74893e613b3ae60a8a28fb44a9c
Opcode Fuzzy Hash: e1780a604520911bfc75e7f7e09f083ce212bc6189ae514f81ab2b90515fa2f1
Instruction Fuzzy Hash: CF012536200B4886E6A3DB10F8983D97365B78A3A5F848016FE8A577A5DE38C78DC304

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002BBB Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180002BCE
LeaveCriticalSection.KERNEL32 ref: 0000000180002BE5

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

..\src\api.c, xrefs: 0000000180002BF7
[%s:%d] %s: (%p, %d (%s), %d ... ) => 0 , xrefs: 0000000180002C03
__bdnimbus_set_optionv, xrefs: 0000000180002C0E

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CurrentThread
String ID: ..\src\api.c$[%s:%d] %s: (%p, %d (%s), %d ... ) => 0 $__bdnimbus_set_optionv
API String ID: 266293576-4040927558
Opcode ID: 8dba8f743c2cd7c3bd27af379d033068daf06d24a557416dd2a34c924912a3f6
Instruction ID: b16ca7db4fb2f36a3bd13c09d439c5c0c0e2d980696d3696a1cbbf1aa5e6a954
Opcode Fuzzy Hash: 8dba8f743c2cd7c3bd27af379d033068daf06d24a557416dd2a34c924912a3f6
Instruction Fuzzy Hash: 07015E36214A4886E6D3DF10F8943DA7725F78D794F408016EE8B166A5DF38C78DD704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180048280 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180048294
LeaveCriticalSection.KERNEL32 ref: 00000001800482A8

Strings

[%s:%d] %s: calling user_context_signal_uninit, xrefs: 00000001800482E0
..\src\upload\upload.c, xrefs: 00000001800482D4
upload_uninit_context, xrefs: 00000001800482C7

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ..\src\upload\upload.c$[%s:%d] %s: calling user_context_signal_uninit$upload_uninit_context
API String ID: 3168844106-3983560504
Opcode ID: 5afb68360c52635bd743f949f41229abb65429b2f30444eabe8834a6c7c08173
Instruction ID: 5302713692c8562e03ac7c0eb654555d3d09c5b0a255550fa6b85023ac3b1ab3
Opcode Fuzzy Hash: 5afb68360c52635bd743f949f41229abb65429b2f30444eabe8834a6c7c08173
Instruction Fuzzy Hash: 7DF08C34200A8895EBC39B01F9983EAA365BB4D7D4F44C421AE49076A2DFA8C74DC304

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000C530 Relevance: 7.5, APIs: 5, Instructions: 25synchronizationCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 000000018000C547
WaitForSingleObject.KERNEL32 ref: 000000018000C559
EnterCriticalSection.KERNEL32 ref: 000000018000C566
WaitForSingleObject.KERNEL32 ref: 000000018000C586
CloseHandle.KERNEL32 ref: 000000018000C593

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalObjectSectionSingleWait$CloseEnterHandleLeave
String ID:
API String ID: 1472654478-0
Opcode ID: f98f9037a1e57bdeef089646d29685b89a1258416e2968abd0640d4b4f883a84
Instruction ID: e699344cdf16340ead0ab4c0fe4fcf2034eb00f8c0dc9b59fe482f430d2aee4b
Opcode Fuzzy Hash: f98f9037a1e57bdeef089646d29685b89a1258416e2968abd0640d4b4f883a84
Instruction Fuzzy Hash: 9FF0EC39210A088AFBC69B15FC997D43321B79E772F41C300EC2A963F0DF289A8D8305

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A1F0 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 19COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018000A1FD
LeaveCriticalSection.KERNEL32 ref: 000000018000A210

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

[%s:%d] %s: %d, xrefs: 000000018000A233
..\src\dns_client.c, xrefs: 000000018000A227
get_randomize_option, xrefs: 000000018000A220

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CurrentThread
String ID: ..\src\dns_client.c$[%s:%d] %s: %d$get_randomize_option
API String ID: 266293576-3551041418
Opcode ID: 2e6f64e3cb6effd3f51fa02ad0638c376460dff5ea1e078bf735267d762e3cbb
Instruction ID: 533db360eb9c5ff80f261fab3edd5af8d3affda2ae6acefe486faf22b4363c4b
Opcode Fuzzy Hash: 2e6f64e3cb6effd3f51fa02ad0638c376460dff5ea1e078bf735267d762e3cbb
Instruction Fuzzy Hash: 01F01539220A8E96EB92DF10F8997C87321F35C356F409512ED0A52274EE79875DC758

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180245EB0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018024618F

Part of subcall function 000000018024E500: _invalid_parameter_noinfo.LIBCMT ref: 000000018024E51D

Strings

UTF-8, xrefs: 000000018024610E
ccs, xrefs: 00000001802460CA
UTF-16LEUNICODE, xrefs: 000000018024612D

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 15c53ed66eed965ca6c2dc6a4d6ba78aac988be83aa6059c1a94fbdbec60fde7
Instruction ID: 4cb0ca05417a9c82e46e229f71b77368ce365810b6b63f5cd012f9736271fd65
Opcode Fuzzy Hash: 15c53ed66eed965ca6c2dc6a4d6ba78aac988be83aa6059c1a94fbdbec60fde7
Instruction Fuzzy Hash: 9381DF72600E1885FBE78F29C19C3E826B2B319B88F57D005DA06576A5DFA9CB4D8703

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800344A0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 214COMMON

Download Yara Rule

Strings

bdnc_rpc_upload_file, xrefs: 0000000180034531
[%s:%d] %s: deserialize_bdnimbus_upload_file_inline failed, xrefs: 000000018003453E
..\src\rpc\rpc_server.c, xrefs: 000000018003452A

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: ..\src\rpc\rpc_server.c$[%s:%d] %s: deserialize_bdnimbus_upload_file_inline failed$bdnc_rpc_upload_file
API String ID: 2351996187-1210292844
Opcode ID: bc0b0475c7717a3f91001ac3ef0de327ca8f26b94db0e245b70005c4efb894a8
Instruction ID: 06a63cfa291acc41b27b0526fc9b6d3231e4f4c3bfc479e02f2a95442617c7c4
Opcode Fuzzy Hash: bc0b0475c7717a3f91001ac3ef0de327ca8f26b94db0e245b70005c4efb894a8
Instruction Fuzzy Hash: 55919B76B04B889AEB52DFA1E4507EE37B4F359B88F418215EE092BB45DF34D269C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180034C70 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 203COMMON

Download Yara Rule

Strings

bdnc_rpc_upload_gen, xrefs: 0000000180034D03
[%s:%d] %s: deserialize_bdnimbus_upload_gen_inline failed, xrefs: 0000000180034D10
..\src\rpc\rpc_server.c, xrefs: 0000000180034CFC

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: ..\src\rpc\rpc_server.c$[%s:%d] %s: deserialize_bdnimbus_upload_gen_inline failed$bdnc_rpc_upload_gen
API String ID: 2351996187-2168660724
Opcode ID: 06c3ebbf208fc813c83d2f6005ad9efdbc64ca1b973a46240bad44ffd553c89f
Instruction ID: 27335c92925b1bbbf9020a3ea56e958da044f0759986471e79a56d56d122a06d
Opcode Fuzzy Hash: 06c3ebbf208fc813c83d2f6005ad9efdbc64ca1b973a46240bad44ffd553c89f
Instruction Fuzzy Hash: BB913972A04B889AEB52DF61E4507DE33B5F349B88F418216EE4D1BB45DF34D669C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008860 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180008A2E
SetEvent.KERNEL32 ref: 0000000180008A4E
LeaveCriticalSection.KERNEL32 ref: 0000000180008A5B

Strings

/_ServerStatus, xrefs: 0000000180008879

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: /_ServerStatus
API String ID: 3094578987-1363190917
Opcode ID: 29a76cc0515ce3dddeb5c8969c67fe73fbe133084c542fd9a1b267b199e7b7d3
Instruction ID: 9d3696cb985281fa855691415d401aa2e86bb96b8c8f4e95b72f76114873efc9
Opcode Fuzzy Hash: 29a76cc0515ce3dddeb5c8969c67fe73fbe133084c542fd9a1b267b199e7b7d3
Instruction Fuzzy Hash: 0D518D32200A88CAE796DF25E8447E977A1F78CB89F1D8031EE4A57769CF34CA49D700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180049C50 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 0000000180049D99

Part of subcall function 000000018001EB50: GetLastError.KERNEL32 ref: 000000018001EB5D

Strings

[%s:%d] %s: finished, xrefs: 0000000180049CAF
..\src\upload\upload.c, xrefs: 0000000180049CA3
upload_write_cb, xrefs: 0000000180049C96

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: ErrorLast_fread_nolock
String ID: ..\src\upload\upload.c$[%s:%d] %s: finished$upload_write_cb
API String ID: 2193046044-2943853338
Opcode ID: 1bd6f5bc475f19adba1666210a2f60dc78c20aa4d017a727306a608c8bb36414
Instruction ID: b12a8a1a430e0e96d2296149c35560d84832282d807004a06b225f4bededbf50
Opcode Fuzzy Hash: 1bd6f5bc475f19adba1666210a2f60dc78c20aa4d017a727306a608c8bb36414
Instruction Fuzzy Hash: B841AF32301E4886EBA29B96E5803EA23A1F78C7D8F418135EF5D53B95EF74C6688704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180185780 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,000000018000102B), ref: 0000000180185816
GetProcAddress.KERNEL32(?,000000018000102B), ref: 000000018018587E

Strings

OPENSSL_Applink, xrefs: 0000000180185877
OPENSSL_Uplink(%p,%02X): , xrefs: 00000001801857B2

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: OPENSSL_Applink$OPENSSL_Uplink(%p,%02X):
API String ID: 1646373207-2538489275
Opcode ID: cf76ad8af8b8aa93f197532fcf8e1762a47f50932cccc9e398c88686fa17c923
Instruction ID: 487988acc7e193bad17f219eccaf2330b15d1d54057c3acfe8ce19506f3e366c
Opcode Fuzzy Hash: cf76ad8af8b8aa93f197532fcf8e1762a47f50932cccc9e398c88686fa17c923
Instruction Fuzzy Hash: 5F514731905F48C5E7928F29E8643A473A1F75C778F45E706EAA9122E5EF78D389C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002D000 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 000000018002D021

Strings

..\src\push_conn.c, xrefs: 000000018002D0C3
[%s:%d] %s: pc = %p, push_id %s, host: %s, port : %hu, xrefs: 000000018002D0CF
push_connection_search, xrefs: 000000018002D0B7

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: htons
String ID: ..\src\push_conn.c$[%s:%d] %s: pc = %p, push_id %s, host: %s, port : %hu$push_connection_search
API String ID: 4207154920-2643372058
Opcode ID: ceace81ff43f0cfa5b89c5349cee157d8402080e34e9870918fd7df3a6e2a4c1
Instruction ID: 2514ca7334aab2fa6c8bdee46ddde592edab9097aa6b9c4af34de514032d05ed
Opcode Fuzzy Hash: ceace81ff43f0cfa5b89c5349cee157d8402080e34e9870918fd7df3a6e2a4c1
Instruction Fuzzy Hash: 3521917160478C80EBD35F22A4803EA77A5F348BC4F488126FF89437A9DEB8CA59C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008AF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180008BB1
SetEvent.KERNEL32 ref: 0000000180008BD1
LeaveCriticalSection.KERNEL32 ref: 0000000180008BDE

Strings

uuid, xrefs: 0000000180008B50

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: uuid
API String ID: 3094578987-3514781862
Opcode ID: 2869479280abbe5ba55ccd72236d0f118442b63c67f1d8a737fa671eb3e9a4b8
Instruction ID: 3726c9dd8a9b249ee703ed9eec6ba6d7c5ef51765c02eae076e2314d6a81b94b
Opcode Fuzzy Hash: 2869479280abbe5ba55ccd72236d0f118442b63c67f1d8a737fa671eb3e9a4b8
Instruction Fuzzy Hash: BE318931201B4885EAE2DB25E4653D933A1FB4CB94F448221EE9D07792DF78CA09C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004F8A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 000000018004F8E0
closesocket.WS2_32 ref: 000000018004F900
closesocket.WS2_32 ref: 000000018004F90A

Strings

fcntl(%d, F_GETFL), xrefs: 000000018004F8EE

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: closesocket$ioctlsocket
String ID: fcntl(%d, F_GETFL)
API String ID: 1937125420-1431147513
Opcode ID: 33a234d68136742b4145d0c4f6d7b203b08b3b5dbafa5e13e41a4da49908a5d6
Instruction ID: c2109fc3fd483216e22ae579cea1f00feda910552a381b65202e912095569648
Opcode Fuzzy Hash: 33a234d68136742b4145d0c4f6d7b203b08b3b5dbafa5e13e41a4da49908a5d6
Instruction Fuzzy Hash: 26119432610E8482D7A19F75E8943987362E749BF8F149301FA764B7E8DF74C599C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025B80 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 0000000180025BCC

Strings

network_awareness_create_th, xrefs: 0000000180025BDB
..\src\win\net_awareness.c, xrefs: 0000000180025BE8
[%s:%d][ERR] %s: failed to create network_awareness thread, xrefs: 0000000180025BF4

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CreateThread
String ID: ..\src\win\net_awareness.c$[%s:%d][ERR] %s: failed to create network_awareness thread$network_awareness_create_th
API String ID: 2422867632-2603990020
Opcode ID: e891083bcac75546d63e7c1c2e86a17605732579f68ae65e68ccd66e2aceae60
Instruction ID: 5691c1647aec7589dd56db06e68458023a44fe92e65cf115a85bed215ecf7188
Opcode Fuzzy Hash: e891083bcac75546d63e7c1c2e86a17605732579f68ae65e68ccd66e2aceae60
Instruction Fuzzy Hash: C8018F7020170841FFD79B20A4563EA6395AB4C795F988039BD8E46391FF7CC35C8348

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026320 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 000000018002634B

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

network_awareness_create_th, xrefs: 000000018002635A
..\src\win\net_awareness.c, xrefs: 0000000180026367
[%s:%d][ERR] %s: failed to create network_awareness thread, xrefs: 0000000180026373

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSectionThread$CreateCurrentEnterLeave
String ID: ..\src\win\net_awareness.c$[%s:%d][ERR] %s: failed to create network_awareness thread$network_awareness_create_th
API String ID: 1012222349-2603990020
Opcode ID: 2c148ef70ba3913e07cd6a4c53cd2bc1b6b9cf92f60995e14851d85e7f82f741
Instruction ID: e678413c495a60392eece61099325daa3caaafa476602e9586cb111eccbafe9c
Opcode Fuzzy Hash: 2c148ef70ba3913e07cd6a4c53cd2bc1b6b9cf92f60995e14851d85e7f82f741
Instruction Fuzzy Hash: FDF067B5601B0881FB928B20E40A3D62394A70C394F884126B98D477A0EF7CC39CC748

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E754 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 18networkCOMMON

Download Yara Rule

APIs

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

WSACleanup.WS2_32 ref: 000000018001DCED

Strings

..\src\global_state.c, xrefs: 000000018000E754
global_state_uninit_nolock, xrefs: 000000018000E766
[%s:%d] %s: max contexts: %d, xrefs: 000000018000E75F

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CleanupCurrentEnterLeaveThread
String ID: ..\src\global_state.c$[%s:%d] %s: max contexts: %d$global_state_uninit_nolock
API String ID: 1588925717-2876554725
Opcode ID: 12d778b7b55d83f0f1f9e86a46daa3854674e63b9d536350ecd4bed721a7efb2
Instruction ID: c1ea444a4ceb6cabd092afe48156af485b9e74938327c445aa6633b684d85d0d
Opcode Fuzzy Hash: 12d778b7b55d83f0f1f9e86a46daa3854674e63b9d536350ecd4bed721a7efb2
Instruction Fuzzy Hash: 0CF039B5A01B0EC6F7E66B11B84D7D433A5B34D389F808112E80A032A1DEBD838CCB49

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029550 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 13COMMON

Download Yara Rule

APIs

InitSecurityInterfaceA.SECUR32 ref: 0000000180029554

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

mech_sspi_global_init, xrefs: 0000000180029573
..\src\win\proxy_auth_sspi.c, xrefs: 000000018002955E
[%s:%d] %s: sspi_fcn: %p, xrefs: 000000018002956C

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CurrentEnterInitInterfaceLeaveSecurityThread
String ID: ..\src\win\proxy_auth_sspi.c$[%s:%d] %s: sspi_fcn: %p$mech_sspi_global_init
API String ID: 4088951990-3800096021
Opcode ID: 6313d900ae708462f74c3dfedc8b8304d90ef00413557a358aad2c9f998d757b
Instruction ID: 0555ff358264ebf01caaee1b5ec352f38bb3e38f07220c584fccb7b0e248e63b
Opcode Fuzzy Hash: 6313d900ae708462f74c3dfedc8b8304d90ef00413557a358aad2c9f998d757b
Instruction Fuzzy Hash: F2E0EC75605B4981F692AB40F40B7C537A6BB5C344F408166A58D07766EFBDC31DCB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B4B0 Relevance: 6.3, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018000B4D4
EnterCriticalSection.KERNEL32 ref: 000000018000B4F6
LeaveCriticalSection.KERNEL32 ref: 000000018000B506
LeaveCriticalSection.KERNEL32 ref: 000000018000B537
LeaveCriticalSection.KERNEL32 ref: 000000018000B549

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: c83de9d3dba140588c0c6fcc39651d55cdd8065b9784165bb7670c7273cf5919
Instruction ID: e5cb3ffc411dcef483e0cf1edcca52ff18fb2d10796c112ed105cf3b6adde431
Opcode Fuzzy Hash: c83de9d3dba140588c0c6fcc39651d55cdd8065b9784165bb7670c7273cf5919
Instruction Fuzzy Hash: 35113436210F4882EB91CF21F88439973A4F34CB84F498412EE8A837A4CF79CA9DC740

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004EF30 Relevance: 6.2, APIs: 4, Instructions: 233networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 000000018004F0E4
htons.WS2_32 ref: 000000018004F115

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: getaddrinfohtons
String ID:
API String ID: 1484439025-0
Opcode ID: 57954d870889008c809453f293f23d4166478da08301828321d14d8bd1b28f9f
Instruction ID: 2380cd41e6dc4490564ff52e2c6584245b849384f9dfaffe19a7d1b369c71104
Opcode Fuzzy Hash: 57954d870889008c809453f293f23d4166478da08301828321d14d8bd1b28f9f
Instruction Fuzzy Hash: 60A17B36A00A888AFBB68F61D5803FD23A0F74C78CF26C119EE4956795DF74C698C709

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004D8F0 Relevance: 6.2, APIs: 4, Instructions: 213networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 000000018004DA6C
htons.WS2_32 ref: 000000018004DAB0
freeaddrinfo.WS2_32 ref: 000000018004DAC7
htons.WS2_32 ref: 000000018004DA9B

Part of subcall function 00000001800503A0: getaddrinfo.WS2_32 ref: 00000001800503EE
Part of subcall function 00000001800503A0: getaddrinfo.WS2_32 ref: 0000000180050409
Part of subcall function 00000001800503A0: getaddrinfo.WS2_32 ref: 0000000180050430
Part of subcall function 00000001800503A0: freeaddrinfo.WS2_32 ref: 00000001800504A2
Part of subcall function 00000001800503A0: freeaddrinfo.WS2_32 ref: 00000001800504BA
Part of subcall function 00000001800503A0: freeaddrinfo.WS2_32 ref: 00000001800504CA

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: freeaddrinfogetaddrinfo$htons
String ID:
API String ID: 2268499712-0
Opcode ID: 8f0bf30cf846410c28a52d9b2b01f32249ca06e1f610130f4e9ed60cc2a33c04
Instruction ID: 829fca35fb16e5c3e49c30a116161fe24adeb8683a5a1f3d45ee309294b66405
Opcode Fuzzy Hash: 8f0bf30cf846410c28a52d9b2b01f32249ca06e1f610130f4e9ed60cc2a33c04
Instruction Fuzzy Hash: 90918E32604A8CCAFBA68F21D4843ED33A0F70D79CF16D156EE4956685DF38CA98C749

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180238B48 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180238B89
_invalid_parameter_noinfo.LIBCMT ref: 0000000180238C09
_invalid_parameter_noinfo.LIBCMT ref: 0000000180238C5D
_get_daylight.LIBCMT ref: 0000000180238CB5

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: cc5e7142a5f7dc61bb8e0efa7752c2a2cdd5d242e459fbdcab9f2bc3caa73ad7
Instruction ID: 4d761994ffb550e847763efdb7f36b724c9569535bdb12eaa27dcb7dd8aea93c
Opcode Fuzzy Hash: cc5e7142a5f7dc61bb8e0efa7752c2a2cdd5d242e459fbdcab9f2bc3caa73ad7
Instruction Fuzzy Hash: 8051D47250170C86F7EF4A28900D3F9A793EB4C714F1BD8269A415F2F5CAECCA499762

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180047E30 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,0000000C,000000018000E422,?,?,?,?,?,?,000000018000CC0F), ref: 0000000180047E3D
LeaveCriticalSection.KERNEL32(?,?,0000000C,000000018000E422,?,?,?,?,?,?,000000018000CC0F), ref: 0000000180047E5C

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 19d0a7b6eca74f8681613015e494f482a39d1d1cfec4c0c8fd9c399c43e20059
Instruction ID: 604945c18a064e28c8ad0c17273b9113ebe387e2c8a11a2387751254b52cdb58
Opcode Fuzzy Hash: 19d0a7b6eca74f8681613015e494f482a39d1d1cfec4c0c8fd9c399c43e20059
Instruction Fuzzy Hash: C7513C36200A4886EB96DF22D4903AD73A0FB8CF88F59C421EF4957765CF34DAA9D344

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002F12 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180002F22

Strings

[%s:%d][ERR] %s: (%p, %d (%s), %d ... ) => %d %s, xrefs: 00000001800033BF
..\src\api.c, xrefs: 00000001800033E5
__bdnimbus_set_optionv, xrefs: 00000001800033DA

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalEnterSection
String ID: ..\src\api.c$[%s:%d][ERR] %s: (%p, %d (%s), %d ... ) => %d %s$__bdnimbus_set_optionv
API String ID: 1904992153-2152615962
Opcode ID: 8610e4e03c6d83c324d98e0b99bc6198c807864057f7ee92bc738eddbcce4e2a
Instruction ID: b5c8ec6da032d52be6e709f660efc047ca4b8da42e6cabc4e57b6637ebfe0299
Opcode Fuzzy Hash: 8610e4e03c6d83c324d98e0b99bc6198c807864057f7ee92bc738eddbcce4e2a
Instruction Fuzzy Hash: E0011E36304B8886E7A2CF04F4543DAB7A9FB89394F44412ABA9A57794DF78C689C704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018B50 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00000001800482F9), ref: 0000000180018B61

Part of subcall function 000000018002B690: EnterCriticalSection.KERNEL32 ref: 000000018002B6C8
Part of subcall function 000000018002B690: GetCurrentThreadId.KERNEL32 ref: 000000018002B70E
Part of subcall function 000000018002B690: LeaveCriticalSection.KERNEL32 ref: 000000018002B75D

Strings

user_context_signal_uninit, xrefs: 0000000180018B67
..\src\user_context.c, xrefs: 0000000180018B7E
[%s:%d] %s: UC_SIGNAL_UNINIT %p, xrefs: 0000000180018B8A

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Enter$CurrentLeaveThread
String ID: ..\src\user_context.c$[%s:%d] %s: UC_SIGNAL_UNINIT %p$user_context_signal_uninit
API String ID: 1861736228-2209794226
Opcode ID: cab9b0d42a23c3fe59efebb4fa123389312e3bb0e2d8e8cbe1923be8117f0c06
Instruction ID: b008b70c0d46d649b0d53aa261d5bf5c07b99d196cc2c253182b2850198001e8
Opcode Fuzzy Hash: cab9b0d42a23c3fe59efebb4fa123389312e3bb0e2d8e8cbe1923be8117f0c06
Instruction Fuzzy Hash: E1018176314A0882E7928F15E4457D93361FB48784F808421EA4957A65EFBACB59CB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A900 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,000000018000C6B0), ref: 000000018002A91E
SetEvent.KERNEL32 ref: 000000018002A935
SetEvent.KERNEL32 ref: 000000018002A945
LeaveCriticalSection.KERNEL32 ref: 000000018002A94F

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalEventSection$EnterLeave
String ID:
API String ID: 2034477713-0
Opcode ID: 7d1a8cd57f3f381c6fe34930b3f38750209621116fbb4b02d976b0097202fce8
Instruction ID: aa529324dc3aaf9350a7520cdd4860ff01e20a29c42bb100a171e8990e638f61
Opcode Fuzzy Hash: 7d1a8cd57f3f381c6fe34930b3f38750209621116fbb4b02d976b0097202fce8
Instruction Fuzzy Hash: 99F03036515908C3FBD78F22D8583A83361FB4AB49F445010EA07465A4DF7ACACEC704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002450 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,00000001800021C4), ref: 000000018000245D
LeaveCriticalSection.KERNEL32(?,?,00000000,00000001800021C4), ref: 000000018000246C
DeleteCriticalSection.KERNEL32(?,?,00000000,00000001800021C4), ref: 0000000180002479
CloseHandle.KERNEL32(?,?,00000000,00000001800021C4), ref: 0000000180002483

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID:
API String ID: 3102160386-0
Opcode ID: d3066824e62218f7cc4699882abc417b418fd63b75ba16aa028a318bc180ccfd
Instruction ID: 5e812227441e0f669f98cd6509820cb02e475c4475c64eafeac7616e31276e69
Opcode Fuzzy Hash: d3066824e62218f7cc4699882abc417b418fd63b75ba16aa028a318bc180ccfd
Instruction Fuzzy Hash: B8E06D3530464482EBD1AB12EB983692322FB9DBC0F008010EF0607E61CF69C9AD8705

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002560 Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000000018000256A
EnterCriticalSection.KERNEL32 ref: 0000000180002579
GetThreadId.KERNEL32 ref: 0000000180002586
LeaveCriticalSection.KERNEL32 ref: 000000018000259A

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSectionThread$CurrentEnterLeave
String ID:
API String ID: 756538297-0
Opcode ID: 666f89412f6a490bf69e771e3a26d109a3e77c65ad2a9c458dc97ae7fac80923
Instruction ID: 35f2555865a433873ff5780301294668e7b8bb1a20c9a9c1aebbc1d03c79c866
Opcode Fuzzy Hash: 666f89412f6a490bf69e771e3a26d109a3e77c65ad2a9c458dc97ae7fac80923
Instruction Fuzzy Hash: 6CE01239610A4A96EBC25FA5F8D83986361F78C791F458421ED0B822B0DE78C68D8305

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180061E00 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 208networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 0000000180061F8C

Strings

::1 localhost, xrefs: 0000000180062116
127.0.0.1 localhost, xrefs: 00000001800620F4

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: htons
String ID: 127.0.0.1 localhost$::1 localhost
API String ID: 4207154920-1120086647
Opcode ID: f5247e631730124675413672fd432c10110f427f1475c00b52aec52766f7d94a
Instruction ID: ef6883716afff62f60ac27ee9db68d74fefa77d107107d75c71bc2fd372d8cf6
Opcode Fuzzy Hash: f5247e631730124675413672fd432c10110f427f1475c00b52aec52766f7d94a
Instruction Fuzzy Hash: 5091F832704B9889FBA29B60D8103ED67A2E74DBC8F58D111EE5C1B786DF78C689C350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180061760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,?,00000000,NameServer,0000000180061A79,?,?,?,?,?,00000000,00000000,0000000180058CAB), ref: 00000001800617B0
RegQueryValueExA.ADVAPI32(?,?,?,00000000,NameServer,0000000180061A79,?,?,?,?,?,00000000,00000000,0000000180058CAB), ref: 00000001800617EB

Strings

NameServer, xrefs: 0000000180061765

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID: NameServer
API String ID: 3660427363-1451388361
Opcode ID: 3ac3433c278aefa7235ad4b556dc35e659ab14e83d60903c37fb01fccf12c2b3
Instruction ID: 3f9b1f2c86e5a5dbbf27775cae567e3561ab41fd22db7066ef2a861ff396eaac
Opcode Fuzzy Hash: 3ac3433c278aefa7235ad4b556dc35e659ab14e83d60903c37fb01fccf12c2b3
Instruction Fuzzy Hash: B811D53260478489E6929F91E8503DAF395F74D7E5F588135BA9847B98CF78C649CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018890 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 0000000180018960
CreateEventA.KERNEL32 ref: 0000000180018970

Strings

N, xrefs: 00000001800188F9

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CreateCriticalEventInitializeSection
String ID: N
API String ID: 2948115387-1161386698
Opcode ID: 950bc264ceb1a14922065b0a41bfe72ffcdb81bfc1abfd0444525644b0d392c1
Instruction ID: d160ddb73ac51204d22678014dff6deaa1ae39070f09f746f013f06fb0e41609
Opcode Fuzzy Hash: 950bc264ceb1a14922065b0a41bfe72ffcdb81bfc1abfd0444525644b0d392c1
Instruction Fuzzy Hash: FC21A336215F44C5DB968F74F89039933A9F74CB08F98813AEA8D8B358EF358569C360

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B3D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 000000018000B43D

Strings

_ServerStatus, xrefs: 000000018000B443
, xrefs: 000000018000B425

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: Timetime
String ID: $_ServerStatus
API String ID: 17336451-2429934550
Opcode ID: 672b665adcdd71ad6fb845b36b19201bf635d7288253c121c38aedb7238a414e
Instruction ID: 5aaf73bfe4d0ef5408aac8ce8ed75bd9fcb4a6fbf99b2d3d491f72d735af7776
Opcode Fuzzy Hash: 672b665adcdd71ad6fb845b36b19201bf635d7288253c121c38aedb7238a414e
Instruction Fuzzy Hash: 41213832A14B8486E785CF35E5543AD33A0F798B4CF14A229EA8C4625AEF74D6E8C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800502C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

getprotobynumber.WS2_32 ref: 00000001800502D2

Strings

tcp, xrefs: 00000001800502F1
udp, xrefs: 00000001800502E5

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: getprotobynumber
String ID: tcp$udp
API String ID: 2881757150-3725065008
Opcode ID: 7a4c2fa2e6778f0c7aa71ee94b1351bed588553b630837462950d2bb232b3413
Instruction ID: c71bddb1f9b1c07b9b4e93fbd8dcd7d5d969708a6c0bf8e718a7d98bfec27c45
Opcode Fuzzy Hash: 7a4c2fa2e6778f0c7aa71ee94b1351bed588553b630837462950d2bb232b3413
Instruction Fuzzy Hash: BDE08634F8250AC1FDEE174E8CCA3EC12A56B4D780FD8801DE21D11760DD5D97AE9705

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A7A0 Relevance: 5.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018000A7CA
LeaveCriticalSection.KERNEL32 ref: 000000018000A8A9

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 724ad86ac54e3935d37c206d10196c819f564b7c412b87f36d2c1631236e154a
Instruction ID: 7b149e0af425acacf097fd825cf9a6164931a1ce2ea4f7607f683c442c696d90
Opcode Fuzzy Hash: 724ad86ac54e3935d37c206d10196c819f564b7c412b87f36d2c1631236e154a
Instruction Fuzzy Hash: 11514936204B4886EBA6DF29E4503A9B3A4F38DF84F188125DF8E87B55DF38C566C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A040 Relevance: 5.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018001A05C
LeaveCriticalSection.KERNEL32 ref: 000000018001A06A
EnterCriticalSection.KERNEL32 ref: 000000018001A086
LeaveCriticalSection.KERNEL32 ref: 000000018001A0CA

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: b70fcadccc1eff5d5d78317c68721dbadc84ec8a5b894f0782efe04bae360ff9
Instruction ID: c5479b60249903c1298fa51bfd89a758d5f5d7a9782d6edff1feb8524f319126
Opcode Fuzzy Hash: b70fcadccc1eff5d5d78317c68721dbadc84ec8a5b894f0782efe04bae360ff9
Instruction Fuzzy Hash: 95415036609F4882FBD39F1598503A973A5E78EBD4F28D421FA4A47794DF39CA59C300

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004A610 Relevance: 5.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,000000018004BEB7), ref: 000000018004A64A
LeaveCriticalSection.KERNEL32(?,?,?,000000018004BEB7), ref: 000000018004A674
EnterCriticalSection.KERNEL32(?,?,?,000000018004BEB7), ref: 000000018004A685
LeaveCriticalSection.KERNEL32(?,?,?,000000018004BEB7), ref: 000000018004A6A1

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 2d2aad89c112bd046e335b7654fd91015dbd212668f3908bd1ccfc98c42c9e12
Instruction ID: ee7233eae8dc0660c261b0a0cbc87d55d5e804063f944a9017367366de9fa758
Opcode Fuzzy Hash: 2d2aad89c112bd046e335b7654fd91015dbd212668f3908bd1ccfc98c42c9e12
Instruction Fuzzy Hash: D841A23A609B4881FBF29F10D8903D863B1F74EBD8F05C625EE4813696DF34D6888388

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004C260 Relevance: 5.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,000000018004ABD1,?,?,?,0000000180048866), ref: 000000018004C29A
EnterCriticalSection.KERNEL32(?,?,?,000000018004ABD1,?,?,?,0000000180048866), ref: 000000018004C2BE
EnterCriticalSection.KERNEL32(?,?,?,000000018004ABD1,?,?,?,0000000180048866), ref: 000000018004C2C9
EnterCriticalSection.KERNEL32(?,?,?,000000018004ABD1,?,?,?,0000000180048866), ref: 000000018004C2FE

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 0523b34edc6c0834812ee6f56f67072510d6d6afab527c17681f1378b4a88198
Instruction ID: 9be4146a6633a554857d3f409b8d029a6f83430b7969616b1229434d9fcea357
Opcode Fuzzy Hash: 0523b34edc6c0834812ee6f56f67072510d6d6afab527c17681f1378b4a88198
Instruction Fuzzy Hash: CE216A36200E89D7E7D68F44EA80B997370F749789F108011EE0A926A4DFB5DA6EC749

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B570 Relevance: 5.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,0000000180021955,?,?,?,?,?,?,?,?,?,000000018001FA11), ref: 000000018001B586
LeaveCriticalSection.KERNEL32(?,?,?,0000000180021955,?,?,?,?,?,?,?,?,?,000000018001FA11), ref: 000000018001B5B8
EnterCriticalSection.KERNEL32(?,?,?,0000000180021955,?,?,?,?,?,?,?,?,?,000000018001FA11), ref: 000000018001B5CF
LeaveCriticalSection.KERNEL32(?,?,?,0000000180021955,?,?,?,?,?,?,?,?,?,000000018001FA11), ref: 000000018001B600

Memory Dump Source

Source File: 00000003.00000002.2154231495.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2154202903.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154578784.0000000180252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154661354.0000000180326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154687946.0000000180327000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154710169.0000000180328000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154736530.000000018032D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154766267.0000000180331000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2154794562.0000000180335000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: f0c0f01528244aa17cba52e43c8170c70655f9fb74dcc8f43388cda4cbac4c8f
Instruction ID: 21f0d15febe3675dee7c31e22d56955ba0c37fdf033b7bdb5daca54d9a1cd97d
Opcode Fuzzy Hash: f0c0f01528244aa17cba52e43c8170c70655f9fb74dcc8f43388cda4cbac4c8f
Instruction Fuzzy Hash: A3111E34311D4845FFC79B62E9943E56366BB5CBD1F48D025BD0A866A1DF28C74CC340

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 6540, Parent PID: 5484COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	22%
Total number of Nodes:	214
Total number of Limit Nodes:	26

Executed Functions

Function 000001A41B91B1C4 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 000001A41B91B2BA

Strings

@, xrefs: 000001A41B91B4A8

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID: @
API String ID: 2706961497-2766056989
Opcode ID: 7e16444e689eb8bee9c1e675e220fd9db7de344bf7600226cd6d405b408096b5
Instruction ID: 43e7725a0a9b3cca1c8444f4200e07152f168e04ea7fee198c041fdbccea5e90
Opcode Fuzzy Hash: 7e16444e689eb8bee9c1e675e220fd9db7de344bf7600226cd6d405b408096b5
Instruction Fuzzy Hash: 56A141302297448FE7A0DB18C495BAAB7E5FBD9315F50492EE186C7390E7B4D886DB03

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B9117AC Relevance: 6.1, APIs: 4, Instructions: 118
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000001A41B9117D3
Process32First.KERNEL32 ref: 000001A41B91180D

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID:
API String ID: 2353314856-0
Opcode ID: ffda93136b51a29bb3684a86e7e043dd7bbdc087f215b77c9927dab396927b19
Instruction ID: d7e92a671bb01170faa4f4deb33b27711c76f0fbb979c543bbc5edb4619b6138
Opcode Fuzzy Hash: ffda93136b51a29bb3684a86e7e043dd7bbdc087f215b77c9927dab396927b19
Instruction Fuzzy Hash: C131E330318A188FEB55EF29D8846E677E2FBD9310F008679D44AC7291EF74E9468782

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B910450 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 493
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountSidW.ADVAPI32 ref: 000001A41B9105D3
GetSystemInfo.KERNELBASE ref: 000001A41B9107E2

Strings

, xrefs: 000001A41B9106A6

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: AccountInfoLookupSystem
String ID:
API String ID: 229831287-3916222277
Opcode ID: e8f6389103c2505388ad839d792f361971cefc2c7a7f621b498c69dfb205a58f
Instruction ID: 3f5dd9872004d06e9339a1b2bbc316fb2187c4afde22f4cd503c0afeb862c53d
Opcode Fuzzy Hash: e8f6389103c2505388ad839d792f361971cefc2c7a7f621b498c69dfb205a58f
Instruction Fuzzy Hash: 03027A30715A098FE759EF28D8597E973D1FB99311F004269E44AC7292EF74A982CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B90E6E8 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 225
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL ref: 000001A41B90E768

Part of subcall function 000001A41B90C798: RtlDeleteBoundaryDescriptor.NTDLL ref: 000001A41B90C80C

Part of subcall function 000001A41B90C818: RtlAllocateHeap.NTDLL ref: 000001A41B90C83D

NtWriteVirtualMemory.NTDLL ref: 000001A41B90E8BE

Strings

@, xrefs: 000001A41B90E755

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual$BoundaryDeleteDescriptorHeapWrite
String ID: @
API String ID: 2532212394-2766056989
Opcode ID: 1a83dd0e45781d205477159a2f30f598c6995d95ffc471ecefc90e072d21656c
Instruction ID: fba7f8dbb9ed8a52bccc6d96f638f86fde06cc9f286dd14943731759b6232564
Opcode Fuzzy Hash: 1a83dd0e45781d205477159a2f30f598c6995d95ffc471ecefc90e072d21656c
Instruction Fuzzy Hash: 0D617130729E488FEB58EF5CC845BF937E5FB95351F144169A849C3291EB74E8838B82

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41A0D0040 Relevance: 5.1, APIs: 3, Instructions: 573
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE ref: 000001A41A0D0130
VirtualAlloc.KERNELBASE ref: 000001A41A0D0174

Memory Dump Source

Source File: 00000016.00000002.2179248939.000001A41A0D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41A0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41a0d0000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID:
API String ID: 2032221330-0
Opcode ID: fe0722d3315e7ef3b87ace32a9ae9c35e0cc2ee78d2a8ddc83f8ab708bb7752a
Instruction ID: 3808f33f693ed78bda6709160e56f020d9bbb9e8ceab1344a8c175168c7b8ee6
Opcode Fuzzy Hash: fe0722d3315e7ef3b87ace32a9ae9c35e0cc2ee78d2a8ddc83f8ab708bb7752a
Instruction Fuzzy Hash: 6AF1F432715A094FE768DE28C8853F577D1FB96761F14417DD88BC3285EBB4F8828682

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B90ECD0 Relevance: 4.7, APIs: 3, Instructions: 151
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 000001A41B90EDC5
NtWriteVirtualMemory.NTDLL ref: 000001A41B90EDE7
NtProtectVirtualMemory.NTDLL ref: 000001A41B90EE3F

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: MemoryVirtual$Protect$Write
String ID:
API String ID: 3502917991-0
Opcode ID: 9a5cc5c7fbd3fe2fdcbd9315215d82efc283155e9b77592adc4638bc95343460
Instruction ID: 4c2ae38730e460aeb43ec878651ef895b83e71a8f1334e2288374acd97f18867
Opcode Fuzzy Hash: 9a5cc5c7fbd3fe2fdcbd9315215d82efc283155e9b77592adc4638bc95343460
Instruction Fuzzy Hash: 2741A571618E488FDB54EF1CD885BAAB7E4FB99301F00056EE44DC3252EB70E942CB86

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B911BB8 Relevance: 4.6, APIs: 3, Instructions: 100
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL ref: 000001A41B911C06
NtWriteVirtualMemory.NTDLL ref: 000001A41B911C22
NtProtectVirtualMemory.NTDLL ref: 000001A41B911C45

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: MemoryVirtual$AllocateProtectWrite
String ID:
API String ID: 2264391890-0
Opcode ID: 068bdf11f20101efba43b0a73501a7a280c7f6309aa1e863de1acfdaa37b6154
Instruction ID: e42c0fd948e84de9b8e9ab74b2bcc1607e7cdc940f1dbdd789aaa29155a7bd81
Opcode Fuzzy Hash: 068bdf11f20101efba43b0a73501a7a280c7f6309aa1e863de1acfdaa37b6154
Instruction Fuzzy Hash: 5C31A571718A1C9FDB44DF59C885BEEB7F4FB88315F40066AE54AC3240DB74E5858B81

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B90EE48 Relevance: 1.6, APIs: 1, Instructions: 64nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL ref: 000001A41B90EEAB

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c0759a78d45f7783e0ba5955d2095ebf6ddd7f5cb97bae5f18963bef716cecab
Instruction ID: fc762b79c8d3ecf077cd0770a1e681b2116200659361d98e8bfe335d7d629f37
Opcode Fuzzy Hash: c0759a78d45f7783e0ba5955d2095ebf6ddd7f5cb97bae5f18963bef716cecab
Instruction Fuzzy Hash: 13118230308A088FE744EF2DD898A6677E2FBE8311B048569A45AC7265CF34D952CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41A102050 Relevance: 6.5, APIs: 4, Instructions: 490
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000016.00000002.2180620271.000001A41A101000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001A41A101000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41a101000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e356398b98103127d6b8e33339f1ca3f6c0dda63d8c4eb172e2624df61f1aed
Instruction ID: de278d09fbb6a7b1482264534baf9443e0bf51f107612841bef46af2599683f6
Opcode Fuzzy Hash: 1e356398b98103127d6b8e33339f1ca3f6c0dda63d8c4eb172e2624df61f1aed
Instruction Fuzzy Hash: E012E030219B589FE7A4DB18C554FAAB7E1FBE9341F50492DF589C72A1DB74E880CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B90CD48 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 160
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001A41B90CE77

Strings

., xrefs: 000001A41B90CE72

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .
API String ID: 1029625771-248832578
Opcode ID: db5f9d9086a8e06d692949b81f8cda11d7b206f02a6c7af3140ca7577404dbc1
Instruction ID: f28cde20f1821aa861dc135d9f27be4f87a3fe9d48fb7da5d674df96255cb09e
Opcode Fuzzy Hash: db5f9d9086a8e06d692949b81f8cda11d7b206f02a6c7af3140ca7577404dbc1
Instruction Fuzzy Hash: DA412A31628B844FE719DF18D4887E17BE9FB9A304F1401BDD4CAC7243EA64E8878752

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B911C80 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE ref: 000001A41B911CF0

Strings

h, xrefs: 000001A41B911CC3

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: h
API String ID: 963392458-2439710439
Opcode ID: 251b90b8968926f84e5ae4e49aae40587a68ef062a1c338474a892719cac78e7
Instruction ID: 579db6d53ee03afb177b5d857e64768d5308cfeed7c8ead8e2a7de76308bf68c
Opcode Fuzzy Hash: 251b90b8968926f84e5ae4e49aae40587a68ef062a1c338474a892719cac78e7
Instruction Fuzzy Hash: AF012D71918A498FE794EF38D449B6AB7E1FBA9305F00872FA489C3161EF74C5858701

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B9010E8 Relevance: 3.1, APIs: 2, Instructions: 102
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE ref: 000001A41B90110B

Part of subcall function 000001A41B90CF3C: LoadLibraryA.KERNELBASE ref: 000001A41B90CFC8

GetFileAttributesW.KERNELBASE ref: 000001A41B901184

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileHeapLibraryLoad
String ID:
API String ID: 4276963072-0
Opcode ID: 1127199ac6a5b9d7ef7dd636ac9cceddd14e8ea7157a8e53c7f3a8997d5e66f3
Instruction ID: f1bdedc83ac34bdb9ea1ea29d502068b08de99a52ea9c87967bf6f91125a5239
Opcode Fuzzy Hash: 1127199ac6a5b9d7ef7dd636ac9cceddd14e8ea7157a8e53c7f3a8997d5e66f3
Instruction Fuzzy Hash: 2231A530725A448FF7A8EB79D8843EA76E5FBC9310F50462DB05AC22E1EA7895478702

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B913528 Relevance: 3.1, APIs: 2, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE ref: 000001A41B91355B
GetTokenInformation.KERNELBASE ref: 000001A41B9135B0

Part of subcall function 000001A41B90C798: RtlDeleteBoundaryDescriptor.NTDLL ref: 000001A41B90C80C

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: InformationToken$BoundaryDeleteDescriptor
String ID:
API String ID: 3818583554-0
Opcode ID: 10c0e65d44493fe69fa6811ea6a7530f65771d2f876b457d79cb99a31aa64b79
Instruction ID: 8dee3f12c2291b5444400f22edf3d27ae0cb8f5a666571327f8bf0bb21a473a1
Opcode Fuzzy Hash: 10c0e65d44493fe69fa6811ea6a7530f65771d2f876b457d79cb99a31aa64b79
Instruction Fuzzy Hash: 5721503071CB098FEB48DF6CD4886A677E1FB98711F01456EE85DC3255EB70E9818782

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B90CA3C Relevance: 3.1, APIs: 2, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 000001A41B90CAB9
VirtualProtect.KERNELBASE ref: 000001A41B90CB00

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e2fd439c977814d937363450f4d1bdbc27d01c71164ee41ec0a2ce8f8d17686f
Instruction ID: 43a2c7e50aa63d3f064e35f1cd1906c501d0a449cebaab43aef01750fe44659c
Opcode Fuzzy Hash: e2fd439c977814d937363450f4d1bdbc27d01c71164ee41ec0a2ce8f8d17686f
Instruction Fuzzy Hash: 8C216230328A858FE750DB28E894BE973F9F795324F144619E955C32E0E778E882D743

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B90DB60 Relevance: 1.7, APIs: 1, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNumberFormatA.KERNEL32 ref: 000001A41B90DC25

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: FormatNumber
String ID:
API String ID: 481257995-0
Opcode ID: e91297c014f3019d6219160346150f9916988d567e6d4f2d1a1d741306d0e3a8
Instruction ID: 89388316e64e7fee50f45599f1fb26a12b93ed81958bafa3fb8f25a3958850e7
Opcode Fuzzy Hash: e91297c014f3019d6219160346150f9916988d567e6d4f2d1a1d741306d0e3a8
Instruction Fuzzy Hash: 6961C831629E1C4BEB19DF18D4846ED77E9EF9A300F10426AD88BD3191FA60F9878785

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B90D748 Relevance: 1.7, APIs: 1, Instructions: 190
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL ref: 000001A41B90D840

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d2a1e527fbfe5384fae60d444219002c33f295322476ba4f288b93bf19bf1c8e
Instruction ID: abc4bfb76a41a4dadc5df94ef3646dfbce0212cd35d40b2503e5f02cd95e5f1f
Opcode Fuzzy Hash: d2a1e527fbfe5384fae60d444219002c33f295322476ba4f288b93bf19bf1c8e
Instruction Fuzzy Hash: 4651E67162EE590BF769AA2C58053B976C9EFD7311F24412DDCD7C30A1EA90E8834682

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41A1015E0 Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2180620271.000001A41A101000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001A41A101000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41a101000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a221755777af9304f0073199aa4e16a510aa1628721def79ae2af35cb4ac584b
Instruction ID: 27668d51b7970bb8b66d1d7608f96dc023dd962da2b83f401dd8eaa9fbfdbc9d
Opcode Fuzzy Hash: a221755777af9304f0073199aa4e16a510aa1628721def79ae2af35cb4ac584b
Instruction Fuzzy Hash: 2C51FA342197498FE784DF19C594B9AB7E1FB99345F44096DF889CB3A0D7B8E980CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B90FD2C Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 000001A41B90FDF3

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5bc0e8a7c1d9981df62fde1f654c2988fdc2d987fa76996d3a94c8e8fc7f5162
Instruction ID: 354675748b2643fac173226dba704e487f6f9ec3571fd2fc8b9a369ab0c01689
Opcode Fuzzy Hash: 5bc0e8a7c1d9981df62fde1f654c2988fdc2d987fa76996d3a94c8e8fc7f5162
Instruction Fuzzy Hash: D431F731629E888FE718DF2884463B5B7D5F786304F14119DD4D787253E6A0B9838792

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B901000 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 000001A41B9010CE

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: b2e49eecc4650cecdc0ae88ff68cfadcfd13d759e10daa97455afb8b011d043f
Instruction ID: 9db50bfe01b9d2d39785e7e087d03a1a17478108dc2044ffa573e3265a97c47d
Opcode Fuzzy Hash: b2e49eecc4650cecdc0ae88ff68cfadcfd13d759e10daa97455afb8b011d043f
Instruction Fuzzy Hash: D131AF30328A088FDB58DF1DD4C9A6533F1FBAA300F14415EF44AC71A6DA60E883CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B912538 Relevance: 1.6, APIs: 1, Instructions: 104COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE ref: 000001A41B9125BB

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 1e2a606bfee192fb295c280de84564edbc6583ac85ffa189bea122fc4c99bd00
Instruction ID: 59e8f22864b909a024fb70835299dc41c7341a80e0125f1ba3bdeb8f1ba7a155
Opcode Fuzzy Hash: 1e2a606bfee192fb295c280de84564edbc6583ac85ffa189bea122fc4c99bd00
Instruction Fuzzy Hash: CA315530218A4C8FD765EF18D8847EA73E5FBD9310F00465AA88EC7295EF709746CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B90CC1C Relevance: 1.6, APIs: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001A41B90CCC0

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: bac77338f76338b17dfae394e38db546f5c72599ad158e480dcab01f8bb866f2
Instruction ID: db075f448a5f19bd25f9799e507be85da3626d540943e890feef905891ddc5d7
Opcode Fuzzy Hash: bac77338f76338b17dfae394e38db546f5c72599ad158e480dcab01f8bb866f2
Instruction Fuzzy Hash: 6B318F30224B889FE345DB28D8847AA77F5FBD9325F144519E849C32E0DBB4E882CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B90CF3C Relevance: 1.6, APIs: 1, Instructions: 84libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 000001A41B90CFC8

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9fb372bf419b8b18e7fed5a67a81708a9f0529748a2ba8a81412138c26b317b9
Instruction ID: 1822fb1aa4d47e97c3398bc5e428e53f89a02d08ee4502178e3f107ac3d3965f
Opcode Fuzzy Hash: 9fb372bf419b8b18e7fed5a67a81708a9f0529748a2ba8a81412138c26b317b9
Instruction Fuzzy Hash: 3121C631728F884BD748EB2C4488675BBE5F7AA305F14427DE4CAC3251E664D9478743

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B90C798 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

RtlDeleteBoundaryDescriptor.NTDLL ref: 000001A41B90C80C

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: BoundaryDeleteDescriptor
String ID:
API String ID: 3203483114-0
Opcode ID: 1e37449890905ab9bc85a0acb699b56a3849bb88109adf205d7c9b46ddfc2453
Instruction ID: 23b636f2421c79b80b51f0fd4552e6fe9a71c3bed5ada656a22a752734427d5a
Opcode Fuzzy Hash: 1e37449890905ab9bc85a0acb699b56a3849bb88109adf205d7c9b46ddfc2453
Instruction Fuzzy Hash: 1011E131737F8A47FB699B3805843B532EAE7DB326F54817C9456C21F1EB64A8838202

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B90C818 Relevance: 1.5, APIs: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 000001A41B90C83D

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 024b27a2ae161daeb2c3f7db8bbbaae22b9973a9d07e479f219f9b0371d218ad
Instruction ID: 28df4da74ad730064881bb2e215ee695429f27727e0bc0081ae84d418bc4446f
Opcode Fuzzy Hash: 024b27a2ae161daeb2c3f7db8bbbaae22b9973a9d07e479f219f9b0371d218ad
Instruction Fuzzy Hash: 8FF0F630328E8A5FF7A99B6D988877576E5E7E9301F14416EA888C3295D9A0D8C38352

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41B91470C Relevance: 1.5, APIs: 1, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexExA.KERNEL32 ref: 000001A41B914729

Memory Dump Source

Source File: 00000016.00000002.2180990206.000001A41B901000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A41B901000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41b901000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 5665f1e6a04ef665cb6e002583dfa9c6b146fdc296e96a831dc21d2c35bbadb8
Instruction ID: 08ae69fc791bb1289f5047e36090ba5ba5c3bfaf1428e63450e600387eaae015
Opcode Fuzzy Hash: 5665f1e6a04ef665cb6e002583dfa9c6b146fdc296e96a831dc21d2c35bbadb8
Instruction Fuzzy Hash: FA0186303149098FE7949B6CA88D76932D0EB9D322F804679A009C73B5D734D882C792

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41A101FC0 Relevance: 1.5, APIs: 1, Instructions: 21libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 000001A41A101FD3

Memory Dump Source

Source File: 00000016.00000002.2180620271.000001A41A101000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001A41A101000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41a101000_rundll32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 37eb22e3c71014e34abb747e807cbfd367a7a8272921ebcea216e32cb781be8d
Instruction ID: 64e157e71810da40a4704813e8d7a5aa963da4b4f2bfbd34db2737a97f0564f7
Opcode Fuzzy Hash: 37eb22e3c71014e34abb747e807cbfd367a7a8272921ebcea216e32cb781be8d
Instruction Fuzzy Hash: 83E0B630518B899FD780EB28C40875A7BE1FBD8305F404A2EE489D3260D3BC95888B02

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41A101380 Relevance: 1.4, APIs: 1, Instructions: 188memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000001A41A1014F4

Memory Dump Source

Source File: 00000016.00000002.2180620271.000001A41A101000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001A41A101000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41a101000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 816fc88231aa2467bf2252115963d1d14762f6c5c40f282537df11a36abcc1ab
Instruction ID: e3abc263b9dac5e943ec176a9f74829b6bcb98c7e00674fe9af25239cb1ab99a
Opcode Fuzzy Hash: 816fc88231aa2467bf2252115963d1d14762f6c5c40f282537df11a36abcc1ab
Instruction Fuzzy Hash: B961E530718B488FD784EB18C088B6AB7E1FBAD355F54496DB48AD7361D778E981CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000001A41A1011C0 Relevance: 1.3, APIs: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000001A41A1011DC

Memory Dump Source

Source File: 00000016.00000002.2180620271.000001A41A101000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001A41A101000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1a41a101000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a26db5a74adc6119d098d68705d28c1916c0da013186a83d7531f391c9707544
Instruction ID: 88c28ccf1c5aae7d6b5328831e40f0b3ca24dd68df56a21d5b9d586f12f27eec
Opcode Fuzzy Hash: a26db5a74adc6119d098d68705d28c1916c0da013186a83d7531f391c9707544
Instruction Fuzzy Hash: A9D05E306086448BD708EB38C85821A7BE1F798304F40452DF98ED3360DA3DCA018706

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 02.dll.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_02._cbaa6bb8cd6eed0719b3582c44155bfdd9769a0_0d6cd92f_1df10794-12d3-4aeb-8e12-18077b77d8b2\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_02._cbaa6bb8cd6eed0719b3582c44155bfdd9769a0_0d6cd92f_4c7642fa-6aac-4566-ab6f-477eaee57c2a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_02._cbaa6bb8cd6eed0719b3582c44155bfdd9769a0_0d6cd92f_78c6e70b-b349-4cf0-8a41-4c90649ff421\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_02._cbaa6bb8cd6eed0719b3582c44155bfdd9769a0_0d6cd92f_86b06d30-c960-47a9-9170-11ab0561e4ea\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E42.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E71.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F4D.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F4E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F8C.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER800A.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER894E.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER898E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER89CD.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9516.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9555.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9576.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

Windows Analysis Report
02.dll.dll